Hacker News Reader

Comment by Cider9986 | Hacker News Reader

Mobile Device Management (MDM) is the only effective way to restrict idevices.

All you need is a macbook and Apple Configurator.

You can remove safari, blacklist or whitelist websites, block installing apps, block deleting apps. It's really customizable.

Edit: expanded acronym.

View on HN

Only? Their solution in the article seemed effective.

This iOS feature isn’t only about locking out users from some features/apps.

It turns a complicated phone into a much more simple one. Both kids and the elderly can benefit from it.

My only issue is that the was only introduced in 2024, so older iPhones can’t benefit.

It was introduced in iOS 18, which is installable back to iPhone Xs (2018). So 8 years of devices have that setting.

Curse Apple and their planned obsolescence /s.

Yes, actually.

I got an iPad 2 found in a drawer that would be perfectly good if the software could at least be easily unlocked so you could only hope to install an alternative OS since they don't want to update it themselves. Or if they allowed installing stuff from outside their store.

But no, the thing runs an ancient WebKit and that's pretty much your only way to run custom code on this stuff.

I can't even create an apple account from this stuff anymore, and apple won't let me create an apple account from any other device I have. Which could possibly help with jail breaking it. And it would already be a pain to be able to create an apple account because they require a name, a birth date, a phone number, an email address... All this to access a store from which nothing would work anyway for an old device like this.

So, fuck them.

And android increasingly becomes like this too.

Meanwhile, you can still run an up to date Linux on a laptop from the 90s.

I commented because my father has an iPhone 8 and vision/cognitive issues. He could very much benefit from this accessibility feature, but he hasn’t been eligible for iOS upgrades for years.

I've used MDM to make my iPhone dumb. It's great! I wish there was an easy way to publish my configuration so others could use it / adapt it, but it's a little involved because you have to wipe your phone the first time you set it up with configurator.

I did that when I had an iPhone, I agree it was excellent. More people should do it.

Looking forward to MDM support on GrapheneOS.

I’m curious about this, what did you do to make it dumb?

This might be how they did it:

https://news.ycombinator.com/item?id=45171200 iPhone dumbphone 10 months ago 399 comments

Interesting. But the list of apps on there is huge! Is it really still a dumbphone? Tha just looks like the apps I already have on my phone, and I still feel like I use my phone too much. What other apps do people have that are so addictive? Games, socials?

I used Apple Configurator on my mac to supervise my iphone. Once that's done, you use configurator to add a profile to the device that (1) contains an allowlist of apps that can be used and (2) an empty allowlist of websites that can be visited. #1 means you can't use any new apps, and #2 prevents the ability to browse the internet by sending links to yourself in e.g. messenger or whatsapp.

Supervised devices cannot be backed up and restored to supervised devices. You can only backup/restore to an unsupervised target. If you want supervision, you have to abandon your backup.

It sucks.

Is that iCloud iPhone backup and local backups?

I don’t use iCloud, so I don’t know.

Can't you use a config profile and enroll it ?

MDM is just parental control for adults.

> All you need is a macbook

Is it really not possible to do this with a non-Apple machine?

Not afaict.

What does the acronym stand for

mobile device management

Mobile Device Management

Monumental Deployment Mastermind

I thought they prohibited the Apple mdm for family use. Was this a soft ban? Can we just use it without like verifying it’s just for the family?

MDM is the worst part of iOS. It undermines all of apple’s security claims, basically making iOS windows. Devices should not be able to be remotely controlled.

It can be done all locally. How can an optional feature that's not even easy to use be the worst part of iOS?

Yeah, no - if I provide my employees $1000 devices, I most certainly would like to be able to exercise some sort of management over them.

> making iOS windows

Baseless claims.

$1000 is irrelevant. Corporate information, and clients information (sometime including PII) is worth millions.

MDM enables enterprises to control how the phones they own behave. If anything it makes it more secure, if an enterprise were to only allow allowlisted apps to run on it.

The only issue is BYOD via MDM (when it's not via "Work Profile"), which is somewhat scary from a user perspective, especially from how hard it is to tell what permissions they might be able to spring on you at any time.

I assume they can spy on anything, that's why I refuse to do any kind of BYOD that requires MDM enrollment. It's also one IT mistake away from wiping out my personal data from my own property.

Company's Outlook, Teams, MS Authenticator and Slack on my personal phone? Ehhhh fine.

The second IT requires a profile it's the second I'm uninstalling anything company related from my phone. They can give me a company phone, or I will only access work related things from their laptop.

Happened twice to me, one time I got a company phone, the other, computer only.

And then some colleagues even paid out-of-pocket to upgrade their Android phones once IT dictated their OS were out of support. No way.

Your assumption is wrong.

How so?

Nonsense. MDM is usually for devices owned by the company or opt in by you personally. There is no way to attack or transparently MDM a personal phone that I know of.

MDM is designed for corporate owned phone environments where there's a great many good reasons to lock down a phone. If you're handing out company owned phones to employees you want the ability to remotely lock/wipe, install and remove apps, set a number of restrictions. If people want to do anything else they are completely welcome to do it on their own personally owned property.

For instance I have recently seen a very successful Apple MDM deployment in a school environment where the teachers and staff have access to a great depth and breadth of PII of a thousand children under age 16. You don't want all those phones to become a free-for-all of people doing whatever they want.

MDM is not the default experience, while Windows doesn't really have a better experience to boast of.

Reply on news.ycombinator.com