6 ms·

A ton of games do this and it is incredibly annoying. I don't want to download an update, then have to download an update. I only wish the same restriction appl

A ton of games do this and it is incredibly annoying. I don't want to download an update, then have to download an update. I only wish the same restriction applied to my Android device.

justinhj 10y ago
Most likely most games are updating only game related data and graphics files. Very few games actually use internal scripting that would be needed to do code updates
- Angostura 10y ago
  The only app I've got that appears to actually update itself without going through the AppStore is the HSBC mobile banking app. I'd be interested in hearing the discussions going on between Apple and HSBC at the moment.
  - algesten 10y ago
    Judging by how sluggish and annoying the HSBC app is, I think it is a web app framed in a thin launcher from the app store. I.e. it downloads a bunch of javascript/html/css and that executes within a UIWebView/WKWebView. Using caching and localStorage, you can construct such an app to not need to download everything on each launch. The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded.
    - robk 10y ago
      Is it possible to do that and use the fingerprint sensor for login in a secure way? I thought the same as you until they enabled Touch login.
      - Klathmon 10y ago
        There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the server.
      - jinglebells 10y ago
        Yeah, https://github.com/EddyVerbruggen/cordova-plugin-touch-id https://github.com/EddyVerbruggen/cordova-plugin-touch-id shows how.
    - mikeash 10y ago
      > The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded. That's the same thing Rollout does. In fact, iOS apps can't download and run native code. The OS won't let you mark pages as executable unless they're appropriately signed, and only Apple has those keys.
      - deleted 10y ago
        [deleted]
      - orbitur 10y ago
        If they're using JSC, then they can definitely download JS and execute native methods. They could subclass any UIKit object and make it conform to JSExport. Done, now they're "running native code."
        mikeash 10y ago
        Sure, and an app displaying a web page using WebView can provide hooks that allow doing that sort of thing too. Neither one is downloading native code.
        orbitur 10y ago
        Only UIWebView, which is going away soon. But surely you can see the difference between executing limited actions inside a web view, and making available any native method to a web view.
        mikeash 10y ago
        WKWebView allows the app to execute arbitrary JS within the loaded page, and intercept URL loads and other actions made by JS code. That's all you need to build a bridge. I don't see any fundamental difference here. Both (UI|WK)WebView and JSC allow bridging. Neither one grants full access to JS code automatically, the programmer has to put some effort into it. And even if there is some important difference, neither one is native code which is what I was disputing above.
  - justsid 10y ago
    I was thinking of the HSBC app the whole time while reading this. In my opinion Apple should reject that piece of shit and force HSBC to write a native app that works properly.
  - masklinn 10y ago
    Supercell's games and a bunch of F2P collect-ish games also do that, when you open the game they have an update process. I'm reasonably sure that only updates static assets though, stuff like description files and graphic assets. It's actually pretty useful as it lowers the payload of the core engine and lets them do much smaller updates compared to having to bundle it all, that's especially important with things like Unity Frameworks which are not delta-updatable in the store (hence Hearthstone's 2GB downloads every time they add a cardback or nerf a pair of cards)
    - tomaskafka 10y ago
      I bet it's some code too. Worked on a F2P mobile game, we bundled a tiny Lua engine, and them pushed various promotion screens as a bundle of resources (images) and lua code (screen layout, its preconditions and what's gonna happen after you click - game provided a small API that Lua called).
    - RSZC 10y ago
      Hey, unrelated, came across a comment of yours from ~5 years ago: https://news.ycombinator.com/item?id=2949645 https://news.ycombinator.com/item?id=2949645 Would you mind elaborating on why Erlang programs tend to have FSMs? LYSE has a chapter on how to use gen_fsm, but I've really been unable to find a great answer as to WHY you would want to use it.
Nutomic 10y ago
Google definitely forbids self-updating apps on Google Play. But I'm not sure how well this is enforced.
- marak830 10y ago
  Horribly. I get a few games from the Japanese market, and almost each one requires in immediate internal download and update. Although those updates never trigger the Android update service, so I'm not sure if they are just downloading more resources of if they are able to request new permissions(I would like to assume not.)
  - irontoby 10y ago
    Games updating DLC is nothing new and is not what this is about. Google did recently change the Android permission model; previously, apps had to request all their permissions at install time and it was all-or-nothing (and frankly, hardly anyone bothered to look them over.) Now, certain permissions have to be requested when they're needed (at least for recent versions of the SDK) and the user can choose to allow or deny. But an app can't grant itself new permissions without going through the official update process.
    - marak830 10y ago
      See I do trust that - but only to an extent. I always wonder when seeing one update, if there is a 0 day that can bypass that. On a technical level I know I run the same risk with my PC, but at the same time, it's more difficult for me to examine processes and startups in my android.
      - lmm 10y ago
        Realistically, if they've written their own native code that parses their updates then almost certainly. If they're using an established library then maybe not (likewise if they're using a decent language, but unfortunately no-one does that). I'm reminded of the example at the bottom of http://www.gamasutra.com/view/feature/194772/dirty_game_development_tricks.php http://www.gamasutra.com/view/feature/194772/dirty_game_deve... where the game had a buffer overflow in displaying its own EULA.
irontoby 10y ago
Neither Google nor Apple nor any other game platform is going to stop games from downloading new content. That's just how games work these days. The reason this type of "hot code push" is more attractive on iOS is because the app review process is much longer, so publishers look for ways to skirt it. Looks like Apple is just starting to enforce it more.

