6 ms·
Rollout.io has been offering a product that leverages this to 'hotpatch' binaries, but it looks like this is now considered not in the spirit of the guidelines.
by darren_ 10y ago
Rollout.io has been offering a product that leverages this to 'hotpatch' binaries, but it looks like this is now considered not in the spirit of the guidelines.
Technicals here: https://rollout.io/blog/under-the-hood-2016-update/ https://rollout.io/blog/under-the-hood-2016-update/
It basically goes:
* add their SDK, which has the ability to swizzle(swap out the implementation for) arbitrary methods in your app
* the swapped in implementations use JavascriptCore to execute javascript you supply, wrapping or replacing the 'real' invocation of the method.
* their SDK checks on startup which methods to replace and downloads the appropriate JS replacements
This is, technically speaking, only using JavascriptCore.
- Retr0spectrum 10y agoThat's actually quite a clever workaround to the current rules, but rather naive of them to think Apple wouldn't fight back at some point.
- mahyarm 10y agoIt's really sad, because that kind of stuff lets you fix bugs / mitigate outages in the wild without having to wait on apple's schedule.
- tedd4u 10y agoThis is true. The problem is bad actors can use this to bypass Apple's review. As an iOS app publisher I slightly regret this inconvenience. As an iPhone user, I appreciate Apple looking out for my security.
- mahyarm 10y agoApple's review isn't that useful in this case as a pre-check, it is possible to avoid it if you want. Apple review does automated code checks & a reviewer manually using your app. With that review process you can deliver executable code after the fact in any way you want and only get caught after the fact if it's even noticeable. You can even get sneaky and add some security exploit to make it look like a mistake. It's much like the argument 'if you ban guns only criminals will have guns' and it's quite true in this case.
- jahewson 10y agoGiven that Apple's automated review tools detect many ways in which executable code can be injected into apps, and OP's link is itself about that very thing - what you say is mostly false.
- mahyarm 10y agoIt was easy to detect because they are not to trying to hide it. They just have to check if the library exists.
- godmodus 10y agoit's not about apple's process being imperfect. sure, you can fool them if you try hard enough and a bad actor. it's about damage mitigation, and shutting down a 3rd party "app-hot-fix" service is a good move. it's harder to fool only apple, than to submit some naive looking thing and still have unmitigated access to changing its code.
- deleted 10y ago[deleted]