So, welcome everyone. For our next talk, we have here Mark Brudemon, who is, I would say,
the expert on AppStores on iOS. So, I'm very happy that we have him here with us,
heading over to you, Mark. Thank you very much.
Thank you, everyone, for coming. This is a talk on Free Software AppStores for iOS and how
that works with the DMA and how things are going to be moving forward to that. My name is Mark Brudemon,
the founder of the project. I'm a software developer, really, I'm a programmer. I've been
software for 25 or more years. I've been developing apps since 2008 for both Android and the
iPhone. I've developed dozens of apps for large companies, for myself, for independent
organizations, for startups, all apps, great and small, really. So, I've gone through the process
of both designing and building applications, as well as going through the distribution process.
Actually, I had to get that through the stores to the end users. So, I really know sort of
all the levels of the process. I will disclaim since this is a legal track. I'm not a legal expert.
I'm not a lawyer. I do not have any formal training in law either American or European or anywhere else.
I do seem to have evolved into somewhat of a policy expert, not necessarily as an aspiration
of mine, but just through us, Moses, of working with some of the aspects of the digital
market's act and advising various organizations around that. The App Fair Project is a
app store for a free and open source software. It aspires to make the software available for the
iPhone and for Android. I really first came up with the idea. It's been justating ever since I
started building apps and encountering how difficult it was to get it into the hands of end users.
But I really started putting together the pieces in 2020 and I found the organization in 2022.
It is a 501C3 nonprofit based in Massachusetts in the United States and we also have a branch
based in France, map fair friends. The mission is to facilitate the creation and distribution
and mobile software applications for the public good for everyone. That's really a core
component that we want to get applications into everyone's hand. In general, this sorts of
apps that the App Fair aims to distribute will be digital public goods. We'll be generally
useful things that people in their everyday life can get utility from. They don't need to be exotic.
They can be weather apps. They can be transit apps. Time tables. They could be absolutely
paid for parking. They can be social media apps. In general, the apps have a broad swath of humanity
will find useful and are sometimes underserved by commercial application creators.
There are to be 100% free and open source software. Everything that goes into the application
both the top level user interface as well as all the components that the application uses
needs to be open source. It needs to cost zero money. There needs to be no fees to the
user's pay or subscriptions. But it must not have any end user monetization goal whatsoever.
This leads into the trustworthy aspect of the project. That's in the universally accessible.
On all devices, iPhones and Android that essentially makes up 100% of all the mobile devices
people use. All languages, one of the goals of the project is to make it so someone can
write an app when he speaks English but have a translated into 50 languages so that a grandmother
and Cambodia can use it. Everyone is able to get the benefit of this labor. All abilities
want to reach out to all levels of accessibility needs that people have based built on top of
the accessibility technologies that these mobile devices have. And then they need to be trustworthy.
So there's not going to be end user monetization. There's not going to be any built-in advertising.
There's not going to be any tracking surveillance. And no analytics or telemetry. Basically,
they aim to respect the privacy of the end user and ensure that any time the application
is collecting data. It's because they actually need to collect the data for the functionality of the
application. For example, whether application might ask for your location. Simply so it can tell you
what the forecast does in your area. Not so it can then ship off your location information to a third
party, a data broker who then packages it up and sells it to some third party.
And the technical outline of how the project works is fairly straightforward.
If you're familiar with, say, the app Android project for Android, for Debian, for how they manage
their app, software repository, or for HomeBrew for Mac OS, the idea is generally that you
have application developers. And these might be individuals. They could be students. They could be
obvious. They could be organizations, nonprofit organizations, governmental organizations,
schools, universities, or it could be commercial entities. As long as they have a goal of creating
something that is not going to be monetizing the end user, anyone can create these things. They
form their own organizations. They build the apps independently of the project and then they submit
the source code of the application to the app to their project itself. And the app to their project
will be made up of a combination of automated mechanisms where you actually take this source code
and you build the application and scan it for bad actions from malware, things like that,
make sure that it's truly all open source. And then I'll have a human component. It'll be,
you know, people will review the applications. You know, is this really the kind of application
that we want. It'll be maintainers who help provide feedback to the app creators when they're
needs to be changes to be made to work on, say, updated versions of the, of the operating systems.
