Epic Games expert says iOS could be like macOS without security drawbacks

AppleInsider · May 14, 2021 11:32PM

An Epic Games expert witness laid the groundwork for an argument that Apple could make iOS more like macOS in terms of app distribution and third-party access without suffering in security.

Credit: AppleCredit: Apple

During his testimony on Friday, Harvard University Computer Science Professor James Mickens laid out the differences between iOS and macOS to Judge Yvonne Gonzalez Rogers. Some of the key areas of distinction include security, app distribution, and third-party app access.

For example, Mickens says that Apple's App Review process provides negligible security benefits over iOS's built-in defenses. That's because of mechanisms like sandboxing, which prevents app from interacting with other parts of the system.

At another point, when asked by Judge Gonzalez Rogers whether iOS is more secure than macOS, Mickens said that he believed it's not "meaningfully more secure."

Additionally, Mickens said that opening iOS to third-party app stores would not have a "meaningful difference on the security experience." If Apple opened up iOS, it wouldn't prevent users from only obtaining apps from the App Store, he added.

In response to the third-party access comment, Judge Gonzalez Rogers said that Mickens had "made a good point," but noted that she's concerned about the numbers.

At other points during his testimony, Mickens said it would be trivial to port security features like malware scanning and notarization to iOS.

Mickens' testimony defends a crux of Epic Games' argument against the iOS App Store. Epic notes Apple says both iOS and macOS are safe and secure, though Apple does not enforce the same restrictions on Mac. This seeming disconnect could undermine Apple's claims that security and privacy are at the heart of iOS App Store rules.

The Harvard University professor is slated to give additional testimony on Monday.

Stay on top of all Apple news right from your HomePod. Say, "Hey, Siri, play AppleInsider," and you'll get latest AppleInsider Podcast. Or ask your HomePod mini for "AppleInsider Daily" instead and you'll hear a fast update direct from our news team. And, if you're interested in Apple-centric home automation, say "Hey, Siri, play HomeKit Insider," and you'll be listening to our newest specialized podcast in moments.

Xed · May 14, 2021 11:35PM

Making iOS like macOS has been and will always will be the worst idea.

rob53 · May 14, 2021 11:45PM

Idiot doesn’t know the differences. iOS always uses admin account while macOS has multiple user accounts with different privileges.

hackintoisier · May 14, 2021 11:48PM

He’s right. macOS is much more open in terms of how users can install apps, and yet the Mac isn’t crawling with malware, unlike windows. Also, if iOS is opened to allow third party app stores, nothing would require users to download apps from those other stores if they didn’t want to. I’ve had an iPhone since 2007, but I recently started toying with android, and I’ve never used any other App Store besides the google play store even though others exist.

I think Apple is exerting too much control. For example, why is it that Netflix or any other app can’t tell me where and how to sign up for a subscription (if those apps don’t use IAP)?

When the iPhone ecosystem was small, Apple’s level of control wasn’t really on anyone’s radar, but as the iOS ecosystem has ballooned to billions of users and billions of dollars of trade, I can see why governments and courts around the planet are interested in how the ecosystem operates.

Others might disagree, but my view is Apple is in some ways restricting trade by disallowing the existence of other app stores. And the restriction of trade is why I believe it’s just a matter a time before the hammer drops, whether in the USA, or Europe or elsewhere.

Xed · May 14, 2021 11:55PM

So you're asking why a store wouldn't want to allow a product to lead them to another store where products are potentially more profitable for the seller? Have you ever seen TV at BestBuy advertise about buying the same TV at Walmart to save a couple bucks? Not only have I never seen that it's a ridiculous idea to think that Sony could advertise cheaper prices at Walmart from within a Best Buy.

Do you know what I do when I want to save money on a purchase? I look for discounts instead of just expecting them to manifest, but maybe that's me and my lack of entitlement speaking.

hackintoisier · May 15, 2021 12:05AM

I think you’re looking at this wrong. You say Best Buy should not allow the tv to advertise about Walmart while the tv is in the store. Fair point.

But you’re not talking about what the purchaser of the TV does with it AFTER they purchased it. Would you want Best Buy to have the power to tell Samsung or Sony (device manufacturer) that they’re restricted from allowing users to look at Walmart ads after they took the tv home? That would be ludicrous.

But yet Apple has the power to tell Netflix (app manufacturer) what users can do with the App AFTER we purchase/download the app? Once the app is on our phones, that’s akin to taking the tv home in my example above. That’s where your analogy breaks down in my view. Netflix should have the right to tell its users about subscription details, etc.

rob53 · May 15, 2021 12:32AM

we actually don’t own the apps we’re paying for. We’re paying for a license to use it. This has been discussed many times. Saying you can do anything with an app because you purchased it is missing the point of virtually all software. In many ways the iPhone is the same thing. Your paid for a product with requirements on how it’s used. This includes not jail breaking it, which is something you appear to like to do but your name.

