Day 11 in #epicvapple starts in about an hour. Today's in-court reporters are @eringriffith and @mslopatto. Harvard's James Mickens, Epic's security expert, will resume his testimony this AM. After he's done, Apple's Phil Schiller will be up.
YGR says she'd really like to finish the case next Monday (me too, your honor, me too). Apple and Epic's lawyers promise they will be done next Monday. YGR says she doesn't want the closing proceeding to take more than 3 hours, 90 minutes for each side.
The lawyers are now arguing about whether Apple's expert Loren Hitt should be allowed to change some of his written testimony. Epic says Hitt is changing his opinion in light of their cross examination last week.
Hitt wanted to change this: "a full one-third offer direct purchases of content through a web browser on the iOS device for content that can be accessed in an iOS app." (You may recall walking painstakingly through how you can't in fact purchase Candy Crush $$ on mobile web)
YGR denies the request.
Mickens is now back up on the stand. Apple's lawyers will begin cross once they fix the mics.
Mickens agrees that Android has more security issues than iPhone.
Mickens says he could not get numbers on the amount of malware impacting Android versus iPhone. He did not get access to any of Apple's internal documents for his report.
“You looked at publicly available review guidelines and made assumptions about what Apple must be doing behind the scenes," Apple's lawyers says. Mickens says he looked at publicly App review guidelines and what various app developers have said.
Apple's lawyer asks about this article that Mickens cites. Mickens acknowledges he doesn't know how many apps Apple successfully removed that had this malware threatpost.com/click-fraud-ma…
Apple lawyer hammering on the fact that Mickens didn't have factual knowledge about what tools and training Apple's app review uses. "I can only see the effects of that," Mickens says.
Mickens acknowledges he doesn't have any Apple internal data on the "success rate" of finding legal compliance issues within app review.
Now asking about this article: tomsguide.com/news/bad-ios-a…
The author doesn't indicate the total number of apps on either iOS or Android with the particular problem, the Apple lawyer says. Mickens says that information isn't necessary to his conclusion.
Mickens says he relied on books written by Jonathan Levin: Mac OS X and iOS Internals.
Some of the technology came into being after Levin's books were written, Mickens acknowledges. We're now going to look at excerpts from the book.
“In actuality, however, Apple’s application security is light years if not parsec ahead of its peers,” Apple's lawyer reads. wiley.com/en-us/Mac+OS+X…
Mickens acknowledges that in 2018 Epic's Fortnite installer for Android had a vulnerability. "It was a programming error. I'm not sure how to apportion blame between the two parties," Mickens says of whether it was more Android's fault or Epic's fault.
“The report does point out some specific incidences in which the attacker won,” Mickens says. “The report talks about the defensive techniques iOS uses” also. Mickens points to his section about Apple's security culture.
Apple's lawyer is asking about zero-day vulnerabilities, holes in software or hardware the manufacturer doesn't know about.
Apple's lawyer pointing to this story. wired.com/story/android-…
The lawyer is walking him through this chart 
Android payout is $2.5 million while iOS payout is $2 million.
Apple's lawyer asks if $500k is a "significant gap." "That gap is sufficient to suggest Android and iOS are in the same rough equivalent class with respect to security," Mickens say.
They've moved on to MacOS. Apple's lawyer asking about whether the number of Windows devices versus Mac devices matters for malware developers. Mickens says that's not the only consideration. We are now going back to read from Levin's book.
Apple lawyer reads from Levin saying that viruses and malware less focused on Mac because there are fewer devices in use. “Would you spend your time attacking 90 percent of the world or less than 5?”
MacOS can stand to have different security measures than iOS because there are fewer devices out there, Apple lawyer says. Mickens says that is a "difference without distinction."
The number of devices that are used in the world hopefully doesn't make a difference in whether we try to make devices secure, Mickens says.
Now looking at this chart. Apple lawyer points out the fact that these payouts are lower.
Apple’s lawyer: the difference in the prices is explained by the number of devices. Mickens says not necessarily
Apple lawyer reads out the second sentence
Moving on to Apple’s Enterprise Program, which lets large businesses distribute apps to their employees. When an employer owns the device, they aren’t likely to write apps that will intentionally harm or scam its own employees, Apple lawyer says
Mickens says he’s aware of instances in which companies have used enterprise program to distribute apps to non-employees.
