Hacker News new | past | comments | ask | show | jobs | submit login

Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

Most consumers understand those concepts and fear those things. Most understand nothing about the economic impact of monopolies and anti-competitive business behavior and the harms they cause consumers in the form of higher prices, lack of innovation, reduced choice, and poorer quality products and services.

So Apple plays off those fears by using language consumers understand, making them actually want the very monopoly that is being forced on them and actually harming them while making billions for Apple.

It's unethical behavior, no more defensible than Sam Bankman-Fried's effective altruism, a.k.a. "mostly a front." This is all right out of Apple's standard playbook.




> Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet.

Looking at one virus alone, the App Store distributed half of a billion copies of it to iPhones and iPads[1]. Similarly, there are multimillion dollar scams on the App Store, as well[2].

[1] https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is...

[2] https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...


That one virus on the App Store was one of, if not the biggest known instance of a virus on the App Store, and your article gives a number four times smaller than half a billion. From your [1]:

> But now, thanks to emails published as part of Apple's trial against Epic Games, we finally know how many iPhone users were impacted: 128 million in total, of which 18 million were in the US.

> "In total, 128M customers have downloaded the 2500+ apps that were affected LTD. Those customers drove 203M downloads of the 2500+ affected apps LTD," Dale Bagwell, who was Apple's manager of iTunes customer experience at the time, wrote in one of the emails.

> Apple also disclosed the apps that included the malicious code, some incredibly popular such as WeChat and the Chinese version of Angry Birds 2.

Still a huge deal, particularly in China, but considering all the virus really did was collect some device info (less information than most ad networks) (and maybe it was able to open URLs and popups on command)[1] and it was the biggest virus on the App Store ever (that I can find), maybe not as awful as you suggest.

The scams on the App Store, yeah that's pretty bad. Though, can you point me at a marketplace as big as the App Store without loads of scams?

[1]: https://www.lookout.com/blog/xcodeghost#what-does-it-do


Apple uses the excuse of security to hold a monopoly.

You are shown that this is by no means as secure as they want you to believe.

Then you argue that "of course, with a market that big!"

So basically you are proving that Apple uses the excuse of security to hold a monopoly.


Not only that, it proves the opposite of the claim.

Suppose there were multiple app marketplaces for iOS. Then some of them could be extremely selective by finding a niche, and thereby be more trustworthy than any unified store that has to carry a million general purpose apps with only cursory evaluation from various publishers of little or unknown reputation.


> all the virus really did was collect some device info (less information than most ad networks)

Nah, that would mean that what really protects iOS users from malwares is just a good sandboxing mechanism and not the "human" control of the App Store. That would also mean that bypassing the App Store shouldn’t be a real security issue.


It’s pretty clear that it’s both. Claiming otherwise is a bit disingenuous. An app store with no human or automatic validation and not $100 would have a magnitude or two more malware.


Can you back that up with an example, perhaps the Android Play Store? Is there significantly more malware on recent (last ~5 years) versions of Android than similarly recent versions of iOS?


Google play store also uses human review.

The question is whether there’s more malware on stores like f-droid, and the answer is yes, there is of course significantly more malware.

This even pollutes the official Play Store to some extent because of course google can’t put the foot down too hard when Facebook et al can simply “start their own app stores” to bypass review if they really want to. Malware rates are much higher on android in general.

https://arstechnica.com/information-technology/2020/09/joker...


> Though, can you point me at a marketplace as big as the App Store without loads of scams?

Not the person you're replying to but isn't that the point?


> > Though, can you point me at a marketplace as big as the App Store without loads of scams?

GNU/Linux repositories.


The biggest of those is NPM, I think, which appears to be between 50% and 100% as big as the app store. Let's call that equal in size, shall we?

https://nitter.net/npm_malware has twenty postings in the last 19 hours, quite far from "without".


NPM is also used by Windows an MacOS machines, and who knows which else. *BSD? Anything that runs JavaScript?

