[chamanbuga]

This is cap. I worked on heads up glasses, and one of our issues was the lack of integration with Apple's iMessage ecosystem. Device makers are willing to go through several security measures, like deploying the MFi chips and certification. However, at best this gives you access to the notification system, not iMessage itself. You are able to respond to messages via the notification framework, but not integrate directly with iMessage even after taking all security and certification efforts. This isn't a security play. This is a walled garden play.

[lynx97]

As a user, I am totally fine with Apple restricting access to iMessage. In fact, now that I read this, I want them to do this, thanks Apple.

[smaudet]

As a user, I'm not certain I completely agree.

Yes, I don't want apps accessing my messages surreptitiously. Points there.

However, what's wrong with allowing another app to post messages to my messages?

If I don't want it, let me turn them off. Maybe, as a UI expert company, it's easy "block app from sending me messages" when I get a message. Seems like something that should be fairly transparent to the (potentially misbehaving) app.

I use a Garmin, and Android, and I use it for messages all the time, it's great. I can't imagine not taking them. It's easy for me to block stuff I don't want, could it be easier, maybe...

But my point is this isn't something unreasonable for a user to want.

As a general aside, it seems when I hear about Apple products anymore, they are locked down, unintuitive, and generally just unpleasant. I even tried an Apple device again recently...eugh.

Apple is only "nice" for a certain, narrow segment of the population.

[bigyabai]

You can thank Apple for the Lightning connector and App Store too, for all the good it does everyone in the EU. If a company uses their power to prevent competition with their own products or services, the market's jurisdiction reserves the right to restore competition to their market and prevent the harms inherent to monopoly abuse.

[windexh8er]

As a user you should be fine with the ability to restrict access to iMessage. Not locked out of it with hardware you own and interoperability dictated by the vendor who also wants you to buy their watch.

[CivBase]

It's absolutely wild seeing comments like this on a supposed hacker community.

[cameldrv]

It's tricky. As a long time Apple user, I appreciate that they are privacy focused, but I also get a lot of spam text messages, calls, and notifications. It's become more and more annoying to deal with these on my Garmin watch and on my phone. I wish I had some sort of AI filter. For example, I want to get a notification if my Uber is running late, but I don't want one if Uber is offering me 20% off if I subscribe to whatever their monthly service is.

[footlose_3815]

"Apple knows best for us" is something I've gotten very tired of over the years.

This example might be apples-and-oranges when it comes to the protecting Apple protecting iMessage, but they often rob the user of the choice that other manufacturers offer.

For example: Hotspot. Android hotspot can be perma-on. iPhone hotspot cannot. It will always switch itself off after some time of non-use. When I asked an Apple employee about this (This was not his dept), his understanding was that it was for not-clogging up Wifi at-scale, and for users who forget to turn it off. But what about the users who want it on always, who pay their cell provider for the biggest pacakge? My computer goes to sleep, and the hotspot turns off and I have to go manually switching it back on because "Apple knows better". I want those choices.

[atmosx]

But the Apple Watch has access to iMessage right? :-)

[mwinatschek]

I’m with you on this one. I’d be fine with Apple opening up their ecosystem in a safe and careful way to other companies but only if the security stays, at least, at the same level - and if I’m able to turn off these options in the settings.

[Ajedi32]

This perspective is infuriating. It's literally Stockholm syndrome. Your device is being held prisoner in a cell that they refuse to give you the key to unlock no matter how much you beg, and you are actually thanking them for it.

How can you not realize that you're being abused?

[zamalek]

Other users might not want to, such are the reasons for toggles.

[burnte]

As another user, I don't want you making that decision for me.

[sirdvd]

As a user, I'd be totally fine with Apple letting me choose who can access to my iMessages.

[Der_Einzige]

People like you are why technology sucks. Please stop having this opinion or similar ones.

[bigiain]

Yep. Same.

I do not want 3rd party hardware/software vendors to have unrestricted access to the messaging app on my phone that is the only option my bank and PayPal and a bunch of other critical services use for 2FA.

Especially not when the software they want to run is JavaScript, with all it's well known npm dependancy nightmares, _and_ from a founder and team that openly admit iPhones are a second class citizen in their development planning and resources.

And especially especially not when the founders have previously shown their colors when they rugpulled all their customers and effectively bricked all the devices they'd sold.

Even with the limited iMessage/SMS access they have now, I wonder how long it'll be before we see a supply chain attack against Pebble exploiting some 11th level deep npm dependancy on something dumb like leftpad.js, that exfiltrates SMS 2FA codes and first anybody knows about it will be when a bunch of CryptoBros start complaining about their exchange accounts being emptied...

[alex1115alex]

Preach. My team's building an OS for smart glasses and some of our most common feature requests are iOS notifications & being able to reply to them.

We're going to have to do insane things to get them working. Due to how ANCS works, we're considering developing an ANCS "doohicky" (either a BLE pop-socket, smart-ring, or mag-safe wallet) which gets notifications via BLE & relays them back to the iPhone, to then send to the glasses. That would just get us the raw notifications, though, and wouldn't solve the issue of replying. The other option is a Beeper-like system in the cloud to bypass iOS entirely, but that also has downsides.

