Apple restricts Pebble from being awesome with iPhones

Every device you let in is another attack surface, and no certification process can eliminate it.

Allowing devices to view and respond to messages is inherently lower risk than allowing them to freely communicate with anyone.

What are the limitations of integrating via notifications? That seems like the user-respecting method. For example, I don't use iMessage or SMS, but WhatsApp.

May I suggest using proper English? I believe part of the reason you are getting downvoted is due to the hat language you are using. Several people, understandably, will not comprehend.

s/cap/crap/?

*This is false.

Yes? Imagine a bug where iMessages are leaked over Bluetooth when a user has installed an application that integrates with some watch brand. Bring this to an airport and you can steal hundreds/thousands of messages from a wide range of people. That’s widely different attack vector than targeting macOS.

That said, I don’t see why Apple can’t provide toolkit/certification that will make it safe to communicate over Bluetooth. They already have it in-place for Apple Watch.

I agree with you, but your iPhone forwards SMS messages, but not iMessages, and there's a trust relationship between the devices through Keychain. Still, doing it blindly over BLE is a scary proposition.

Same with Phone Link on Windows.

How would step 1 improve security over not allowing third party devices to send messages at all?

We have decades of experience that users will blindly click whatever prompts they need to make the app work.

I absolutely hate these sorts of nagging popups and I’m happy that a vendor I already have to trust doesn’t pop them up when I acquire a new product and sign it into my Apple account.

Imo, if this were to happen, it should happen by allowing devices like the pebble watch to sign into an Apple account and acquire permissions through that process rather than nagging on my phone on pairing.

> any process running under your user can access

You will need to grant that app explicit Full Disk Access permissions in order for it to access that folder.

In what world is screenshotting an iMessage enough to move them out of the security boundary

I don’t think you understand what the security boundary of iMessage is.

People’s phones got compromised by NSO sending images to them via whatsapp that used an exploit in one of the image libraries to run a malware payload. The security boundary isn’t about whether you can see your own messages, it’s whether bad people can root your phone by getting untrusted code to run. That’s a very different proposition if iMessage is a single codebase that they fully own end to end versus it has a plugin ecosystem. Having such a plugin system widens the security boundary by adding a much larger codebase that would require trust.

Did you mean to reply to a different comment?

Hey, there we are.

That's exactly it.

You've always been able to use Applescript to send iMessages on a Mac.

If your value prop to customers is seamless and secure default behavior, then of course blocking insecure peripherals aligns with your financial interests. This doesn't seem nefarious at all to me.

That's the problem. Apple has two arguments. It obviously only tells us about the one that sounds good.

It's not a problem, it's a good thing that someone's financial interests intersect with sound security practices.

That like saying "people want reliable cars" conveniently aligns with Toyota's interest and implying there's something wrong happening.

I'm glad Apple's financial interests are aligned to my interests of not letting the eco system turn into a shitty Android-esque privacy wild west.

Yes, you could. It's indeed troubling to see this mindset on HN. We have an overflow of professional "explainers" these days, we need more doers and fighters.

Unlike Microsoft of the 90s, there are alternative mobile operating systems that are actually competing with iOS and Apple, so the argument isn't the same. In fact, people point out that iOS doesn't have majority share when you look at global usage, and only has a small majority when you look at the US. Microsoft's next nearest OS competitor didn't make a browser, and a lot more than half of computer users were using Windows.

Making your own products interoperate better than competitors' products is pretty typical and I don't think it rises to the level of "anticompetitive practice."

If you don't like it (and I can totally understand why), there are numerous other smartphone makers out there with products that allow better integration with these watches and you're free to buy one.

MS didn't get into trouble because they went after competing browsers, they got into trouble for doing that while also having a monopoly on PC OSes. Apple doesn't have anything like a monopoly in this market (their US market share is about 50%, worldwide is around 28%).

I honestly don't care about Microsoft bundling a browser. The real problem was that they intentionally broke web standards to push websites to "work best on Internet Explorer," so even those who chose not to use Windows were affected.

Not any anticompetitive practice, just the ones that allow in competitors who have different security models for human/computer interaction.

Imagine if you could swap out Siri for Alexa. The privacy guarantees are nothing alike. People buy iPhones because they prohibit unsafe choices.

To add: if the goal is to make a system where the yes/no answer is irrelevant, then it's a system when very horrible UX: the pop-up shouldn't be there in the first place!

This also doesn't address the obvious solution: safe and easy defaults, and an option for manual overrides in advanced "I know what I'm doing" settings.

