Comment by idle_zealot | Hacker News Reader

Comment by idle_zealot | Hacker News Reader

Parent Full thread

The most interesting thing here to me is this bit

> Apple's new fee structure and other terms and conditions for alternative app stores and distribution of apps from the web (sideloading) may be defeating the purpose of its obligations under Article 6(4) of the DMA

because, well, yeah, that's exactly what they do! When Apple users complain about the DMA forcing Apple to allow other stores and sideloading they often predict that Meta and other nefarious corporations will launch their own distribution as the exclusive source of their popular or near-required apps in order to skirt Apple's privacy rules. That is a possibility (though it hasn't happened on Android), but I feel that the benefit of sideloading community-made apps that break Apple's rules by interoperating with services unofficially would more than offset any losses to privacy. However, as Apple's implementation stands the fees and agreements necessary to distribute apps would keep most FOSS or community-maintained apps from being distributed, while allowing rich bad actors an avenue of further abusing their users. It's the worst possible world; a free-for-all for rich corporations to distribute whatever garbage they want and no balancing pressure from unofficial apps keeping their behavior somewhat in check. Moving from a world where Apple gets to decide what code runs on your phone to one where anyone with sufficiently deep pockets makes the call. I hope that the EC finds that the spirit of the DMA is that users decide what runs on their phones, and that Apple's proposed changes are not in that spirit.

>Apple's opt-out by default data policies cost Meta billions of dollars the quarter it was introduced in the OS update. Meta would assuredly restrict their apps to a Meta store to get back those billions.

This conclusion doesn't follow from the premise. Look at Meta's revenue since the roll out of ATT. They're essentially back to where they were. They've figured out ML based probability targeting. If anything, they're in a better position than they were pre-ATT, because now they really have some secret sauce in there, because no one else seems to have been able to figure it out.

You are suggesting Facebook doesn't mind valuable information restrictions because they have found other sets/means of valuable information.

That just doesn't follow. Facebook wants everything.

It is a near certainty that yesterday's restricted information is even more valuable today, since they can also increase its value via machine learning systems.

And high profits today don't dampen the need for growth, they accelerate the need by iteratively raising the baseline for next year. The year after. And onward. For the shareholders. For Zuckerberg.

Facebook lobbied against ATT because it was a massive pain in the ass. Plus, they might not have known if the ML based targeting worked out. At this point, they've spent the capital to work around it, and it's a new moat. I doubt they'd want it to be reverted.

Good point. They are going to lean into their advantages in any situation.

But given their lead, customer base, tech and capital, they can monetize and leverage surveillance information better than anyone in their space. More information creates more advantages for them than anyone else.

Any Facebook killer isn't going to out ad monetize them. The opposite. It is going to be something that provides a better but different experience - and likely to be incompatible with Facebooks surveillance-ad business model. A reverse moat Facebook won't/can't cross.

Similarly to GDPR - ATT is bad for Meta but much worse for Meta's competitors.

> Meta and other nefarious… in order to skirt Apple's privacy rules

This isn’t hypothetical, it is precisely what Meta (then Facebook) and Google both already did.

https://techcrunch.com/2019/01/29/facebook-project-atlas/

https://www.techtarget.com/searchsecurity/news/252456835/Fac...

But outside of Europe people still won't be able to use alternative app stores, so Meta has to provide their app through Apple store, where it will be available to EU users too.

You can restrict which countries your app is available in the App Store. Is there something in the policy that states your app can't be outside the App Store in EU but in the App Store elsewhere?

Good news is that Apple can completely enforce a rule against it in their own store, and this one wouldn't bring any scrutiny from the Commission.

CTF is waived for nonprofits, which is how a lot of FOSS projects are structured.

lots is doing a lot of work here. the overwhelming majority of FOSS projects have no structure at all much less non profit corporations behind them. more accurate would be to say "a small number of FOSS projects" or "a lot of the top several FOSS projects".