It's a total mess, especially compared to Android where you can just easily listen for notifications & send them to the glasses without much pushback from the system.

[Retric]

Every device you let in is another attack surface, and no certification process can eliminate it.

Allowing devices to view and respond to messages is inherently lower risk than allowing them to freely communicate with anyone.

[AndrewHart]

You could say the same about software and app stores. If safety were the top priority, then the safest option is to say no apps, but that isn't competitive or lucrative. Apple's approach is to create safe frameworks and a review process that allows the App Store to exist.

[tapland]

You could argue for only allowing communication through selected carriers, or connections to selected brand computers, and connecting to selected manufacturer Wi-Fi hotspots too

[presentation]

Yeah, but while Apple might consider the hardware to be "untrusted", at some point I trust the hardware I bought. Apple telling me I cannot decide what devices are trusted or not is annoying.

[tremon]

You do realize this is a very infantilizing attitude? Why can't the end user choose its own level of security vs usability? Letting a corporation decide this for all users is just creating a nanny state in different clothing.

[madeofpalk]

What are the limitations of integrating via notifications? That seems like the user-respecting method. For example, I don't use iMessage or SMS, but WhatsApp.

[criddell]

I'm just guessing, but notification suggests you could respond to an incoming message but maybe you can't initiate an outgoing message?

[8ytecoder]

The attack vector is a 3pt app being compromised - maliciously or otherwise - that logs/collects the messages - i.e, the apps themselves can be a threat vector. To be blunt and honest, I’m not sure I disagree. The notification framework seems like an okay compromise to me. I have used it with my Garmin bike computer and I’m more than happy with the level of integration.

[saagarjha]

The framework that lets you collect messages and ship them god-knows-where but not send them?

[DrBenCarson]

Might be a little bit of both but nothing you said there contradicts the original point--opening up iMessage integration to arbitrary bluetooth connections is a bad idea. It blows open access to all your messages...who knows, maybe even the e2ee keys. Law enforcement would have a brand new frictionless way into all your messages

[saagarjha]

I don’t think Apple would ever expose the encryption keys to your messages. Nobody would want it anyway: why reimplement the protocol when you actually just want to send and receive messages? And I fail to see why it would be frictionless for law enforcement, as they’d need to have access to your device.

[shuckles]

And what happens when the MFi chip is cracked, as it has been before, and Apple has to choose between permanently compromising their ecosystem or disabling support for a bunch of 3rd party peripherals?

[xnx]

Does iOS have third-party accessibility software that would have full display and interaction privileges?

[mceachen]

s/cap/crap/?

[eddythompson80]

Or they mean cap as 'lie' in genz speak. 'No cap' = 'No lie'. in a sentence "I saw an alligator today. No cap"

[internetter]

cap (noun, verb, slang)

(n.) A falsehood, exaggeration, or lie. "Saying you climbed a V10 after a month? That’s cap."

(v.) To lie, exaggerate, or be deceitful. "He said he coded the whole app in a day, but we know he capping."

[whyenot]

> This is crap

I appreciate you sharing your experience, I just wish you could have done it without this bit.

[pertymcpert]

*This is false.

[bloodyplonker22]

May I suggest using proper English? I believe part of the reason you are getting downvoted is due to the hat language you are using. Several people, understandably, will not comprehend.

[saagarjha]

Nothing makes their English any less proper than yours.

[boringg]

It might be a walled garden (which is a form of security) but thats also why a lot of people buy their products. Know your demographic.

[Aachen]

I don't think anybody buys their product for the specific reason that they can not do certain things. Nobody likes the restrictions. People buy a product because there are features (things they can do) that they want, including intangible features like usability (it's easier to make a full system backup on iOS than on Android, for example)

Edit: or maybe I'm wrong. I do know one person who bought a phone because it sucked, because they didn't want to spend as much time glued to the device. It was an Android with a tiny tiny screen, though, because iOS would not be allowed to run on hardware of your choosing due to Apple's restrictions... Either way, I guess there is a market of people who do want to inflict pain upon themselves, but this really does seem like exceedingly niche argument to me. Saying that the restrictions are the reason why their demographic buys their device is just buying into Apple's lies that fund their bottom line

[apimade]

As someone who has found a lot of holes both in design and implementation, which have been reviewed and vetted by excellent people and companies, which have all the appropriate certifications - no thank you.

I understand the benefit of an open ecosystem. Use your web browser, or a third-party app. The tech adopted by the masses needs guard rails and secure defaults.

I hated Apple’s ecosystem growing up, now I think it’s necessary. We can’t trust developers, or companies, that have competing interests to do the right thing.

[theelous3]

> I hated Apple’s ecosystem growing up, now I think it’s necessary.

Funny, because the overwhelming majority of people and systems exist outside of it and are doing just fine. This sounds like the sentiment of a crab in a bucket who's feeling quite safe from the sides since it was caught.

[saagarjha]

> Use your web browser, or a third-party app. The tech adopted by the masses needs guard rails and secure defaults.

Do you think “the masses” should not use web browsers or third party apps?