There's nothing complex and impossible about removing some "if" statements responsible for code signature enforcement.
For reference, in 2023, Apple produced a little less than Romania or Hong Kong, and a little more than Egypt or the Czech Republic.
Hong Kong is small (though not a lot smaller than the Czech Republic); Egypt is big.
--- edit ---
I accidentally compared Apple's revenue in 2023 to the IMF forecast of GDP for 2025. For 2023: Apple produced very slightly more than Hong Kong or Nigeria, and a little less than Malaysia or Iran.
Nigeria is even bigger than Egypt. It still produced less than Hong Kong.
I agree - such a small player like checks notes "the 3rd most valuable company in the history of humanity" has no chance at implementing these troublesome rules.
Iran's GDP is artificially depressed.
One of surface, it's a lot LOT more work than that, the very obvious is "it's probably not if, but assumptions made everywhere, so it's not remove a condition but add a lot of check and rethink the whole process to ensure it's still consistent and safe";
Two, that's not what the issue is. It doesn't matter if it takes a lot of work or not. Nobody would accept something like "unfortunately, it's impossible to do all the complex engineering to comply with the YourCarCannotHaveA50PercentChanceOfExplodingWhenStarted regulation", which is an exagerated exemple on purpose; whether it's hard or not has nothing to do with anything being discussed, it's only a PR cop out.
These sort of things can be tricky to refactor and more complex than they first seem. For example I recently spent the past 12 weeks or so just moving some fields around on a CRUD app (not adding or removing - just changing their order!) because there were assumptions built on assumptions built on assumptions about what order things are in and what comes first and what has already been done or not and so on. What ostensibly seemed trivial, actually required almost a complete rewrite of whole parts of the CRUD app to overcome the assumptions and implied behavior of what happens when and how.
(Disclaimer: I may be wrong, I haven't done much of my own research, it's just things I read in various articles over the years)
On the surface, it's easy to do. But that is also based on the assumptions where they had to maintain some first party apis vs now having to create and maintain them so that third parties could use it. If they are committed to security which apparently DSA mandates, they have to devote many resources on it to ensure there are no threat vectors. Plus, there is no set guidelines on how much the APIs need to offer, it will be another session where competition asks for more and they will be asked to do that too.
I agree that a lot of websites (mostly news websites) have the "ad tracking or subscription" model, and I'm not sure if there has been a clear ruling in it yet, but maybe the DMA makes this stricter for Meta since it is a Gatekeeper
But DMA regulators dont agree calling it a false choice and asking meta to monetize by non personalized ads. The thing as you mentioned is how other publishers have the same model, which was never objected by any authority under GDPR either (so they clearly seem to think the model is valid). Its obviously a sticky situation where rules are different for different companies in the same jurisdiction when they are offering the same thing.
A counter could be whether if Meta isn't allowed, would no one else be allowed, but you already know the answer to that question.
It's unfortunate that Apple thinks of these as opportunities to lecture them on their own laws instead and unsurprising that approach doesn't work.
I understand a situation where what they want is literally impossible via tech, but then if EU is already talking to others in the space, they would have the same understanding. Otherwise, why keep the regulations vague?
Based on various accounts it does not seem these workshops are looking at arriving at a consensus either. Morever, it seems Apple did consult with EU regulators while rolling out their changes.
Apple knows the intent of the law and thus they know what to do. They just don't want to and so try to but-actually their way around it with bad-faith interpretations like they would in other systems. What they don't get is that that's just not how things work here.
> When interpreting EU law, the CJEU pays particular attention to the aim and purpose of EU law (teleological interpretation), rather than focusing exclusively on the wording of the provisions (linguistic interpretation).
> This is explained by numerous factors, in particular the open-ended and policy-oriented rules of the EU Treaties, as well as by EU legal multilingualism.
> Under the latter principle, all EU law is equally authentic in all language versions. Hence, the Court cannot rely on the wording of a single version, as a national court can, in order to give an interpretation of the legal provision under consideration. Therefore, in order to decode the meaning of a legal rule, the Court analyses it especially in the light of its purpose (teleological interpretation) as well as its context (systemic interpretation).
https://www.europarl.europa.eu/RegData/etudes/BRIE/2017/5993...
https://developer.apple.com/documentation/browserenginekit
They needed to engineer, maintain, document and support a whole class of APIs so that third parties can create their own competitive browser engines (that offer JIT, etc) while still maintaining iOS sandbox security. There are going to be hundreds of frameworks, thousands of APIs, that will need to come to ensure compliance with the DMA
I think Apple has done a great job of protecting non-technical people from a lot of the possible harms of malware. There's a lot of incentive for them to make sure security is handled right. I'm convinced going back to the 90s and giving every software developer full access to users phones would create a lot more problems than it would solve.