And translators, and that's a big component. The app fair will contribute people who are experts
in localizing the applications each individual, each individual, you know, language that we support.
And then the app fair packages the distributes it and then the app fair client application
will then be the sort of front facing mechanism for both iPhone users and Android users to be able
to browse, search, review, download, install, and update applications. So that's more less
in outline of the project process. One of the advantages of using the app fair project is that
you don't need to sign up for anything. There's no fees, there's no registration.
You know, you don't need to accept terms and conditions like you do to distribute an application
on, say, the place door or the app store, you don't need a special account. The app fair project aims
to provide automated distribution for you so that you don't need to go through the manual process
for distributing on multiple app stores. And, you know, we'll help with translations,
accessibility compliance. And the big thing is a trustworthy and a seal of approval. One of the
problems is free software or software that is ostensibly free zero cost on mobile devices is that
you never really know what the motivation of the person who developed this software. So there's
a lot of distress for, say, free weather applications for any free application that might be looking
at your contacts, books and things like that. There's just saying that if it's free, then you are the
product. That's not true with free end opens for software, but the end users don't know about that.
So things distributed through the app fair project will have the seal of approval,
this sort of guarantor of trustworthiness that there's no sinister nefarious money
gathering operations going on behind the scenes. So how do you build an app store?
An app store is really just an app that installs advantages of their applications. It's not really
conceptually all that complicated. It's an app that installs apps. How do you do it on Android?
On Android is very well established. There's a lot of different app stores on Android. I mentioned
the app to write project. There's a lot of companies have their own app stores as Amazon,
Samsung Galaxy app team mobile. And in China, every app store is third party app stores. And
on first party Google Play app store, because Google Play services is not available in China.
And essentially the technology behind it is well established. It's been around since the beginning
of Android. You've set a permission in your applications metadata and install packages.
You've signed in and distribute your app store application. They have a published API that you
call that says download this application package, validate it, install it, update it. And you don't
really need to go through Google at all to do this. You can just go home today. You could write an
app store app. App is start distributing apps. It's pretty straightforward. But the iPhone side
is an important side. This is a talk about iOS and one of the central components of providing
universal access is providing access to all devices. So that's really an essential part of the
App Fair Project's mission. And you basically can't build an app store for the iPhone.
Historically, there was something called citya. It's actually from 2008. It predates the Apple
App Store. They used the ability to access private APIs if you jailbreak your iPhone, which is essentially
hacking into your iPhone by passing some of the restrictions that are set in place. And then you can
talk to private internal APIs. They've been using that to build and distribute applications for
a very long time. But it's a widely considered be a fairly extreme measure to jailbreak your iPhone.
And Apple is always closing the loop holes that enable people to do it every year. So it's an
ongoing cat and mouse game between the development community that brings these jailbreaks to the
surface. And Apple is plugging the holes all the time. It's not really a sustainable way to get a
widespread adoption. And then there's these tethered workarounds in order to do it. If you are
trying to up as a developer for the iPhone, then you have the ability to launch and run your
own applications. You need that in order to be able to develop and debug your own app. And so
that these various tethered workarounds like all store until recently, size store, trolls store.
That basically take advantage of that. They say, okay, you can download an application for
somewhere else. You can sign it with your own developer certificate and then you can install it.
But there are no published APIs like there are on Android for installing or updating applications.
And that's pretty much the roadblock to project like this. You can't really get past it.
That is until the DMA, which is the top topic of this conversation.
So in case people haven't heard of it, I mentioned most of you have the Digital Markets Act,
aims to create a level playing field. It wants to make the digital market fair and more
responsible, more contestable. And its history is that it was in 2020, it was proposed. It got
signed into law in 2022. 2023 was when their designation of gatekeepers took place and there are
five gatekeepers. The ones that are relevant to this topic are Google and Apple.
And then last year, a little longer a year ago, was a deadline for compliance for the various rules
that were laid out by the Digital Markets Act.
So the Digital Markets Act is a big act. A lot of components has eight major sectors.
The one that affects us, my project and this talk is the last one here, the online
Intermediation Services. In other words, the Google Play Store and the Apple App Store.
All of these are important. This is the one that is relevant to us.
And so the online Intermediation Services has a bunch of requirements and generally reading through
the articles, the important ones are that they need to allow third-party app stores and side-loading.
