Me: you know, many businesses already change between summer and winter schedules; many retail stores, many services, many public transit operators.....

how the hell could they make the "just one administrator" mistake?

It's not a mistake, because it's not a 'permissions/who can be administrator' 'mistake.' It's the account owner. It's the person who's credit card is on file.

Why would Apple 'comply with a court order' that has nothing to do with them?

If the court ordered the father to disband the account, and he didn't disband the account, he needs to be taken back to court to force compliance.

That being said, the article DID make clear that there WAS a court order for him to disband the account, and even if he was using in all the right ways for all the right reasons, not-complying with a court order is extremely problematic.

Then her remedy is to go back to court and compel the target of the order, aka the ex-husband, to do as ordered, not to claim that a third party with no standing in the case is at fault.

If you and I contract that I will sell you may Ford Escape for five grand, and you give me five grand and I don't give you the keys, you don't go to Ford and ask them to make you a key. They will, correctly, say "....and what does this have to do with us?" when you wave the sale contract at them.

And nothing Apple did or didn't do prevented the mother from having that custody.

She had a remedy from day one: make new accounts for the kids. Inconvenient? Sure. But way less inconvenient than most of the stuff that goes along with 'we're separating.'

*Should* Apple develop a system to deal with this a big more gracefully? I'd say so. But to conflate this with 'they're violating a court order for custody' is utterly ridiculous.

If something has never proven to have worked can it ever be said to have failed? A riddle fit for Bilbo.

"I plan on starting an AI company that just sits around and talks about AI companies.

Therefore I need at least eleventy-bazillion nVidia GPUs and three nuclear power plants worth of juice."

I am prepared to invest $2 billion into your startup. Please advise where to wire funds. Thanks you oh so much for this ground floor opportunity! /s

At some point people are going to realize that Ouroboros or a mobius strip takes you nowhere and just costs you money to keep circling forever.

(maybe the smart Wall Street money already has. Hmmm....)

I once had an interesting conversation with an Android OEM. I sat down with them to discuss what security issues they'd like to see the Android security team work on. They asked me "When are you going to fix the USB hole?". I didn't know what they meant and asked for clarification. They explained that in some parts of the world, notably India and China, there were "free" charging stations set up in bus stops, train stations and other public areas. These charging stations allow the public to charge their phones, for free! There's just one catch. On a sign above the charging station there's a set of instructions that tells users how to go about activating the charging. The sign tells them to go into the Settings app, then "About Phone", then scroll down to the build number, tap it seven times, then... it walks them through enabling ADB and accepting the key of the "charging station" computer, which would then proceed to install malware -- and to start charging.

Huge numbers of people used these charging stations every day, to the point that the biggest problem users had (besides the malware) was that they were always occupied. No one had a problem with "activating" charging for their device.

90% of people are capable of following a list of instructions. 100% of people are capable of either following a list of instructions or getting someone nearby to do it for them.

Anyway, this OEM wanted us to disable ADB entirely, or allow them to, because their users were doing it, getting loaded up with malware, and then blaming the OEM for making a crappy phone. I, of course, told them that we were not going to disable ADB and we were not going to remove the compliance requirement that forces them to support ADB.

Unfortunately, the current change still doesn't fix the "USB hole", but it does offer a way to rate-limit malware installation via downloadables.

Anyway, if you really think your users can't follow instructions, or can't get someone else to do it for them, you can always just register for a developer account. As long as you don't distribute malware, people will be able to sideload your APKs without using ADB. If the $25 is too much for you, maybe share the cost with some buddies, or get one of the limited accounts, though your APKs will only be installable on a small number of devices. Except, of course, by people who can follow instructions, or get someone else to.

Yep. It allows them to stop malware. How terrible!

How did you learn this?

I suspect you actually do derive a lot of utility from AWS and Azure, you just don't realize how many of the services you use every day are running on them.

Oh, actually, I missed the most obvious flaw in this argument: The verification doesn't give Google any significant control! It does give them the real-world identities of registered developers, yes, but then what? It doesn't do anything to require registered developer to use the Play store or comply with any Play policies other than one: Don't distribute malware.

The real purpose here is malware rate-limiting. Right now, malware authors can pump out huge numbers of apps with small variations to defeat identification. Google may identify one malicious app and warn all of the user that have it installed, but the malware author has thrown out a hundred variations of that app and Google only twigged to one. What ID verification does is require the developer to tie each app to a unique government-issued ID. In countries where you can't just go get a hundred government IDs, this means teams of malware authors can make approximately one malicious APK per team member. In countries where they can go get a hundred unique government IDs per person (because the government is actively cooperating or because they have a cousin in the ID office) it doesn't help so much, but Google can then start working with the governments to crack down.

I don't know if you noticed in the announcement, but this program is starting in a small number of countries, with the cooperation of and at the request of the governments who are trying to defend their populace against waves of malware. This isn't an accident.

Actually, though, your comment and my off-the-cuff response both miss the real difference which is why malware authors would choose to use F-Droid to distribute their apps. They'd have to publish source, which would be a disadvantage in the competitive world of malware authoring, and publishing source code would also make it easy for their malicious code to be identified. It makes a lot more sense for them to publish via downloadable sideloads or -- even better, if they can manage it -- in the Play store.

From a security perspective, it makes sense to treat F-Droid differently from random downloadable sideloads... but how is the Android OS supposed to tell the difference? The Android mechanism for establishing APK trust is signatures. So... F-Droid could arrange with Google to get the platform to trust APKs signed by F-Droid, which would make F-Droid work fine. And, actually, there's no need for Google to go through any complicated process to set that up: F-Droid can simply register as a developer and sign the APKs it distributes. Done. Of course, if F-Droid ever screws up and does distribute malware, it could result in all of their apps being evicted from Android device, but since F-Droid is a zero-malware platform, that's not a problem, right?

How many apps in F-Droid vs how many in the Play store?