Hacker Newsnew | past | comments | ask | show | jobs | submit | NotPractical's commentslogin

Non-preloaded apps can't access your camera feed unless they are open in the foreground (zero days aside, but you're probably not interesting enough to burn one on).


Previously:

Apple pulls iPhone torrent app from AltStore PAL in Europe (268 pts) - https://news.ycombinator.com/item?id=45098411

Apple revokes EU distribution rights for an app on the Alt Store (249 pts) - https://news.ycombinator.com/item?id=45040064


> I can’t say for sure that preferring web versions of services helps with censorship

The linked article isn't enough to convince you? Look up Gab or Parler. (Yes, I find most of the speech there reprehensible. No, I don't think they should be denied the right to publish and distribute an app.)

Using a social media app instead of a website, as most people do, means that everything you are seeing has essentially been pre-approved by Apple and Google.

If the tide swings even a little further to the right on X, expect the X app to be banned as well. I was secretly hoping that it would be banned when Musk took over just to remind the right of why centralized app stores are a terrible idea. But with ICEBlock the left has finally been alerted to that fact as well, which might be even more beneficial to the cause of software freedom in the long run, since the left is generally less afraid of the proper solution to this problem, regulation.

In the meantime, keep using web apps instead of native apps.


Parler was also kicked off of AWS…

As far as X being banned, if you haven’t heard Tim and every other tech CEO bends a knee anytime Trump and conservatives asks him to.


They also bent a knee to previous Democratic party administrations and will bend the knee to them again the next time the Democratic party is in power. Large tech companies aren't interested in spending money and poltical capital fighting censorship demands of anyone who is likely to have power within the US government.


And therein lies a problem. Each 'side' has no problem with it as long their team is not affected. Just yesterday -- on AM radio of all places -- I had democratic pundit openly wondering how Epstein's list is going to be used against them after spending a fair amount of political capital pushing for its release. It is all a game and, sadly, we are getting played. In such an environment, it is hard not to become cynical.


There is a huge difference between a president using the “bully pulpit” and threatening to take away a network’s broadcast license because they said something he didn’t like. That was a road too far for even Ted Cruz who criticized both Trump and the FCC.

A democratic president also didn’t accept personal bribes from companies to allow a merger to go through (Paramount) or accept bribes from other companies that were afraid of retaliation - Meta, Google, Twitter and Disney.

The current administration has carved out outs for companies that bend a knee when it comes to tarriffs. This is the worse case of false whataboutism yet.


AWS isn't the only way to host a website, and his been an obviously bad choice for hosting something controversial since it denied service to Wikileaks.


> Parler was also kicked off of AWS…

Which reminds us of the difference between AWS and Apple -- Amazon Web Services is the web and the web is an open platform. If AWS denies you, you go sign up at any of their competitors or buy your own servers and plug them into the internet. If Apple denies you, iPhone users can't get your app, and if you go sign up at a competitor or buy your own servers, they still can't get your app.

> As far as X being banned, if you haven’t heard Tim and every other tech CEO bends a knee anytime Trump and conservatives asks him to.

That's because they currently control the government. Now think ahead by more than two days and consider the possibility that the other party might win an election again someday. What should you do right now when you're in control of the government to prevent yourself from getting screwed the next time that happens?


> If AWS denies you, you go sign up at any of their competitors or buy your own servers and plug them into the internet

And then your ISP kick you out.


All of them? It's a website, the servers don't have to be in the same place as your bedroom. They don't even have to be in the same country.


And then what happens when CloudFare de platforms you? It doesn’t take much to DDOS most websites that aren’t protected by something like CloudFare.


So now you just have to get deplatformed by Cloudflare, AWS, Fastly, Azure, Radware, Google, Akamai, F5, Imperva and every other DDoS protection company in the world all at the same time while simultaneously suffering from a DDoS attack that never lets up or your site immediately comes back.

Meanwhile a DDoS attack is a crime, so Apple doing something with the equivalent effect is now something you're equating with the commission of a crime.


No the Supreme Court said a long time ago that a company has “no duty to deal”. Meaning it doesn’t have to do business with anyone it doesn’t want to.


But you don't want to do business with Apple, you only want to do business with your own customers who have iPhones.


> 4chan does provide access to people in the UK

That's the default when you host an app on the world wide web, though. Regardless of how big of a burden it is for 4chan (I would think it's as simple as flipping a switch in some control panel blocking UK access?), it still does compel the US-based company with no commercial presence in the UK to consider complex international law and to make changes to their US-based web app in response to a foreign jurisdiction's regulations, which feels wrong to me.

This is tangential to whether it affects "free speech" outside the UK, though, and I'm inclined to agree that it doesn't, but I guess it depends on how you define free speech. If 4chan's web app itself is considered speech, and not just the content that's posted there, maybe. But I think free speech advocates are a lot more concerned with the content.


It's the same with the GDPR...

But note that merely being accessible in the UK is not enough here. The service must either target the UK or have a significant number of users in the UK, or it provides harmful content. So the online forum for Oregon gardeners is quite safe even if, indeed, accessible from the UK.