(Mickens and Apple lawyer agree Facebook used the enterprise program to distribute an app to pay users to collect information about them)
Mickens says he’s unaware of any instance in which an employer sought to harm their own employees. He says he is not saying the enterprise program should be used to distribute apps to non-employees, only that it’s technologically possible
Apple's lawyer is walking through various potential harms that the operating system's security can't protect from, such as an app that seeks to persuade depressed teenagers to suicide, fake reviews or copycat apps
Mickens in his report referred to these as "quality assurance" properties and not security.
Mickens says Apple is taking his statement out of context. His report doesn't claim that Apple's app review seeking to keep out apps that would cause physical or mental harm is objectionable, he says.
Apple's lawyer asks if someone were to take a broader view of security and include in that preventing apps that cause physical, mental or financial harm, whether he'd make the same statement that app review doesn't provide security. Mickens says he would not make the same stmt.
If Apple were to make a decision that no apps should have pornography, and a third-party app store wants to distribute it, who should prevail, Apple lawyer asks. That's a complex policy issue that a court should be involved in, Mickens says.
Apple's lawyer asks about the app tracking transparency introduced in iOS 14. "It's a policy issue and the court would have to decide," Mickens says.
Mickens says opening up the App Store doesn't mean there has to be a maximalist interpretation that everything has to be allowed. “You haven’t opined on some kind of middle ground,” YGR asks. No, Mickens says, he only opined on the design spectrum.
Apple lawyer asking about this article theverge.com/2021/2/8/22272…
Mickens says he didn't review the apps in question in the article, but agreed with the author's conclusions.
Apple's lawyer finishes. Epic's Justin Clarke up for redirect.
From a technical engineering perspective, there are a variety of options for third-party app stores, some where Apple has some control over what is allowed and some where it doesn't, Mickens says.
With the notarization approach, Apple doesn't review everything but does for malware. It could adopt something where it scans for objectionable content, Mickens says.
Clarke says Sesame Street could set up an app store where it moderates to make sure the apps are all okay for children. Mickens agrees, says a company like Disney would have an incentive to make sure it appropriately moderates its app store.
Even if iOS is opened to third-party app stores, Apple controls the underlying operating system. It could turn off the spigot, Mickens says, if it found objectionable content.
Allowing third-party app stores could give more "eyeballs" to human app review, since there would be more competition by those app stores with Apple's, Mickens says. It could provide innovation in this area, he says.
The notarization method, where Apple just does some scans but mostly allows apps through, is the most scalable of the different models, Mickens says.
Mickens says it is very common for security researchers not to have confidential information when they are assessing security. One does not have to be an Apple employee to understand the security of Apple's products, he says, citing the bug bounty program
App review is never going to be perfect, Mickens says. Opening up iOS doesn't mean we can't have the other aspects of content moderation, he says. "In the industry today, does anyone do it better?" YGR says. Mickens says he can't point to anyone in particular.
Apple lawyer says that if iOS is opened up, Apple would have to allow both Sesame Street and itch.io. Mickens says he doesn't know that's true.
Mickens says there is a spectrum of options here, not a binary.
And Mickens is done. Epic’s Katherine Forrest says they are done. Apple’s Richard Doren calls Phillip Schiller
Schiller is going over his resume. When he came back to Apple in 1997, Steve Jobs reorganized the company by function, Schiller says. Now those functions all report to CEO and the executive team makes decision as a business overall.
Schiller says Apple became one P&L for the whole company. "We made decisions on the products collectively," he said. We don't compete with each other for a slice of the pie.
And now we are taking out 20 minute morning break. Back at 10:35/1:35.
Back. Schiller says he was involved in the decision to develop the iPhone. They decided to start working on it in 2004 and it was released in 2007.
The most important aspect of developing the phone was the security and privacy issues, Schiller says. It was going to be able to have a lot of sensitive, personal information in your pocket everywhere you go.
Apple doesn't consider itself a hardware or software company but a "product company," Schiller says. They don't license iOS to anyone else.
Schiller says he doesn't view the smartphone market as a duopoly. They compete against many companies including Samsung, Microsoft, Google, Huawei, LG, Motorola and Amazon.
When the iPhone was introduced there were two digital stores -- Steam and Handango, Schiller says. en.wikipedia.org/wiki/Handango
There were no third-party apps on the iPhone when it launched, only native apps, Schiller says. The security and privacy risks of opening it up was too great in their view, he says.
Shortly after the iPhone was launched, Apple decided to open up and allow third-party apps, Schiller says. "We started to hear more feedback from developers," he said, and developers were jailbreaking the phone anyway. Without APIs, those were unstable, he says.
Apple decided in late 2007 to move forward with creating the App Store, Schiller says.
The software development kit uses Apple's intellectual property and developers are required to use it, Schiller says.
