Malleable software: Restoring user agency in a world of locked-down apps