App Store Rejection of the Week: Dark Hours

Society as a whole, to some extent, and the various industries involved.

Why should children be punished with a lifetime of shitty ingrained behaviors just because they were born to shitty parents who wouldn't do the right thing? I'd rather not create the Eloi and Morlocks from HG Wells.

> shut down people's connections until they removed their malware.

Yes, in an ideal world, that might work but most people don't actually know they have malware. That's the point of the malware! And it's not like you can say "no internet for you until you replace your TV[0]" because that's an extremely quick way to the courts and a customer reputation below the toilet.

(Ignoring the "who pays for that?" question because that is a whole 'nother can of worms.)

[0] https://www.ibtimes.co.uk/fbi-google-disrupt-proxy-network-a...

I'm not going to argue we should close all banks or whatever ridiculous argument people come up with just because someone lost money.

The only way to 100% prevent scams is to remove the potential entirely. There are scams, infinite actually, right now, on iPhones. Do you support that? Surely not, so we should lock iPhones down more no? Ideally, we ban smartphones altogether, to prevent scams. Oh you don't support that? Well come back when one of your relatives loses 1 million dollars.

Look, we can take steps to prevent scams, and we do. What we should NOT do is go so extreme that people cannot even use their devices the way they want that they paid for. This is anti-consumer. If I want to install some software, I should be able to. It is not Apple's responsibility to baby me, baby you, and baby the entire world and say "no no you can only use our approved software!"

Especially when some of that approved software is... wait for it... malware! Yes, there is quite a lot of malware on the Apple App Store and the Play Store. But I can't install open-source software I've audited myself on my iPhone? How strange.

It appears to me this has nothing to do with scams, and everything to do with control, censorship, and profiteering.

Fortunately, it's not a linear scale. All sorts of technical and political options exist which don't fall cleanly into the anarchy or baby-proofing spectrum. Random incomplete examples, in no particular order and off the top of my head:

GGP's idea of making it more commonplace to have a "Johnny" helping people with their tech needs to prevent accidents could work socially, if there are ways for communities to create more people willing to do that.

Worldwide legal penalties for spamming/scamming could grow more teeth, increasing the likelihood of bad outcomes for people that make malware or questionable apps.

Software distribution systems could standardize on better systems of provenance and ownership handoff to further technically harden against "good extension sold out to an evil maintainer" or "github credential leak let a bad guy publish an artifact"-type attacks.

Cooldown periods for users trying to grant questionable access patterns could be imposed, though that might feel too baby-proof for some.

On-device permission boundaries could be modeled in an "XOR" way: apps distributed from Apple's walled garden could be disallowed from approving data sharing with apps users install from other repositories. That's Apple's prerogative (they own the distribution and vouch for at least some of the quality of the app store apps), but doesn't prevent users from installing parallel ecosystems if they want.

Something that's very paternalistic, but doesn't involve baby-proofing what's possible, is the idea of credentialing users. You need a driver's license to operate a car. In the US, you need a (much easier to get) food handling license to commercially process food. The latter's a short briefing and test of comparable effort to those mandatory corporate anti-phishing trainings that already-technical people hate. Perhaps some users could benefit from that as a prerequisite to installing non-trusted software.

For vetted walled gardens like the App Store, further improving the granularity of and required justifications for permission requests as providers have been doing might help. "This poker app wants to access all of your saved contacts and photos" becomes "this poker app wants you to select a single profile photo and up to 5 contacts a day to add as opponents, after which access is revoked" or whatnot. This only works if App Store reviewers get serious about rejecting apps for overbroad permissions requests and explain their rationale to app developers, which would require Apple and friends to spend a lot of money to enable. Fortunately, they have insane margins. Less fortunately, their shareholders wouldn't go for this unless forced by regulation or similar.

Anything that helps with threat attribution. If Grandma can install an app from a random URL, and then gets hacked 6 months later, it'd be great if something got in her face that loudly indicated that the decision to install the untrusted app was the root cause of her compromise and some "do you want to disable the ability to do this in the future/require a phonecall to $provider to turn it back on?"-type hint.

For apps that spend money, further integrating pattern-aware anti-fraud and spend caps with payment APIs so that e.g. a microtransaction app that got hacked can't suddenly spend $100 where the user typically spent $5/month. Banks are already starting to get proactive/argumentative about unexpected transaction patterns a la "sir, are you sure you want to send $5000 in your first overseas money wire? Can you tell us more about that transaction? Are you aware of this common fraud?"

...and so on.

> Okay but again we cannot form all technology to only work for people with cognitive issues and nobody else.

We can take their needs into consideration, just as we legally require businesses to put wheelchair ramps in.

> NO, there are not, because Apple chooses to only allow their app store. The market we are talking about here is not "all smartphones". It's "the market of software available for iPhones", in which they hold 100% control over. This should be legislated against.

Should Gucci have to sell Coach handbags? Should Ford have to sell Toyotas?