Xed · May 15, 2021 12:37AM

And if that was a one-off purchase that would be fine, but since all the updates go through the curated store it's really just piggybacking on Apple for their support and infrastructure and then paying them their due once costs are involved. Do you think the store would work if everything was a $0 cost through Apple and then all other costs for the customer being deal on the side with a very clear conflict of interest while still always going through Apple for App updates? I don't see how it could.

That isn't to say that there's not an argument for saying Apple takes too high of a cut, but you haven't made that argument or factored in how much other stores take for the same or even less service. And let's not forget how much app stores charged before the Apple introduced the App Store for iOS.

Beats · May 15, 2021 12:49AM

Yeah. And I want Apple to develop an app that pays me $1 for every iOS user. I also want Apple to release a game controller. I also want Apple to build an Apple Store in my backyard so I don’t have to travel so far.

Problem is, Sweeney Turdd, WE AREN’T THE CEOS OF APPLE.

davidw · May 15, 2021 2:10AM

Apps like Netflix are bad examples. One does not "purchase" a Netflix app. It is available for free for anyone with an account. No matter which platform the account holder uses to pay for their subscription. The same with apps like Fortnight and Spotify. Every Netflix or Fortnight or Spotify account holder can use the Netflix or Fortnight or Spotify app on an iPhone or X-Box or PlayStation or Switch or TV Box or smart TV, without ever 'purchasing" the app on any the platforms. In order for the platforms to support those free apps, all they are asking is a commission from users that pays for their account using their platform.

You think it cost Apple, Google, Microsoft, Sony or Nintendo nothing to provide Netflix, Epic and Spotify to have their free app on their platform. Apps that depends on platforms whose owners invested billions of dollars in R&D to develop, maintain and update?

Epic or Spotify not wanting to pay anything to the owner of platforms that their free apps are on, for the access to those platforms customers, cost of R&D to develop those platforms and cost to maintain those platforms, would be like setting up a food truck in a McDonalds parking lot and then telling customers that purchase food from them, to go inside McDonalds is they need napkins, straws, ice, condiments, get out of the cold, to throw away their garbage or to use the restroom. What's in it for McDonalds?

You purchasing of a TV from Best Buy is also a bad example. When you buy a TV from Best Buy and take it home, Best Buy do not own the IP that the TV depends on, in order for you to view anything on it. On the other hand, Apple, Google, Microsoft, Sony and Nintendo owns the IP that makes their devices work and allows free apps from Netflix, Epic or Spotify, to exist. And you never ever purchase that IP.

genovelle · May 15, 2021 2:12AM

Is he and anyone else willing to put their home and financial future on the line to prove it? Android is the example and it is a horrible idea.

jungmark · May 15, 2021 2:18AM

safari still connects to the open web. Do a Google search.

App makers can Advertise too.

genovelle · May 15, 2021 2:18AM

People forget. Apple had about a third or less of the market and Android has most of the rest. Developers make far more money with Apple because of the very choices these idiots are trying to undo. Piracy is uncontrollable on Android because every popular app is cloned out of existence and Google can’t stop or even block them when complaints come, because it’s the wild Wild West.

hackintoisier · May 15, 2021 2:19AM

My argument isn’t whether the 30 percent cut is too high or low, I know that’s Epic’s argument. My hang up is with the restriction put into place on what Netflix (and other developers) can tell users.

Remember, Apple doesn’t actually restrict Netflix’s business model… of opting not to use in app purchases. The only thing Apple restricts is a notification from Netflix on where/how the user may sign up for a subscription. If the business model (of not using IAP) is allowed, then what’s point of disallowing a note to users of where/how to sign up for a subscription? The only thing that’s being accomplished in the end is confusion for the user.

If the loss of in app payments is hurting Apple’s ability to manage the App Store, it could raise its fees on developers of a certain size to recoup the costs. They can then bake the costs of doing business with Apple into their subscription fees and so on to ensure Apple gets its cut, and the developer earns a profit.

I also support the idea of other App Stores because there are developers out there with a different idea of what an app can be than what Apple may think. For example, Wi-Fi Explorer to analyze your radio environment so you can know which Wi-Fi channels to use and which to avoid. No such app exists in the iOS App Store. But they do exist on android and even on the Mac App Store. If people are willing to pay for such an app in an alternative App Store, why should Apple be allowed to restrict such trade? Such an app is not harmful, it’s actually helpful. This is the question governments are going to grapple with.

