Friday, June 14, 2024

UTM Blocked Outside App Store via Notarization

Benjamin Mayo (Hacker News):

App Review has rejected a submission from the developers of UTM, a generic PC system emulator for iPhone and iPad.

The open source app was submitted to the store, given the recent rule change that allows retro game console emulators, like Delta or Folium. App Review rejected UTM, deciding that a “PC is not a console”. What is more surprising, is the fact that UTM says that Apple is also blocking the app from being listed in third-party app stores in the EU.

As written in the App Review Guidelines, Rule 4.7 covers “mini apps, mini games, streaming games, chatbots, plug-ins and game emulators”.

UTM says Apple refused to notarize the app because of the violation of rule 4.7, as that is included in Notarization Review Guidelines. However, the App Review Guidelines page disagrees. It does not annotate rule 4.7 as being part of the Notarization Review Guidelines. Indeed, if you select the “Show Notarization Review Guidelines Only” toggle, rule 4.7 is greyed out as not being applicable.

UTM:

Apple has reached out and clarified that the notarization was rejected under rule 2.5.2 and that 4.7 is an exception that only applies to App Store apps (but which UTM SE does not qualify for).

This is confusing, but I think what Apple is saying is that, even with notarization, apps are not allowed to “download executable code.” Rule 2.5.2 says apps may not “download, install, or execute code” except for limited educational purposes. Rule 4.7 makes an exception to this so that retro game emulators and some other app types can run code “that is not embedded in the binary.” This is grayed out when you select Show Notarization Review Guidelines Only, meaning that the exception only applies within the App Store. Thus, the general prohibition remains in effect for App Marketplaces and Web Distribution. But it seems like this wasn’t initially clear to Apple, either, because the review process took two months.

This also seems inconsistent with the fact that the Delta emulator is allowed to be notarized outside the App Store. It doesn’t make much sense for the rules to be more lax within the App Store. I first thought the mistake was that Apple didn’t mean to gray out 4.7 for notarization. Then everything would make sense. But the clarification states that 4.7 is not intended to apply to notarization.

The bottom line for me is that Apple doesn’t want general-purpose emulators, it’s questionable whether the DMA lets it block them, and even siding with Apple on this it isn’t consistently applying its own rules.

kelthuzad:

If Apple can block what’s on “independent” third-party app stores, then the letter of the DMA may be violated or not, but its spirit is most certainly violated. Hope the EU cracks down on such malicious compliance.

Steve Troughton-Smith:

Apple needs to read the terms of the DMA again; Apple can’t reject UTM from distribution in third party marketplaces, in just the same way it can’t prevent Epic from building an App Store. App Review is going to land them yet another clash with the EU, and potential fine-worthy rule violation.

Thomas Clement:

Sigh… what is even the point of third-party distribution if Apple is going to block whatever competition it does not want to see there?

Miguel Arroz:

This is so stupid. UTM is an essential tool for my work, running stuff I need 24/7. This shows that 1. The EU didn’t go far enough in telling tech companies the products people buy belong to them and they must be able to run whatever the hell they want on those products regardless of what some multinational company likes it or not, and 2. Every platform Apple makes is not targeted for real work and productivity except macOS and that’s mostly for historic reasons.

UTM:

We will adhere by Apple’s content and policy decision because we believe UTM SE (which does not have JIT) is a subpar experience and isn’t worth fighting for. We do not wish to invest any additional time or effort trying to get UTM SE in the App Store or third party stores unless Apple changes their stance.

gorkish:

I remember the flash-in-the-pan moment where through some strange conflux of exploits and firmware features UTM on iOS was able to access full hardware virtualization support. It was a glorious glimpse into an alternate reality that we will likely never get to see again.

I don’t have enough superlatives to express my disappointment when seeing all of that effort suppressed and restricted by Apple.

When the UTM authors say “it’s not worth it” -- they may be onto something. Apple is slowly but surely beginning to be “not worth it” for me and for many other professional users.

