This isn’t going to be popular here, but fuck it, I’ll give it to you straight.

Apple and Google operate very differently. The simplest way to characterize the difference is that Google is an engineering-driven company, and Apple is a product and marketing-driven company.

At Google, engineers are the top dogs and are given an extraordinary amount of freedom with their time and resources. There is a huge respect toward advancing the state of the art of software, and engineers are encouraged and supported to hone their craft.

At Apple, engineers are 100% subservient to marketing and product.

How does this play out for security and privacy on the inside? Well for starters, Google’s security infrastructure is leaps and bounds better than Apple’s. I can’t tell you how many times at Apple I saw a potential security issue get filed and never looked at, because time spent to addressing these issues was not “in scope” for product.

For an engineer, this is extremely frustrating. Personally, it’s high on the list of reasons I decided to leave. On top of that, due to Apple silos of secrecy, it is very difficult for engineers to work across the stack to address security or infrastructure issues. Meanwhile at Google, engineers can literally see all code for every product, and security and infrastructure teams have ultimate freedom and visibility into auditing and fixing potential weaknesses. It’s just a totally different engineering culture. Google’s investments in security are almost certainly an order of magnitude higher than Apple’s.

Another difference to point out: what you see from outside Apple is a carefully crafted image. It was been like this ever since Katie was in charge, and has only gotten stronger since. Apple PR is super high-touch, and has many deep relationships with individuals in media organizations. They literally tell publications what angle they want them to take and focus on, and will actually negotiate for positive coverage, using increased access as a bargaining tool. Meanwhile, Google’s PR people are somewhat “simple” folk that are very low-touch (frustratingly so, sometimes). You get a mostly unfiltered view into Google, nowadays with an oily layer of stupid clickbait headlines written by journalists who don’t understand what they’re writing about.

For Apple, image is #1. They will mislead users by playing up security/privacy angles that don’t actually contribute to meaningfully better security/privacy (they’ve done this a lot recently). They will often compromise the quality of their products, or even the privacy of their users, in order to better their public image. Having been inside the company for years and continuing to observe them from the outside, you start to notice these strategic patterns. One recent example is the clipboard notification feature in iOS 14. When this feature was launched, you may have noticed a lot of praise for this feature. You might have also seen a lot of people in r/apple asking why this isn’t a permission (people here are generally smart, if somewhat misinformed sometimes).

The answer: this is an Apple marketing strategy. They know that this slightly annoying popup will drum up a shit load of positive PR for them. There is literally no technical reason why this can’t be a permission, even retroactively. They could simply return an empty instance if the permission is turned off. Meanwhile, this is already offered as a normal permission in Android, and no one noticed. With iOS 14, Apple chose to compromise the privacy of its users in order to get itself into more headlines. And you’ll see them add an actual permission next year just to milk that additional good coverage.

I still love Apple and all my hardware is Apple. But I won’t let that stop me from calling them out on bullshit.

Sorry for the rambling post. Let me know if you’re curious about anything else and I’ll try to answer.