| ▲ | develoopest 6 hours ago |
| I don't understand why ensuring general-purpose computing is not a priority of the European Union. All that talk about sovereignty, and we are giving full control of our digital lives to 2 American companies. |
|
| ▲ | littlecranky67 3 hours ago | parent | next [-] |
| Because the EU wants attestation for age verification, digital surveillance and censorship, not free software platforms that wont implement any of those. |
| |
| ▲ | monegator 3 hours ago | parent | next [-] | | lobbyist from the usual american companies are convincing "politicians" to sponsor those bills. | |
| ▲ | pbasista 3 hours ago | parent | prev [-] | | EU does not want that. Only a few politicians, some of whom happen to be currently in power, in the EU or elsewhere, are pushing for those agendas. But fortunately, they do not represent the majority. | | |
| ▲ | littlecranky67 3 hours ago | parent | next [-] | | Bank account register, EUDI Wallet, Chat Control, digital Euro… They might not be the majority but they manage to go through with all of this. | |
| ▲ | throw-the-towel 3 hours ago | parent | prev [-] | | If the majority is unable to do anything then their opposition doesn't really matter. |
|
|
|
| ▲ | vincnetas 5 hours ago | parent | prev | next [-] |
| Well that was the original android phone idea. Get a hackable open device that you can write apps for your self. Even attach third party hardware to it for extra functionality with lots of customisation. But this idea has mutated quite a bit. |
| |
| ▲ | mosura 5 hours ago | parent | next [-] | | Even by 2015 the noise in Google was “the Chrome OS model is better” with reference to them centrally controlling everything. Andy Rubin was no saint, on so many levels, but when he was removed from Android leadership and the Chrome culture effectively took over this was always how it was going to go. | |
| ▲ | dainiusse 5 hours ago | parent | prev [-] | | I fully agree with it. But I think Google also understands that the platform is unatractive for businesses. In my case I just don't do Android app because I know it is easy to just take and hack. It is not the case on iPhone. And my app is one time payment so the ability to just copy out the APK leaves me not doing an app at all... | | |
| ▲ | Jean-Papoulos 3 hours ago | parent | next [-] | | The people that go through the trouble of installing apks from random websites to not pay $1 are in the minority. What's more, most of them wouldn't pay that dollar if they couldn't find the cracked apk. So the only thing you're realistically doing is cutting yourself off of a huge market. Convenience sells, the Play Store does that | | | |
| ▲ | _imnothere 5 hours ago | parent | prev | next [-] | | > I know it is easy to just take and hack No you don't, otherwise we wouldn't have banking apps on it. | | |
| ▲ | dainiusse 3 hours ago | parent | next [-] | | It is a bit different. My app doesn't rely on 3rd party services at all. It just provides functionality.
It is not about breaking into someones account. I just know that the app can just be cracked - there are plenty of sites that do that for android. Because you can't just load your app on iOS - this is just not possible (well perhaps there are a few percent of some jailbroken iPhones, but that is neglibile). On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model. | | |
| ▲ | stevefan1999 3 hours ago | parent | next [-] | | > On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model. Think about Windows and software privacy | |
| ▲ | kmeisthax 2 hours ago | parent | prev | next [-] | | The only difference between iOS and Android when it comes to loading code onto your device is that, on iOS: - You have to setup a developer account with Apple first, and dev-signed apps can only be installed onto specific provisioned devices only[0] - The free tier of that developer account is inconvenient for actually using dev-signed apps as a daily-driver, and won't let you use certain entitlements - Apple's dev tooling is designed to make it feel like you can only sign code you're compiling yourself On the surface level, this might seem like a big difference, because Android has a command that lets you load arbitrary APKs with no particular fanfare or ceremony, while Apple's dev signer is buried inside of a compiler/IDE suite. But people have built tools to make it easy to take an arbitrary .ipa, sign it using your dev account, and resign it once the free tier's 7 day limit expires. Of course, this still requires you actually go and obtain an .ipa of the app you want to use, and Apple distributes App Store[1] app binaries[2] encrypted. That part requires actually having a jailbroken device to dump the app binary with. But once the app is cracked anyone can install it. If you want an actual "uncrackable" app you need to put a critical part of your app's workflow onto a server, and then have your app send an iOS DeviceCheck or Google Play Integrity attestation that the phone is running the actual App Store/Google Play version of your app. But that's also incredibly draconian behavior towards your customers as it basically forces your app to be always-online... which is why a disturbingly high number of games do this. [0] Yes, I know about Enterprise signing, but Apple specifically forbids distributing Enterprise-signed apps outside of your organization and those apps get revoked all the time. Signing with your own dev account is way more robust and that's what most iOS power users actually use. [1] I have no clue if FairPlay encryption applies to EU-DMA-compliance signed apps. [2] ONLY binaries - all your resources are unencrypted and can be downloaded off the App Store CDN and inspected by anyone. Code signing signatures do apply to resources, AFAIK | |