Probably OP was thinking about the deb and rpm repositories of the main distributions but yes, NPM and the likes are other examples of large repositories.


Yes, I meant deb/rpm repositories. NPM is not a Linux repo, it's multipurpose, with lots of proprietary software.


It's the open part of it that's comparable to the app store in size. The closed part is in addition.

I agree there are linux-only repos that are ~1% of that size and contain little or no malware or abuse. That's true whether you measure size in updates per day or total count of packages, so 1% seems reachable without considerable malware problems.


> so 1% seems reachable without considerable malware problem

Another plausible explanation is that pure FLOSS repos are free fron malware.


No, npm is not a Linux distribution. It's a programming language package manager and package repository.

The distinguishing feature of Linux distributions is the existence of maintainers. Human beings who put in effort into maintaining the quality and integrity of the packages and keeping them up to date. We Linux users generally trust those people, and they stand between us and all the software developers out there. To get to us, you gotta go through them. And they generally aren't in the habit of allowing obvious malware into the software repositories. That's why we trust them in the first place.

Contrast that to repositories like npm, pypi, rubygems, cargo which are all designed so that any random person can make an account and push up any package they want. There's no checking. Accounts might be compromised by or outright bought by malicious actors. Just like popular browser extensions which get bought and converted into malware.


NPM is not a Linux repository.


> The biggest of those is NPM, I think

No, it's not even a Linux package repository. Think repositories for Debian, Fedora, Arch, etc.


I mentioned it because it contains a lot of GPL-licensed packages, and a lot of it's used on linux, and it's at least near the scale of the app store. It falls a little short along all three axes, but it seems to be the closest.

I don't think either Debian, Fedora or Arch are anywhere close to a million packages or a thousand updates per day. Well below 10%. They're GNUish and 100% linux, but really bad on the size axis.

The app store has at least two classes of problems that those three don't have, and have to handle the problems at much higher scale. "Those guys manage to handle a simpler problem at much smaller scale, so it's possible for the app store too" is hardly an argument.


Is the malware in NPM in the GPL part? I guess no, so this is my point: FLOSS repos can be trusted.


Yes it is. Most likely also in the other part, although link I included doesn't mention any of that. The key appears to be: A large repo with lots of uploaders, some of which guard their passwords poorly.

As long as a FLOSS repo is small and has few uploaders, it'll be safe. Hardly a model for a big and busy repo like the app store, of couse.


The largest Linux repo is nixpkgs.


> Though, can you point me at a marketplace as big as the App Store without loads of scams?

Maybe the issue is being so big then. Which is exactly why the EU did this in the first place. So Apple has yet another lever to comply: reduce their size.


How’s that compare to android though? For the most part apple’s walled garden IS safer and more privacy preserving than android.


What kind of take is this? The main channel for apps is extremely similar to iOS's App store. I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.


> I highly doubt if there is a difference, it's due to non-Google App stores or sideloading.

Tech journalists have literally warned Android users that they need to be wary of apps from inside Google's walled garden.

> With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around.

https://arstechnica.com/information-technology/2020/09/joker...


Once you've submitted apps for review enough times, you get to know how arbitrary the review process is.

Many, many people game the system in terms of in-app payments, e.g. showing a link to subscribe on their website but hiding the link for the review.

If they can't catch that, why do you they can catch anything?


I disable autoupdate for apps on android, since all it does is bring in more ads normally. I manually update webview every once in a while and that's it.

Also, most of my apps come from fdroid anyway.


Isn’t that the point?


If Apples system is better they should be able to compete successfully in a free market. The don't seem willing to attempt that.


You are free to choose an android phone or an Apple one; that part of the market is absolutely free. Apple is the top seller of smartphones, I believe this qualifies as "competing successfully".


> that part of the market is absolutely free.