But still it is an awkward legislation and it would be simpler to simply block rather than to threaten and fine services from around the world.


> It is possible to enforce UK judgements and fines in the US, though my understanding is that it is not simple or guaranteed.

I am curious as to how that could possibly work. Is there some trade agreement that requires the US to respect UK court rulings? Generally the US has sought to distance itself from any kind of foreign influence or control.


> I can always "apt-get install".

I don't think you can reliably fix a specific version of a package though, meaning things will still break here the same way they did before containers.


If you need a specific version of one package: apt-get install hello=2.10-3

If you want to lock down versions on a system, Apt Pinning: https://wiki.debian.org/AptConfiguration#Using_pinning

If you have a herd of systems - prod environments, VMs for CI, lots of dev workstations, and especially if your product is an appliance VM: you might want to run your own apt mirror, creating known-good snapshots of your packages. I use https://www.aptly.info/

Containers can also be a great solution though.


That's what the apt sources are for; point them to a snapshot of known-good packages (e.g. S3, AptOnCD, whatever), and disable everything else.

I remember doing such things (via .deb packages, rather than random scripts) a couple of decades ago.


Nearly anything that isn't end-to-end encrypted is fair game, assuming there is probable cause. Access to your physical location history (even if you weren't suspected of a crime) wasn't off limits until 2024 [1]. (It still isn't off limits if you are suspected of a crime, but is no longer collected at the scale of "most Android users" [2].)

[1] https://www.eff.org/deeplinks/2024/08/federal-appeals-court-...

[2] https://techcrunch.com/2023/12/16/google-geofence-warrants-l...


End-to-end encrypted data is also fair game -- the only difference is that there are simply fewer parties that have the data to give.


Chats with chatgpt are end to end encrypted (it's https), but one of the ends is OpenAI.


While I understand (and agree with) the general sentiment of what you're saying, you are not correct in saying that this is end-to-end encryption, and HTTPS itself does not guarantee that end-to-end encryption is in use.

In this case, there's an explicit middle point - chatgpt.com resolves to a CloudFlare server, so CloudFlare is actually one of the ends here. It likely acts as a reverse proxy, meaning that it will forward your requests to a different, OpenAI-owned server. This might be over a new HTTPS connection, or it might be over an unencrypted HTTP connection.

It really is super important to emphasize this point. End-to-end encryption is not simply that your data is encrypted between you and the ultimate endpoint. It's that it can't be decrypted along the way - and decrypting your HTTPS requests is something that CloudFlare needs to do in order to work.

(To be clear, I'm not accusing CloudFlare of anything shady here. I'm just saying that people have forgotten what end-to-end encryption really means.)


Great points, of course if you use full strict or flexible SSL you could be ok (safe) from Cloudflare, but no way that is the case here


I don't believe there's any mode you can use that would make it truly end-to-end encryption. I may be incorrect, but I don't recall seeing anything like that.


Yep. This is why the estimates of compute needed for AI (if it turns out to be useful) are many orders of magnitude too low — the technology isn’t mature until it actually succeeds at tasks, with fully homomorphic encryption from my prompt through the response.


FHE is far too computationally heavy. Won’t be used on ChatGPT for a very long time if ever


A law with more teeth than the EU's Digital Markets Act (which, contrary to popular belief, does not actually require sideloading) could theoretically be passed. The current (pre-lobbying) iteration of the App Store Freedom Act looks pretty good (ctrl+f "security", "safety", "integrity" returns zero results).

https://www.congress.gov/bill/119th-congress/house-bill/3209...

Realistically speaking, that probably won't happen, though. What can you, yourself do to mitigate the impact?

Install a forked version of Android without Developer Verification. LineageOS, GrapheneOS and CalxyOS are all pretty good options. Stop using any apps with remote attestation via Play Integrity, which will mean sacrificing more and more functionality as time goes on. Try to use mobile sites instead of mobile apps as much as possible. Watch the F-Droid catalog get smaller and smaller until it crumbles completely when it becomes unusable by >80% of Android users.


> Basically all antitrust actions thus far regarding mobile platforms have been regarding their gigantic commercial app stores. That is entirely unaffected by these changes.

This is more or less true. Epic Games is most likely not going to fight Google any further in the U.S., assuming they actually get what the recent injunction promised them (which does not include unrestricted sideloading, but does include better protections for verified third party app stores on Android).

But at the same time, I don't think it's invalid to say that antitrust law provides a pretty solid framework for a hypothetical "sideloading mandate". The EU's Digital Markets Act comes very close, but falls short of declaring exactly what a "third party app store" should be. That is, "an independent source of applications without any oversight whatsoever from $BIG_TECH_CO".

However, they probably specifically avoided doing that because they knew it would lead to malware on iOS, and a huge win for Apple in the court of public opinion. Will the EU or any of the other regulators actually ever go any further than "third party app stores"? Probably not, to be honest.


What? The parent comment alleges that your claim that Google engaged in fraudulent marketing is false, but your reply just restates your original claim without addressing their argument.

> except the EU

Also Australia, Japan, Brazil, and the United Kingdom, with others sure to follow.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: