Apple to Developers: Heads I win, tails you lose (part 2)

Sometimes everybody loses a bit.

> The threat vector is facebook telling users to install Instagram/FB from their own app store

PSA, do not install Facebook on your iPhone. Use your browser.

Apple does deserve credit for forcing some privacy improvements on iOS for the Facebook app but it is in no way comparable to the privacy of a web browser. If you are using Facebook's app because you're on iOS and you're thinking, "oh it's fine, Facebook can't track me" -- please uninstall it, a native app on iOS still has far more tools at its disposal to track you than it should have.

As just one example, I would like to say that Facebook's in-app browser code on iOS is now blocked (https://www.engadget.com/meta-can-track-facebook-and-instagr...) but I'm not sure if that's actually the case. I hope it is, a quick cursory search couldn't tell me but it's very possible that Apple patched this by now. But what I do know is that Apple made a lot of noise about blocking tracking code before this article came out and while Facebook still had these capabilities.

Don't use known untrustworthy native apps. Don't use them on Android, and don't use them on iOS.

---

Also to be clear, the privacy improvements Apple has pushed for on iOS are in no small part to stop allowing access to an advertising ID that should not be on iOS at all. I don't want to act like there's no meaningful improvement here, Facebook's reaction is proof enough that Apple's changes did increase privacy. And I fully support Apple improving privacy. But some of that improvement is Apple putting controls in front of systems that shouldn't exist or covering for systems that are way more open and way less sandboxed than they should be.

So part of the difficulty of talking about Apple's security models and the role that the app store plays in that process is that some of Apple's policies are really only enforced on the app store, even though they should be enforced at an OS level that would apply to every app regardless of what app store it came from. Of course, not every permission can be expressed that way, but some permissions can. Web browsers are proof of that -- Safari doesn't have a quality control system in place to block abusive websites like Facebook, but despite that, it still manages to be better for your privacy for you to use Facebook from Safari instead of via a native app on iOS.

I worry that Apple's app store polices are sometimes used as an excuse to avoid building much more robust protections against tracking into the OS itself, and I worry that better privacy standards on the iOS app store get interpreted as proof that native apps on iOS are just generally safe and private. But Apple's standard of what counts as private "enough" to be on the app store is not always as strict as it could be. Generally speaking, until we get much better sandboxing controls on mobile devices than we have today, known malicious or known privacy-intrusive apps like Facebook, Twitter, Instagram, or Threads should not be installed period from any app store 1st or 3rd-party, they should be used in a web browser.

Reasonable people can disagree whether a 3rd-party app store would make this problem worse, but please don't have the takeaway of "a 3rd party app store would make the Facebook app suddenly unsafe and my parents would get fooled into installing it." The Facebook app is already unsafe, and your parents already shouldn't be using it.

You may not like the judge's decision, but at this stage, all the appeals are over.

The judge ruled that Apple is entitled to take a cut of transactions, regardless of who acts as your payment processor.

> as discussed in the findings of facts, IAP is the method by which Apple collects its licensing fee from developers for the use of Apple’s intellectual property. Even in the absence of IAP, Apple could still charge a commission on developers. It would simply be more difficult for Apple to collect that commission.

https://stratechery.com/2021/the-apple-v-epic-decision/

The judge did hint that Epic screwed up by arguing that Apple should not get a cut of transactions at all, instead of arguing that 30% was too high.

Apple pay subscription cancellation ease and refunds protect the consumer. I’m not here to defend all of their practices. I am saying there are very obvious consumer friendly parts of the ecosystem starting with the fact that I don’t need to run tech support on my families tablets and phones.

I barely ever see consumers complain about the ecosystem, mostly companies and developers. And I just don’t feel like they are going to use a more an open system to the benefit of the consumer. I trust them _a lot_ less than Apple.

Facebook doesn't need a secondary app store on Android to bypass the default one's privacy rules because the default one isn't stopping them from doing what they want to do in the first place.