Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russia presses Apple to install Kremlin-approved apps

economist.com

Post reply on HN
Print view View original

41–50 of 92 posts

Re: Russia presses Apple to install Kremlin-approved apps

#41

Post by tinus_hn »

scarface74 wrote: post #30
gruez wrote: post #24

Earlier quoted context omitted.

>While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts. There's a huge difference between "implement this standard on your phones" and "execute this binary blob".

There are millions of “binary blobs” written by third parties on iOS. Its Apple’s responsibility to write an operating system that can run in hostile environments.

Still there’s a difference between things Apple chose to include and things they were forced to include.

Re: Russia presses Apple to install Kremlin-approved apps

#42

Post by lern_too_spel »

scarface74 wrote: post #26
lern_too_spel wrote: post #21

Earlier quoted context omitted.

Device management apps are given access to (almost) everything by the operating system by design. Further, it seems Russia wants the same unrestricted access to iCloud data that China got. Apple has already set a precedent with China, so expect more of this.

It wasn’t stated that Russia was mandating device management. And just like if a regular app can cause security issues, it’s the fault of the operating system and should be fixed, if your data on the cloud can be read by an adversary, instead of only having the private keys on the device, that’s a flaw in the implementation that Apple needs to fix. Yes si realize that everything stored on iCloud is not E2E encrypted.…

> That’s the real issue, not that the data is in China.

In the US, data requests have to be for individual accounts and go through a judge and sent to the company, who might file an appeal. This is not the case in China. The government can simply get the data it wants without any company appeal.

> It wasn’t stated that Russia was mandating device management

Nor was it stated that it isn't. My point was that the sandbox doesn't automatically imply that these apps are safe, as you had claimed.

Re: Russia presses Apple to install Kremlin-approved apps

#43

Post by johnnycab »

scarface74 wrote: post #11
Retric wrote: post #6

Earlier quoted context omitted.

Forcing the apps to go through their approval process likely discourages some malicious behavior. Even if Apple approves an app they can still yank it at any time should the discover an issue. Require Apple to include apps and anything goes.

From the article, it will be able to be deleted just like any other app. I doubt that Apple is going to let the Russian government create the image or use some type of nationwide MDM or Enterprise. certificate. It could go through the same app review process. On the other hand, this should be an excellent test of Apple’s security and review process....

>I doubt that Apple is going to let the Russian government create the image or use some type of nationwide MDM or Enterprise.

>On the other hand, this should be an excellent test of Apple’s security and review process....

In between your two contrasting comments, lies the rub of how much further Apple is willing to capitulate to the demands of nation states ─ who demand nothing less.

https://www.nytimes.com/2019/11/28/world/europe/crimea-apple...

Re: Russia presses Apple to install Kremlin-approved apps

#44

Post by GhettoMaestro »

jdavis703 wrote: post #10
scarface74 wrote: post #2

If Apple trusts the security of its own operating system, it should be able to sandbox the apps just like any other app. While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts.

Why do you trust the security of US emergency alerts? We know about security flaws in SMS, MMS and iMessage. I’m guessing not as many people outside the government know about the flaws in emergency alerts, but in this case I’d be most worried about them.

I trust iMessage a hell of a lot more than naked SMS.

Also emergency alerts in the US are now fairly well secured with a PKI (iirc). Doesn’t stop a dumb or rogue operator, but it does provide some authenticity regarding if the alert came from a legitimate authority or not.

Re: Russia presses Apple to install Kremlin-approved apps

#45

Post by nexuist »

coldtea wrote: post #37
scarface74 wrote: post #2

If Apple trusts the security of its own operating system, it should be able to sandbox the apps just like any other app. While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts.

> While the US doesn’t force companies to install apps The US doesn't need to. Most companies dominating the field are US based. If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto... A lot of the grandstanding "we would never do that" stems from this dominance...

> If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto...

This is already the case. They're not called favors, they're called federal laws.

However, there are no federal laws requiring the installation of software on almost anything (maybe military applications?) There is no need. The government can just go through ISPs & carriers & companies for surveillance purposes. Russia's government can do the same thing.

This move is an attempt to energize the Russian software market and not much else.

Re: Russia presses Apple to install Kremlin-approved apps

#46

Post by codedokode »

coldtea wrote: post #37
scarface74 wrote: post #2

If Apple trusts the security of its own operating system, it should be able to sandbox the apps just like any other app. While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts.

> While the US doesn’t force companies to install apps The US doesn't need to. Most companies dominating the field are US based. If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto... A lot of the grandstanding "we would never do that" stems from this dominance...

That's right. Apple and Android firmware is already written by US companies complying with US laws and US court orders. They will do everything court orders so there is no need for an additional law.

And, by coincidence, companies that sell equipment with non-US firmware, are not very welcome in the country.

Re: Russia presses Apple to install Kremlin-approved apps

#47

Post by zepto »

scarface74 wrote: post #30
gruez wrote: post #24

Earlier quoted context omitted.

>While the US doesn’t force companies to install apps, it does force companies to support E911 and the system used for Amber alerts and other mandated alerts. There's a huge difference between "implement this standard on your phones" and "execute this binary blob".

There are millions of “binary blobs” written by third parties on iOS. Its Apple’s responsibility to write an operating system that can run in hostile environments.

We all know that so far nobody has ever created an unassailable operating system.

A key tool Apple uses to mitigate the risk is the ability to remove those binary blobs from distribution and to prevent them from running.

Re: Russia presses Apple to install Kremlin-approved apps

#48

Post by codedokode »

nexuist wrote: post #45
coldtea wrote: post #37

Earlier quoted context omitted.

> While the US doesn’t force companies to install apps The US doesn't need to. Most companies dominating the field are US based. If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto... A lot of the grandstanding "we would never do that" stems from this dominance...

> If they weren't, the US would turn protectionist and require specific favors from them to let them operate in the USA pronto... This is already the case. They're not called favors, they're called federal laws. However, there are no federal laws requiring the installation of software on almost anything (maybe military applications?) There is no need. The government can just go through ISPs & carriers & companies for…

Unlike US court, Russian government or courts cannot order Apple or Google to disclose or remove information (ok, they can, but Google simply ignores their lawful requests). So the situation is non-symmetric.

Although I am against this law because probably it is there to allow spying for Russian citizens and prevent them from using secure messengers like Telegram or Tox.

Re: Russia presses Apple to install Kremlin-approved apps

#49

Post by fierarul »

alehul wrote: post #31
imrelaxed wrote: post #5

This very worrying, particularly because Apple recently caved in and marked Crimea as Russian...

Crimea only appears as Russian if you're viewing it from within Russia, which recognizes Crimea as part of Russia, not Ukraine. If you're viewing Crimea from Ukraine, it will appear as Ukrainian, because Ukraine recognizes Crimea to be part of Ukraine. That seems fair, doesn't it?

So, literally, everybody lives in their own bubble.

Except if the guy from Ukraine drives into Crimea there's a whole foreign army to arrest him.

Re: Russia presses Apple to install Kremlin-approved apps

#50

Post by codedokode »

Lio wrote: post #7

Does anyone know how much Russian iPhone says are worth to Apple? Also interesting to know would be much the iPhone platform is worth to Russian app developers if they can no longer buy Apple hardware to test/develop against? If both of these figures are small then it could well in Apple's interests to just abandon sales in Russia. Since, from the article, this proposed law would only cover sale of new devices those…

iPhones are very expensive (new one costs more that average monthly salary), but very popular in Russia.
Post reply on HN