Hacker News new | ask | show | jobs
by austinheap 1617 days ago
iOS has allowed side loading for half a decade now. Companies that find $100 prohibitive have a free path that’s nearly identical to Android side loading.
3 comments

iOS most certainly does not have real sideloading. You can if you recompile the app with your own key every 7 days. Or you can use testflight with some very serious restrictions like not being able to monetize at all.
There are endless KYC/AML requirements for entities that can transfer or emit USD.

It’s completely reasonable that side loaded applications should not be entitled to use regulated payment services.

Edit: Even Android will not entitle side loaded apps for Google payment processing. Android and iOS are literally identical in this regard.

Either side loaded apps get allowed to use payment processors, or the App Store apps are allowed to use whatever processor they want.
Not a lawyer but that’s probably illegal in the states. (Also hilarious username is hilarious!)
Sideloading on iOS is nothing like sideloading on Android, you have to compile the app from source with your personal key and even then it's only valid on the device for 7 days.
There is tooling to manage self-signed certs beyond the seven day window. Unrelated but I find it weird that “you have to compile the app” is a bad thing now.
There are ways to go past 7 days but all come with even more downsides to both the end user and company trying to get users to sideload. "You have to compile the app" is extremely related if you're a company wanting users to install your app, especially since that requires more than just knowledge to be able to do.

To ask you the inverse question, in what way is any of this "nearly identical" to Android sideloading which allows indefinite sideloading via any delivery method, including installation of 3rd party stores, with no more than a click on an approval prompt from the user?

Optimizing for people who want to side load ~and~ cannot click the build button in Xcode seems wild to me. (No disrespect!)

It’s identical though in that <when one side loads> one is <completely disconnect from the ecosystem of the device manufacturer>.

Re: side loading binaries/APKs on my actual phone that’s logged into my actual bank account? Hard pass. There’s a time and place for lax security. This is what air gapping is for.

> Optimizing for people who want to side load ~and~ cannot click the build button in Xcode seems wild to me. (No disrespec

When you personally limit sideloading to be "I compile the app and manage a personal security chain to keep it active" it may seem wild, that's not what the vast majority of Android sideloading/3rd party stores is though. Xcode, beyond requiring installation, requires a macOS install to run it on. There are other ways to compile iOS apps, each even less accessible to users or distribution by companies. And again: the obvious statement that the vast majority of revenue generating apps on the App Store are not open source.

Even amongst the Android tech nerds 3rd party stores like F-Droid are popular because users don't want to compile their open source apps constantly... and there are even less requirements around compiling Android apps than iOS apps!

> It’s identical though in that <when one side loads> one is <completely disconnect from the ecosystem of the device manufacturer>.

Not true, sideloading apps on Android means loading them from a different source not disconnecting them from Google services or the Android ecosystem as a whole. It of course allows for that if it's what you're after but it's not limited in such a scope.

> Re: side loading binaries/APKs on my actual phone that’s logged into my actual bank account? Hard pass. There’s a time and place for lax security. This is what air gapping is for.

On Android sideloading is being able to pick which app sources you trust, even if that means "not Google". That could mean "I compiled it myself on an air gapped computer" to you, "I loaded it from a 3rd party store" to another, and "I downloaded it from the developers site" to a third. Which you personally choose is irrelevant as each user gets to pick their allowed sources so it can fit any user's need.

> Don't forget that you need a Mac.

Anything that can run LLVM can side load.

Oh, so Apple freely distributes all the iOS libraries now, too?
Don't forget that you need a Mac.
Could you please explain the mechanism for a consumer sideloading apps onto an iPhone?

I've never heard of this being possible.

There are several methods for doing it but they are all crippled in ways that make it impossible to actually use the system for anything but QA testing and development.

You can install any app you compiled with your own key and it lasts for 7 days before requiring it to be recompiled.

It does not have to be recompiled. The entitlement is akin to SSL: it has to be renewed. Automated tools can do this for you.

This seven day lie/conspiracy/flat-earth is disappointing.

AltServer can do it but in my experience the Windows version of AltServer is extremely unreliable. AltStore never really auto-renewed properly for me until I put AltServer on an old MacBook Air. Furthermore, the fact that this process needs a second device to bootstrap provisioning at all[0] might be a non-starter for some. Take a week-long vacation? Well, now all your sideloaded apps stop working.

A far bigger limitation for me is the three-app provisioning limit. There isn't any way to work around it[1], and if you do want to do serious sideloading you almost certainly will need to upgrade to a paid developer account.

[0] Specifically iOS only allows app provisioning over USB or Wi-Fi, not locally. Locally installed software cannot actually communicate with the remote debugging daemon. You can work around this with network extensions, but you don't get to use them in dev-signed apps unless you have a paid dev account that's been approved by Apple to use them.

For the record, that isn't to make sideloading harder; that's because Facebook went and shipped a spyware VPN with their enterprise cert.

[1] Personal experience time: Even when jailbroken, and with AltDaemon and Immortal installed, AltStore still bumps up against the three-app limit.

Clone repo. Click build. Publish to yourself via TestFlight. Never think about it again.
That requires a $100/yr dev account. Otherwise you have to get a new cert every 7 days.