Thank you for coming and I really apologize for the technical glitches, but we will jump right
in.
This is going to be a talk about app stores free app stores on the iOS and Android platforms.
So quick note about me, I'm a software developer.
I've been developing software for 40 years.
As you've missed on my technical difficulties, I just had right now.
But yeah, I've been developing software since there's a little kid and I've been developing
apps for the iPhone and for Android since 2008 basically since the beginning of when you could do that.
And I developed a very first ebook reader for the iPhone that was known as Stanza.
That was went on for a while.
And then since then I've done dozens of other apps.
More recently, I created an open source tool called Skip.dev that helps you develop apps for both iPhone and Android from a single code base.
I'm also the founder of the non-profit app fair project, which helps promote and distribute apps to universally for both platforms.
And I'm also a board member of the Android project as of last year.
So nearly everyone in the world has a little computer in their pocket.
There's over 6 billion smartphones around the world.
The vast majority of human beings have one.
And these devices, they know just about everything about us.
They know where we are, they know who we are, they know where we're going.
They know what we're interested in, what we like, our media or movies and so on.
And the question is, who really owns this device?
Is this yours?
You bought it, it's your property.
But you actually own it in the sense that you have complete control over it, that you have agency.
So how does software get on to a computer?
When I first developed software back in 1982, a little radio-shack TRS AD,
that had no persistence storage.
So I subscribe to a magazine called the Rainbow Magazine and they send you an issue every month.
And in it, they would have printed pages of source code.
And so I would sit there and I'd easily transcribe that source code from my computer.
From the pages of the magazine onto the computer.
And then hope that you didn't make any typos because debugging was quite a primitive operation back then.
And then you would run it.
And there would be little games or graphics demos or things like that.
So that was how we really got started in software development.
Since then, from that point on, I got a cassette tape peripheral that would let you save and load your programs.
So it wouldn't disappear when your system plugs are computer.
And from then on, you moved on to floppy disks and heart disks and CD ROMs and so on.
As we all know, that's all gone.
You don't have really physical media ever.
Everyone's in a wireless CD, but it's pretty much gone the way of pretty much everything else from the last millennium.
And the result is that we just should be software over the internet now.
And app stores have been the result of that phenomenon where a single organization will collect a number of applications and potentially curate them.
And then list them for download and allow you to download them directly to your advice on mobile platforms.
This is far and away the most predominant form of software distribution.
And an app store when you run it on your phone is really just an app that installs apps.
It's not really doing anything fancy.
It's essentially a gutsy-tup downloader.
It has some features like search.
You might be able to review applications.
You might be able to categorize them and browse them.
But really all it is is an app that installs apps.
So as of around the launch of the modern generation of smartphones, you really had two players that rose right around the same time.
Apples, iOS, which runs on their iPhone and subsequent devices like the iPad.
And then Google's Android.
iOS is exclusive to Apple devices and Android runs on not only Google's own devices that they did not start out by manufacturing.
But on a variety of other manufacturers that they license out the operating system too.
Generally speaking worldwide, Android has about a 75% market share and iOS more or less takes up the rest.
And then you have a very long tail of very small representation of other devices.
But for the most part, Blackberry is gone when to his phone is gone.
You're left with really two players in this market.
When apps start getting first developed for these devices.
When they were first released, there were no app stores.
The very first app store was actually something called Citya, which was developed by Jay Freeman,
also known as Souric, back in 2008.
And this was a really nifty little app store.
People were blown away.
You could actually, you know, the iPhone came out and only had a few built-in applications.
But a web browser and a calculator and, you know, a context list and things like that.
But for the first time, this was something that allowed you to get browser download and potentially purchase applications from a variety of sources from a variety of developers.
And it was wildly popular.
It had started out with a small catalog with hundreds of apps, maybe 1,000 and had millions of developers.
And it was pretty neat.
2.0 when that came out, Apple introduced their own app store.
And they said that this was going to be the exclusive way of developing and distributing software for their devices.
At the same time, they change the operating system to break all the mechanisms that Citya was currently using to be able to, to install their applications.
And they essentially froze out that platform.
City, I continued on for a few more years, finding work around to be able to continue operating
and to be serving their users. But ultimately, if you are fighting against the platform,
as you've heard from the previous talk, you're always going to wind up losing the platform
vendor is actually dedicated to crushing you. Android, on that their hand, took a different
pack. They started out by providing APIs, rather developers, to be able to develop and
distribute their own apps. And that actually wound up, you know, starting a fairly open ecosystem,
a vibrant ecosystem of a number of different app stores. There were a number of commercial
app stores, a couple of the big ones in the west for the Amazon app store, the Samsung Galaxy
store worldwide. And there were also some non-commercial ones, after all, being a notable one,
which I'll describe in a little bit. But it was never really a level playing field.
The vast majority of Android devices are Android certified, and that certification process
comes with various requirements. One of those requirements was that the Google Play Store
be the most prominent, only pre-installed device, and prominently displayed on any handset
that was Android certified. And that was problematic for competition in that space.