That part of the market not being separate from the other part of the market is the issue. There could be a dozen different reasons that someone might want an iPhone over some competitor, and if they buy one for that reason, they're stuck with Apple's store even if they would have chosen something else given the option.

Not only that, the markets are tied together in both directions.

Suppose that you do want to go into competition with Apple and Google and make your own competing phone platform. The biggest problem you're going to have is that people expect you to have a lot of apps available for your phone before they'll buy one, but you have to have a lot of customers before anyone will make apps for your platform.

The traditional way to solve this is by creating a cross-platform framework and then giving developers an incentive to use it, generally by making it easy to distribute apps to existing platforms. For example, Valve wants game developers to develop for SteamOS, so they provide cross-platform frameworks and a distribution system that also works on popular incumbent platforms like Windows. Then developers make games that run on Windows and incidentally also on Linux/SteamOS, and now there are more games available for SteamOS than ever before and it's the most promising competitor to Windows for PC gaming in a long time.

Conversely, Microsoft is prevented from making an app store for iOS, so they can't do that and their ambition to create a viable competitor to Apple and Android faltered. Likewise Ubuntu Touch and Firefox OS and every other attempt to create a viable alternate phone platform. And then you say "just buy a different phone platform" -- as if that wasn't the problem.


At least in the US, imessage gives apple an effective monopoly. Their are strong social repercussions for not having imessage. If you want to be included you pretty much must have an iPhone.

Apple is well aware of this and plays into it hard.


> At least in the US, imessage gives apple an effective monopoly. Their are strong social repercussions for not having imessage. If you want to be included you pretty much must have an iPhone.

That's because people are idiots. There's nothing that iMessage does that whatsapp, telegram, kakao, line can't do. In fact, US/Canada are the only ones that actually use SMS or iMessage, as far as I know, and the rest of the world use other messaging apps. I have been living in Canada for 5 years already, and in no instance I had any issue whatsoever. I now use iPhone, but nobody talks to me via iMessage, it's all either Messenger or Whatsapp, or Instagram

If Apple is able to hold such a stronghold over Americans because of something so easily bypassed, then you deserve to be controlled, really.


Oh stop it, Apple isn’t responsible for people’s choice of friends, they do need to provide a UI affordance that someone may not be getting messages displayed corrected


> Oh stop it, Apple isn’t responsible for people’s choice of friends, they do need to provide a UI affordance that someone may not be getting messages displayed corrected

Apple has been repeatedly requested to change the colour to a less ugly shade, or to give users the choice to disable the feature or to give Android apps an API of some sort so they can comply with whatever Apple's requirements and get the blue text boxes.

Apple hasn't taken action because they like the current state of affairs, they want the social ostracism of non-Apple users.


I should also be free to run whatever software I want on the phones I bought. Don't care about Android or iOS. I want to run Linux, postmarketOS.


> that part of the market is absolutely free.

https://en.wikipedia.org/wiki/Tying_(commerce)


android just checks every app for safety (play protect) and isolates every app at system level. solutions for sideloading are actually very simple.

so, is it "safer"? what's "safer" about it? or is it really just a meme apple has successfully perpetuated about it's limitations?


This week I removed adware from Android, which is installed according to the following scheme: a person sees a fake advertising notification about an infection, then even trying to close it opens Google Play or another store with some kind of antivirus with a generic name like xcleaner, to make it harder to find it among others, and installs it. Then this application starts working in the background and every 2-3 minutes creates full-screen advertising banners with vibration, also about infections with links to other garbage. It does not exist in the list of applications and in the activity list as soon as the banner is closed. While it is there, instead of its name it shows a webview, and you need to guess to go from the list of processes to the application in order to see its real name and delete it.

A year ago, I also saw a fake advertisement for a squid game. These fake advertisements have already become a meme, but they also offer to download from Google Play a slightly similar game, where after quickly clicking on the screen, the smartphone will suddenly prompt you to buy an expensive subscription and then you will not be able to cancel it, because Google does not provide for them refund. This idea comes from SMS scams since j2me platform, and judging by the comments on this game, people are still losing money, especially if they leave their phones to children.

