4 ms·

Contacts (and in iOS 4, calendar data) are completely unprotected. Just create an instance of an AddressBook and go to town. Your pictures are only accessible t

by ajg1977 16y ago

Contacts (and in iOS 4, calendar data) are completely unprotected. Just create an instance of an AddressBook and go to town. Your pictures are only accessible through the camera roll UI... IF the developer is only using public APIs. Since we can assume that there are no public APIs that support tethering setup, we can also assume that it's still possible for them to be used in rogue apps and for developers to have access to private data.

pieter 16y ago
You can make a perfectly fine SOCKS proxy without using any unpublished API's. It's just listening on one socket and then opening a new one based on the request.
bombs 16y ago
It's possible to create a tethering app using public APIs. The APIs for HTTP/HTTPS connectivity and WiFi connectivity are public. Apple rejects apps that use private APIs.
- tomjen3 16y ago
  How does Apple actually scan for private APIs? Couldn't you write the instructions necessary to make the private API call on the stack at runtime and then simply execute an assembly jump instruction?
martingordon 16y ago
iOS4 added the ability to access the Photo Library in a similar way to the Address Book. You are no longer limited to accessing one user-chosen photo at a time. Even better/worse, you also have direct access to the camera(s), which means you don't need to prompt the user or display anything on-screen to capture photos or video. I know Android clearly warns users about an app's capabilities. Does anyone know if that opt-in, or is it derived by some type of code analysis?
- vetinari 16y ago
  The required permissions are listed specificaly by app developer, so no, there is no code analysis. However, during app runtime, only those listed capabalities are provided to app. If the app tried to use something else, it would get exception. Short of bug in the platform, there is no way getting around.

by ajg1977 16y ago

pieter 16y ago

You can make a perfectly fine SOCKS proxy without using any unpublished API's. It's just listening on one socket and then opening a new one based on the request.

bombs 16y ago

It's possible to create a tethering app using public APIs. The APIs for HTTP/HTTPS connectivity and WiFi connectivity are public. Apple rejects apps that use private APIs.

tomjen3 16y ago
How does Apple actually scan for private APIs? Couldn't you write the instructions necessary to make the private API call on the stack at runtime and then simply execute an assembly jump instruction?

martingordon 16y ago

iOS4 added the ability to access the Photo Library in a similar way to the Address Book. You are no longer limited to accessing one user-chosen photo at a time. Even better/worse, you also have direct access to the camera(s), which means you don't need to prompt the user or display anything on-screen to capture photos or video. I know Android clearly warns users about an app's capabilities. Does anyone know if that opt-in, or is it derived by some type of code analysis?

vetinari 16y ago
The required permissions are listed specificaly by app developer, so no, there is no code analysis. However, during app runtime, only those listed capabalities are provided to app. If the app tried to use something else, it would get exception. Short of bug in the platform, there is no way getting around.