[fainpul]

Even after Google puts this crap in place, you can still uplodad your own apps to your own Android devices, using ADB. Doing the same for iOS, using Xcode, costs you USD 100 or more (depending on country) per year.

I'm in no way defending Google here, just pointing out you're going from bad to worse and think it's a good thing.

[aucisson_masque]

Yeah but where you were losing a lot, you're now losing only a little bit.

And on the other side, the benefits of using iOS over Android spyware outweighs the cons now.

[hellojesus]

I haven't seen new data from celbrite in awhile, but I believe that grapheneos was the only truly secure phone from it for both bfu and afu as of a couple years ago.

Apple lost my confidence after they removed Advanced Device Encryption for British users (plus implemented age verification for them).

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

[virgildotcodes]

I think it's been said that nobody has yet cracked Apple's Lockdown Mode, but that's likely not truly comparable?

[strcat]

iPhones with Lockdown Mode enabled have definitely been exploited which is confirmed by leaked documents and statements from commercial exploit vendors. Lockdown Mode primarily reduces attack surface in Safari and from Apple services. It does very little to protect against other attack vectors such as messaging apps or physical data extraction.

https://support.apple.com/en-ca/105120

You're thinking of Apple saying they haven't detected a case of a device with Lockdown Mode exploited in the wild themselves. Extremely few devices use Lockdown Mode and Apple has very little insight into successful exploits so there isn't much opportunity for them to detect it in the first place. Lockdown Mode bundles everything together and has very inconvenient changes many people won't accept. That greatly reduces usage even by people fully aware of it who want a lot of what it provides. For example, there's

Apple has said they haven't seen a case of a device with Lockdown Mode being exploited which is extremely misleading. Apple doesn't have that much visibility into devices being exploited and would mostly seen failed attempts. All of the Lockdown Mode functionality being bundled together contributes to it barely being used. There's no opt-out system for most of it beyond disabling it as a whole. Only a subset of the Safari restrictions can be partially disabled per-app and per-site which doesn't fully restore web compatibility. It's more that hardly anyone is using it and that Apple doesn't have much insight into apps and the OS being exploited successfully in the first place. Lockdown Mode is definitely useful but people should read about what it actually does and compare that to how devices get exploited. Apple's memory corruption exploit protections aren't tied to Lockdown Mode.

[soco]

How is then law enforcement getting what they need from people's iphones? Because I understand they do, in some way. And I'm not asking about forcing people to hand over pin or fingerprints, but just by themselves.

[strcat]

Lockdown Mode is focused on reducing the attack surface from Safari including the WebView and Apple services including iMessage/FaceTime. It does nearly nothing to protect against non-browser/non-messaging attack vectors in the OS or other apps. It's up to app developers to implement similar restricted modes and also baseline exploit protections. App developers need to explicitly opt-in to using the standard exploit protections used in many parts of the OS and Apple discourages doing it:

https://developer.apple.com/documentation/Xcode/enabling-enh...

[fsflover]

Here is one example how: https://news.ycombinator.com/item?id=47716490

[varispeed]

iPhone security is a myth. This is because you can't scan iPhone for threats, so Apple can pretend they don't happen. iOS is probably the least secure platform there is thanks to the security by obscurity approach by Apple.

You can use iPhone being blissfully unaware it has malware on it even in Lockdown mode (which is essentially cope mechanism and Apple way of saying "we care about security, trust us bro").

[kakacik]

Can I plug iphone via usbc and access photos and videos directly and rest of the filesystem directly? Thats my flow, I am not buying a phone which has this artificially disabled 'for my own good', while being unix under the bonnet. Insult to my intelligence and all that.

[poolnoodle]

You really think Apple doesn't gather data on what you do on your devices? This notion that Android == spyware is so old and boring but HN just loves Apple.

[aucisson_masque]

I'm sure they do collect data but not to the point that they hamper functionality. They still focus first and foremost on usability, functionality whereas Google focus on collecting data, serving ads and then on functionality.

But yeah, there is no doubt in my mind that they both collect as much as they can.

[mbgerring]

Google gets nearly all of its revenue from targeted advertising, and Apple does not. Apple has an incentive to restrict or completely deny third-party data collection, because they’ve made privacy a major part of their brand marketing and there is major reputational risk to Apple for being caught lying about this. Apple’s “Ask App Not To Track” feature made such a measurable dent in the revenue of various surveillance tech companies that they complained about it, loudly, including Meta paying for a full-page ad in the New York Times about it.

There are multiple objective reasons to believe that Apple is a more trustworthy actor here than other companies, including vulgar capitalistic reasons.