| ▲ | kotaKat 2 hours ago | parent | prev [-] | | > Because you can't just load your app on iOS - this is just not possible (well perhaps there are a few percent of some jailbroken iPhones, but that is neglibile). No, smart normies are sideloading with the 7-day limit and leveraging automation to have their pirated apps automatically re-sign and re-push. If you pay the $99 to Apple for a dev cert (or like $10 to a service that'll sell you a cert off someone's account), it'll even just sign out for the year for you. No screwing with Xcode or anything, just drag-drop-sign. Even gives you the options to patch the app out at resigning so you can do hacks and mods like the good old jailbreak days. https://sideloadly.io/ |
| |
| ▲ | graceful6800 4 hours ago | parent | prev [-] | | Have you tried extracting, decompiling, and modifying someone else's app? It wasn't hard before LLMs and it's nearly trivial now. | | |
| ▲ | skinfaxi 4 hours ago | parent | next [-] | | Is that not possible with ios applications? | | |
| ▲ | Xirdus 4 hours ago | parent [-] | | You can't sideload iOS applications. Meaning there's no point to doing any of the listed things. | | |
| ▲ | stevefan1999 3 hours ago | parent | next [-] | | You technically can sideload. For 7 days or on TestFlight | | | |
| ▲ | drdexebtjl 3 hours ago | parent | prev [-] | | Of course you can. How do you think developers test their apps? | | |
| ▲ | Xirdus 28 minutes ago | parent | next [-] | | Never did iOS development. I always assumed it requires active USB connection with a dev machine or an emulator. | |
| ▲ | actionfromafar 3 hours ago | parent | prev [-] | | Normal people can't. I'd bet more people run jailbroken than bothering with developer-mode sideload. |
|
|
| |
| ▲ | hparadiz 4 hours ago | parent | prev [-] | | The crypographic flow that allows payments to work is straight up pub/priv key encryption with one time use tokens. It's not something you can hack. As soon you see the token it's already been used and thrown away. So whatever nonsense about decompiling literally doesn't matter. | | |
| ▲ | jfyi 4 hours ago | parent | next [-] | | So your professional opinion is that the attack surface of mobile banking apps is limited to tokenized payments? Honestly, I'd be appalled if tokens were routed through my banking app. There is no reason the local client needs that data. | | |
| ▲ | hparadiz 3 hours ago | parent [-] | | My professional opinion is that APKs can be de-compiled regardless and that has nothing to do with tokenized payments themselves which are like you said handled through server-server communications at the payment processor level. Your phone simply sends a one time use token to authorize the transaction. | | |
| ▲ | jfyi 3 hours ago | parent [-] | | You were the one that brought up payments though. Nobody else specified. They just said it could be hacked, which you seem to agree with. | | |
| ▲ | hparadiz 3 hours ago | parent [-] | | I don't agree that your example makes sense. Don't feel like writing a wall of text. Zero justification for a locked down system. | | |
| ▲ | jfyi 2 hours ago | parent [-] | | What exactly was my example? You agreed with me already. Kind of odd to flip around now. > which are like you said handled Also, I corrected your misstatement about payments. They have absolutely nothing to do with decomp, and certainly can't be used to dismiss the entire attack surface of a mobile banking app. Your example is complete nonsense. You are really digging a hole here. |
|
|
|
| |
| ▲ | pixard 4 hours ago | parent | prev | next [-] | | He said his app is a one time payment. Presumably there isn’t a backend and he relies on App Store purchases. I know, it’s shocking an app could just be an actual application rather than a web view. | |
| ▲ | skinfaxi 4 hours ago | parent | prev [-] | | You can patch out the payment checks if you can decompile it | | |
| ▲ | hparadiz 4 hours ago | parent [-] | | The payment doesn't happen on the device. It happens at the VISA/Mastercard/AMEX level. So "the app" should be doing the validation upstream on the server side and simply reporting yes/no to the app. If you hack the yes/no okay but most payments are for physical things IRL so the payment gateway that is not on your phone is gonna be like ??? - in other words it's on the app not to trust a raw true/false signal and instead rely on server side checks. This is all irrelevant. I make regular massive purchases on my linux box where I can read the memory. It doesn't change anything. | | |