I know this is a hard question to deal with because of the potential for piracy, and porn which is harmful to children, and so on. I get it. It’s a very sensitive topic. But safari is a free app that can be used to access porn and other illicit content, yet it comes by default on the phone. From my point of view, on balance, I prefer a more open system.

We will see how this topic is resolved. Very interesting.

cpsro · May 15, 2021 2:56AM

iOS is much more secure than MacOS… and it needs to stay that way. It’s difficult enough to rid a Mac of crapware. Put that in a small touchscreen device (with all manner of sensors and cellular capabilities) and you’ve got yourself a hot mess. iOS also represents a target audience for malware roughly 20x larger than macOS.
No, Epic, it would not be nice if iOS was as vulnerable to malware and code pollution as macOS.

tenthousandthings · May 15, 2021 2:57AM

One fallacy in the testimony is that macOS and iOS are equal-value targets. They’re not. iOS is a high-value target, like Windows. I love macOS but it just isn’t in the same universe as iOS or Windows.

ericthehalfbee · May 15, 2021 3:27AM

Just proves you can go to Harvard and still be an idiot. Either that or he’s getting paid to say what Epic wants him to.

iOS isn’t “meaningfully more secure”. Based on what? There are significant differences between them and for him to minimize those differences as being “meaningless” shows his ignorance.

He’s also wrong about third party stores not affecting the security of users who choose not to use them. The mere act of opening iOS up to allow outside installs automatically makes iOS less secure. iPhone users will now get bombarded with links to encourage them to install this or that App. The reason mass targeting people works is that a small number fall for it. This vector doesn’t exist right now.

Third party Apps will almost certainly not be vetted the same (these stores will be operating on razor thin margins and won’t have the budget to) meaning that we’ll see things like SDKs with built-in tracking/harvesting used to suck as much data as possible.

He’s also ignoring privacy (concentrating only on security). This is an area that will be blown wide open with third party stores. If your friend downloads a shady App then any communication you have with them could now be intercepted. Your iPhone is “clean” but the other persons isn’t and because of that your personal information can be extracted. Apple also has many APIs that are available to enterprise developers, but not regular developers. Does anyone think third party stores will bother to check which APIs an App is using and if they’re abusing APIs that are only for enterprise users?

This guy isn’t really thinking this through.

genovelle · May 15, 2021 3:56AM

The problem with you analogy is that the app is built within apple’s store and its Apple’s advertising that got them there in the first place. If the developer has its own database of customers signing up with them directly in the first place because they did the work to attract them, Apple makes nothing on it. Remember 90% of Spotify’s subscribers are outside of iOS and pay Apple nothing. Almost all of the 10 Spotify pays only 15% to Apple on. That means they are just being greedy.

Rayz2016 · May 15, 2021 5:14AM

I live in a house.

I own the house outright.

But there are rules that state what I’m allowed to do to my house.
I cannot put up a fence around my front lawn (weird one). I cannot build a four storey extension in my back garden, even though I own the land. I cannot build a massive three hundred foot satellite dish in the roof. I cannot do anything that would make the house unsafe and then try and sell it.

Why? Because even though I own the house and the land, the rules are their to stop me from doing dumb stuff that affects everything me.

And you actually don’t own any piece of software. You only think you do.

nyw · May 15, 2021 7:20AM

The expert is crazy, iOS not being “meaningfully more secure” than macOS is, (ignoring how ambiguous the word meaningfully is) is completely not the same thing as whether or not IOS has the same potential to be at risk as MacOS does. MacOS can download and install any software, which means it can be at risk of any malware anyone wants to write. That is the potential of risk, how badly the malware can be, given the worse that can be created and installed. The same malware simply cannot be installed right now on IOS, because it would not have been approved on the App Store. I can write an app right now that deletes all the files in a certain folder at any time for macOS, someone would have to install it, run it, approve the app to do those things. Ie, meaningfully it doesn’t matter that this app can be created and installed, because nobody would install it (please don’t underestimate stupidity). However, this has no bearing on the fact that you simply cannot do the same thing on IOS.

22july2013 · May 15, 2021 7:32AM

There are scores of dictatorships in the world and I'm sure that one of them will bring down the hammer soon enough. And I'm looking forward to that because when some country, like Russia, demands something totally unreasonable, Apple will just shut down the App Store in that entire country. There will be no third party apps any more in that country until the hammer is lifted. Otherwise, if Russia requires an Epic App Store on iOS, and Apple permits it, then people in America will find a way to access the Russian Epic App Store, using VPNs. If Apple caves and allows app stores run by other companies, I will tell my friends to not bother buying Apple anymore because I won't support them. I'll switch to Android since it's cheaper.

Epic Games expert says iOS could be like macOS without security drawbacks

Comments