You can just say “pfft, wow, you really believe that?”, I guess, but if that’s your position there’s no reason to argue about this with you.

[kakacik]

Apple's ad revenue is growing massively past few years, projected to be 13 billion revenue stream next year. Where do you think those ads are ending up, and do you really believe they are non-targeted? So while your statements are still somewhat valid, not that much and not for that long.

Also, for anybody from outside of US, its US 3-letter agencies that pose biggest actual security risk since US laws treat us as sub-humans. Apple is as translucent to those as Android. But I get it, its still much easier to make PR campaign based on security for Apple than Android.

[rybosworld]

While not equivalent to a true iOS app, PWA is a decent option that allows you to circumvent the app store restrictions. If you are trying to build apps primarily for yourself, it's a decent option.

[pngwen]

Actually I have been tinkering with PWA as a way to remake some of my toy apps. Though a lot of the automations I made for Android can be replicated through Apple’s Shortcuts app.

The biggest loss for me was Termux. I had lots of scripts and such that I ran, plus just having a Linux environment in my pocket was nice. Luckily I found ish which gives me alpine Linux on top of a virtual x86 machine as provided by a JITC layer. I can host PWA apps out of that environment for local use. Of course I can also ssh to my unix like machines from there too.

I am starting to tinker with swift a bit more too. As with google, I could buy a dev key to deploy my own apps only this way I have all the window dressing and end to end encryption on cloud storage.

[latexr]

Doesn’t that require you to host it and have it available on the open web, though? Is there a host that allows you to, for free, not only HTML/CSS/JS but also access to arbitrary tools and bespoke scripts on the backend?

[noduerme]

For free? No, but if you built a native app that needed a backend, you'd still need to host the backend somewhere too. I host my own web apps from a cheap mini pc at home and access them over tailscale for personal use.

[tnelsond4]

I host my app on GitHub pages for free. But yes, it's just static which is really all you need with how powerful wasm and JavaScript are.

[noduerme]

That's true for most things where you don't need users to share or collaborate on updated data. But if you need so much as a highscore board for your casual javascript game, you need some kind of backend. The parent's assumption that it should be totally free to run arbitrary server code somewhere is mildly ridiculous.

[rybosworld]

Yeah it stands for Progressive Web App - but there are lots of hosting solutions with generous free tiers.

[godwept]

I host a bunch of my own PWAs on Cloudflare using Pages and Workers. It's been free so far.

[Bewelge]

I'm pretty sure that if you build your PWA in a way it works offline through caching (which is easy if it's just a static website), you could host/serve it temporarily and just install it once.

[herzigma]

As a lark, I built a set of personal productivity apps that are delivered as standalone local webpages. Works surprisingly well on Android, haven't tested on iOS.

[groby_b]

Have PWAs stopped working on Android, or something?

[beej71]

I love PWAs. I just hope they never get too popular, or Google will kill them.

[brandonhorst]

This is not true, running your code on your phone with Xcode has always been free.

[quantumleaper]

With a free account, it needs to be reinstalled every 7 days because the signature expires. It's hardly convenient for personal use.

[pzo]

even worse - if you need to build some app with entitlements or some features likes push notifications etc then you need non-free account

[roysting]

I would like to mention that although I’m aware of the limitations, I think it is worth designing and advocating for web app standards that could even at some point become a viable competitor to native apps, especially for apps that really don’t need to be native/wrapped apps in the first place since most are CRUDs anyways.

Maybe this will be a catalyst towards further evolution of the web app as Android devs want to carve out some freedom from the world domination corporate shadow government walled gardens.

[regularfry]

You're not wrong, but it will always be the case that the web platform lags native. There will always be stuff you can't do without a native client. The proportion of apps that it's viable to run as a PWA will probably increase over time, but the platforms have both the ability and incentive to stay out ahead.

[manmal]

Most apps can be a PWA nowadays. A Hetzner VPS costs roughly the same as the Apple dev membership. Saying this as a native iOS dev since iOS 4. For your average pretty json printer you don’t need to go native.

[cbsks]

Offline PWA sites are very limited on iOS. If you force close Safari, look at your phone funny, or don’t visit the site regularly, the cache is cleared and you are stuck at a loading screen until you have internet again.

That’s what forced me to finally bite the bullet and pay Apple yearly so I could develop an app for my friends and I to use. Would have much rather kept it as a PWA.

[manmal]

Yeah they can’t make it too easy to bypass the App Store :( I don’t think that’s a super strong argument though. Native apps have downsides as well.