And over the years, these two different gatekeepers, all their policies started to converge
and align. You wind up having a system where the Apple App Store and the Play Store
have more or less the same sequence of operations you need to go through in order to get your
phone on to end devices. A developers need to identify themselves and register centrally.
They charge developer fees. Some of them annual, some of them, some of them one time.
They're lengthy terms and conditions that you need to agree to, and these terms and conditions
are obviously non-negotiable. And furthermore, there was changing. There was changing out
from under you. They can come up tomorrow with a new set of terms and conditions. If you don't
agree to it right away, you're out of the store. So it's very much a short list that developers
are kept on. Every app that you want to distribute has to be uploaded to their portal,
has to be reviewed by humans, potentially, or some degree of automation or a combination.
And then if it's approved, it winds up getting distributed and that same process you need to
go through again for everything to update that you distribute. The benefit is that you can reach
billions of potential customers. And the entire world is your oyster. If you distribute
through these stores, the cost is that they take a 30% cut off of the top of an individual sale
that goes through any of these applications. And that 30% cut leads to extraordinary
extraordinary profit margins for these business divisions. The Google Play Store is
came out in the epic trial last year. It makes around 70% profit margin. The Apple App Store
makes around 80% and that is unprecedented in the history of technology in comparison to AWS
makes around 20 to 30% profit margin. But so what's the problem though? You know, be thankful
for what you have. If you're lucky that you're able to reach, you know, these gigantic user spaces
margins, we hear love free software. But we never, we often don't examine why. We don't
often say, like, what is it about free software that what problems does it solve? Why do we prefer
this over other ways of developing distributing software? So one hazard that has a risen,
especially in recent years has been that these app stores have these large profit margins
have led to developers seeking alternative monetization routes for their apps rather than paying
an absorbent of 30% cut to Apple or Google for your app store app. You can seek alternative
means of monetization. And that is often through advertisement. An advertisement can provide a
direct stream of revenue for the developer. But as a side effect and as a additional revenue
stream for the people that are providing this ad tech, they provide a stream of data collection
from your devices to centralize data brokers that then package them up, resell them, you know,
throughout the world. This data collection is massive in scale. It can get all sorts of information
from all sorts of parts of your devices. If you trust it with your contacts, with your calendar,
with your location, with your media libraries, your photos, your camera, it can assemble
these gigantic dossiers of people that are extremely valuable to resell.
You know, what does your phone know about you? It has all these sensors. It tracks not only,
you know, where you are, but where you're going, where your habits are, and where your interests
are. And it can drive all sorts of secondary information, you know, not just your interest,
your religious affiliation, your, you know, your political allegiances, and so on.
So how do you identify the good apps from the bad apps? Almost all of these are marked as free,
not in the sense of free software, but in the sense of, it causes your money to download.
But how do we identify the good from the bad? And the problem is that you really can't. You have
these opaque bundles of binaries that get sent down to your device. And you can't look inside.
They are at the very least obfuscated and at the very worst, especially in the case of Apple
devices, they are encrypted. And if you are in pretty much any Western country, they will,
the law will be adhering to the principles of the United States digital millennium copyright
app, which makes sort of felony to break open these applications and look inside and examine
what exactly they're doing. Not everyone has the digital millennium copyright app, but more or less
every Western country has equivalent laws on the books that have followed the precedent.
So free software to the rescue, obviously, right? You can publish a source code and you can
publish the app and you can tell people, okay, line these two things up. And you can see we're not
doing anything the farias we're not, you know, sneaking off your information. But can you, can you work
with that on a personal basis? Can you, you know, can you just say, as a principal, I'm only
ever going to download these applications from these commercial app stores that are sourced from
you know, places where they build the software in the open. And you could, in theory,
you would have to manually manage that curation yourself, but you would be hard pressed to actually
prove it. You know, someone can say, here's the source code that goes into my app, but how do you
actually prove that these opaque blobs match the code that was published online? It was
literally easy to slip in a little extra thing right before you submit a build that might add in a
ad network, a data broker, all sorts of data collection, certain, certain, typically,
tracking your, you know, personal information and, you know, your claims would be false, but it
would not be provable. So that's where F2A comes in. How many people here have heard of F2A?
All right, so I probably don't need to give you all that much background. So, started in 2010,
it's one of the oldest app stores out there, over 15 years old, as of last year, and exclusively for
you know, open source software. And it is verified, you know, either the project itself will build
the binaries and distribute them to end users or it allows the developer to build the binaries themselves
and distribute the binary and then the Android project will validate that by performing a reproducible
build of that and checking bit by bit that they are that they're the same. So essentially impossible
to hide anything when it's distributed through F2A. So that's for Android, you might say that we've
got Android covered in that respect. So let's hop over to the other side of the doopily.