Developing the SDKs took Apple's software team about a year, Schiller says. The costs for that weren't allocated to the App Store.
The App Store was designated as the only way to download apps to maintain "the quality of iPhone [and] maintaining security and privacy to users," Schiller says
The iTunes store required music to be sold for $0.99. With the App Store, Apple decided to let developers set the price for the app, Schiller says, and take a 30 percent commission.
“Is Apple’s 30 percent commission still competitive?” Apple lawyer Richard Doren asks. “We believe it is, yes,” Schiller says.
YGR asks if developers of free apps have to pay anything. Schiller says they have to pay a $99 fee.
The App Store “was a huge risk,” Schiller said. We were taking this hot new product and create something we had never done before. Apple had no idea how it was going to do.
Schiller says Apple made no forecasts about how the App Store would do.
Doren asks Schiller about his 2011 email about whether the 70/30 split will "last forever." Schiller says he was forwarding a WSJ article about competition from web apps.
Schiller says Apple considers Google Play and app stores by Microsoft, Samsung, Huawei and Amazon to be competitors to its App Store. The consoles "I consider them competitors as well, xBox, Playstation, Nintendo Switch," he says.
Doren asks about this 2008 e-mail that Schiller sent that Epic highlighted in its opening.
Schiller says "the plan" he was referring to was the one to launch the App Store in a few weeks. “This wasn’t a monopolistic plot?” Doren asks. No, Schiller says.
Schiller was in charge of creating the developer program. The Mac developer program charged $3,500 to join, but Apple wanted the iOS developer to be more open and accessible (hence the lower fee).
No one pays a fee for the tools under the Apple developer agreement, Schiller says. There are 30 million developers who have entered the development agreement, Schiller says.
The Apple Developer License Agreement currently has 1 million developers, Schiller says. This one charges $99 a year. It can be set up for an individual or a company/team, Schiller says. It gives access to additional APIs and toolkits.
Steve thought the $99 fee was important to help keep the App Store from being filled with junk, Schiller says. the fee is waived for governments and educational institutions.
Schiller runs WWDC. It's generally attended by about 6,000 developers but streamed online by as many as 50 million people. It costs Apple about $50 million each year to put on. Schiller says that is not charged against the App Store in internal financials.
Apple is building a developer facility on its campus. Apple has educational programs and training programs for developers. None of those are not charged against the App Store, Schiller says.
Originally about 50% of apps were free, Schiller says. Today that is about 84%, he says. The no. 1 way that mobile developers monetize is advertising, he says.
Apple makes no revenue from those advertisements nor does it earn anything on apps that sell physical goods or services, Schiller says.
In 2019, apps selling physical goods and services made $400 billion, Schiller says.
And now to IAP. When created the App Store, Apple thought developers would just want to sell their apps, Schiller says.
Schiller and Doren are going through a presentation from December 2008 about app commerce models (irritatingly, I can't find a copy of it on the Box).
At the time, most apps used a "download" model where users would pay upfront. The presentation talks about the "in-game commerce" on xBox 360, PS3 and Nintendo Wii to let users to buy while playing. Schiller says Apple didn't have this type of in-game commerce for its apps.
Apple also didn't have the ability to have subscriptions. App developers were asking for the ability to charge for subscriptions and in-game commerce, according to the presentation.
The download and install was still widely used. But in-game commerce was just starting and developers said if Apple created an in-app purchase model that would put it in the lead, Schiller says, summarizing what the presentation said.
This should say "none of those are charged"
Ron Okamoto, who headed up developer relations, was a big supporter of introducing IAP, Schiller says. YGR asks if Okamoto will be testifying; Apple's Doren says no, he has retired.
Ha! It is on the Box. Here is the presentation they were going over: app.box.com/s/6b9wmjvr582c…
After the first year of the App Store, there were 25,000 apps in the store, Schiller confirms.
The development of IAP allowed for the creation of the "freemium" model, where apps can be downloaded for free and then buy in-app, Schiller says. About 17 percent of apps on the App Store use this model, he says.
About 6 percent of game apps are paid, Schiller says.
The App Store "commerce engine" tracks what users download, both free and paid, Schiller says. IAP was added to the commerce engine. The SDK for it is Storekit, Schiller says.
When Apple creates a new product it must go through the Apple New Product Process. IAP is not a product, it is a "feature" of the commerce engine, Schiller says.
The commerce engine handles the "ask to buy" feature, which confirms you want to buy something. It also interacts with parental controls, Schiller says.