Side-loading is the term that has evolved to mean direct installation of applications
straight to your device. Fair and non-discriminatory access to these services.
No preferential treatment. They basically can't favor their own services over the services of third-party.
You need to have a lot of interoperability requirements. Terms of conditions need to be transparent.
And they can't have any anti-steering. They can't force you to steer people towards their own
gatekeeper services and away from competitive services that might be available.
So here's what I thought would happen when the designation was made before the compliance plan,
you know, came out is essentially that they would do what Android does.
Add the ability to self-sign your own applications. And the technology exists for this already
is a popular misconception that you can't side-load on the iPhone. That's not true.
You just need to have a special enterprise certificate, which Apple only hands out to a select few
large corporations that pay a lot of money. But once you have this certificate, you can
develop your application and you can sign it with a certificate and you can email it to your staff
or you can put it on a website to upload. You can distribute it however you want.
And it is for all intents and purposes, it is side-loading. However, you need the certificate.
If someone gets their hands on a certificate and starts signing apps and just giving them away
for free at anyone, which happens actually quite a lot, Apple closes that loophole and they
put the kibosh in or certificate they resend it and then all the applications are not allowed.
So it is possible and it is very straightforward. And then the second thing they need to do is
actually publish app store APIs because the first step allows you to side-load things directly.
The second step is what you need to actually build an app store app and app that distributes and
maintains other applications. And there are publish APIs in Android, there is something called
package installer that lets you call functions, they can install package, and they exist on Apple
as well in this mobile installation framework. It is what city airlines are using. And they have
got functions, mobile application, install, and install. You can figure out what these functions do,
but these are currently private. So basically make this, so anyone can get it, make this, so
you can make an app store app and that is all you need to do. That would be fully compliant,
make everyone happy, make my life easier. So here is what actually did happen.
So in order to go through this, you basically have to do all of these things. The non-fansy
stars are the ones that are pre-existing requirements to build and ship an application for the Apple
app store, the fancy stars are the new things, the new steps you need to do. So you always need to
sign up with Apple except their terms and conditions which are frequently changing and you get
zero notice when they're about to change. And if you don't immediately adhere to them,
you can no longer issue updates to your applications. And then a way to approval, hope that they
approve your account. You need to pay an annual fee, $99 US dollars. You can get an exemption from that
if you're a non-profit or educational institution. New step is you need to agree to alternative
EU terms addendum, which is quite long and involved and has a lot to say about how you can monetize
your apps differently. Then again, you need to build and upload it to the airport, all the
app store connect portal. And once you've done that, you need to request a distribution token from
alternative app marketplace. So say the app fair is an alternative app marketplace. You want
to distribute an app through me. What you do is I give you a token, a passcode basically. You build
your app, upload it to Apple, and then upload that token to Apple. And they take those two things
and say, okay, this app, if we approve it, is going to wind up being able to be distributed through
the app fair through me. You go through app review. It's what they call notarization, but it's
really just a subset of app review. It's a combination of automated scans and human involvement.
You know, that could take an hour, could take a month. Once it passes, you get a token for the
particular version of the application that was approved. You hand that back to the alternative
app marketplace, they're able to download your signed and approved application and then finally
the distributed. And then lastly, you have to pay there for someone notorious Quartingology fee,
which is 50 cents for every download of your application beyond the first million in a year.
And that's only for monetized applications. But it is definitely a hindrance to anyone who thinks
I'm going to make this hit app that billions of people use, you're going to be hit with a massive bill.
So this is the process that they consider compliance that is the facts on the ground right now.
The actual app review subset, the Notarization Guidelines, contain a lot of guidelines around
the sort of content that you can have in your application. It's not just around security.
I won't go through all of these, but there are some fairly ones that should give pause to someone
who thinks that this is a sort of clear and objective standard for a third parties.
One of them being something like this, where they say if you market your app in a misleading way,
your app in a little bit removed, it'll be blocked from being installed. And you might have your developer
account terminated, meaning you can never make an app again. What is the definition of misleading
is there any adjudication mechanism for this, is there any appeal? No, there's not. It's just
whatever they consider to be misleading. So these are the sort of some things that we find
really deeply problematic with the app review subset that you have to that you have to go through.
