Apple's Arguments Against Sideloading on iOS: All Your Questions Answered

[toobravetosave]

PHA != side loaded apps. PHA == apps that they classify as potentially harmful (i.e., this survey is trying to put a number on how many devices have what they are classifying has potentially malware). This does not have a directly correlation reported for how many of those apps are side loaded or not.

I'd like to see some evidence of your claims.

actually google classifies all sideloaded apps as PHA

edit: so the number of sideloaded apps lies somewhere between 0 and the total amount of PHA

 

[Pro Apple Silicon]

I like how they have to make up a name for it like "side loading" which rings of hacking or bypassing.

The rest of world still just calls it "installing". Thanks.

 

[hans1972]

Let's be real here. This is about money and not security or privacy. They are afraid that the big game publishers are going to establish their own game stores and thereby circumvent in app payments. It's common knowledge by now that games and in app payments are the real cash cow on the app store.

If it's not about money for these game developers or the user's who support them but only about alternative distribution methods, let Apple charge 30% for any distribution method and allow Apple to rejects app even downloaded from other app stores and sources.

 

[ksec]

when has apple ever pulled out of a market on some make believe principle you think they have? they only care about money

But that is what MR comments have suggested for years, and repeatedly.

And Apple cares about its user and privacy. It is a fundamental human right. They are doing it for their user.

At least that is what many comments on MR have suggested.

Yes there is an huge /s in case anyone not getting it.

 

[januarydrive7]

and here's the second part of your request

Play Store identified as main distribution vector for most Android malware

Mammoth research project using Symantec (now NortonLifeLock) telemetry confirms what everyone suspected.

www.zdnet.com

You're not helping yourself with these links:

But the research team pointted out that despite the large number of malware originating from Google's official app store, the Play Store had a small threat-to-legitimate app install ratio (VDR), with only 0.6%, leading researchers to say that "the Play market defenses against unwanted apps work," even if some apps slipped through the cracks sometimes. However, due to the Play Store sheer size, this slippage ended up dwarfing any other source.

If we are to ignore sheer numbers and take the VDR index as a a primary indicator for maliciousness, the research shows that users are more likely to install malware by downloading it from web pages via their browsers or from alternative markets.

The worst offenders are not from play store. Even though play store distributes more in comparison, the alternative download locations cause more damage (look at VDR).

 

[veena3]

If it's not about money for these game developers or the user's who support them but only about alternative distribution methods, let Apple charge 30% for any distribution method and allow Apple to rejects app even downloaded from other app stores and sources.

So, what would be in that case the benefit for customer or software developer? And is it really technically possible for Apple to know how much someone paid out of their system?

 

[toobravetosave]

You're not helping yourself with these links:

View attachment 1908223
The worst offenders are not from play store. Even though play store distributes more in comparison, the alternative download locations cause more damage (look at VDR).

and that's only possible by allowing access to install those apps via a toggle and that's acceptable to me for users to engage at their own risk just like a computer

 

[davidako]

If today Apple invented a way to charge 30% of sideloaded app revenue then Tim Cook would announce support for sideloading tomorrow.

 

[hans1972]

Then Apple should say that. It wouldn't take a big change in wording. Something like "Gatekeeper attempts to identify malicious code...". Their current wording is misleading.


I'm by no means defending the claims of every anti-virus program out there, I haven't looked at what their claims are vs what they actually do. I just find it misleading to say Gatekeeper ensures security when it suits them and then use that as a point against the Mac's security later.

If I say the seatbelt in your car will ensure your survival in a crash, I can't then claim that that same seatbelt is unsafe and you should expect it to fail.

Apple doesn't say it ensures security: "ensures that all apps from the internet have already been checked by Apple for known malicious code — before you run them the first time."

It only ensures the application being checked for known malicious code.

It doesn't ensure being checked for unknown malicious code.

 

[Red Menace]

You have had the ability to build anyone’s app from source and sideload for years. Of course, that turned into a **** show when everyone started trying to sneak stuff in and pull their usual crap, so now it is pretty much useless.

I expect the same thing to happen here, since the bigger data miners/scammers will be getting involved. Of course, it will turn into a **** show when they start pulling their usual crap, so it will eventually become useless (unless you are talking about web apps, which will most likely be the result when everything gets tossed).

 

[januarydrive7]

actually google classifies all sideloaded apps as PHA

edit: so the number of sideloaded apps lies somewhere between 0 and the total amount of PHA

Go look at the data sources you sent from https://transparencyreport.google.com/android-security/overview.

When PHA sources are given, it's only talking about from the Google Play store. The argument they are giving is that updating Android protects you when you download from the play store, because the play store hosts some PHA. They don't account for side loading at all in those data sources.

A reasonable inference could be that there is minimal PHA on the play store --- there is an unknown amount from outside the play store. However, if there is minimal on the play store, and other reports are true, then there is a lot outside of the play store.

Also, this still doesn't say how many people actually side load.

 

[Naraxus]

Smh. How much did Apple pay you for this pr Macrumors?

 

[boss.king]

Apple doesn't say it ensures security: "ensures that all apps from the internet have already been checked by Apple for known malicious code — before you run them the first time."

It only ensures the application being checked for known malicious code.

It doesn't ensure being checked for unknown malicious code.

That's fair, I do seem to have misread that.