I don't use ios and won't say whether manual moderation there helps prevent the same crap, but let's not ignore that if you're not tech-savvy, this Android security alternative is pretty easy to get around.


literally the same "scam ad - scam app" pipeline exists on ios. ads exist, bad scammy ads exist, garbage apps exist, stuff slips through app moderation filters, or just stays around and gets by because it's juuust enough for it to not be outright malware. bad ads and apps are unfortunately not a platform specific problem, nor are they really "solved" by either of platforms.

funnily enough, some bits of it might be worse because ios and app store are promoted as 'being secure' period, almost unequivocally - so it ends up being a thing like 'well, ios is secure and this app is on the store, so it's all good, right?", which doesn't always happen to be the case.


My Grandfather had 3 different SMS apps installed on his android when I looked at it one day. Each of them had tried to take over as the primary app.

AFAIK, This cannot happen on Apple.


I still think there ought to be some solution that includes both "apps can't force/trick you into changing defaults" and "owner of device can still choose to change defaults".


From what I’ve observed in this thread, there seems to be an over abundance of faith in competition and freedom to tinker.

I think that this is faith, not objectivity - which is misplaced in this specific scenario.

The challenge isn’t market dynamics, but rule breaking and predation on victims.

Non tech inclined people are targets/marks for bad actors.

Malicious websites, innocuous messages, hard to avoid buttons - are all designed to circumvent good intentions.

This is resolved with rule enforcement, retributive and governance powers.

If we are adamant about competition, then apple being locked down while Android remains open is about the best you will see.


There is. It's called iOS.


are you asking what is safer about, eg, selinux vs regular linux? I think that is pretty self-evident that a constrained user experience results in a reduced attack surface.

these questions are silly if you pivot them to be about other things rather than the fruit company, just like the arguments that "[company] needs to run open-infrastructure so other companies can build commercial products on [company] servers".

It's rather obvious they're being asked in bad faith with the intention of dragging down the discussion. You know perfectly well what SELinux and application sandboxing are for, and that they're net benefits.


Maybe but the vast majority of people have zero issues with malware and don't really care about the perceived advantage of privacy (just Apple marketing because they can't sell ads, if they could they wouldn't give a shit).

I take care of Android devices used by elderly people, and they have just zero issues. Not anymore than they would have with iOS.

All this is nonsense talk trying to help the indefensible position of Apple. Most people also use Windows computers with no monopolistic app store and even though sometimes they are problems they almost always come from user errors. Most of the time it's poor choices, generally from greedy behavior (trying to get stuff for free without knowing much).

If a user doesn't know what it's doing, it can ask someone for help or stick with Apple's App Store if that suits him. Allowing other possibilities for more competent people doesn't change this fact one bit.


my mother has thousands of notifications from the browser, from all the websites that request permission to show them.

Her phones become really slow because of this.


Late reply, but that is definitely "user error"; and the iPhone will exhibit the same problem if you allow any random app notifications access. There are plenty of bad actors, even on iOS. For example, even Uber Eats will target you with ads if you dare allow all permissions for notifications just to get orders tracking...

In fact, their notification system makes it complicated to just allow specific behavior and not something else. It's not better than the notification settings in typical web apps. As a day one user of iOS, I find it funny that you complain about notification out of all things, because if there is one place where iOS is just as fucked as every other platform it's notifications...

Nowadays I have resorted to basically denying notification for everything but the few stuff where they are actually relevant...

Also, you should correctly set things up for your mother and refuse notification prompt for every website and just whitelist the few that might be usefull..


> Which is ironic, considering that the App Store is likely one of the largest malware distribution vectors on the planet.

