I find the FUD against third party app stores on iOS to be simultaneously crediting Apple with providing immense amounts of security in its App Store, and believing that it would be incredibly helpless without sole control through its App Store. That's very contradictory, both in ignoring the many, many vulnerabilities and scams that have proliferated on the App Store through the years (not to mention other negative user experience), but also ignoring the great pains that Apple has in ensuring security through layers and mechanisms beyond the App Store.
iOS is more secure than Android not simply because the App Store is better curated than the Play Store, but protections built in its very own operating system model. There are permissions restrictions that Apple has guarded carefully and not subject to removal through the permitting of third party app stores.
Furthermore, because Apple still has ultimate control of its operating system, it can design a careful flow to enable the use of third party app stores and side loading. It can hide it deep in Settings behind multitudes of "are you sure?" windows and security checks. It can coax users not to relinquish protections.
Hell, if Apple embraced the whole decentralized app store idea, it can provide an AppStoreKit SDK and sets of standards for third party app stores to adopt, a sort of security certification system that they can choose to conform to and be recognized for meeting Apple standards, similar to Apple's verified third-party repair stores.
The idea that allowing third party app stores will doom iOS is an anti-Apple critique in disguise, because it claims that Apple is helpless outside of its App Store. There is a lot more Apple can do.
> Apple still has ultimate control of its operating system
This is by far the most under-appreciated point in all the dialog around third-party app stores (and intentionally downplayed by Apple itself). Apple doesn't have to control the store to control the platform. The degree to which independently-distributed binaries can still be locked down remains entirely within Apple's control, and if they really do somehow fail to stop this legislation (realistically, I see both Apple and Google tying it up in the courts for years) expect a new level of hardening in iOS and Android from top to bottom.
Ironically, this will probably be better for security in the long run.
> iOS is more secure than Android
[Citation Needed]
https://www.ijert.org/research/security-comparison-between-a...
I see your 2017 study and raise you these 2019 articles.
https://www.wired.com/story/android-zero-day-more-than-ios-z...
https://arstechnica.com/information-technology/2019/09/for-t...
I don't think I've ever seen the tech press warn users that they need to be wary of installing apps from inside Apple's App Store the way they have with Google's Play Store.
>With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place.
A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around.
https://arstechnica.com/information-technology/2020/09/joker...
Well it's a bullshit claim to justify them taking 30%. Not sure why you've taken it seriously...
> Furthermore, because Apple still has ultimate control of its operating system, it can design a careful flow to enable the use of third party app stores and side loading. It can hide it deep in Settings behind multitudes of "are you sure?" windows and security checks. It can coax users not to relinquish protections.
If they make the flow add package signers (or maybe a packagename,signer tuple), that would both be more friction than a on/off checkbox and possibly a better way to do it for users. I may want apps X from Y, but I don't want it if it's signed by someone else and I may not want other apps, etc.
Exactly. There's a lot of potential UX flows available that could protect user security even when it comes to third party stores, and the law does not restrict Apple's ability to impose such safety restrictions.