But only when they can be overridden. MacOS around 10 years ago is a good example. It came out of the box in a foolproof state — only apps from the app store or registered developers would run, and SIP is enabled. But if you know what you're doing, you could disable both those things without any loss of functionality.
We believe in the same thing, our devices should be free like speech. But the whole thing turned into a show because some rich software companies don’t want to pay Apple 30% while they have no problem with other platforms like gaming consoles.
Apple initially did that to protect the ecosystem from malware and make sure all apps meet their quality standards. Also to make distribution easy for indie developers. All commendable goals. But as the iOS market share grew, this turned into a very convenient revenue source that they can't let go now.
The digital market should be regulated for sure but what’s happening is a bunch of companies who are in the digital market (and not regulated themselves) exploiting the public sentiment and the regulatory processes.
Spotify and others fail to mention that they were able to access billions of Apple customers without paying a single dime to Apple initially which is unheard of in business relationships.
Yes, Apple may deserve a cut when a user was acquired thanks to the app store alone. Like in that case when you're an indie developer and the app store putting your app listing in front of potential new users is genuinely helpful. However, to many developers, and especially large ones like Spotify that do their own marketing, the app store is a hindrance. It's an obstacle they need to clear. It provides no value to them.
Spotify is able to "access billions of Apple customers" because Spotify spends millions on ads and because statistically some people who would like to use Spotify on their phone happen to have an iPhone. Apple has no part in this at all. Simple as that.
Apple designs and manufactures incredible hardware and software. The ecosystem they created is beautiful, secure, and intuitive to use. When it was first announced, many people started using it even before they allowed apps on it. Apple later launched the App Store and allowed 3rd party developers access to their platform in exchange for a percentage of the sale price.
And this is where most people trip, it's their platform, not an open ecosystem. Apple is granting Spotify access to billions of Apple's users in exchange for a cut of the sale price. It doesn't matter if one person bought a subscription or one million, the platform still belongs to Apple. And in exchange billions of Apple customers are likely to purchase a subscription from Spotify.
If a company builds a 50,000 people capacity football stadium, and I open a concession stand in there in exchange for a percentage of the sales, can I say I want to sell to all these people without paying my contractual obligations? Spotify is free to sell their subscriptions and install their applications wherever they like but that's not the contractual agreement they had with Apple.
Private ownership is essential to our economy, Apple created this platform and their own it. Forcibly taking it from them would give all the wrong signals to everyone else about what could happen to them next. Who knows, maybe someone says you voted for the wrong party.
---
Digital marketplace, not just Apple or gatekeepers or whatever, must be regulated from the first principles. A couple of rich software companies cozying up to regulators and trying to force changes that will increase only their profit margins is not the way to do it in my humble opinion.
No. Those users control themselves. They are not Apples users. They own their own device and they are free to do whatever they want with the hardware that they own.
> the platform still belongs to Apple
No actually. The device is owned by the user.
> billions of Apple customers
They aren't Apples. They own their own device.
> e but that's not the contractual agreement they had with Apple.
Or instead of that, they can completely ignore apple's copntract, and force Apple by law to allow them access to this market. If apple doesn't like it, then they can leave the EU entirely, or accept 10s of billions of dollars in fines.
> Forcibly taking it
Its not Apples. The device belongs to the user.
> must be regulated from the first principles.
Ok, and what about the first principle of "A user owns there own device and should be free to pay Apple exactly 0 dollars for the ability to install spotify on the device that they own".
I'm not allowed to install any software I want on my car's computer, the platform belongs to them. They don't provide the tools, libraries, the know-how, or even sue the people who share it online. And similarly, according to Apple's EULA the devices cannot run any app that is not approved by Apple and they can even revoke their approval or even disable the phone.
Those were the license conditions the hardware sold under, which sounds very user hostile. Regardless, nobody has to buy their products, they chose to buy it because the benefits it provided surpassed the limitations. When Spotify created their developer account they knew what the limitations were as well. This isn't an open platform. One can sue Toyota to get access to install Spotify to Corollas and get another 500 million customers, but that also wouldn't work either.
The only thing that can stop Apple is people not buying their products and developers not making apps therefore reducing the value of their ecosystem. Only then they will by themselves would open the ecosystem, which they should've done 5 years ago.
