Hacker News Reader

Comment by bsder | Hacker News Reader

Apple believes in user privacy.

Your naïveté is touching.

Well, Apple makes most money with hardware. Unlike Google who makes most money with ads. So at least in theory Apple can more easily invest in privacy.

EDIT: Check their last quarter's results, Apple makes only 6% of their revenue with online services: https://www.apple.com/pr/pdf/q1fy15datasum.pdf

I think they actually get most of their revenue from the App store and iTunes--and in neither of those cases is privacy good for business.

> Huberty said that Apple's online services are underappreciated by investors because they accounted for less than 6 percent of the company's revenue over the last 12 months.

http://appleinsider.com/articles/14/05/28/apples-app-store-r...

Ah, interesting.

Revenue is a useless metric when comparing across markets. Hardware and software are different. What are the profit margins?

There was a reddit post where OP works for a third party company that Apple send Siri voice to. People complained that users didn't read the EULA or whatever. Anyway OP said it was very specific too and crazy. So it doesn't sound like Apple being the champion of privacy.

This is the thread: http://www.reddit.com/r/technology/comments/2wzmmr/everythin...

Apple is using third parties to help make Siri better not to make money.

And let's be clear we don't know the contract between Apple and these companies. Given Apple's track record it should have numerous privacy conditions.

>Given Apple's track record

Well Apple collaborate with the NSA, so that immediately disqualifies them from giving the slightest shit about privacy.

What's the alternative for any company? Leaving the US?

Challenge the law, like Microsoft does.

The government sets the rules, companies just play the game. Changing the laws an tax rules are the most direct way to influence the behaviour of businesses.

Instead of condescension, please provide some sources and state your beliefs in a productive way.

I think that was more or less the point of the GP minus the condescension bit. Making unqualified statements about what you believe about a large corporation is roughly on par with contesting that particular belief.

Then again Apple has a track record and APIs to put forward. Just about every API in iOS puts privacy first. If you want e.g. location data, the API asks the user's permission -- including with Apple's own apps.

How do I install any API from apple without providing Apple (and whoever else) with my credit card?

The OsX machine at my office is mystifying, am I supposed to provide my personal credit card to apple to get security updates? That is more secure and insures more of my privacy than not entering my credit card into a system I don't trust?

I view Apple as insulting my intelligence with promises of "convenience" that amount to being able to give them money on impulse.

Apple accounts are free. You can't use iTunes with a free account or get the premium developer offerings (i.e. iOS developer certs) but you don't need to pay to use the OS or get updates.

You seem to be under the impression that you can create one of those "free accounts" without apple tracking those activities. Privacy is not having anybody be able to log your activity, not "everybody but one company I like".

Apple's walled garden approach to everything makes apple one of the worst offenders with regards to not just privacy, but freedom as well.

That's a great area to discuss but not relevant to what we were talking about. The point I was referring to was the specific claim that you needed to give Apple a credit card to use OS X.

I'm not looking for free as in beer, I am looking to not share data that conveniently uniquely identifies the private me to random foreign 3rd parties like Apple just to do my job. Buying media via cash+reimburse or through company ordering is not my money and is often the solution for using commercial OSes with personal privacy outside my employer remaining similar to the unbanked. (But I can't tell if that is a waste of time with Apple, since I obviously need follow whatever procedures for security updates until the next purchasable media.)

From other comments, it sounds like I can dance around to make it possible on OsX, but every other OS (except ebooks?) that I have ever installed either makes opt out a transparent (though smaller button/font) process or has no registration process at all.

I don't like that the machine will be in a very small group of opt-out OsX systems compared to reasonable percentages of other Oses. By not sharing my personal details, I might be risking my coworkers having lower than normal privacy when using OsX machines.

"Create an iTunes Store, App Store, or iBooks Store account without a credit card or other payment method" https://support.apple.com/en-us/HT204034

Which leads to: https://support.apple.com/en-us/HT203905 " If you're using the iTunes Store or App Store for the first time If you're using the store for the first time with an existing Apple ID, you must provide a payment method. After you create the account, you can change your payment information to None."

I've always end up back in UX loops wanting my credit card since I seem to need a new version that is free but in the app store to get security updates..

You don't need to use the App Store to get security updates.

They have been always been available for download from the Apple site:

https://support.apple.com/en-au/HT201222

Its a weird secret option, but here's how you do it (I used to work for them.)

