alt Hacker News> Many of the things you're listing are the exact things the platforms would have to be banned from doing by the regulation you're proposing because they're the mechanisms used to exclude competitors.
And they should still be banned from forcing apps to do it under their arbitrary judgements in order to participate on their platform. That isn't the same thing as preventing them from doing it. Some people honestly think they love walled gardens (they don't), but some people honestly need walled gardens. There should even be competing walled gardens. Let me install the best kids app store for my kids, and the best grandmas app store for my grandma.
I'm also not sure that attestation should be banned at the app store or platform level; it's a service. I'd ban it at the bank and merchant level. Attestation should be a tool for the user of the device (just like everything else on the phone they own.) They should be able to get it to attest to whatever they want to get it to attest to - if I'm a company and I issue my employees phones, I might want to make sure those phones haven't been tampered with. If I'm a parent and I issue my children phones, I might want to make sure those phones haven't been tampered with. The problem comes when arbitrary people are using it to make sure that the user hasn't tampered with their own phone since it came from some official list of blessed companies.
Let me install the best kids app store for my kids, and the best grandmas app store for my grandma. Let me be able to use attestation to make sure their phones haven't been altered since the last time I checked.
> If apps have to be signed by the platform
I'd like to get back to apps being signed by upstream, so we know they actually come from the author. I couldn't care less if the platform offers a service which verifies those signatures, and if almost everyone uses that service. That's just DNS. If your platforms service becomes hostile, there will be cheap/free competitors, just like DNS.
Just agreeing loudly. But the problem with F-Droid is that it is to be a store that has been blessed by Google in order to avoid legal questions. I know that this is not their fault, and that they hate it. I exclusively use F-Droid and don't even have a Google Play account, but if they started making decisions that I couldn't stand (they haven't, ever) I wouldn't have any alternative.
I remember the bullshit settlement of Microsoft antitrust is that they had to place a modal popup do select a default browser (that I never saw, once, in any context.) No reason why the platform's store can't be demoted to one of a number of stores other than that it is a profit spinner.
> And they should still be banned from forcing apps to do it under their arbitrary judgements in order to participate on their platform. That isn't the same thing as preventing them from doing it.
If they do it and it's enabled by default then they still get to grief their competitors because by default anyone who tries to use the competitor gets a big scary red box that deters adoption and has to jump through a bunch of hoops to get past it. It also thwarts adoption of competing signing alternatives because >90% of people will use whatever the default is even if the alternatives are at least as good.
> some people honestly need walled gardens
"Walled garden" is an Orwellian term. It's meant to imply that someone is curating what's inside it and not letting in things you don't want, and that is indeed a useful thing. But then people use the same term to mean a "garden" that locks you inside of it rather than locking bad things out. The only people who need that are small children and adults with mental illnesses severe enough to justify them having a guardian assigned to make their decisions for them.
> I'm also not sure that attestation should be banned at the app store or platform level; it's a service.
It isn't a service at all. The device contains hardware to sign the state of the device using a protected private key. Solving the problem is very simple -- you ban the device from coming with any private key already installed that the user can't freely extract. Then the root of the chain of trust is the customer's public key, not the vendor's, and whether a device is authorized comes down to whether the user's public key is authorized rather than the vendor's, which in turn makes the system vendor-agnostic.
> That's just DNS. If your platforms service becomes hostile, there will be cheap/free competitors, just like DNS.
DNS is actually a pretty terrible model because the "competition" is a fraud. There are registrars and registries and the registrars compete with each other but the registry still sets the price the registrars pay and the registries have a monopoly over every name in that TLD, so the competition can't actually get you a lower price than the monopoly registry itself sets. And the registries only compete with each other to the extent that you think that example.dental is valid substitute for example.football (no, sorry, those are both the same registry anyway) and to the extent that example.co.uk is a domain you could get instead of example.com rather than needing both. Meanwhile ICANN charges an extortionate amount to anyone who wants to become a registry and the entire system is set up to encourage squatting, to the point that the registries are now doing it themselves rather than making any attempt to impede it.
In general if you want something to work well you need to make it a protocol rather than a service. As soon as you allow a central chokepoint to exist you'll have a troll jumping out from under the bridge and trying to collect tolls.