You can look at all of these guidelines, both the full app review guidelines and the Notarization
subset app store review guidelines. It's a nice little picker where you can toggle between the two
two modes. So that's in order to create an app. What is it? I'll turn about Marketplace
distributor and need to do. In other words, what does the app care need to do? They have to,
again, register with Apple, agree to terms and conditions. You need to request and Marketplace
entitlement. And that has various rules. One of which is that you need to have a base in the
European Union, which is why we started the app fair France. You need to provide a 1 million Euro
annually renewable business letter of credit. And then you need to actually build the app store app
and then submit that through app review. In order to actually process the applications that you
receive in distributed, you basically need to set up a server that accepts the handoff of the
application that Apple passes off to you after the developer signs and uploads it. And then once you do that,
you host the application and then you can have your application talk to the server and redistribute
these things. So what are the barriers to having a free software app marketplace? Obviously,
I mentioned the 1 million Euro letter of credit for Marketplace entitlement. That's a big ask.
The inability to inspect the encrypted app delivery. So Apple applies DRM to every application.
You can't opt out of it. And there's a few issues with this. You can't obviously scan it
for malware. You can't really use reproducible builds in order to verify that the actual source
code matches the app that was installed. The DRM itself that really runs a file of free software
licenses like the GPL. So if you want to be able to use the GPL, it would need to have exceptions
added to it, which introduce problems with compatibility with other GPL software. And then Apple
themselves has a requirement that you need to have scanning in place in order to
in order to be allowed to distribute these apps. But it's completely impossible to do,
or at least illegal to do, because they themselves are encrypting the app and you can't decrypt it.
There's analytics that they do. They track whether you install or install apps. And it's partly
so that they can build up the numbers to know whether you qualify for the Quart Technology fee that
you owe. App review. As I mentioned, these can take an hour. They can take a month. There's really
no telling. There's no service level agreement. And so if you need an urgent patch to any
of your applications for say security, you're out of luck. And the last one is they have a remote
kill switch. They can actually delete your app from your device if you want. So our view is that
the only way forward really to comply with both the spirit and the letter of the digital market
sector is that you really need to store all this away. You need to be able to have direct
side loading. Developers need to, without going through Apple at all, be able to generate
their sending certificates. You need to be able to build and distribute these things with
any special entitlements. Marketplaces need to be able to grant entitlements to developers for
security sensitive permissions. And the app installations need to be opened up and documented
to say that you can just do these things directly. In other words, it needs to become just like
Android is right now. A quick note on security, there's a lot of out in the DMA about security,
a lot of exemptions that are applied. And for this reason, Apple is really, their arguments
are heavily hinging on security. They have an interesting paper building across the
ecosystem from millions of apps, the front analysis, you can read it on their website.
But there's a lot of discussion in there about why side loading is considered dangerous,
why you should never be allowed to do it. I've always found those fairly hollow because if you
go to the page for Apple Music on Android, they have an Android Apple Music APK that you can just
download and install and they guide you step by step through all the steps you need to do,
including one that says, note that you may need to change your Android security settings to
complete this installation. So, I've always found those very hollow, but that's really the angle
that they're pushing in order to be able to skirt around some of the limitations of requirements that they have.
And I'll note a broader point about security is that security is not just about individual
devices, it's about the insecurity of a monoculture. If you have one single centralized source
no matter who they are, no matter where they are, you have these issues where you can't
understand their decision-making process and advice pressure. A few notorious examples are the
removal of the H.K. Maps Live from Hong Kong in 2019. The removal of election novellies,
smart voting application in 2021 by the behest of the Russian authorities. And then just last year,
WhatsApp telegram signal and threads all just got yanked from the App Store. In China, these were
unreviewable, these were unappealable, these were decisions that were made by Central Authority.
And Apple themselves should be concerned by this because they have invited themselves to be
a center of pressure for these things. If they opened up these App Store APIs and made it so,
I can just download these things directly, then that would limit a lot of the pressure on them.
So, the next steps for the App Fair, we're working towards building up a community of volunteers and
contributors. We're looking to raise funds for the standard business level of credit requirement.
And then for the time being, we're probably going to continue to distribute applications through
existing channels. So, apologies for going over time, but I want to thank you all for going.
I'm free at our next time for questions. I'll be around, though, in case you have any questions.
And here is my contact information.