Apple couldn't collect its commission without IAP, Schiller says. IAP doesn't do the payment processing, Apple outsources that to Visa and AliPay and other providers, he says.
Apple has 5,000 people on AppleCare support who help with refunds, Schiller says.
Last year, Apple rolled out a new feature to help with fraudulent transactions via refunds, Schiller says. There is a mechanism within IAP now to notify developers of refunds. Schiller said they introduced that last summer.
Apple introduced subscriptions in response to developer requests, Schiller says. Apple provides for both non-recurring and reoccurring subscriptions, he says.
The "Reader rule" allows apps that acquired customers on their own to avoid using IAP, Schiller says. The rule came about around 2009, he says, to let users access content they had already bought.
The commission on subscriptions changed in 2016. The first year its still 70/30, but on the second or additional years its 85/15, Schiller says.
The video partner program started a few years ago, Schiller says. The AppleTV team wanted to integrate Siri so it could search for shows across video services. To persuade companies to join, Apple said it would reduce the commission to 85/15.
Apple supports both cross-platform and cross-wallet play for games, Schiller says. Game developers expressed that if Apple wanted to remain competitive in games, it needed to support cross-platform and cross-wallet.
Developers can sign up users on whatever platform they want and there's no commission due to Apple, he says.
Lunch break now. Back in 40.
Back. Schiller is talking about the small business developer program, which allows developers with less than $1 million in sales to pay 15% commissions. Schiller says they first thought about establishing a program in 2016.
They are looking at a 2018 e-mail in which Schiller suggested diverting some of the commission for small developers to search ads. Schiller said they changed the program last year because after four years of discussion he thought they needed to get it out there.
The pandemic, and its impact on small businesses, was a motivator, he says. Doren asks if the lawsuit impacted the decision. Schiller says it "helped" him get it done.
"I proposed commissions even lower," Schiller says. But Apple's anti-fraud team was worried about anti-money laundering and said lower than 15 percent could be problematic.
Over 90 percent of all developers are eligible for the program, Schiller says. Apple proactively reached out to developers in December.
"We have tens of thousands of developers at this point," Schiller says. It is still a "minority" of those eligible. Google announced its own small developer program in response, he says.
The App Store has search ads so that one developer gets the top spot when a user searches for an app within the store, Schiller says. Apple allows "conquesting" -- which means that developers can put in to show up on someone else's app title, Schiller says.
He believes it helps small developers get noticed by users by showing up when a user is searching for a more popular app. In response to a YGR quesstion, Schiller says Apple doesn't compete in these auctions with its own apps.
Schiller says Apple included the rules that prevent developers from telling customers they can buy cheaper online, because if you go to Nordstrom's "you wouldn’t expect to see a tag that says you can go next door and buy these at Macy’s."
Email communications from developers to their users are allowed, Schiller says, just not to divert customers from paying through the App Store.
Schiller says he played Fortnite many times, though not since the app was removed from the App Store. Doren reads him a marketing e-mail he received in early 2018 about Fortnite coming to iPhone. The e-mail mentioned other places to play the game.
That e-mail doesn't violates Apple's rules because it's just information about where to play, he says. "What if it said, 'If you go to Fortnite on your PC, you can buy V-Bucks cheaper?'" YGR says.
"Not if it’s sent generally to the user base," Schiller said. If a developer sends a message to all users, that's ok. Apple just doesn't want users who signed up through the App Store targeted. "Broad communications we’ve never had problems with."
YGR says she has heard testimony that developers can't get e-mail addresses. Schiller says that's not true. Apple just requires the developer get it directly from the user.
Apple doesn't allow "stores within the store" because it could subvert things like parental controls, he says. The App Store provides key info like age appropriateness, privacy information, he says.
Itch.io would not be allowed within the App Store for those reasons, Schiller says.
The Executive Review Board (ERB) has been meeting weekly since the App Store started to help with questions about whether things raise issues with the app review guidelines. Schiller says he has been on the board since it was created.
The App Review guidelines are updated at least yearly, sometimes more often, when the ERB runs into new situations or frequent problems. The first guidelines were published in 2010, he says. At the time, no one else published their guidelines, he says.
Do other stores publish their guidelines now, YGR asks. Schiller says he know some do, but doesn't know if its pervasive.
Schiller says he considers Roblox a game, though it contains many games. It's concept is new. The developer of the app is Roblox. But the app itself allow creators to create games within the app. They are content within the app, he says.
Doren asks about Creative Mode within Fortnite. "As long as the app itself, Fortnite, is reviewed and follows the rules," creators can make things or new games within the app, Schiller says.