Make an account - does not require payment option

Buy a FREE app in the store

None will be a payment option as one of the possible credit cards (as you dont have to pay for a free thing)

That's no different from every other major mobile platform. The other ones do one better and build their own apps entirely using the same APIs that third parties have access to, which is why Firefox exists on those other platforms.

iOS permissions give users far more control than Android. Internet Advertising now an unrvokable permission on android.

You must be confused. There is no "Internet Advertising" permission on any mobile platform.

And your condescension is irritating.

Apple seems pretty solid on the protection of users' privacy. Devices are encrypted by default, for example, and there are robust protections from rogue applications in place.

Is there are specific practice that Apple engage in that makes you think they are particularly reckless regarding users' privacy?

He's comparing Apple to Google. In that respect, Apple comes out looking pretty bad. Google's devices are also encrypted by default and have much more robust protections against rogue applications in place (both static and dynamic automated analysis of apps for malware, vs. just a human eyeballing it).

Android devices aren't encrypted by default, Google backtracked on that.

http://arstechnica.com/gadgets/2015/03/google-quietly-backs-...

New ones are, I think. The Nexus 6 is. Older devices don't necessarily get upgraded. It's a hardware/software issue, not a philosophical issue.

Google devices are, as I said. Mentioning that other Android devices aren't is like saying other Linux distros don't use RPM in response to a statement that Redhat does.

So are iOS devices that have a passcode and are running iOS 8, and with fingerprint scanning a lot more people have password locked devices. Good article on the subject is here:

http://www.darthnull.org/2014/10/06/ios-encryption

And yet, with all that wonderful "automated" malware checking Google is also now manually reviewing App.

http://blog.lifars.com/2015/03/18/google-now-manually-review...

How does the addition of manual checks against the distribution policies change the fact that Google's malware checking is better than Apple's?

I don't understand what makes you say that Google's malware checking system is superior to Apple's. Do you have a source for that? Do you have a source to the way Apple in general does their app vetting, or Google for that matter. At this point you are basically saying: "Google is better because I said so." Do you have evidence that Apple does NOT run an automated virus and malware scan, resource analysis, or any other automated malware detection on their apps before adding them to the queue to also be manually checked. Just because Apples does manual checking it does NOT mean that they completely forego automatic checking. Just like the fact that Google did automatic checking did not prevent them to also implement a manual checking system.

Nowadays both companies do a pretty good job vetting App submissions, though Apple also filters on quality (sometimes) where as Google does not, but that's within each companies respective philosophies, and can be considered a strength or a weakness, depending on your own philosophy.

Do you have evidence that Apple does? They have made no claims that they do, instead continuously pointing to human vetting as their filter on malware, which is laughable. We all know that unskilled contractors stepping through some policy checklist aren't a legitimate protection against malware, but it's enough to fool people like Gruber, many bloggers, and you 14 hours ago before I pointed out your mistake.

If the only thing Apple does is simply pay people to poke around the app on an iPhone for a few minutes, then by that assertion there should be a stunning amount of Malware on the AppStore. I mean, all you have to do is place a time delay code, or a server side activation procedure, and you would be able to bypass all manual checks. What on earth makes you think that Apple does NOT use malware scanning. I mean, it's easy to setup, easy to implement, and cheep. This is why Google went to manual scanning first, and only later on went to human and AI assisted checks, which are harder and more expensive to setup.

In any case, you made an assertion that Apple does NOT run automated scans, unlike Google. I asked for proof. Now you demand proof from me that they do. It doesn't work that way. You made an assertion first, you back it up.

My proof is in the result. AppStore has next to no malware on it. PlayStore (now) is also very clean and safe. Google achieved this through combination of automated and manual vetting. Apple is notoriously silent about their process, other than advertising their one USP, which is no longer unique, but given if we use logic, we must assume that both companies use similar tools to achieve similar results.

Your assertion that Apple is far less secure would suggest much more malware being live on the AppStore, and yet in my search on google I was only able to find a few older articles about researches being able to smuggle in custom written malicious code onto AppStore. Meanwhile, while searching for malware on iOS, google presented me this in a search result at some point:

http://techcrunch.com/2015/02/03/new-adware-found-in-google-...

That's just one example from 2015. I don't think it's fair to check back to 2014 and prior, as back than Google Play Store was basically Wiled Wiled West.