Sorry but the actual statistics from mobile security companies that track this stuff show otherwise. From Nokia's Threat Intelligence Report 2020 (https://pages.nokia.com/T005JU-Threat-Intelligence-Report-20...):

Among smartphones, Android devices are the most commonly targeted by malware. Android devices were responsible for 26.64% of all infections, Windows/PCs for 38.92%, IoT devices for 32.72% and only 1.72% for iPhones.

Android malware infections are an order of magnitude higher compared to iPhones.

(I tried to look for data from more recent years but iPhones don't show up in the reports after 2020.)


Citing xcodeghost as a big smoking gun of Apple malfeasants is absurd. Apple handled that whole situation really well considering it came from a bunch of downloader websites where the attacker had modified clang and Xcode.


Meanwhile I can’t even get them to approve a simple midi remote app…

They need to “investigate”


>Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

When someone claims he's the only one who can protect the public I immediately see some question marks.


"Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive. It would be better to live under robber barons than under omnipotent moral busybodies. The robber baron's cruelty may sometimes sleep, his cupidity may at some point be satiated; but those who torment us for our own good will torment us without end for they do so with the approval of their own conscience."

— C.S. Lewis


Technically it's true that if you were to equate influence to the ability to protect, that when you lose that influence you also lose the ability to protect.

So far, it's all been speculation, even drawing parallels with Android or Windows doesn't help because it's not similar enough. I would expect a broader ecosystem or additional facets to an existing ecosystem to also cause an expansion of questionable quality and practises, but that applies to everything, not just mobile phones.


FWIW, my observation of Google's app store policies over the last 8 years or so is that they simply trail behind Apple's policies by a couple of years. Google is constantly expanding their store policies in order to better vet who is distributing apps, restricting the behavior of apps, etc. and they almost always mirror what Apple has already put in place.

I would agree with you that Apple isn't the only entity that can provide that type of vetting process but it also seems clear to me that a vetting process is actually a useful and desirable service.


F-Droid does a better job than either of them for my purposes and it's just like one guy.


You mean the EU/ECJ?


You're talking about the EU and states alike - right?


You do know that except for arguably Hungary (and even that's slowly being worked on... it's just really hard), all EU members are democracies and the EU itself is a democratic institution?


Or like the United States with their military operations protecting w̶e̶a̶k̶ a̶n̶d̶ o̶p̶p̶r̶e̶s̶s̶e̶d̶ p̶e̶o̶p̶l̶e̶ their interests around the world ?


I did get kind of annoyed at the very specific wording they used throughout the article.

Especially the constant mentioning of the "EU" when this applies to the EEA, leaving out two entire countries. I hope they actually realize this internally.


Three whole countries. You left out one. Everyone makes mistakes. :)


But only some (PR writers) are actually paid to not make them.


>Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

It's the same sales pitch that Canonical is using to justify its centralized snap store.


Absolutely. Shuttleworth has always been the little wannabe apprentice to Jobs' dark arts.


> a monopoly is the only thing that can protect them against malware

That playbook really gets around huh.


>Yes, it's been Apple's modus operandi with the App Store from the start: trick consumers into thinking the App Store being a monopoly is the only thing that can protect them against malware, illicit and questionable app content, pirated software, scams, and fraud.

Tim Cook is parroting Steve Jobs when he says that Apple deeply cares about users' privacy and security. Jobs was smart enough to realize that emphasising security and privacy protections would increase sales because Apple is a company which sells computer products instead of advertising solutions and services like Google and others(although Apple is increasingly thinking about how to monetize their Big Data).


Jobs knew his audience: people who buy computers as appliances for specific tasks, and don't want to (or can't) understand anything about how computers actually work. To these folks, computing is basically magic; so it's easy to put a bit of fear into them to make them more faithful to the shaman.


This seems awfully dismissive of people who choose to use a system. Just because you don’t agree with people’s choices doesn’t mean we don’t understand “how computers actually work”.


