5 ms·

Hasn't this always been against the App Store terms? I thought the only language you were allowed to download code from the internet and run was Javascript on A

Hasn't this always been against the App Store terms? I thought the only language you were allowed to download code from the internet and run was Javascript on Apple's VM.

tyingq 10y ago
Yes, that's correct. IOS Developer Program License Agreement, section 3.3.2: "3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's builtin WebKit framework..."
- empthought 10y ago
  ... or JavascriptCore, which is what React Native uses.
  - madeofpalk 10y ago
    ..."provided that such scripts and code do not change the primary purpose of the Application"
    - deleted 10y ago
      [deleted]
    - seanclayton 10y ago
      So you can add features all you want, just make sure you don't change your todo list app to a dating app and all is fine.
      - madeofpalk 10y ago
        Once you've 'worked' with Apple's app review for long enough you'll learn that you can't rely on such an assumption.
empthought 10y ago
The wording of the prohibition has varied over the years. Current wording is: Except as set forth in the next paragraph, an Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exceptions to the foregoing are scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store. So even if you download JavaScript code and run it on Apple's VM, they reserve the right to reject it if it changes the primary purpose of the application.
- seanclayton 10y ago
  >The only exceptions to the foregoing are scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store. It looks like this says "If you use download code that is run on JavaScript core (ie, JavaScript), then you can do this so long as you don't change the purpose of your app when you submitted it to the App Store."
- Jare 10y ago
  I think that wording with the "exception" is from the OSX developer program. As far as I can remember, the iOS info sheet has always been taxative with no exceptions about executable code. Of course all wordings allow Apple to start rejecting a previous approved app if they feel the code/scripts the app is now downloading are in violation. The explanation in the rollout.io site about why they are fine is intentionally deceptive. They have the guts to link to a document that says "An Application may not download or install executable code." and then quote more friendly excerpts in the hopes that you won't read the actual doc. I can't imagine why Apple has let this go on for so long.
darren_ 10y ago
Rollout.io has been offering a product that leverages this to 'hotpatch' binaries, but it looks like this is now considered not in the spirit of the guidelines. Technicals here: https://rollout.io/blog/under-the-hood-2016-update/ https://rollout.io/blog/under-the-hood-2016-update/ It basically goes: * add their SDK, which has the ability to swizzle(swap out the implementation for) arbitrary methods in your app * the swapped in implementations use JavascriptCore to execute javascript you supply, wrapping or replacing the 'real' invocation of the method. * their SDK checks on startup which methods to replace and downloads the appropriate JS replacements This is, technically speaking, only using JavascriptCore.
- Retr0spectrum 10y ago
  That's actually quite a clever workaround to the current rules, but rather naive of them to think Apple wouldn't fight back at some point.
  - mahyarm 10y ago
    It's really sad, because that kind of stuff lets you fix bugs / mitigate outages in the wild without having to wait on apple's schedule.
    - tedd4u 10y ago
      This is true. The problem is bad actors can use this to bypass Apple's review. As an iOS app publisher I slightly regret this inconvenience. As an iPhone user, I appreciate Apple looking out for my security.
      - mahyarm 10y ago
        Apple's review isn't that useful in this case as a pre-check, it is possible to avoid it if you want. Apple review does automated code checks & a reviewer manually using your app. With that review process you can deliver executable code after the fact in any way you want and only get caught after the fact if it's even noticeable. You can even get sneaky and add some security exploit to make it look like a mistake. It's much like the argument 'if you ban guns only criminals will have guns' and it's quite true in this case.
xsmasher 10y ago
Yes, but it has not been widely enforced.

Hasn't this always been against the App Store terms? I thought the only language you were allowed to download code from the internet and run was Javascript on Apple's VM.

tyingq 10y ago

Yes, that's correct. IOS Developer Program License Agreement, section 3.3.2: "3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's builtin WebKit framework..."

empthought 10y ago
... or JavascriptCore, which is what React Native uses.
- madeofpalk 10y ago
  ..."provided that such scripts and code do not change the primary purpose of the Application"
  - deleted 10y ago
    [deleted]
  - seanclayton 10y ago
    So you can add features all you want, just make sure you don't change your todo list app to a dating app and all is fine.
    - madeofpalk 10y ago
      Once you've 'worked' with Apple's app review for long enough you'll learn that you can't rely on such an assumption.

empthought 10y ago

The wording of the prohibition has varied over the years. Current wording is: Except as set forth in the next paragraph, an Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exceptions to the foregoing are scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store. So even if you download JavaScript code and run it on Apple's VM, they reserve the right to reject it if it changes the primary purpose of the application.

seanclayton 10y ago
>The only exceptions to the foregoing are scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store. It looks like this says "If you use download code that is run on JavaScript core (ie, JavaScript), then you can do this so long as you don't change the purpose of your app when you submitted it to the App Store."
Jare 10y ago
I think that wording with the "exception" is from the OSX developer program. As far as I can remember, the iOS info sheet has always been taxative with no exceptions about executable code. Of course all wordings allow Apple to start rejecting a previous approved app if they feel the code/scripts the app is now downloading are in violation. The explanation in the rollout.io site about why they are fine is intentionally deceptive. They have the guts to link to a document that says "An Application may not download or install executable code." and then quote more friendly excerpts in the hopes that you won't read the actual doc. I can't imagine why Apple has let this go on for so long.

darren_ 10y ago

Rollout.io has been offering a product that leverages this to 'hotpatch' binaries, but it looks like this is now considered not in the spirit of the guidelines. Technicals here: https://rollout.io/blog/under-the-hood-2016-update/ https://rollout.io/blog/under-the-hood-2016-update/ It basically goes: * add their SDK, which has the ability to swizzle(swap out the implementation for) arbitrary methods in your app * the swapped in implementations use JavascriptCore to execute javascript you supply, wrapping or replacing the 'real' invocation of the method. * their SDK checks on startup which methods to replace and downloads the appropriate JS replacements This is, technically speaking, only using JavascriptCore.

Retr0spectrum 10y ago
That's actually quite a clever workaround to the current rules, but rather naive of them to think Apple wouldn't fight back at some point.
- mahyarm 10y ago
  It's really sad, because that kind of stuff lets you fix bugs / mitigate outages in the wild without having to wait on apple's schedule.
  - tedd4u 10y ago
    This is true. The problem is bad actors can use this to bypass Apple's review. As an iOS app publisher I slightly regret this inconvenience. As an iPhone user, I appreciate Apple looking out for my security.
    - mahyarm 10y ago
      Apple's review isn't that useful in this case as a pre-check, it is possible to avoid it if you want. Apple review does automated code checks & a reviewer manually using your app. With that review process you can deliver executable code after the fact in any way you want and only get caught after the fact if it's even noticeable. You can even get sneaky and add some security exploit to make it look like a mistake. It's much like the argument 'if you ban guns only criminals will have guns' and it's quite true in this case.

xsmasher 10y ago

Yes, but it has not been widely enforced.