Google offers 'short term fix' to help ad publishers bypass Apple's iOS 9 security protocol

124

Comments

  • Reply 61 of 81
    tmaytmay Posts: 6,453member
    Quote:

    Originally Posted by Gatorguy View Post





    IMHO people aren't as willing to pay for what they want content-wise as you may think. I recently "cut the cord" for cable. In my research on how to go about it I came across numerous questions about how to get certain pay services for "free", essentially stealing the content. In fact a recent article I read claims cord-cutters on the whole are a cheap lot, looking for any way possible not to pay for play.



    IMO not only are folks becoming less willing to suffer ads in order to receive valuable content, they aren't willing to pay much money (if at all) either. Quite a conundrum for content providers. Should we all simply pay some dollar amount each month to access websites and blogs? Perhaps we should be paying some amount beyond the carrier each month just to access the internet?



    If you can't afford to pay that access fee will the poor become even less informed about ways to break free of their condition in life?

    I don't think cord cutters are necessarily the same set of persons as pirates. Cord cutters implies previous Cable subscription, and those same people had opportunities to pirate then as now. Has it gotten easier to pirate today?

     

    I think that there's a market for a more granular, shorter subscription cycle, that is encouraged by high quality original content like HBO GO. Myself, I would be more inclined to supplement Netflix and Amazon Prime with short stints of HBO GO, in rotation with Showtime and others with original content, For example, a month of Netflix plus HBO GO would be just under $24.00. Of course, this assumes that you have some sort of broadband connection which could be quite expensive.

     

    I count myself as one of the binge watchers of Netflix, and I expect that the cord cutter paradigm fits them to a "T".

  • Reply 62 of 81
    tmaytmay Posts: 6,453member
    Quote:

    Originally Posted by konqerror View Post

     

     

    Very simple. If you are compiling your app for OS X 10.11 or iOS 9, your app cannot access any non HTTPS site by default. If you want to access an ordinary HTTP site, you must exclude it or disable ATS completely. (Subtlety: your HTTPS site must comply with the latest standards, TLS 1.2, have a modern certificate and the highest security cipher suites, or else it will be blocked)

     

    Not all of Google's ads are served over HTTPS because they sell the ads from a large number of sources.

     

    A large number of apps must disable this feature. As an example, an app that wants to read AppleInsider would have to because HTTPS is broken on this site.


    I read (on the Apple dev site)  that you can create a plist of exceptions. Not ideal, but better.

     

    See the link in the Google blog update.

  • Reply 63 of 81
    afrodriafrodri Posts: 190member
    Quote:

    Originally Posted by eightzero View Post

     

    I do see some sort of reckoning coming. Google doesn't actually make anything, and yet are one of the most lucrative corporations on the planet. Still, banks and financial institutions were established centuries ago, and they are hugely lucrative even though they actually make nothing. But economics is only one of many things in this world I don't fully understand.


     

    This is a trend an ancient trend – as a species, fewer people are "making things" (e.g. manufacturing or growing crops) and more people are involved in services. Doctors, nurses, and people working retail don't 'make' things, but healthcare and retail are the largest employment categories in the US.  As we get more specialized, some of the services that people provide (like serving ads, the finance sector, analyzing film theory, abstract mathematics, HR management, etc...) are very removed from any end consumer, so they appear baffling, but can often be quite valuable or may payoff on a longer time line. I'd even argue that Apple doesn't really add value by "making things" – they primarily outsource the actual manufacturing. What they provide is design of hardware and software and management of infrastructure.

     

    So, there may be a reckoning coming, but I'd argue it is in the other direction – industries that manufacture physical objects will continue to decline as a percentage of "what humanity does" just as hunting, gathering, and agriculture have declined. They will always be there, but fewer people will be doing them.

  • Reply 64 of 81
    mstonemstone Posts: 11,510member
    Quote:
    Originally Posted by konqerror View Post

     

    A large number of apps must disable this feature. As an example, an app that wants to read AppleInsider would have to because HTTPS is broken on this site.


    The SSL issue on this site is a common problem. Many organizations use CDN (content delivery networks) and often they are running on Nginx or Apache, both of which have an issue of running multiple SSL certificates in virtual hosts. It can be done on a single IP using names instead of IP address to map host directories, but most providers, and clients as well, don't like to do that. They would rather have their own IP because if they happen to be sharing with a company that gets blacklisted then they get black listed as well.

     

    In this case, AI forums is hosted by Fastly Inc. and that is the SSL certificate used on the server. AI cannot serve SSL content because of a domain name mismatch with the certificate. You can get around the problem by using VMs  (virtual machines) instead of virtual hosts, but those are complicated to set up and manage. It is an ongoing issue that really needs to be fixed at Apache. This is one area where Windows server gets it right compared to UNIX.

  • Reply 65 of 81
    Quote:

    Originally Posted by mstone View Post

     

    The SSL issue on this site is a common problem. Many organizations use CDN (content delivery networks) and often they are running on Nginx or Apache, both of which have an issue of running multiple SSL certificates in virtual hosts. It can be done on a single IP using names instead of IP address to map host directories, but most providers, and clients as well, don't like to do that. They would rather have their own IP because if they happen to be sharing with a company that gets blacklisted then they get black listed as well.