While he was certainly targeting that kind of audience it is extremely shortsighted to think that it was Job's primary target. In fact, if you have enough knowledge about everything he has said and done, it's easy to argue that he was in fact targeting very competent peoples, that were quite knowledgeable about technology and that wanted shit to just work precisely for those reason.

Because when you know how things work and what they are capable of, the last thing you want to do is fight with them so that they work. At least, someone who doesn't know better cares much less because he is clueless about the existence of a better way.

Jobs was in the business of selling bicycles for the mind, not dumb consumption machines. The latter development of basic consumer focused products is just after the success of the iPhone and happened basically precisely when he left (while officially he was still managing apple, it's pretty clear that after the launch of the first iPad, jobs didn't have a lot of impact at Apple his health condition not allowing).

It also made sense because before Apple was something to exhibit to display wealth nobody that wasn't competent enough with technology would have spent so much money on it. Which is exactly why current Apple offering is absolutely terrible for its price.

Most of the crap told on Apple nowadays are complete memes from the second wave of Apple cultist (most of them arriving with the iPhone) that completely ignore the true history of Apple and how it got to launch such successful products.


> it's easy to argue that he was in fact targeting very competent peoples

Competent in other fields of endeavour, sure.

Jobs was in the business of selling computers that looked (and worked) good to people who would otherwise hate computers. Dealing with geeks was always (and still is) a necessary evil, so he'd have enough of an ecosystem to sell to "normies".

Jobs fundamentally hated the Macintosh and tried very hard to get away from it very early (Newton, anyone?). Once he got back on the saddle, his first Big Idea was to wrap them into colourful shells, and fuck the tech inside (jesus, was the first iMac dog-slow!). His second idea was to co-opt FOSS and Java developers, again to have enough geeks building stuff for his platform; they would be unceremoniously dropped once the iPod got traction and he could finally get to run the "better Sony" he always wanted to have.

The rest is just stories he told to power his reality-distortion field.


There’s a couple inaccuracies you’re making, but here’s the most blatant:

> Jobs fundamentally hated the Macintosh and tried very hard to get away from it very early (Newton, anyone?).

Jobs had nothing to do with the Newton, it was started about a year after he was forced out, Sculley coined the term Personal Digital Assistant, and it was one of the first things killed when Jobs got back to Apple.


> Jobs was in the business of selling computers that looked (and worked) good to people who would otherwise hate computers. Dealing with geeks was always (and still is) a necessary evil, so he'd have enough of an ecosystem to sell to "normies".

NeXT contradicts that.

Though, I like how you mention he always wanted to be a "better Sony." That's definitely on point.


Surely Apple recognizes “*nix-sphere web software developers who want a nice laptop” as one of their target professional markets in the OSX era, too. That’s sold a hell of a lot of MacBooks. It’s developers of software for their own platforms that Apple has long had a tense relationship with.

The original iMac hardware specs were also pretty reasonable for when it came out, no?


> Most of the crap told on Apple nowadays are complete memes from the second wave of Apple cultist (most of them arriving with the iPhone) that completely ignore the true history of Apple and how it got to launch such successful products.

Apple Watch, Apple TV and HomePod would like a word.


To extend this metaphor: one thing to note is that Jobs wasn't the guy doing the magic. That was Woz. Jobs was the priest who wrote the rules about what magic is and isn't OK.

And now you know why I call Tim Apple the iPope.


At the time of Jobs, apple's stance about security was mostly marketing as well.

Remember all the times when a computer could be compromised via a bug in the jvm that was supposed to safely run the java applets?

Normally it would be fixed immediately on linux and windows, and take months on osx because apple had their own jvm (that had the same bugs because it was just a fork).


I’m not convinced that it’s a “trick.” Do you genuinely believe that iPhone customer satisfaction will not go down if sideloading and/or third party app stores are supported? For me, it’s impossible to imagine that this is the case.