| ▲ | skinfaxi 6 minutes ago | parent [-] | | Ah I see you are focusing on apps that have some web component that would enable ongoing authorization. I was thinking about apps that offer a trial but you can upgrade with an in-app purchase and there is no ongoing service component. |
|
|
|
|
| |
| ▲ | curt15 38 minutes ago | parent | prev | next [-] | | Do you target macos or windows, which have always given users full control of software management? | |
| ▲ | drdexebtjl an hour ago | parent | prev [-] | | The fact that app piracy is more prevalent on Android has nothing to do with technical differences between iOS and Android side loading, and everything to do with the markets in which iPhones and Android phones are popular. |
|
|
|
| ▲ | inigyou 6 hours ago | parent | prev | next [-] |
| It's a regulated market economy. Someone has to actually make the product. They can't force someone to make a product. There's MNT in the EU. |
| |
| ▲ | mosura 5 hours ago | parent | next [-] | | Do what the Chinese did and fork Android. The EU has enough tech talent to do it, but the political and managerial class lack both the strategic ability or the willingness to adequately reward the effort it would take, almost certainly preferring to, again, outsource the concern, and then be shocked Pikachu later. Anyone doubting this should see how BMW think about their in car software. And that is for a supposedly premium product. | | |
| ▲ | inigyou 5 hours ago | parent | next [-] | | There's GrapheneOS. It's Canadian, not European. I'm not sure where LineageOS is from. BMW isn't the EU government. Like I said, someone has to actually do it. BMW Actually Did It in a really user hostile way, and that's the best we have. Why is nobody Actually Doing It but good? Or why aren't we buying MNT products? | | |
| ▲ | mosura 4 hours ago | parent [-] | | BMW behaviour is perfectly representative of the EU mentality. As is your comment. It is basically “someone else should do this properly and I will take the benefits” but not actually willing to put up the hard bit themselves. | | |
| ▲ | inigyou 4 hours ago | parent [-] | | I'm talking about the government of the EU. You seem to be talking about all the countries and the people in the countries. | | |
| ▲ | mosura 4 hours ago | parent [-] | | You need to parse the word mentality in context. The root problem here is the EU is culturally broken, and until some grand disaster will simply decline ever further with everyone involved wondering why no one else is doing anything about it. | | |
| ▲ | inigyou 4 hours ago | parent [-] | | Why don't we export some better culture to Europe then? That would be a good place and now would be a good time for Americans to flee to. | | |
| ▲ | throw-the-towel 3 hours ago | parent | next [-] | | Take up the White Man's burden—
Send forth the best ye breed—
Go bind your sons to exile
To serve your captives' need;
To wait in heavy harness
On fluttered folk and wild—
Your new-caught sullen peoples,
Half devil and half child.
</sarcasm> | |
| ▲ | mosura 3 hours ago | parent | prev [-] | | You couldn’t epitomize the problem more if you tried. |
|
|
|
|
| |
| ▲ | ptero 4 hours ago | parent | prev [-] | | If the govvies (any govvies; there is nothing specific to EU here) drive that process of forking a large, powerful, universally used system you will end up with more surveillance, not less. Because kids, because pornography, because terrorism, whatever. This is too powerful an option for control freaks to resist. | | |
| ▲ | mosura 3 hours ago | parent | next [-] | | And this is why everyone gives up on doing anything while standing around complaining that no one does the right thing. What is so pernicious about the EU approach is the enthusiasm and efficiency with which it stops anyone from doing anything, while simultaneously attempting to regulate what everyone else in the world can do. If they put even a small part of that energy into encouraging the right thing to happen they would be in such a better place it is insane. | | |
| ▲ | inigyou 3 hours ago | parent [-] | | Not really. They weren't saying if it existed in the EU it'd have to surveil. They were saying if the EU government created it it'd have to surveil. | | |
| ▲ | mosura 3 hours ago | parent [-] | | Honestly your reading comprehension is not good today. They said if the government “drive the process of forking” which could mean encourage a group of academics to do it, or a commercial consortium. It does not mean the EU government take on the task themselves. * It is self evident from actual EU behaviour that any mobile os that gets to users will be legally required to be a surveillance disaster area, regardless of origin, and the only people that have prevented this already are evil US corporations. * edit to add, the EU did encourage many technical efforts vital to the mobile phone industry at different times with a mix of funding, political support etc. The Arm people would tell you AMBA (a standard relating to SoC component integration) wouldn’t exist without this, and yet no one would classify this as “a creation of the EU” but very much enabled by them. For whatever reason since about 2005 their strategic ability in this area has not merely disappeared but become actively wrong. | | |