[giancarlostoro]

Even free-er with Expo and React Native. Course then you have to touch JavaScript ;)

[frizlab]

This is not true either. At some point you had to pay. But it’s been a long time since they made it free (with caveats).

[solarkraft]

What an insane song and dance to run software.

[encom]

>free

You forgot to factor in the cost of a Mac.

[cromka]

You don't need a computer to develop Android apps?

[Gander5739]

All you need is a phone: https://github.com/atamshkai/Android-Studio-On-Android-Phone

[Imustaskforhelp]

I remember running kali linux once on my phone with (termux+vnc) and a vnc viewer app watching some random youtube videos a few years back

So I feel like, Something like this was/is possible but its immensely hard for something like this being used especially when a desktop os on a phone is so bad ergonomically speaking unless you have a keyboard mouse connected

A better option iirc is to use something like kivy[0] directly with termux, not sure if java might have direct options too or not.

[0]: https://github.com/kivy/python-for-android

[dartharva]

You can use _any_ computer to make Android apps. For iOS you strictly need a Mac.

[autoexec]

You aren't even limited to android apps. You can install termux and write and compile your own code to run from there or to copy and run anywhere else.

[frizlab]

No. You can upload your apps on your iPhone for free. You just need an Apple ID.

[bayindirh]

Sorry, even as a developer, "but, you can use ADB" is a big big copout.

What's the next step when ADB requires some hoops to enable? Will we say that but the eMMC has an unencrypted EXT4 partition, we can just desolder and write into it?

[Dylan16807]

It's not a copout, it's a comparison to iOS. You're seeing an argument they didn't make.

[jraph]

As a dev, i'd say having to use adb is a minor inconvenience.

Still unacceptable, a better option would be to use something like lineage or some other aosp distro without the google services (hoping that nothing makes you dependent on them).

This still doesn't address the vast majority of people though (and that's what I'm concerned about the most).

What we need now is:

- short term, work on pushing apps not to depend on the google services so phones preinstalled with something like /e/ become a viable option for most people. Push our public services to stop mandating Google and Apple OSes for random stuff.

- longer term, work on making alternatives to Android and iOS viable options for most people (stability, usability and availability of services people use). The best candidate for that today is Linux mobile.

Breaking network effect around proprietary services is one of the strategies towards this.

Another one is reducing our reliance on computers (of any shape) altogether, maybe.

[gmueckl]

There are ways to wrap adb in a friendly interface. I can totally see a desktop based manager and marketplace for phone apps as a workaround.

[plombe]

Not. You don’t need to pay $100 to upload your app to an iPhone, even with XCode for iOS 26

[seviu]

Technically not but the devil is in the details. Having to reinstall the app every 7 days and a limit of one app doesn’t even pass the bare minimum.

Jolla has a prelaunch campaign, decent phones for 200€. I might just as well grab one. Sick of having a phone which is more expensive than my laptop but I can barely use.

[MYEUHD]

The limit is 3 apps AFAIK

[antiframe]

Imagine Windows limited you to three apps. How is this acceptable?

[rimliu]

Imagine Windows was free.

[antiframe]

Wait, I can download and run iOS on my own hardware? Not that I have tried, but I always thought Apples whole schtick was you were only allowed to run their software on their latest X revisions of their hardware?

[lostlogin]

Imagine if you paid for Windows and didn’t get adverts.

[ok123456]

Isn't keeping ADB enabled (most people who do this don't enable it and then promptly disable it) a huge security problem? ADB enabled means an adversary can completely own your device and "back it up" by simply plugging it in.

This is much worse than nagging about "untrusted sources".

[dvdkon]

No, there's a trust-on-first-use procedure where you have to accept the computer's key on your phone.

[fc417fc802]

Not only is it TOFU but that comment is doubly wrong because you can't really back up much other than the bulk storage directory without adb root (which requires a custom build, which obviates the issue to begin with).

[manmal]

Apple has the same thing, but for some reason added Developer Mode which you must enter on the iPhone first. It’s quite involved, with a restart and 3 confirmation dialogs. That had me wondering why they are suddenly so cautious around this.

[sigmar]

>ADB enabled means an adversary can completely own your device and "back it up" by simply plugging it in.

each adb host has to be individually white-listed by an unlocked device. also the current behavior is that it auto forgets any white listed host that hasn't connected within 7 days.

[wolvoleo]

No it's not. Your computer creates a unique ID and you have to accept that on the unlocked phone the first time (or every time if you choose to).

So even when adb is on an attacker can't just plug into your phone and use it. Besides, I just switch it off when I don't use it