Maybe some might feel that way at first, but it’s also an opportunity and responsibility to educate.
This problem is why enterprise contractual agreements and large compliance systems exist for companies at this scale. Large hosting providers like AWS, Azure, GCP, etc. provide an ability to scale and assurances about risk mitigation, privacy, and availability that are much more viable than each company having to maintain their own private in-house fleets just to create an additional illusion of privacy/security that’s actually no better than tight contractual controls to begin with.
Maybe they need to explain this properly, but servers don’t magically have a lower level of risk just because they’re behind your four walls. In fact, if you lack the experience and expertise, the risk is almost certainly higher depending on your threat model. (And for Apple, their threat model is at the nationstate level. They don’t choose their hosting providers lightly.)
Are… you really suggesting that the real problem here is not criminal extortion but that the payment approach isn’t safe enough to ensure their criminal associates get paid, and that this is what the feds should help improve?
It doesn’t need a cookie popup because they aren’t using cookies for non-essential reasons, similar to how it complies with GDPR because they aren’t collecting any data beyond what is necessary for the service’s stated purpose.
I don’t think any app store or payment provider would look fondly on a process that refunds that many transactions just because you want to turn around and double/triple the price. Credit card companies/payment gateways hate mass refunds and normally it could be cause to terminate your contract. To refund people because the app was forced to go out of business is one thing, but if you want to implement a price increase the supported way is what the developer said: to announce it in advance for next renewal.
Probably what you’d have to do is close the current app and publish a new app with the new business model (subscriber-only at a higher price). The amount of people who would move to such app would only be a tiny fraction of the previous userbase (as most app users were free before), and now you keep having to deal with this chaotic company who could just change the rules again at any time with little/no notice. Plus you’ll never get the kind of reach you had before without the freemium model. I think most indie devs would likely choose to just quit and move on with their lives. If someone wants to buy his code from him and publish their own subscriber-only app, probably it’s an option.
This problem is why enterprise contractual agreements and large compliance systems exist for companies at this scale. Large hosting providers like AWS, Azure, GCP, etc. provide an ability to scale and assurances about risk mitigation, privacy, and availability that are much more viable than each company having to maintain their own private in-house fleets just to create an additional illusion of privacy/security that’s actually no better than tight contractual controls to begin with.
Maybe they need to explain this properly, but servers don’t magically have a lower level of risk just because they’re behind your four walls. In fact, if you lack the experience and expertise, the risk is almost certainly higher depending on your threat model. (And for Apple, their threat model is at the nationstate level. They don’t choose their hosting providers lightly.)