Here you go:
>> People using an iOS device can never be sure they are installing the secure app they wanted to install or some switcheroo.
>This is complete bullshit. Apps are signed by developed and by Apple. Were you not aware of that?
If you are now going to claim that when you said apps were signed by the developer, you didn't mean the apps sent to the device, that quoted response makes no sense in that context. I interpreted your response as charitably as possible.
> Seems like this is total bullshit. Do you have any evidence that China can modify the packages?
I explained how app distribution works and assumed you could work it out. It looks like my assumption was mistaken, so here it is step by step: 1. The package sent to the device is not signed by the developer but by Apple or China. https://www.quora.com/Is-iMessage-encrypted-in-China 2. China's firewall sits between users and servers outside of China. https://en.wikipedia.org/wiki/Great_Firewall 3. The Great Firewall routes the app store download request to a proxy that injects malware and resigns the package with their own key, which is trusted by the device.
Interesting that you seem unworried that Apple's own privileged MITM position allows it to insert malware, which governments can request.
> There is no indication of an MITM vulnerability between the developers and Apple, nor is there one between Apple and users.
Once again, the biggest MITM is between the developer and users, which F-Droid's reproducible builds prevent.
> Your claim about aggregate Android malware numbers being lower than iOS was false:
My claim was about malware from the Play Store and the Amazon App Store.
Please stop calling claims bullshit (you've done this five times now) just because you are unwilling to follow the logic and want me to spell it out. If you need help understanding an argument, just ask for it.