| ▲ | inigyou an hour ago | parent [-] | | If the EU government told a group of academics "hey, go make a phone" it wouldn't have mass surveillance. If it insisted on being closely involved in the process, then it would. |
|
|
| |
| ▲ | inigyou 3 hours ago | parent | prev [-] | | I'm not 100% sure about surveillance but you will definitely end up with the most milquetoast risk-averse bland corporate system ever, complete with 6 months of paperwork and KYC to get a certificate to sign any executable with your real name, so it will be allowed to run. |
|
| |
| ▲ | p0w3n3d 5 hours ago | parent | prev | next [-] | | They can make the product according to rules that are imposed on them. One rule: allow privacy. Unless the privacy is not in the field of interest of both the producer and the EU | | |
| ▲ | inigyou 5 hours ago | parent | next [-] | | Yes, you could make the product. But you're not. And neither is anyone else. And there's nothing the EU government can directly do about that. | |
| ▲ | vovavili 5 hours ago | parent | prev [-] | | Then why are you not making it? |
| |
| ▲ | drdexebtjl 3 hours ago | parent | prev | next [-] | | They can’t force someone to make a product, but they can force someone to choose between making a product or exiting the EU market. In practice they’re the same thing. | |
| ▲ | cmeacham98 5 hours ago | parent | prev | next [-] | | While the EU and its member countries can't (or at least morally shouldn't) force people to make the product, if it was a priority they could incentivise it with funding, tax breaks, etc. | | |
| ▲ | inigyou 5 hours ago | parent [-] | | NLnet funds a lot of things, few of which get very popular. It keeps a lot of FOSS gears turning but it's not making the next iPhone. |
| |
| ▲ | toymin 5 hours ago | parent | prev [-] | | They could give more funding to SailfishOS, for example | | |
| ▲ | inigyou 5 hours ago | parent [-] | | Sailfish would have to ask for it. Possibly via NLnet. Have they? And they need a plan to spend it. |
|
|
|
| ▲ | yorwba 5 hours ago | parent | prev | next [-] |
| There is no shortage of general-purpose computing hardware in the EU. If you need some general-purpose compute to make a car, an oven, or a phone, you can get it. That consumers mostly buy special-purpose devices that don't always allow them to make full use of the possibilities of the hardware is hardly a sovereignity challenge. |
| |
| ▲ | zb3 4 hours ago | parent [-] | | Show me where I can get a general-purpose computing hardware with 8GB+ of RAM that fits in my pocket and has a touchscreen. | | |
| ▲ | yorwba 2 hours ago | parent | next [-] | | Fairphone? https://www.fairphone.com/the-fairphone-gen-6#f_slide_1 But also, I doubt any polity would have its sovereignty undermined if their general-purpose computing hardware doesn't fit into their pockets. | |
| ▲ | rerdavies 3 hours ago | parent | prev | next [-] | | My recently-purchased Google Pixel 10 Pro has an unlockable bootloader. (Although it may be locked if you buy it through a provider). And, for a nominal one-time payment, you can register as a developer, and compile, install and run absolutely anything you want on a non-rooted Android phone with a locked bootloader (within the constraints of the security system, which is, of course, A Good Thing). | |
| ▲ | RobotToaster 3 hours ago | parent | prev [-] | | and a 5g radiotelephony MODEM. |
|
|
|
| ▲ | 927373912092 4 hours ago | parent | prev | next [-] |
| Sovereignity of the EU regime, not of their subjects. Why would these corrupt bureacrats give up their full control over the lives of those who didn't elect them? |
|
| ▲ | petra 5 hours ago | parent | prev | next [-] |
| I'm sure Europe currently uses the surveillance capabilities of those systems to prevent bad shit from happening. So maybe they prefer another solution to the sovereignty issue. |
|
| ▲ | vlyan 4 hours ago | parent | prev | next [-] |
| why do you still believe that EU is a benevolent entity? |
| |
|
| ▲ | fsflover 2 hours ago | parent | prev | next [-] |
| Because the Free Software Foundation Europe (https://fsfe.org) that fights for this has a too low support of people. Please support them if you care about it. |
|
| ▲ | 5 hours ago | parent | prev | next [-] |
| [deleted] |
|
| ▲ | okanat 3 hours ago | parent | prev | next [-] |
| There is actually a law being made called Digital Fairness Act at the moment. However the working group hasn't finalized it yet. Note that there are competing political groups and MEPs in the EU from far right neo-fascists, to corporate lobbyist right-wingers, to Greens and even digital privacy maximalist Pirates. Lobbyist right-wingers are now the biggest group and they pass laws like Chat Control because it gives the impression that they do something and it makes corporations money. EU has been founded as a maximally neo-liberal union. The broad human rights are remnants of the Soviet scare and world-war trauma. |
|
| ▲ | legastenigga 4 hours ago | parent | prev | next [-] |
| [dead] |
|
| ▲ | pitchlatte 5 hours ago | parent | prev [-] |
| yeah but processors phone home anyway at a level beneath the OS and there’s no european chip development worth mentioning. so i’m not sure real sovereignty is ever going to be possible. crazy considering ASML being in europe. |
| |