And no pop-ups at all.

Don't forget the classic "Oh, that 3rd party app/feature is so popular, I bet we could build a identical/slightly less useful thing ourselves so people don't have to use other things than Apple software ever"

I am aware that apple blocks certain functionality to maintain a cohesive and secure experience. It is THE reason I buy their products, I want the curation. Otherwise I'd buy an android device.

What kind of trouble does she have managing rcs conversations? It works fine for my partner on their iPhone.

If you don't like an iPhone, don't buy an iPhone. Don't legislate your consumer preferences on me.

100% agree that decisive anti-trust action is needed. In addition, many of us can (and do) choose to just not participate (to the best of our abilities) in the nonsense from these companies.

Many of us are not required to use Apple devices (and we choose not to). Additionally, many of us are able to choose privacy-respecting Android variants (like GrapheneOS). It sometimes is less "convenient", but IMHO it is better then surrendering to the duopoly...

Apple Silicon could not have existed without the vast amount of capital that a trillion dollar company like Apple could've mustered, TSMC might even be one or two generations behind where it is right now if Apple couldn't afford bankroll the latest generation and temporarily monopolize it, and for that reason alone I'm fine with the state of affairs

It's also great that Apple is able to negotiate with countries as an equal wrt. user privacy, iMessage is the only e2e encrypted messenger allowed in China, and is currently able to mobilize a significant political movement against mandatory backdoors in the UK

> Mobile computing is de-facto owned by two companies.

Still beats the Windows era when a single company owned desktop computing (which was the only type of computing for consumers).

> We've wound up with Standard Oil 2.0

Skipped right over Microsoft!

> We must break up these companies.

With Microsoft it was a complex consent decree. (The initial ruling to break up the company was overturned.)

I mean you could just not buy apple's stuff

isnt it efficient though for these capabilities to exist? why not nationalize them instead and make them accountable to the public

I don't think we need any major government intervention.

What we need is a law that requires companies like Apple to allow their customers to install and run the software they wish, and provide external developers with the same OS features their internal teams have access to.

Europe and Brazil already have such laws, though they could go farther.

In the US we had this bill, which would have covered most of these issues and had bipartisan support: https://en.wikipedia.org/wiki/Open_App_Markets_Act

Trouble is that most major governments are democratic, meaning that the governmental powers that be are the very same people (the population at large) who are already not willing to do anything about it. The majority will clearly isn't there at this time (that can change in the future, of course).

Government is a useful tool to clean up the dissenters who wish to act against the will of the people, but under a democracy you cannot believe that the majority are the dissenters. That defies the entire premise.

Remember when people realized that Apple apps were bypassing application-level firewalls like LittleSnitch?

First it was denied, then it was a bug, then it was a "temporary workaround" while ... something ... was updated.

And that was just ... accepted as an answer. I could never fathom why TextEdit might need a kernel extension in the first place, let alone unfettered/unmonitored network access. I don't even think it was necessarily nefarious, just "we know best, shut up and buy".

I mean the reason is because Apple, the people who made the security boundary, and Apple the people who made Quicktime are the same people.

I'm not saying it's not anti-competitive but it's fine from a security context. Apple knows exactly how Quicktime behaves, that it doesn't act maliciously, and can't be updated to do so.

Replace MDM administrator with ‘malware author’ or ‘spy software’ to get your answer. There is functionally no difference between a regular company doing MDM wanting to bypass camera permission prompts and a hacker who has tricked/forced the user into enrolling into MDM.

Now, replace ‘Apple’ with ‘malware author’. What’s the difference? Well, for one, a hacker has nothing to lose and everything to gain from snooping on your webcam. Meanwhile, if Apple mishandles this permission or used it to beam video data to HQ, there’s a high likelihood hundreds of millions of dollars of iPhone or Mac customers are lost, resulting in billions of dollars in stock value loss.

I like that the EU forces Apple to be more open. If you don't, just don't come to Europe.

"Love it or leave it" - why not make it better?

The question is more, where is that 'force' expected to come from which should make them change their way? Just hopes and prayers?

Likely a condition from IP holders to make sure the play is counted and paid for.

Do you listen without your phone? Ime the app is fine with phone nearby, but for independent playback from just the watch it’s trash.

Music isn't in the list of apps and I don't see any way to add it. I would love to fix this in my car radio.

Just did this, pressing play on my headphones still launches Apple Music.

Not only every time they connect, but every time they are paused or stopped too. My car has this problem. It was not possible to pause the music, it would always immediately restart play.