 

[januarydrive7]

and that's only possible by allowing access to install those apps via a toggle and that's acceptable to me for users to engage at their own risk just like a computer

It's only possible because there's the possibility to side load these apps.

 

[makitango]

Thr biggest danger is still apps with questionable ToCs as in regards to their use of your contacts book. Basically, all our data are spreading legs at the grace of other people‘s privacy settings. No matter if sideloaded or not.

 

[hans1972]

yep!

this article details how "the report shows that 0.09 percent of devices that only run Play apps have PHAs on them, while 0.61 percent of devices that also run apps from third-party locations have PHAs."

here's the article as well as the android security report the information is from

Google Data Shows Tiny Fraction of Android Devices Run Malicious Apps

A new transparency report on Android security shows that far less than one percent of all devices have a potentially harmful app running on them.

duo.com

Google Transparency Report

transparencyreport.google.com

What Google considers harmful it pretty different from what I consider harmful.

Example: app who records your phone calls with the user's knowledge.

I consider it harmful, Google not.

 

[Villarrealadrian]

It's not about people's safety, if that were true they would've banned Facebooks apps long time ago, it's all about the revenue services generate to apple lets stop acting dumb...

 

[hans1972]

So, what would be in that case the benefit for customer or software developer? And is it really technically possible for Apple to know how much someone paid out of their system?

We shouldn't care about the software developer. So any argument which relies on benefitting a developer is an argument I reject.

Apple would have to contractually have the right to audit all the developers. I mean if the developers don't care about money, why would they even care?

 

[xazac]

Please, twitt the following message from your Twitter profile

@USSupremeCourt @SenateFloor I don’t want sideloading on iOS #KeepiOSfreefromSideloading @tim_cook @Apple

 

[Biro]

The people who want to be able to sideload with iOS are never going to be convinced. Frankly, I suspect many are pursuing this out of sheer vindictiveness toward Apple. Others are doing so strictly for selfish reasons with no regard to what it might mean for others in the Apple ecosystem. But know this - once the cat is out of the bag, there's no putting it back. Once malware begins turning up on Apple devices as it does now on Android products, it'll all be over. And I'll go back to a flip phone.

 

[jdphoto]

I‘d be happy to allow side-loading if I could be sure none of the apps I use would take down their app store versions and force users to side-load. If all apps were made available from the app store as well as through other means, side-loading would introduce more choice. However, realistically users wold have to side-load many apps by companies that don’t like apple’s restrictions.

Point and case: I have to use zoom, but would never want to install a non-AppStore version. That’s why I zoom exclusively form my ipad instead of my mac. I they could, zoom would defiantly bypass the app store.

It's precisely this for me. Though I'd also expand to having to ensure that if a developer offers an app both in their store/a 3rd party store and in the App store then they are liable for the apps having identical features and functionality. That way they can't put a "slimmed down" version in the App Store but you have to go to them to get the full featured version.

 

[dba415]

The people who want to be able to sideload with iOS are never going to be convinced. Frankly, I suspect many are persuing this out of sheer vindictiveness toward Apple. Others are doing so strictly for selfish reasons with no regard to what it might mean for others in the Apple ecosystem. But know this - once the cat is out of the bag, there's no putting it back. Once malware begins turning up on Apple devices as it does now on Android products, it'll all be over. And I'll go back to a flip phone.

Please return your iMac 5k Retina then. It's running a dangerous OS littered with Malware, that's according to Craig F himself!

 

[januarydrive7]

The people who want to be able to sideload with iOS are never going to be convinced. Frankly, I suspect many are persuing this out of sheer vindictiveness toward Apple. Others are doing so strictly for selfish reasons with no regard to what it might mean for others in the Apple ecosystem. But know this - once the cat is out of the bag, there's no putting it back. Once malware begins turning up on Apple devices as it does now on Android products, it'll all be over. And I'll go back to a flip phone.

The funny part is there is a lot of overlap with those who scream and yell whenever the topic of CSAM scanning comes up.

 

[SamRyouji]

The important part of that process however is eventually those scam apps are removed. Side loading means users will download apps they are never aware are scams and will keep using those apps. None will tell them its a scam app and those apps will stay online for users to keep downloading.

Any system will eventually accidentally let something bad through. Whats important is the system keeps at it and adapts.

Rightfully agree. But as from Epic vs Apple trial docs revealed, Apple has admitted in their internal emails that they're short on App Store reviewers team. If that's so, it's very logical to add more competent reviewers to keep those scam apps at the bare minimum.

 

[Mockletoy]

During his testimony in the Epic Games trial, Craig Federighi explained why a similar security apparatus couldn't be ported over to iOS. First, Federighi notably admitted that macOS has a "malware problem" and that Apple finds the level of malware on macOS "unacceptable." Federighi is implying here that the macOS security model is not a perfect system and that it doesn't want to implement a system that yields "unacceptable" results, in its eyes, onto iOS.

Federighi went on to say that iOS "has established a dramatically higher bar for customer protection" and that as of May of 2021, macOS is "not meeting" that bar. While Apple built the iPhone from the ground up under the curated App Store model starting in 2008, the Mac's longer history which long predates that app distribution model has required more flexibility.

And so they begin laying the groundwork for locking down the Mac. I mean, morally and ethically, according to everything they've said, how could they not?

They've flatly stated that sideloading is the criminal's best friend, so how could they in good conscience continue to allow it on one of their platforms?