Previously:

Update (2024-06-19): John Gruber:

Apple’s stance on this seems inscrutable and arbitrary: retro game emulators are, at long last, acceptable, but general PC emulators are not. Such arbitrary policy decisions related to the purpose of the app are fine for the App Store (legally speaking), but clearly not compliant with the DMA. That’s one of the few areas where the DMA is clear. Apple can, of course, ban (say) porno apps from the App Store, but can’t refuse to notarize them for distribution outside the App Store in the EU.

Apple has a security leg to stand on when it comes to JIT compilation, but the version of UTM (UTM SE) that was held up in review for two months, and ultimately rejected by Apple, doesn’t use a JIT. […] That restriction should, in theory, be permitted under the DMA on security grounds. But how the no-JIT version of UTM could be rejected for notarization, I do not see.

And, again, Delta is a retro game emulator, but that’s, officially at least, not why it’s able to be notarized, because the retro game emulator exception doesn’t apply for notarization. If Apple were being consistent it would either notarize both Delta and UTM or neither.

Jason Snell:

In other words, parts of Apple apparently think that they can enforce inconsistent and arbitrary rules even outside the App Store, which is contrary to the entire regulatory process that led to the DMA and the concept of alternative App Stores in the first place.

[…]

The whole point of the DMA is that Apple does not get to act as an arbitrary approver or disapprover of apps. If Apple can still reject or approve apps as it sees fit, what’s the point of the DMA in the first place?

See also: Accidental Tech Podcast, Ben Lovejoy.

Previously:

25 Comments RSS · Twitter · Mastodon

Regardless of whether UTM followed the rules or not, I find the use of notarization to backdoor app review quite egregious and disturbing. Once upon a time, Apple claimed that "notarization is not App Review," and that the technology was only meant to guard against malware. How soon until the same thing happens on macOS? This needs to be regulated ASAP, and not just in the EU.

Old Unix Geek

When the UTM authors say “it’s not worth it” -- they may be onto something. Apple is slowly but surely beginning to be “not worth it” for me and for many other professional users.

This!

Small part of me is starting to wonder whether SnapDragon Elite PCs + Linux + étoilé/GnuStep/Cocoatron will become an alternative for portable computing. Can't say I much trust Windows and its login requirements either...

The primary challenge I’ve found with switching to Linux is that Wayland desktops are locked down to the point where important automation and accessibility tools just can’t work properly. As of yet, there’s no accessibility ‘escape hatch’ for trusted third-party apps on Wayland like there is on macOS.

It's worth noting that Apple now officially differentiate between PCs and consoles.

One of the sub-official counterpoints to opening up iOS have long been "But what about the Switch?"

I think we can all agree that a console is not a phone.

The point is that if you don't like how Apple makes its products (and the product is both hardware, software and policies) buy something else. Eu regulating how Apple should make their stuff is weird, requesting more regulation so that the user can run whatever it wants is even weirder, you have bought a product where you can't run whatever you want, buy something else if you don't like it.

@Giogio: Indeed. If you don't like my pool, go swim somewhere else. Don't insist that I change my pool to suit you.

@DJ: I think that captures the fundamentally disagreement.

Once Apple sells me an iPhone, it isn't their iPhone any more it is *mine*. I'm not insisting that they let me run whatever software I want on *their* hardware. I'm insisting that they let me run anything I want on *my* hardware.

So to apply that to your example, the company that sells me my pool can't prevent me from using whatever pumps or accessories I want.

Yes, you are buying the hardware, but you're *licensing* the software (OS) that runs on it. You bought the pool, and now you want the manufacturer to change the filter for you so that you can fill your pool with honey and still have it work.

Yes, DJ that is exactly the *problem*. I don't want to "license" software; I want to buy it. But software companies have come up with this "licensing" concept so that they can control what you can and cannot do with the software after you've paid for and installed it.

