Apple claims 'sideloading' apps is 'serious' security risk

https://www.bbc.com/news/technology-57597349

by frumper • 5 years ago

16 24 5 years ago

frumper4• 5 years ago

Something has to give. Apple controls what apps are allowed, how those apps behave, how those apps operate and then point to the web as the alternative, which they also control the only browser they allowed on the system. Then stories like https://www.theverge.com/2021/6/11/22528701/apple-rank-own-a... show why all that power concentrated has already lead to anti-competitive behavior. While I don't think there is a single perfect solution, I do think that if they don't flex in some of these areas that the governments of the world will break them.

jsnell• 5 years ago

https://news.ycombinator.com/item?id=27565002

https://news.ycombinator.com/item?id=27603849

anonymousiam• 5 years ago

Sideloading has worked well for Android. Users are not idiots and there are enough warnings so they know that they should not sideload an application unless they really know what they're doing.

Apples argument serves Apple's 30% interest in iTunes revenue and removes the choice from the user.

grawprog2• 5 years ago

That's how they get you. First you sideload one app, you think you can stop with just one, then next thing you know you've got F-Droid on your phone, your sideloading left and right. Then before you know it, all your money now belongs to a Nigerian Prince and hackers are ransomwaring your grandma.

Yeah kids sideloading might seem fun, but it's a gateway to disaster. Just say No to sideloading.

frumper4• 5 years ago

It sounds like we need to get the hackers to ransomware the Nigerian Prince's grandma.

cyanydeez2• 5 years ago

hey man, sideloading is just the start, next thing you know theyll be saving progressive webapps and never leaving their browsers!

threatofrain2• 5 years ago

Something troublesome to people who worry about privacy would be FB asking people to side-load, which in a sense they did when they bought a VPN and asked kids to grant all access to network traffic [1]. Kids will ignore warnings, and they are thought to be savvier than their folks. Kids are the ones who will download games that basically train you to love ads.

And Apple doesn't collect revenue from FB, but FB is probably the heaviest in its weight class. If FB asks, parents will say yes. If Fortnite asks, children will say yes.

[1] https://techcrunch.com/2019/01/29/facebook-project-atlas/

rektide2• 5 years ago

it's amazing to me how much imagination & concern people put in to 0.000001% of side loading cases.

if a computer is a bicycle for the mind, these people insist we go out fully padded, with front & back training wheels, walk our bikes up & down hills. never exceed 10mph or your eyeballs might pop out.

building a smarter culture able to avoid dangerous & bad forms of computing seems much more like the end I think we should spend time promoting. give people choice, visibility, and an ambient social network that can help provide background & discussion around the tech you've started dabbling in, that can warn you.

frumper4• 5 years ago

Parents would say yes to Facebook because it has a reputation. If Shadybook wants you to side load then you're not doing it because you don't know what it is, you don't already have an account outside of iOS garden, and likely will never hear about this company to even install it. It only works for Facebook because they are big enough to establish the relationship outside of Apple's walled garden.

I'm not sure what security concerns Fortnite might have either. It's a billion dollar game with a solid reputation. They're not going to start ringing up your credit card with fraudulent charges, and if they did then it would make the news and tarnish that reputation.

People interact with many companies outside of the iOS ecosystem just fine.

cyanydeez2• 5 years ago

it serves their entire ecosystem, what next, users loading PWA and bypassing their entire ecosystem? heave fordbid!

apple is like the malevocence of hardware software walled garden, they make it easy to do what makes them tied to the platform and e erything else a struggle.

maxharris• 5 years ago

Simply allowing sideloading is the best solution because it disrupts users the least while maximizing their freedom. Web apps are not the answer because they will never cut it for every use case (even if that use case is just the installation of a non-Apple browser engine).

jnwatson• 5 years ago

This would be evidence that the last 50 years of OS research is for naught.

If we can't run two apps at the same time, and have some confidence that the interaction between those apps is constrained, why in the world did so many computer scientists and engineers spend all this time on permissions schemes and information flow control?

api2• 5 years ago

Why is it not a risk on MacOS?

Answer: the MacOS customer base expects a computer they can run stuff on, and would not tolerate it without defecting.

klipklop2• 5 years ago

They are slowly moving in the direction of only letting you run apps from their app store. Look at all the warnings and prompts you get if you try to run a program you downloaded outside of it.

frumper4• 5 years ago

This is definitely my fear for the future of MacOS, though it will likely cause me to just get an iPad and a windows computer instead.

mcphage• 5 years ago

They're not pushing you in the direction of running apps from their store, but they are pushing in the direction of having apps be notarized: https://developer.apple.com/documentation/security/notarizin...

api2• 5 years ago

For many years the secret incantation to run an unsigned app is right click open twice in a row and confirming at the warning. “Run this… yes, and I really mean it!” Once you do this once it remembers and opens normally. This is still the case in Big Sur and on the M1.

This idiom is fine with me. It’s easy to remember but kind of hidden from the non-technical. It also forces you to think a little which protects from accidentally launching an unsigned app.

An alternative idiom that would work would be a red warning and requiring the user to type “YES.” This is also common in non-reversible delete dialogs.

threatofrain2• 5 years ago

MacOS is arguably much more unsafe than iOS, which is a concern of mine as I imagine Apple will eventually answer the question of integrating your health and finance data on MacOS.

klipklop2• 5 years ago

At the very least they should let you self sign and run applications you built yourself. I feel that is enough barrier to entry to keep Grandma from sideloading a virus.

I just wanna build and run RetroArch dammit.

makecheck• 5 years ago

I remember going on vacation away from my computer and discovering my own app failing to launch after a few days. I guess I had tended to rebuild and reinstall it so often that I never saw their signing expire before.

It is pure crap that Apple has any ability to prevent you from running software you created and installed yourself.

kolyaio• 5 years ago

I think this is just an excuse to keep users locked to the App Store. Yeah, it could be more secure to some extent but Apple’s walled garden isn’t unbreachable. There were cases that scum and fraud entered the stores.

I’d say that Apple’s approach makes the users more ignorant of security issues. Because they assume that their device 100% which isn’t possible.

I don’t understand why they are limiting the advanced users so much ? If I bought iPad Pro that means I am an advanced enough user to know what kind of apps I need and I can avoid problematic apps. The iPad Pro has Mac level CPU - M1 Chip. Why shouldn’t users be able to leverage it fully ?

Programming isn’t really possible on a iPad just because of this BS

Also, a lot of the features iOS got are inspired by the jailbreak community. And even on macs there are apps that really offer big improvements to usability like bettersnap or bettertouchtool.

Apple claims 'sideloading' apps is 'serious' security risk

Related Stories