     

    In this case, AI forums is hosted by Fastly Inc. and that is the SSL certificate used on the server. AI cannot serve SSL content because of a domain name mismatch with the certificate. You can get around the problem by using VMs  (virtual machines) instead of virtual hosts, but those are complicated to set up and manage. It is an ongoing issue that really needs to be fixed at Apache. This is one area where Windows server gets it right compared to UNIX.


     

    Huh? Your suppositions are completely wrong.

    https://en.wikipedia.org/wiki/Server_Name_Indication

    This problem has been solved on anything newer than IE6.

  • Reply 66 of 81
    tmaytmay Posts: 6,453member
    Quote:

    Originally Posted by afrodri View Post

     

     

    This is a trend an ancient trend – as a species, fewer people are "making things" (e.g. manufacturing or growing crops) and more people are involved in services. Doctors, nurses, and people working retail don't 'make' things, but healthcare and retail are the largest employment categories in the US.  As we get more specialized, some of the services that people provide (like serving ads, the finance sector, analyzing film theory, abstract mathematics, HR management, etc...) are very removed from any end consumer, so they appear baffling, but can often be quite valuable or may payoff on a longer time line. I'd even argue that Apple doesn't really add value by "making things" – they primarily outsource the actual manufacturing. What they provide is design of hardware and software and management of infrastructure.

     

    So, there may be a reckoning coming, but I'd argue it is in the other direction – industries that manufacture physical objects will continue to decline as a percentage of "what humanity does" just as hunting, gathering, and agriculture have declined. They will always be there, but fewer people will be doing them.


    Apple doesn't "simply outsource" manufacturing; they are intimately involved in developing the process and often procuring and implementing equipment and tooling to provide to the contract manufacturer. 

     

    Have you ever considered that these same services that employ a lot of people may be inefficient and ripe for disruption? Manufacturing here in the United States is actually on an upswing and we have 22% or so of world manufacturing share, but because of productivity improvements, you won't see a lot of employment increases over time.

  • Reply 67 of 81
    mstonemstone Posts: 11,510member
    Quote:

    Originally Posted by konqerror View Post

     

     

    Huh? Your suppositions are completely wrong.

    https://en.wikipedia.org/wiki/Server_Name_Indication

    This problem has been solved on anything newer than IE6.




    Did you happen to read the part of my post that mentioned that as being undesirable because it uses the same IP address for all shared hosting websites?

  • Reply 68 of 81
    afrodriafrodri Posts: 190member
    Quote:

    Originally Posted by tmay View Post

     

    Apple doesn't "simply outsource" manufacturing; they are intimately involved in developing the process and often procuring and implementing equipment and tooling to provide to the contract manufacturer.


     

    I never said they "simply outsource" – Apple's involvement in developing the process and providing tooling is well known.  The point is, there are very few Apple employees who are directly manufacturing things (i.e. sitting on the assembly line) - Apple provides services such as the design and engineering, which is generally the more lucrative activity.  Hence why Apple's margins are closer to 30% and Foxconn's to 3%.

     

    Quote:


    Have you ever considered that these same services that employ a lot of people may be inefficient and ripe for disruption? Manufacturing here in the United States is actually on an upswing and we have 22% or so of world manufacturing share, but because of productivity improvements, you won't see a lot of employment increases over time.


     

    Of course - services are being disrupted all the time. And we are producing more and better stuff all the time, but with fewer people. Just as we (humans) produce more food than before even though fewer people are actually farmers / hunters / fishermen. The point is, the trend is towards fewer people directly "making things" and more people providing services.

  • Reply 69 of 81
    The article is BS, and should have been taken down once the original authors were told by many (including myself, I am an apple dev) that Apple told developers how to disable this encryption before Google did, at a session at Apple%u2019s WWDC event, and even has the instructions on their developer website. Apple Inside should explain this and update the article like most other sites have done.
  • Reply 70 of 81
    It has now been shown that Apple told developers how to disable this encryption before Google did, at a session at Apple%u2019s WWDC event, and even has the instructions on their developer website.
  • Reply 71 of 81
    sjksjk Posts: 603member
    iqatedo wrote: »
    Google showing its true colours?
    Maybe you mean its true letters? ;)
  • Reply 72 of 81
    revenantrevenant Posts: 621member
    Quote:
    Originally Posted by cnocbui View Post

     



    How on earth did you manage to get all that out of Apple for free?  To get that stuff, I've had to spend thousands!  I feel absolutely cheated now, except for the Beats, which were priced about right.




    iOS and OSX releases have been free for some time now (unlike microsoft). the new iWork has also been free for a spell (thankfully not subscription based like microsoft). I just recently purchased a new macbook pro under the educational discount, as professors are allowed like their students, and I saved quite a bit of money that way. The beats headphones i am probably going to sell, because i already have a very decent pair of headphones and in my eyes it will make the laptop cheaper.