(He has not offered a view on whether Fortnite is a game, experience or metaverse, however)
Apple's FEAR team = Fraud, Engineering, Algorithms and Risk
The App Review team tries to keep bad things out of the App Store, while the FEAR team tries to address what's gotten through, Schiller says. FEAR watches trends in fraud, spam, malware etc.
All creative content in Roblox uses architecture approved through app review, Schiller says.
There are more than 1 billion iPhone users and 2 million apps in the App Store, Schiller says. About 280,000 of those are games, with 75 percent of them being free.
Apple undertakes an App Store cleanup that removes apps that aren't up-to-date with the operating system or have very low usage (like less than 5 downloads), Schiller says
Since 2010, "in my opinion, in many ways, it has gotten easier" to switch between iPhone and other phones, Schiller says. It's easier to transfer contacts and photos, plus apps are often on both iOS and Android platforms.
Apple, Google and Samsung all have tools to make it easier for users to switch from iPhone to Android or vice-versa, Schiller says.
Doren is asking Schiller about a 2013 report from Goldman Sachs about switching between iOS and Android. Epic's Katherine Forrest objected, but YGR says she will allow it.
The author complained about the cost of switching their music. Early days of iTunes, music often had DRM on it, Schiller says, but by 2013 that would have been gone. iTunes is also now available on Android, Schiller says.
Schiller also says that today most people stream music, so this might no longer be relevant. The number of apps available on both iOS/Android is much higher today than it would have been in 2013.
Ah. This is on Box: app.box.com/s/6b9wmjvr582c…
The writer found there were $79.85 in "explicit" switching costs of getting apps/content from one phone to the other.
Schiller says he has an xBox, Nintendo Switch, Playstation, a Mac, his iPhone, iPad and an auto-racing rig.
Steam competes with the App Store because "users can find games to download and play" through either, he says. "Its important for us to try to understand what each platform is doing."
Schiller said he is aware of Microsoft's announcement that it will be lowering commissions. It goes into effect in August.
Schiller says that they would love for Microsoft to have its xCloud service on iPhone, so long as it follows the same rules for all developers.
Apple mandates that it offer each game available for download because its customers want to be able to see the age rating, privacy policy etc., he says.
How is this different from Netflix, YGR asks. Apple doesn't review the content for each movie/TV that Netflix shows, he says. The App Store is also not a movie store, its an apps and game store. "When you bring in games in a different way, it no longer works as a game store."
Apple wouldn't require users to pay for the download of the game for Microsoft xCloud, Schiller says. But you couldn't go to one app and in that app have the 10 games, YGR asks. Correct, he says.
Microsoft could have offered a "catalog" app that just showed what games were available for download through Apple's App Store, he says.
Last year, Apple spent $18 billion on research and development. From 2005 to today, it's been a cumulative $100 billion, he says.
Doren is now listing iPhone "innovations and investments" that are useful for gaming and having Schiller explain each: accelerometer, gyroscope, retina display, haptic engine
(The point, I'm sure, is that none of theses developments would be listed as costs on financial statements related to the App Store but are useful for apps, particularly gaming apps like Epic's Fortnite).
Stereo speakers, neural engine (a dedicated processor for predictive techniques/machine learning), Lidar (light detection and ranging)
And there we go: "Were any of these costs" attributed to the App Store? Doren asks. No, Schiller says.
Now they are talking about cellular developments from 2G to 5G that have occurred since the opening of the App Store. Apple didn't invent cellular networks, Schiller says, but needed to incorporate them into iPhones.
They also had to incorporate WiFi, Schiller says. Now moving on to Apple's chip developments
Apple's first chips were in 2010 and new features are added each year, Schiller says. 2013 - first 64-bit chip. 2014 - Metal. 2016 - Fusion chips.
"Each year it gets faster and faster and more and more efficient," Schiller says.
The first SDK made available to developers in 2008 was about 100k. Today there are about 150k, Schiller says. Each year, the company offers 1,000 to 5,000 new APIs for developers, he says.
Schiller just explained Metal and they played the video of Epic's Tim Sweeney introducing the technology at WWDC.
Doren says this is a good place to stop for the day. YGR has a question for Tim Sweeney: You've been in this trial for over a Fortnite. How did you come up with the name for your game?
The game came out of a game jam. Originally, you built forts and there used to be a day/night cycle in the game, he said. So they combined the words.
YGR says she'd like to meet with the younger lawyers after the trial ends. They will get coffee with her on Tuesday to talk about the experience (but not substance) of the trial.
And we are in recess for today. Schiller will resume his direct in the AM.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