Regarding the EU forcibly taking stuff over. Well, if push comes to shove, do you think the US would allow a 3 trillion dollar American company to be bullied, go after European companies or would they react in a really unpredictable way?
Apple devices are successful because they provide a great value. They didn't just sell the hardware like Nokia did, they kept delivering software updates and spend billions of dollars sustaining the ecosystem. The limitations were put to improve user experience, for example they didn't allow apps to run continuously in the background so that users can have all day battery life. The high level of control they have allowed them to provide greater value than other ecosystems which brought more users and so on. This requires continuous work to keep it running and they're entitled to be paid for their work.
And again, nobody has to buy their products, you can buy other products and install whatever software you want on those, and do whatever you want there. Android has a bigger marketshare and some people still use Nokia or Blackberry.
---
A digital marketplace consists of everyone that participates in the digital economy not just Apple. All the websites, service providers, apps, hardware manufacturers, users, companies, and their interactions.
When someone buys a car, they usually don't expect to run third-party software on it. They use it to get to places. They expect to use the built-in entertainment system to listen to music and maybe use CarPlay or Android Auto, and that's it.
When someone buys a smartphone, they expect to be able to install apps on it. That's the smartphone thing, that's what sets it apart from dumbphones. Third-party apps are what sells smartphones.
> Apple devices are successful because they provide a great value.
Uh sorry??? It may have been true 10 years ago, but an iPhone costs around $1000 now. That's outrageously expensive for what it is. You can say that about midrange Android phones, but definitely not about iPhones. You pay this much and still don't get to actually own the damn thing.
> for example they didn't allow apps to run continuously in the background so that users can have all day battery life
How is that related to the app store? Android does that as well. An app only gets to run in the background if it starts a "foreground service" which shows a persistent notification.
Sandboxing apps and enforcing their behavior does not require limiting what the user can do with their own device.
> This requires continuous work to keep it running
It absolutely does not. If iOS stopped getting updated 5 years ago, no one would've noticed. It's been a finished, feature-complete product for a long time.
You don’t have to use an iPhone. You’re welcome to use any Android based phone you’d like and install anything Google allows on it.
Or use any European based phone operating system. Oh wait, there’s none, because any phone company that became successful in Europe had to run away.
Leaving aside all the idealist "I own it" stuff that's been repeated here many times, there's another angle to this.
If you're a mobile app developer, you're effectively forced to develop for Android and iOS, it's a duopoly.
Would you accept a status quo where there were only two store brands for the entire US, and any seller of any product at all had to use one, the other or both? And all citizens had to shop in one or the other, and couldn't even switch because it carried many additional costs?
Apple is the one who will have to get with the program and will no longer be able to force users to not have control of their own devices.
Actually, we are quite literally in a thread where there is another option. That other option being to use the law to protect a consumers right to do whatever they want with the device that they own.
If Apple doesn't like it, then they can leave the EU.
> Regarding the EU forcibly taking stuff over.
They aren't taking anything over. They are simply protecting a user's right to do what they want with their own device.
The whole "user agreement" thing is one of the biggest problems, because it means Apple thinks you buying an iPhone doesn't inherently entitle you to the advertised functionality of it.
Which is, to out it mildly, highly misleading and potentially illegal. The "small print" shouldn't contradict the big picture. You can't pretend you're selling a device and then turn around and declare that those sales were only about raw hardware and not actual functionality. That's not how products work, and most importantly, not how consumer protection laws see it.
The reason why Apple is so adamant in this line of reasoning is clear once you factor in the App Store rationale. From that perspective, any time a third-party app runs on a user's device and calls iOS APIs in order to actually function, it's not part of what the user actually paid money for. Any execution of any software that uses those APIs is an additional transaction altogether, dealt with separately through the iOS EULA. In short, Apple's position is that any time iOS does anything, either by default or powering a third-party app, it's not actually part of the functionality that was paid for in full by the iPhone's owner, because the owner never paid for ANY functionality at all, only the hardware.
According to the App Store policies, if I remember correctly, technically all the customers belong to Apple. Although, the developers are also correct to see it the other way around as well.
The ecosystem was built on the assumption that hardware would be sold with its own profit margin and software would have its own separate profit margin to sustain its own operations, tools, and libraries.
The DMA made the entire software branch unsustainable and everybody thinks that Apple earned enough and they should give the software for free. Well, it's their platform and they're entitled to profit from it as they're pleased. Even the European Commission admitted that as well, because saying otherwise is akin to confiscating their intellectual property. I wouldn't bet the house on it but I think Apple would give up the European market before the core technology fee.
