Apple vs the Law

> "...unfortunately, it's impossible to do all the complex engineering to comply with the Commission's current interpretation of the DMA..."

There's nothing complex and impossible about removing some "if" statements responsible for code signature enforcement.

It’s extremely complex. I’m not debating whether they should comply - they should. But it’s gonna cost them years of engineering effort, and maintenance far into the future. See, for example, BrowserEngineKit

https://developer.apple.com/documentation/browserenginekit

They needed to engineer, maintain, document and support a whole class of APIs so that third parties can create their own competitive browser engines (that offer JIT, etc) while still maintaining iOS sandbox security. There are going to be hundreds of frameworks, thousands of APIs, that will need to come to ensure compliance with the DMA

Or, they could just let their pocket computers run the software users download and install, like every single other computer ever made and sold, rather than special-case engineer padded cells for every use-case, application class, or bit of interoperability.

That is an oversimplification of what I stated.

Apple has a significant engineering challenge to turn their current operating system into something that allows side-loading similar to what Google offers. It's not a matter of "commenting out an if statement"

The current developer SDKs Apple offers are strongly tied to their services, which cost them money to run. So first thing is, they have to decouple that so developers can implement applications using a baseline SDK that does not use Apple services (no iCloud, no Maps, no HealthKit and so on)

I think it would be great for users if they did do this. It would be akin to what Google does by shipping and updating Play Services separately from the base Android install

The reason I linked BrowserEngineKit is because if you want to do this properly, you have to build something like Apple has built with that framework (which was built to comply with these policies). Take for example, implementing your own JIT: because arm64e uses pointer authentication, the system uses PACs to ensure that pointers into executable code have not been tampered with. Apple now develops and supports a whole slew of APIs like `be_memory_inline_jit_restrict_rwx_to_rw_with_witness()` in order for developers to manage this themselves.

You saying "just let their pocket computers run software users download and install" is not like every single other computer ever made and sold. This is a gross oversimplification of the modern state of computing, both on mobile and on desktop. There are reasons you don't want random developers loading code into your OS kernel, and Windows and macOS both have protections for this (though the CrowdStrike crashes recently shows what happens when those protections are lax!)

If Apple gave the users root and let them run arbitrary software and just didn't sign certificates for their infrastructure (for push for example) this wouldn't be a problem. Supposedly they've already even developed a VTE for iOS. All they need to do is have a toggle under settings to disable signature checking and ship the VTE so people have an escape hatch and everyone would probably calm way down.

Sure, I'd be into that. But that would not comply with the DMA I think? As in, Apple still has a ton of work to do, engineering wise, if they are to make their platform available to all in the way specified by the DMA

For example, I don't think it would fly that they could say to the EU: users who want a third-party browser just have to enable root access and lose access to all Apple services and authentication

Ah I forgot Apple advertises managing SSO as a feature of iOS and not an external service like sane people would.

Well. I guess they'll have to choose between opening it up like every other company does or acknowledge that it's a separate pay for service then.

They do a lot of that kind of thing and my answer for all of it is the same: Open it up to everyone or acknowledge it's a pay-for cloud service that has nothing to do with the actual phone OS. If people have root they can (and will) develop their own services that won't need that which would comply with the DMA.