And when the control that they choose to exert becomes too egregiously detrimental to users and developers, that's when it becomes necessary for government to step in with regulation.

> You bought the pool, and now you want the manufacturer to change the filter for you so that you can fill your pool with honey and still have it work.

No, I'm just telling them to stop preventing me from doing whatever I want. I'm actually asking them to do less work, seeing as they devote who knows how much resources to preventing people from running arbitrary software.

@Doodpants: But you knew what you were getting when you bought the system, and you want to go back after the fact and change that?

@gildarts: You can do what you want with the hardware, since you bought the hardware. The software is licensed, and you're stuck with the terms of that license. I suppose you could strip off the licensed OS and roll your own, and then you can do whatever you want. But if you're going to run the licensed OS on the hardware, you have to live within the terms of that license. Governments should not intervene in that. If users don't like it, they can buy something else.

@DJ: I understand what you are saying, and even sympathize with it, but I'm 100% on board with governments forcing this down Apple's throat no matter how much they kick and scream about it.

Apple's management of their App Store has proven that:
1. They can't actually stop scams
2. The software review/notarization process is arbitrary and capricious
3. They are 100% willing to use their stranglehold on software distribution to extract extraordinary profits from app developers

They might not be strictly a monopoly, depending on how you draw up the market definitions, but they are definitely a duopoly with Google and more restrictive rules applies when there are only two players in a market.

On a personal level there isn't even two options because of ecosystem lock-in and how little I trust Google.. But this doesn't prevent me from hating Apple being control freaks about my device.

Yeah, I realize people have strong feelings about this.

But all of those things that you listed don't change the fact that it's Apple's (or Google's) platform. I know it's not a popular opinion here, but everyone knew what they were getting when they bought what they bought. It's unreasonable to ask the government(s) to change that.

@DJ: "If users don't like it, they can buy something else."

No they can't; the only alternative is to not buy a smartphone at all, because Apple and Google are the only choices.

You're arguing that if a company has been running afoul of antitrust law or engaging in other consumer hostile behavior from the beginning, it's too late for the government to enforce the law just because consumers have already willingly entered into a harmful situation... how does that make sense? It's never to late to enforce the law or punish bad behavior. The fact that "everyone knew what they were getting" doesn't absolve Apple of all wrongdoing.

I guess I really have trouble with the whole concept of this being any kind of monopoly situation. Back when the government forced "Ma Bell" to break up, phones had a singular purpose, and having one company control the whole thing truly was a monopoly. Today's smart phones all provide the essentials of communication: phone calls, texting, email, even social media. They also provide apps that can do various things, but the necessity of those... varies, to say the least.

It's like wanting to install a disco ball over your pool, and insisting that the company add an outlet on the side of the filter to power it.

@DJ Your position on the OS licensing issue is flawed, mainly because the mere legal posession of a copy of software already grants the right to use it. It is not the EULA that allows me to use iOS, it is the fact that I physically have a copy of it on a functioning device.

To illustrate the absurdness of your position, consider the following scenario:
An iPhone owner manually deletes all their personal data and iCloud account off their device, remove any passcode/lock screen authentication, and give the device up on Goodwill or any other donation place.

Another random person picks it up from there and brings it home. Remember that all the previous owner did was manually delete their personal data from the phone, they did not reset it completely, so the device is still ready for use as soon as it's turned on, not needing to go into the first-time setup, and most importantly, the EULA acceptance screen.

Is it your argument that the person who brings the device home and starts using it is breaking the law all day, every day, because each time the iOS copy is used there's no license agreement between the new phone owner and Apple?

I am not a lawyer, so the intricacies of licensing law is outside my scope for the most part. My understanding of it is that, by owning the iPhone hardware, you are allowed to use the software. That doesn't mean that you own the software though.

You are "allowed" to use the software merely by legally posessing a copy of it. The EULA is a completely separate thing.