You've made so many mistakes of logic and fact, it's hard to figure out where I should begin. First, itself "wild" and not "wiled". Second, Apple doesn't allow "virus scanners," which is why you'll never hear companies like Sophos talking about malware on iOS -- they have nothing to gain. If you are in the right circles, you know there is plenty of malware on the App Store -- it's significantly easier to get it on the App Store than it is to get it on the Play Store. The main deterrent to malware on both platforms is the requirement that the app publisher have a credit card, which the stores both verify. If a publisher behaves badly, their identity is already known through their bank. Finally, you seem to be confusing manual scanning, static analysis, dynamic analysis, and human review to the point where it's hard to even figure out what you're claiming. Google implemented dynamic analysis long before 2014 (your "wiled west"), which Apple very clearly still hasn't done.

> First, itself "wild" and not "wiled".

Thank you for the correction, and I am guessing you mean "it is" rather than "itself" in the above correction of my spelling.

> Second, Apple doesn't allow "virus scanners," which is why you'll never hear companies like Sophos talking about malware on iOS -- they have nothing to gain.

1. Until recently Apple did allow virus scanners on iOS. However, those programs were largely useless for 2 reasons. First, because without a jailbreak you can not run unsigned code on iOS, unless you have found a jailbreak vulnerability that can be exploited directly on the device, but I haven't see those since iOS 3 or 4. Second, because iOS jails each app, so one app can not scan the file system or any of the other apps on the OS. Conversely, one app can not maliciously attack or install unsigned code on the OS without a jailbreak.

2. Sophos would have a lot to gain from exposing wide spread malware in the App Store. Such news would pressure Apple to reconsider their decision and allow virus scanners into the App Store, or at least clean up their act. One way or another, it would be a lot of GOOD pub for Sophos.

3. Given that there are many jailbroken iPhones, and that it's trivial to access app files on a jailbroken iPhone, it would be easy for Google to run their own Malware scanners on AppStore submissions. Considering that they would most certainly (according to you) find hundreds, if not hundreds of thousands, instances of Malware, it would be a wonderful PR story for Google, once and for all proving the undeniable superiority of the Android OS. And yet, I have yet to read that story. Forget Google, HTC, Sony, LG, and any number of other manufacturers would have direct pecuniary interest in discrediting Apple by proving to the world that the AppStore is teaming with Malware. I guess all of the above mentioned companies are operated by utter idiots, if we are to believe your assertions.

> If you are in the right circles, you know there is plenty of malware on the App Store -- it's significantly easier to get it on the App Store than it is to get it on the Play Store.

What are these "right circles?" Links, facts, anything to backup the above statement?

> The main deterrent to malware on both platforms is the requirement that the app publisher have a credit card, which the stores both verify.

Use a prepaid VISA card, put any name and address you like. Works like a charm, you can register an account like that on either store.

> Finally, you seem to be confusing manual scanning, static analysis, dynamic analysis, and human review to the point where it's hard to even figure out what you're claiming.

You are confusing the meaning of such terms as manual scanning, static analysis, dynamic analysis, and human review. There, we both made utterly unsubstantiated claims, now we are even!

> Google implemented dynamic analysis long before 2014 (your "wiled west"), which Apple very clearly still hasn't done.

1. Thank you yet again for pointing out the SAME typo in my previous post for the second time in your reply. To return the curtesy, I would also like to point out that "itself" and "it is" do not have the same meaning in the english language. I do understand that this page is frequented by many people from other countries, who may speak different languages. I, for instance, speak fluently 2 languages, in addition to English. So I do apologize ahead of time if you are indeed an ESL person, but to improve your knowledge of the English language I felt the need to point out your mistake yet again.

2. Could you please provide any proof what so ever to your claimed assertion that Apple does NOT conduct dynamic analysis.

3. Please refer to this article [0] which details utter inaptitude of PlayStore's dynamic analysis tools in 2014.

[0] http://www.syssec-project.eu/m/page-media/3/petsas_rage_%20a...

Well then be cynical, and let's say that Apple is greedy but believes user privacy is a selling point for its hardware products, just like its accessibility efforts. The result is the same. My iPhone randomises its MAC address when scanning for Wi-Fi, Apple's APIs to ask for user permissions are improving with every release, and iMessage is as secure as a closed-source IM platform can be.

Reply on news.ycombinator.com