It is not a violation of someone's IP for a 3rd-party dev to make an app that interacts with that someone's OS. Software interacting with (and being compatible with/depending on) another doesn't touch the IP domain at all.
Why would you think they don't have a problem with the cut game console manufacturers take?
It's also different kinds of companies: Epic and Spotify have quite different concerns, for example.
Because they haven't sued them in the US nor lobbied the EC to label game console manufacturers as "gatekeepers".
The record labels are charging artists up to 50% for an album and nobody is even betting an eye about it or talking about regulation. That's why I find all this noise so artificial.
Security is relative concept. For most people being able to browse internet, add/remove apps, and be sure that they will not break things goes a long way.
Apple has a significant engineering challenge to turn their current operating system into something that allows side-loading similar to what Google offers. It's not a matter of "commenting out an if statement"
The current developer SDKs Apple offers are strongly tied to their services, which cost them money to run. So first thing is, they have to decouple that so developers can implement applications using a baseline SDK that does not use Apple services (no iCloud, no Maps, no HealthKit and so on)
I think it would be great for users if they did do this. It would be akin to what Google does by shipping and updating Play Services separately from the base Android install
The reason I linked BrowserEngineKit is because if you want to do this properly, you have to build something like Apple has built with that framework (which was built to comply with these policies). Take for example, implementing your own JIT: because arm64e uses pointer authentication, the system uses PACs to ensure that pointers into executable code have not been tampered with. Apple now develops and supports a whole slew of APIs like `be_memory_inline_jit_restrict_rwx_to_rw_with_witness()` in order for developers to manage this themselves.
You saying "just let their pocket computers run software users download and install" is not like every single other computer ever made and sold. This is a gross oversimplification of the modern state of computing, both on mobile and on desktop. There are reasons you don't want random developers loading code into your OS kernel, and Windows and macOS both have protections for this (though the CrowdStrike crashes recently shows what happens when those protections are lax!)
For example, I don't think it would fly that they could say to the EU: users who want a third-party browser just have to enable root access and lose access to all Apple services and authentication
Well. I guess they'll have to choose between opening it up like every other company does or acknowledge that it's a separate pay for service then.
They do a lot of that kind of thing and my answer for all of it is the same: Open it up to everyone or acknowledge it's a pay-for cloud service that has nothing to do with the actual phone OS. If people have root they can (and will) develop their own services that won't need that which would comply with the DMA.
Hell, just releasing my own personal code as open source — auditing it, decoupling libraries, removing internal stuff, it's a huge multi-week effort for me to do. For any company with as much code as Apple, it's pretty daunting
Perhaps if they had opened parts of their infrastructure much earlier, they wouldn't be legally compelled to do it now, and have to invest significant resources to do so.
It doesn't seem like the average Android user is worse-off because of that, security-wise.
But iOS requires that everything be signed by Apple in one form or another. Even debug builds of your own apps you run on your own device from Xcode. IMO, it is absolutely unacceptable to market your devices as general-purpose ones, make the SDK public, but still be an intermediary in app distribution for no good reason whatsoever. I'm surprised the EU is so seemingly patient with Apple's clearly contemptuous conduct.
If Apple wants to offer something similar, now, they are going to have a lot of work cut out for them.
You're not thinking this through, it's not a magic button Apple presses. They are going to have to develop a ton of frameworks just to get something like installable APKs.
Apple allows developers to use iCloud and Maps for free. Presumably because you distribute through the App Store. So if they allow for side-loading they're going to have to lock down and split their App Store "services" into a separate framework — hey, sounds familiar? Just like Google Play services.
Separating out all of Apple's authentication layers, paid and cloud services, and ensuring apps can be cleanly distributed without dependencies on those things it not a trivial engineering exercise.
I'm not trying to imply that Apple should not comply with the DMA. I believe they should. I also believe that it would be a seriously complicated thing to extract their App Store services from their developer APIs in such a way that people could develop against a baseline SDK sans Apple services.
You think side loading on Android cost Google "nothing" to implement and maintain? No, it costs them engineering resources to support that feature. It's a good feature to support and it's beneficial to users. But it's not free, it doesn't magically insert itself into the Android codebase if they "comment out an `if` statement" as the GP suggested.
Also, Android is gradually adopting many iOS-like permissions and security models. We recently updated our Android apps related to reading and writing to the file system. Why is that? Because the free-for-all they shipped with was heavily abused by developers.