A few months ago, Amazon opened a section of their online store where they sell apps for Android devices. Following the same boring-but-descriptive naming scheme that Microsoft pioneered with such products as a word processor called Microsoft Word, a flight simulator called Microsoft Flight Simulator, and so forth, they call it the Amazon Appstore.

Apple, of course, is suing them for trademark infringement. Amazon’s stance: “App store” is a generic, descriptive term for a store that sells apps. Apple counters: “Is not!”

It’s a bit more eloquent than that, but look at this:

“Apple admits that the current edition of the Oxford English Dictionary defines ‘app’ as, in part, ‘[a]n application, esp. an application program,” Apple said in the court filing. “Apple further admits that the current edition of the New Oxford American Dictionary defines ‘store’ as, in part, ‘a retail establishment selling items to the public: a health-food store.'”

And the best part:

“Apple denies that, based on their common meaning, the words ‘app store’ together denote a store for apps,” the document said. [emphasis added]

Really? Funny, I thought that was how the English language worked.

(In the interest of full disclosure: I own an Apple laptop, and Android phone, and use Amazon’s affiliate program…but not their app store.)

I’ve dealt with a couple of companies that try to plug the general lack of security in email by using a “secure email” service. The way this works is:

  1. The company sends you an email with a link to a third-party or co-branded website, asking you to click on it in order to read important information about your financial/insurance/whatever account. (Or better yet, the third party site sends you the mail on the company’s behalf.)
  2. You click on the link and open the site in your web browser.
  3. You register for the site (which usually involves entering your name, choosing a password, and possibly entering other personal detail like a reminder question.)
  4. You log into the site and actually read the message.

Can you see what the problem is?

That’s right: Steps 1-3 are exactly what you see in a phishing attack. Only in a phishing attack, the third-party site is a fake that’s trying to collect account information (like your login and password) or personal information (like your SSN).

So while they may be solving the immediate problem of “someone might intercept this message,” they’re perpetuating a broader problem by training people to fall for phishing attacks.

Sadly, this is not new.

Update 2022: A decade later, they’re still doing it.