"You don't own the software" means you don't own the copyright, so you can't do what the rightsholder can, such as make new copies, eistribute them, sell them etc. But you do absolutely own the individual copy of iOS you have on the phone.

Also, copyright law (both in the US and the EU) does not grant the rightsholder any rights over controlling what you can do with an individual copy beyond the usual stuff like sell new ones, duplicate, etc. That's a totally separate thing from the EULA, which is contract law.

And the law is generally much more free to regulate contracts than it is to regulate copyrights (due to international copyright treaties and such)

"It's my apartment building. Why should government force me to install fire sprinklers and emergency exits?"

"It's my store. Why should government force me to sell merchandise to people with a different skin color than mine?"

"It's my restaurant. Why should government force me to keep rats out of the kitchen?"

"You can do what you want with the hardware, since you bought the hardware. The software is licensed, and you're stuck with the terms of that license. I suppose you could strip off the licensed OS and roll your own, and then you can do whatever you want."

No, you can't strip off the licensed OS and roll your own. The hardware is locked down by Apple to prevent it from running any OS except Apple iOS. Thus, if you don't own the software, you don't own the hardware either.

@Rob: So you're saying, "It's my platform. Why should government force me to allow Fortnight to run on it?" is in the same boat as your examples?

Old Unix Geek

@DJ:

It has been understood for a long time that allowing powerful entities to restrict one's freedoms is harmful. Usually the powerful entities are governments, hence the Constitution. However, companies can play the same rule. Hence anti-trust / anti-cartel laws. As far as I'm concerned, Apple has no right to prevent me from choosing to run Fortnight on the phone I bought. If Microsoft did the same as Apple does, using hardware mechanisms for preventing people from running Linux on their PCs, there would be no Linux. As far as I'm concerned, if you use your market monopoly to distort the market, for instance by banning companies you do not like, you should lose that monopoly.

If you don't believe Apple is a monopoly, I'll quote Aaron Hillgass, who was responsible for developing some of Objective-C, a technology that Apple claims makes life so easy for developers that Apple must receive "fair compensation" for its use by developers on "its platform": "Negotiations with Apple (our biggest customer) end with "...because we are Apple (and will destroy you if we don't get everything we want)." Most didn't say the last part aloud, but Mike Fenger's team shouted it while renegotiating our role in the Enterprise Partners Program". These are the people you are defending.

Sounds like another example of eshitification where companies originally sell a product, and then change rules after the public adopts it to maximize profits. Another major competitor in the marketplace like a Tesla phone would have Apple eshitifying their pants.

I'm sorry, why are people defending blocking apps outside of the app store? If the app isn't being distributed with Apple, what is even going on here?

Sure, Apple should run their app store how they see fit, within reason, I agree with the Apple pundits on this, mostly; however, I contend Apple should allow non App Store sources and should have no say so unless it is pulling known malicious content (as in legitimately flagged malware). I believe Apple running their app store in their usual shitty way will cause it to lose influence and marketshare in the face of better competition. The key is, Apple has been ruled to largely give unfettered access to other markets and Apple is being super stubborn about it, so there simply hasn't been any competition yet.

Google Play has many stupid rules as well, but I often do not use Google Play to put apps on my Android devices because sideloading is allowed and Google has no ability to stop me given, well the whole sideloading angle. And again, you can install whole ass app stores on Android, not just individual apps.

Also, I agree with Jeff Johnson, the idea you own the hardware but license the software so all you need to do is simply avoid iOS… iOS devices most certainly do not have open bootloaders!!!! I'm dying from laughter over that suggestion. The idea that it's okay, you still own the hardware, is a choice without distinction since the hardware is now a paperweight. I don't even…

I appreciate the expertise and experience presented here, and that many of you feel "wronged" by Apple, Google, etc. for not allowing you to do what you want. The majority of the population (5 9s, at least) don't care though.

Leave a Comment