There's nothing like that for iOS, as I mentioned, all iOS apps are encrypted, there's no open
app store, APIs, you only have one route to doing it and you have no means of verifying it. However,
the digital market's act popped up fairly recently. It was proposed in 2020, it passed in 2022 and it
came into enforcement in March 2024. And that mandates that the gatekeepers, the digital gatekeepers
of online intermediation services, in other words Apple and Google and their app stores,
be able to provide the ability to have competition in the market and open up their APIs to allow
alternative app marketplaces. And that is what came into effect. And a lot of people thought,
great, we are going to have F2A for Apple now. And we can have a single universal source of applications
across both sides. The problem is many people know is that the actual claim to compliance
of for on the side of iOS was the implementation of these alternative app marketplaces. And
it establishes a lot of rules. For the marketplaces themselves, you need to get approval from Apple,
you need to be based in the EU, you need to write a 1 million euro standard business letter of
credit. And then you have core technology fees, basically junk fees that are layered on top of it
that are applied on a per download basis, even for free applications. For developers,
you might think that you could just submit your app directly to these alternative app marketplaces,
like you can do on Android, no, you still have to do exactly the same thing as if you are
distributing your app through the Apple App Store, you need to get approval, you need to pay
your fees, you need to read to the term to conditions, upload the app, and then wait and hope for approval.
And only then is the app processed by Apple and bounced over to the alternative app marketplace,
which then is permitted to redistribute it to the users of these marketplaces.
And the biggest problem is that the exact same restrictions on the close source marketplace
apply to the alternative app marketplaces, which is that the apps are wrapped up in a DRM bundle.
They are encrypted. And this not only means that the end user can't see inside the app, it also
means that the alternative app marketplace is also enabled to look inside the app,
which makes it essentially impossible to comply with Apple's own contractual rules for
these alternative app marketplaces, which is that they guarantee that any apps they distribute are
free of malware. They have that requirement, but they do not offer any possibility that anyone can
legally verify these apps, not only by scanning the binaries, but by lining them up with the
underlying source code. At least we still have Android though, right? So maybe iOS is a
lost cause, maybe the rules are not going to be in force for them, but we still have Android.
And we did, up until the end of last year, at the end of last year, a lot of you probably heard
that Google announced their Google developer registration mandate, which requires that
anyone who wants to distribute applications anywhere in the world on an Android certified device
regardless of what store friend it goes through, or whether you're just providing it for
direct download from your website, must register centrally with Google. And the rules might sound
familiar to you, if you have to register centrally, you have to agree to ever changing terms and
conditions, you have to pay fee, and you have to register each of your applications with Google
and in an ongoing way, any new applications you need to put through them. And this is a gigantic
problem for the world of free software. All of a sudden, these two marketplaces are starting
to really close in and align on all of their policies. And this is a critical problem for
Android, because we can't really require our developers register with Google especially
if we're just reproducing their builds, many will not. So it's really an existential crisis for
marketplaces like ours that really rely on the freedom and independence of the app developers
to be able to contribute their applications. But it's not just about what apps are available,
it's also about what applications are not available. The centralization of control
should be concerning for everyone, not just free software developers, because you have a lot of
perils that come from centralization. You have a lot of examples of how any centralized control
can lead to abuse. You saw this in Hong Kong in 2019. You saw this in Russia in 2021 with the
fair voting application that got pulled. And you saw it in the US in 2025 when applications
that were designed to help people protect themselves from police brutality were unilaterally
and extra legally pulled from these app marketplaces at the pressure of the administration.
In each of these cases, these were extra legal requirements that the gatekeepers wound up
complying with. And this had worldwide consequences. And there was no review, there was no accountability
and it's definitely going to continue happening again and again. So what can we do about this?
How can we actually change this? What hope is there? As you probably know, I'm in the United States
so the likelihood of there being meaningful regulation any time in the next few years is extraordinarily
unlikely. But policy makers in Europe are actually very receptive to feedback to communication.
And I've talked with many of them myself. I frequently consult with digital markets act
regulators on how to go about things. And you need to make your voice heard to your policy makers.
You need to point out that the only real path to digital sovereignty is through the total
disintermediation of centralized control. You really need to be able to make it so that
you can get directly to end users without going through one single centralized group.
I started a website called Keep Android Open that focuses on pushing back against the Android
developer verification mandate. I encourage people to take a look at that to see points of contact.
For developers, I think everyone should consider the promotion of these alternative app
marketplaces by developing for them first. If you're an Android developer, consider shipping your app
on on F-eroid before anything else. And then there's nothing stopping you from also going through
the Google Play Store. If you're on iOS, sign up for Alt Store and try distributing your application
there. These app marketplaces are growing and thriving, but they need more high quality software
and software developers are the ones that we really need to provide that. And for everyone,
developer, user, policy maker, use these marketplaces. If you do not have them installed on your
phone, download F-eroid for your Android phone, download Alt Store, if you're in the EU or Japan.
Use them. See what they have and who knows, eventually they might be your one or only
exclusive source of applications. My time is up. Thank you very much for coming. I don't have
time for questions, but I will be outside this room if anyone wants to chat. And then I will be over
at the F-eroid booth in UD-2 if anyone wants to learn more about the project. Thank you all for
coming and hope you have a good remainder of the fuss done.