> That is a possibility (though it hasn't happened on Android)

Android as a platform has far fewer default privacy controls as iOS. Meta doesn't need an alternate App Store to slurp up Android users' data. They would need one on iOS which gives them and everyone else impetus to create alternate stores which allow them to slurp up more data. Apple's opt-out by default data policies cost Meta billions of dollars the quarter it was introduced in the OS update. Meta would assuredly restrict their apps to a Meta store to get back those billions.

> Meta would assuredly restrict their apps to a Meta store to get back those billions

Unless, of course, the friction introduced by requiring users leave the App Store they're comfortable with costs them more.

This.

Plus Meta can't leave the store since they need it to address non-EU markets, and Apple can definitely force them to keep being available in store in the EU if they want to be available elsewhere.

> Apple's opt-out by default data policies cost Meta billions of dollars the quarter it was introduced in the OS update. Meta would assuredly restrict their apps to a Meta store to get back those billions.

How would a different app store change these OS policies and features?

The question is about the level of entitlements alternate app stores have and whether Apple has any oversight of those entitlements. If the EU decides anyone can make an App Store and Apple has no say, then iOS would need to trust the entitlements (and signature chain) from those alternate stores. If the alternate store allows entitlements to suck up user data with no say from Apple, then the mechanisms to prevent access to that data are toothless on the device. ACLs aren't effective without controlling the underlying authentication mechanism.

Things like accessing the address book and photos are behind entitlements. If the app's entitlements (from the App Store) don't even permit usage the API will throw an error. A third party store that Apple has zero input on could just allow all API access with super loose entitlements.

If there's no control of who can start a store and Apple is forced to allow that, then it's trivial for big vendors like Meta but also vendors like Epic to start stores with zero access controls to data on the device.

It gets even worse with web views apps use. A web view has access to the unencrypted data that goes through the view. If Meta launches Meta Browser that backs web views inside apps they can see all the traffic from all third party apps.

If Apple puts additional protections at the OS level to gate access to sensitive data the same complaints will be leveled against them as today. By forcing consumer choices into the system the very likely end result will be less consumer privacy. If a person buys an iPhone that's an affirmative signal they trust Apple. If they then have to make additional choices about browsers and app stores they're not necessarily going to be able to make informed choices.

Access to sensitive data an features is gated behind entitlements and user permission. What any reasonable sandbox needs to do is make it difficult for an sandboxed app to tell whether it actually has a permission it has asked for or not by providing the user an option to provide scoped or fake data. Oh, Facebook won't run without me giving it access to my contacts? Ok, here you go, but gee, it looks like I don't have any contacts outside of the iPhone defaults.

I agree. No company can be trusted with such a great amount of user data. Our phones are with us 24/7 and some companies want to not only listen and track but also change our behavioral patterns to suit them. The store analogy doesn’t work anymore. It’s like a store manager is living in my room and looting my personal belongings for valuable things because I once glanced at their storefront. The amount of power these mega corporations gained over the last two decades must be curbed or else they will shape the fabric of our society in their own image.

Because, as has already been explained ad nauseam, Apple's control measures are partly technological and partly contractual. If Apple catches you tracking users after users opt out of tracking, Apple will de-list you from their store.

If Meta can simply set up a different storefront (or directly side load), they merely have to follow the EU laws (which are less restrictive than Apple's).

It seems broken if the following things are true at once:

1) we agree that it is good for society that Meta (or others) aren’t allowed to violate your privacy

2) those rules are enforced by a megacorp (like Apple) as part of an everything-bagel of rules that they also profit from (some % cut of app revenue)

If (1) is true then privacy rules should be enforced by governments, not by a megacorp everything bagel power grab.

If (2) were true alone but (1) wasn’t true then it would make Apple’s enforcement of those rules even more obviously bad.

Meta has already been forced to offer non-ad access to Facebook. I assume that is tied to a privacy guarantee (or it wouldn't make much sense - ads can be obnoxious but it is the unconsented surveillance that needs to be reigned in).

Reply on news.ycombinator.com