     

    i suppose you are making the point that you had to buy a computer to get the operating system in the first place. but if apple is not charging for the new operating system, like they used to, then is it not free? I had a macbook pro 2009 for many years and enjoyed new operating systems without having to buy it, though, yes, initially i paid for the laptop. but it is stretching, even semantically, to argue that those new operating systems were not  free. 

  • Reply 73 of 81
    freerangefreerange Posts: 1,597member
    sflocal wrote: »
    I finished reading Google's ATS handling.  It seems to only be limited apps that communicate using nonsecure HTTP connections.  I hate Google in general, but even their paper says that they want people to start upgrading their apps to use encrypted HTTPS connections, and if that is done, everything will be fine and no "workarounds" will be needed.  


    Am I missing something?  It's more like Google is telling app developers to update their apps to be more current and secure.

    Of course you are missing something! If they sincerely want developers to upgrade their apps to be more secure, they should just tell them to do so immediately! NOT advise them on how to break the security feature! Classic google! Using the Android philosophy!
  • Reply 74 of 81
    freerangefreerange Posts: 1,597member
    tmay wrote: »
    The whole ad impression, click bait paradigm for funding web presence has created a sewage system of the internet, where information is propelled in a stream of excrement at huge inefficiency while we pay in bandwidth and the most precious commodity, time.

    You forgot the other precious commodity, screen space!
  • Reply 75 of 81
    gatorguygatorguy Posts: 24,566member
    freerange wrote: »
    Of course you are missing something! If they sincerely want developers to upgrade their apps to be more secure, they should just tell them to do so immediately! NOT advise them on how to break the security feature! Classic google! Using the Android philosophy!
    :facepalm:

    The bypass is made available by Apple rather than some Google discovery, and discussed in this Apple technote:
    https://developer.apple.com/library/prerelease/ios/technotes/App-Transport-Security-Technote/

    If Apple "sincerely wants developers to upgrade their apps to be more secure" then why offer a workaround? Is this classic Apple? Nope.
  • Reply 76 of 81
    Quote:
    Originally Posted by cnocbui View Post

     

    When Apple gives away it's products for free, do let me know.


     

    False analogy. Google does not give advertisement placement away for free to their customers. You* are not their customer. Your interests, page views, and clicks are what they sell to their customers. You are like livestock, getting "free food for life" from a farmer, thinking you are the farmer's "customer."

     

    *you = anyone using Google's "free" services

  • Reply 77 of 81
    gatorguygatorguy Posts: 24,566member
    False analogy. Google does not give advertisement placement away for free to their customers. You* are not their customer. Your interests, page views, and clicks are what they sell to their customers. You are like livestock, getting "free food for life" from a farmer, thinking you are the farmer's "customer."

    [SIZE=10px][SIZE=14px]*[/SIZE]you = anyone using Google's "free" services[/SIZE]
    Actually you are Google's customer. Well maybe not YOU. ;)

    Job #1 is make their services valuable to you. Valuable enough that you choose to be their customer. Remember that search came first. Finding a way to pay for it came secondary to that. If you're not happy with what Google offers you then ad revenue can't follow. Really no different from magazines or newspapers or websites that need to make sure their primary customers, you, enjoy their content so that they can make a living from their secondary customers like Ford, ATT, Apple, Proctor and Gamble, or others promoting their products thru advertising.

    Even then the ads Google delivers on their behalf rely on an anonymized identifier with nothing about the personal you monetized. "You" are simply a number lumped in a basket with others showing similar interests. Nothing I've read indicates they collect sensitive personal information for ads nor permit those using their ad services to collect anything of a highly personal nature either. Rather than opening a wallet to pay with greenbacks a whole lotta folks would prefer to trade some targeted ads for value. In fact I doubt even you would be willing to take a ten-spot from your bank account to take part here. "Free" is good for you too.

    The whole "you're the product" spiel is more a trite meme than anything IMHO. "You" are simply a code lumped in a basket with others having similar interests and demographics. Ads don't frighten me*. Why do they frighten you?

    *But the personal data aggregators serving the insurance and financial industries do.
  • Reply 78 of 81
    Quote:

    Originally Posted by Gatorguy View Post





    Per TBell "To help lazy developers sidestep security protocols" ?



    And "in reality"? I really do not understand why they allow this.

  • Reply 79 of 81
    gatorguygatorguy Posts: 24,566member

    And "in reality"? I really do not understand why they allow this.
    IMO Apple isn't yet ready to close the door for developers who haven't yet gotten around to making the necessary changes or have particular exceptions they need for whatever reason.
  • Reply 80 of 81
    john.bjohn.b Posts: 2,742member
    if Google actually cared about [B]security[/B], they'd draw a line in the sand and publish a date where [B]all[/B] ads on the Google ad networks must support https. No ifs, ands or buts. That they don't tells you everything you need to know, right there.

    This is just prioritizing revenue over security.

    And shame on Apple for allowing the "workaround " in the first place.
Sign In or Register to comment.