A ton of games do this and it is incredibly annoying. I don't want to download an update, then have to download an update. I only wish the same restriction applied to my Android device.

justinhj 10y ago

Most likely most games are updating only game related data and graphics files. Very few games actually use internal scripting that would be needed to do code updates

Angostura 10y ago
The only app I've got that appears to actually update itself without going through the AppStore is the HSBC mobile banking app. I'd be interested in hearing the discussions going on between Apple and HSBC at the moment.
- algesten 10y ago
  Judging by how sluggish and annoying the HSBC app is, I think it is a web app framed in a thin launcher from the app store. I.e. it downloads a bunch of javascript/html/css and that executes within a UIWebView/WKWebView. Using caching and localStorage, you can construct such an app to not need to download everything on each launch. The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded.
  - robk 10y ago
    Is it possible to do that and use the fingerprint sensor for login in a secure way? I thought the same as you until they enabled Touch login.
    - Klathmon 10y ago
      There's no reason why they can't have the native portion do the authentication and just have it return a signed token to the JS portion which forwards it to the server.
    - jinglebells 10y ago
      Yeah, https://github.com/EddyVerbruggen/cordova-plugin-touch-id https://github.com/EddyVerbruggen/cordova-plugin-touch-id shows how.
  - mikeash 10y ago
    > The reason that's allowed is because everything executes within a sandboxed browser environment. No native code is downloaded. That's the same thing Rollout does. In fact, iOS apps can't download and run native code. The OS won't let you mark pages as executable unless they're appropriately signed, and only Apple has those keys.
    - deleted 10y ago
      [deleted]
    - orbitur 10y ago
      If they're using JSC, then they can definitely download JS and execute native methods. They could subclass any UIKit object and make it conform to JSExport. Done, now they're "running native code."
      - mikeash 10y ago
        Sure, and an app displaying a web page using WebView can provide hooks that allow doing that sort of thing too. Neither one is downloading native code.
        orbitur 10y ago
        Only UIWebView, which is going away soon. But surely you can see the difference between executing limited actions inside a web view, and making available any native method to a web view.
        mikeash 10y ago
        WKWebView allows the app to execute arbitrary JS within the loaded page, and intercept URL loads and other actions made by JS code. That's all you need to build a bridge. I don't see any fundamental difference here. Both (UI|WK)WebView and JSC allow bridging. Neither one grants full access to JS code automatically, the programmer has to put some effort into it. And even if there is some important difference, neither one is native code which is what I was disputing above.
- justsid 10y ago
  I was thinking of the HSBC app the whole time while reading this. In my opinion Apple should reject that piece of shit and force HSBC to write a native app that works properly.
- masklinn 10y ago
  Supercell's games and a bunch of F2P collect-ish games also do that, when you open the game they have an update process. I'm reasonably sure that only updates static assets though, stuff like description files and graphic assets. It's actually pretty useful as it lowers the payload of the core engine and lets them do much smaller updates compared to having to bundle it all, that's especially important with things like Unity Frameworks which are not delta-updatable in the store (hence Hearthstone's 2GB downloads every time they add a cardback or nerf a pair of cards)
  - tomaskafka 10y ago
    I bet it's some code too. Worked on a F2P mobile game, we bundled a tiny Lua engine, and them pushed various promotion screens as a bundle of resources (images) and lua code (screen layout, its preconditions and what's gonna happen after you click - game provided a small API that Lua called).
  - RSZC 10y ago
    Hey, unrelated, came across a comment of yours from ~5 years ago: https://news.ycombinator.com/item?id=2949645 https://news.ycombinator.com/item?id=2949645 Would you mind elaborating on why Erlang programs tend to have FSMs? LYSE has a chapter on how to use gen_fsm, but I've really been unable to find a great answer as to WHY you would want to use it.

Nutomic 10y ago

Google definitely forbids self-updating apps on Google Play. But I'm not sure how well this is enforced.

marak830 10y ago
Horribly. I get a few games from the Japanese market, and almost each one requires in immediate internal download and update. Although those updates never trigger the Android update service, so I'm not sure if they are just downloading more resources of if they are able to request new permissions(I would like to assume not.)
- irontoby 10y ago
  Games updating DLC is nothing new and is not what this is about. Google did recently change the Android permission model; previously, apps had to request all their permissions at install time and it was all-or-nothing (and frankly, hardly anyone bothered to look them over.) Now, certain permissions have to be requested when they're needed (at least for recent versions of the SDK) and the user can choose to allow or deny. But an app can't grant itself new permissions without going through the official update process.
  - marak830 10y ago
    See I do trust that - but only to an extent. I always wonder when seeing one update, if there is a 0 day that can bypass that. On a technical level I know I run the same risk with my PC, but at the same time, it's more difficult for me to examine processes and startups in my android.
    - lmm 10y ago
      Realistically, if they've written their own native code that parses their updates then almost certainly. If they're using an established library then maybe not (likewise if they're using a decent language, but unfortunately no-one does that). I'm reminded of the example at the bottom of http://www.gamasutra.com/view/feature/194772/dirty_game_development_tricks.php http://www.gamasutra.com/view/feature/194772/dirty_game_deve... where the game had a buffer overflow in displaying its own EULA.

irontoby 10y ago

Neither Google nor Apple nor any other game platform is going to stop games from downloading new content. That's just how games work these days. The reason this type of "hot code push" is more attractive on iOS is because the app review process is much longer, so publishers look for ways to skirt it. Looks like Apple is just starting to enforce it more.