I'd imagine that for the vast majority (>99%) of users, it would stay exactly the same. You can download installers (a la any desktop/laptop) or go through a repo/store of your choice on Android and very, very few outside of tinkerers or techie types bother. Out of all my friends and family, I've yet to find a single other person with F-Droid installed or who downloaded an APK direct from a developer's website or github.


Sounds like apple should be liable for any damages from malware or malicious software that does make it on their platform.


Someone needs to ask Apple the same thing I've always been repeating: why can I visit pretty much any website with a recent browser and be safe, but can't run a native app in the same way? Hell browsers have bluetooth, USB, FS, etc access now as well.

What, their shitty app sandbox isn't all that good or something? Methinks the real reason is money.

But tbf, even though I can install APKs on Android I don't really do that as there's still the fear of bad actors; maybe the Android sandbox is safe & secure but I don't _know_ that, they haven't _told_ me explicitly about it. And if it's not safe for Android too, then why not?


> Someone needs to ask Apple the same thing I've always been repeating: why can I visit pretty much any website with a recent browser and be safe, but can't run a native app in the same way? Hell browsers have bluetooth, USB, FS, etc access now as well.

> What, their shitty app sandbox isn't all that good or something? Methinks the real reason is money.

Or maybe just because designing a good sandbox is really hard. Look at snap packages on linux. They're one of the most common way of sandboxing linux apps and come with significant limitations compared to unsandboxed software.


Yeah a lot of these questions are just obviously bad-faith and wouldn't be made in any case except for the fruit company. It's intentionally dragging down the discourse with dumb bullshit.

"selinux had an escape once therefore it's useless!" no, that's not how that works and you know it.

"gatekeepers should have an obligation to interoperate with third-party systems!" oh so google needs to run open SMTP relays to allow third-parties to build commercial operations on google's infrastructure and send mail to google's users? google needs to not block unwanted commercial solicitation from third-party operators because they "have to interoperate"?

etc etc

in this case - ctrl-f for "sandbox" and virtually every single one of the comments is some variant of the same obviously bait/flamewar comment.

https://news.ycombinator.com/item?id=39143802

https://news.ycombinator.com/item?id=39141456

https://news.ycombinator.com/item?id=39140427

the discourse is always really bad in these threads and frankly a ton of it is android users who can't help but roll in the shit and sling insults constantly ("apple sheeple who only care about blue bubbles", etc) and we've completely normalized them acting out (both as a society and here on HN) for some reason.


Lmao, salty much. I literally pointed out the same issue for Android as well; there is a sandbox, can I trust it and if not then why not?

The discourse is on why we accept that browsers can sandbox websites but we can't place the same amount of trust in sandboxing of apps and historically Android has been better at that than Apple because they actually allow you to do it in the first place, the caveat being that it's not really made clear if this is "safe" or not.

Apple is one step behind Android on this but they're _both_ many steps behind making it transparent to the user that "installing any app from anywhere is as safe as visiting any random website".


> Someone needs to ask Apple the same thing I've always been repeating: why can I visit pretty much any website with a recent browser and be safe, but can't run a native app in the same way? Hell browsers have bluetooth, USB, FS, etc access now as well. > What, their shitty app sandbox isn't all that good or something? Methinks the real reason is money.

That’s not really the point. On the Web you have a single google.com, and on the AppStore you have a single "Google" app. If you allow multiple sources for apps you break this idea of a unique registry and allow anyone to create an app named "Google" or any other well-known brand. There’s no way of ensuring the "Google" app you’re looking at is the genuine one anymore.


I mean surely that's solvable in a similar way that it was for websites, ie SSL+certs registered to domain x. Can the OS (Android, iOS) not have a provision to show who any app is really from in the same way that I can see right now that: "Y Combinator Management, LLC. issued by Digicert"?

Unfortunately it's not really perfect solution for the web either as plenty of people still get scammed by fake urls + not bothering to check who the cert is for/from...


I mean to be fair, we criticize google for the opposite with their extensions and app store.

And now they cracked down on small developers to revert that. So it's not a totally invalid point from Apple.


Apple’s App Store has more choice, quality, and innovation than Android does; yeah, there are other factors at play there—but it’s a bit brash to accuse people of understanding nothing when, in the case of mobile app stores, you’re arguing from imaginary evidence.


>Apple’s App Store has more choice, quality, and innovation than Android does

>you’re arguing from imaginary evidence

Thanks for the laugh.


That’s literally because Apple won’t let apps compete. If someone posts an app before you that is to similar to what you post, they will tell you no.


Apple has more choice because it won't let apps compete?

> If someone posts an app before you that is to similar to what you post, they will tell you no.

search "2048 game" and let me know how many similar games they said no to.


It’s a self-fulfilling prophecy. If you force people to differentiate to compete, then there will be more innovation and diversity. That also means there’s less incentive to create “yet another journaling app” because you don’t know what is “too similar” for the reviewer. (Real example: “you can’t list this because it has a similar feature to X” rebuttal: “X has many features, but we are focusing on simplicity and this feature is our only feature we intend to support. For privacy, we won’t sync or do any of the other fancy things X does.” Their final response: “it’s still too similar” — all paraphrases). In order to compete in established verticals, your app has to be nearly feature complete and “different enough” as well as be completely polished. This is quite a gamble when starting out.

> search "2048 game" and let me know how many similar games they said no to.

I don’t know how old the rules are for this. I just know it currently exists. Also, it’s possible that a number of them were submitted at the exact same time and there was a race condition allowing the market to be flooded.


This is a weird premise overall. Aren't both positions nonsense?

People test an app out on Android. If it works, they will make an iOS app.

That would make innovation across mobile devices, not android/apple. Wouldnt it?


Android is even more expensive (in time, and money) to get up and running, these days.

For example, they force you to go find your country's D-U-N's number provider, which usually costs time and money -- unlike the US, where looking up your own number is free. Then they verify it. Apple just looks it up for you, for free.

When you register as a person, Apple just requires basic supporting documentation and doesn't require a real device. Google requires that you have a specific brand of device in-hand to sell an app, and won't let you use smaller, less known brands (at least in the US, even if the brand is popular where you live). This means you need to drop nearly $1,000 USD on a phone, just to make a free app. Apple is $99, all-in.

The play store (for me) was approx 955 + 25 + 15 to get an app listed.

So no, Apple is probably a less expensive gamble. Especially if you already have access to a mac (rented or paid).


Fair points. It sounds like perhaps your position is more against their opaque and inconsistent application of their policies than the policies themselves which I can agree with.


I’m against the policy itself. If I’m running a flea market, I don’t want it full of hot dog stands. That’s because there is only so much physical space. If I search the App Store for hot dog stands, the space is unlimited. There’s so much they could do there (a/b testing similar apps to find the “best ones” like YouTube, comes to mind). Since there’s no competition, they don’t innovate nor do they see that the old rules don’t and shouldn’t apply. Their search is so bad, it’s a miracle people don’t install malware.


Have you even ever visited the Android play store? I use both and the difference is night and day, and not in a positive way for Apple.


I only use iOS and know way too little about Android. I was under the impression that iOS had more quality apps than Android, just based on personal experience of (quickly and sloppily!) using Android apps. Could you give a few examples of the quality Android apps that are missing on iOS? Would be fun to check out.


The quality overall on iOS is way better than Android. There are obviously going to be a few outliers but I’ve worked at multiple companies where Android is an afterthought (in every way imaginable). I’ve also heard the same from peers in the industry.

iOS apps bring in more money and that absolutely shows in the time and effort companies put into their apps. The big names (FAANG) might have equality but once you leave the top apps the quality difference can be stark.


I'm specifically not talking about the apps, but the stores themselves.


So what? That's entirely irrelevant to the point being made.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: