8 ms·

iOS 12 uses Lua code downloaded from Apple's servers

sbjs 8y ago
Wait, am I understanding this right? Apple is doing exactly what they forbid iOS developers from doing for years? Downloading code from the internet and executing it, in order to make runtime decisions or to allow live upgrades? That's just hypocritical BS right there. But the comment thread in the tweet is wrong about it being dangerous. Lua can be sandboxed like any decent VM in 2018. "Danger" isn't the problem.
- zepto 8y ago
  You aren’t understanding it right. That isn’t forbidden.
- nodesocket 8y ago
  Of course, it is their platform. The reason they prevent runtime/live updates is because 3rd party developers can and will easily inject malicious code. Apples owns the entire platform, I have no problem with them having "root" privileges. Honestly I'd rather have a closed platform with strict guidelines than the wild wild west that is Android.
  - Jyaif 8y ago
    Spoken like a true ignorant. What prevents 3rd party developers from embedding "malicious code" in the binary itself?
    - xoa 8y ago
      >What prevents 3rd party developers from embedding "malicious code" in the binary itself? Required review by Apple? That malicious code is restricted from doing much precisely by the sorts of things OP is complaining about? The potential economic return isn't as high because Apple can forcefully clean it off? That it's harder to be anonymous when $100/year has to change hands for a cert and Apple wants to know who you are on some level so it'd be at least somewhat harder to avoid them going after you? None of these are bulletproof, even combined. But even so they're not worthless either to that goal. Are you actually asserting that the actual state of malware on iOS is identical or worse then that of Android or Windows/Mac/Linux? That's not something I've seen supported before but I'd read a good source if you've got one.
      - Jyaif 8y ago
        If I want to hide "malicious code" in my binary (whatever that means on iOS), there's no amount of Apple review that will be able to catch it. In fact, even their restriction on downloadable code is not enforceable. This limitation is not about improving security, it's about preventing developers from creating ecosystems inside their apps.
        saagarjha 8y ago
        Apple will most likely catch whatever you have in mind. If not, they will certainly pull your developer agreement once they figure it out.
        jonhendry18 8y ago
        Once someone figures out what you're doing Apple can flip the remote killswitch and disable your app.
        filleduchaos 8y ago
        Given your previous comments, I'd be very surprised indeed if you'd ever even opened Xcode in your life (to talk of actually getting an app you built approved and listed in the App Store). But sure, you totally know how to sneak malicious code past Apple's security processes, and for some completely sensible reason you've neither used it for your own nefarious gain nor reported the exploit and claimed the fat bounty that would inevitably await you.
      - modells 8y ago
        I wouldn’t blame capitalist conspiracy just yet what can be attributed to practical intentions for reasons: 0. Trying to prevent average developers from shooting themselves in the feet too often by having apps that depend on external servers to run, then having a big security incident and Apple being blamed for allowing insecure, third-party code to run. 1. Trying to keep tabs on devs pivoting too far without a re-review. Can’t sell a Farmville app that then becomes a bitcoin wallet which then steals said bitcoins. 2. Keep the quality of apps up by curating through review rather than allowing free, unlimited publishing of random/broken apps. It’s a small barrier to entry and proof that someone invested to make something worth publishing. 3. Malware for old/jailbroken iOS existed way back, but it’s not really a thing, anymore because 0days get mostly either reported to Apple or sold/auctioned off. https://www.theiphonewiki.com/wiki/Malware_for_iOS https://www.theiphonewiki.com/wiki/Malware_for_iOS
    - sctb 8y ago
      Could you please stop breaking the guidelines by posting uncivilly and/or unsubstantively? We've asked already and eventually we ban accounts that won't stop. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- xoa 8y ago
  What. Apple has no issues trusting Apple 100% completely, nor do any of their users. Or more specifically, Apple itself is simply an inseparable part of the core trust foundation since they control the entire stack of hardware, firmware and software. You calling this "hypocritical BS" is just nonsense, it's like acting shocked that Apple doesn't allow any random developer to issue microcode processor updates even though Apple could. Of course Apple can, there is no equality there. Apple develops private code and dogfoods it before making it public. Any platform developer by definition has to do low level stuff as part of making higher level stuff. This is not difficult. "Hypocrisy" gets thrown around way too often on the Internet, and if you do so you are basically always wrong, either because it's not actually hypocrisy at all (the word is not a synonym for "anything I don't like") or because it's a meaningless thing to say anyway vs more substantive complaints.
  - insidegui 8y ago
    It's also worth noting that the bundle that includes the Lua code is signed and its signature gets verified by the OS before running.
  - deleted 8y ago
    [deleted]
  - denzil_correa 8y ago
    > "Hypocrisy" gets thrown around way too often on the Internet, and if you do so you are basically always wrong, either because it's not actually hypocrisy at all (the word is not a synonym for "anything I don't like") or because it's a meaningless thing to say anyway vs more substantive complaints. Another thing - hypocrisy has no bearing on the conclusion of the argument. You can be a hypocrite and be logically correct. OTOH, you can be far away from a hypocrite and be wrong.
- untog 8y ago
  Apple owns the OS. They've used private frameworks in their apps for years too, even though third party apps aren't allowed. Because they own the platform. It's hardly surprising.
- samcat116 8y ago
  There's a reason that there's App Review for 3rd party devs. Apple doesn't need app review for its own apps.
- machiavelli1024 8y ago
  Yeah, right?! They also have this “Software Update” thing in Settings, which installs kernel updates and other stuff from the internet!
- joemi 8y ago
  Adding to the other replies explaining why it's not hypocritical, I have an example. Consider section 5.2.4 of Apple's App Store Review Guidelines https://developer.apple.com/app-store/review/guidelines/#intellectual-property https://developer.apple.com/app-store/review/guidelines/#int... > 5.2.4 Apple Endorsements: Don’t suggest or infer that Apple is a source or > supplier of the App, or that Apple endorses any particular representation > regarding quality or functionality. Apple definitely infers and suggests and even explicitly states that Apple is the supplier of their own apps. This clearly violates section 5.2.4. But Apple does not have to follow the rules that apply to third party developers because they're not third party developers. They're first party developers.
  - Domenic_S 8y ago
    I think they mean "imply" rather than "infer", don't they? Inferring is drawing a conclusion: you imply something, and I infer your meaning.
    - joemi 8y ago
      Good catch. I didn't notice that when copying it.
Jyaif 8y ago
That's something that Apple forbids app developers from doing (unless the lua interpreter is running in a webview).
- haney 8y ago
  https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ > 2.5.2 Apps should be self-contained in their bundles, > and may not read or write data outside the designated > container area, nor may they download, install, or > execute code which introduces or changes features or > functionality of the app, including other apps. The wiggle room is in the "introduces or changes features or functionality of the app" line, they've given themselves vague discretion to reject things that download too much code, but there are tons of apps that do OTA updates that haven't been rejected because they aren't changing fundamental features/functionality.
  - nomadluap 8y ago
    Also if there was no wiggle room here, then any app that downloads and displays webpage content would be in violation due to embedded javascript.
    - DerekL 8y ago
      For a long time, downloaded code could only run inside Apple’s WebKit or JavaScriptCore, but since June 2017, you can use any language and interpreter. Apparently, almost nobody noticed: https://www.theregister.co.uk/2017/06/07/apple_relaxes_developer_rules/ https://www.theregister.co.uk/2017/06/07/apple_relaxes_devel...
      - binomialxenon 8y ago
        It's good that they revised that ridiculous restriction, but I think they should go further still. It was disingenuous to advertise the iPad as a "computer replacement" when having an environment for Python coding (widely used for beginner programming) was essentially banned. There really should be a way to work in even compiled languages on iDevices.
ChrisLTD 8y ago
It’s nice that Apple isn’t tying this functionality to OS updates. It was pretty bad a few months back when typing prediction went haywire and we had to wait weeks for a fix. Separately, I’m surprised Apple didn’t do this with Swift. I thought one of the goals of Swift was to be a good language for low level code up to high level scripting.
- zepto 8y ago
  Or JavaScript. Presumably both of these have more overhead than Apple wanted in this case, but it does seem odd.
  - vorpalhex 8y ago
    lua is much easier to execute and much easier to sandbox than JS.
    - pcwalton 8y ago
      I don't see how Lua is easier to sandbox. I'm a bit surprised at the use of Lua, given that JavaScriptCore is already there. But I wouldn't be surprised if Lua was just something that the team was already familiar with. Lua is tiny, so it's not like it adds a significant dependency.
      - simonh 8y ago
        As you said Luna is tiny, which makes it easier to sandbox. A smaller system with a more limited set of behaviours and features is much easier to test and verify.
        pcwalton 8y ago
        I guess, but (1) JavaScript is already there, so using it adds no new attack surface; (2) JS engines get more scrutiny; (3) sandboxing isn't as important anyway since the interpreter only runs trusted code.
currysausage 8y ago
Looks like the code is not obfuscated and even includes comments. Does anyone here have the URLs? Might be an interesting read.
stefan_ 8y ago
It's like a WoW addon. They should make the entire UI scriptable and create an addon store.
- earenndil 8y ago
  They won't do that because they want a consistent look for their devices. If you jailbreak, though, you can inject code that hooks into random methods and changes the ui; but that's not officially supported.
mintplant 8y ago
The example is interesting (a suggestion to contact the organizer of an event you're running late to), and supports my suspicion that much of the "smartness" ascribed to modern devices boils down to lots of hand-crafted pattern-response rules. Pay no attention to the programmers behind the curtain.
- dan-robertson 8y ago
  I’m not really sure anyone should be surprised that much of the smartness is rule-based with maybe a bit of “AI” to help with speech recognition and fiddling with the words a bit. I think this is good because it tends to lead to misunderstanding being biased towards not doing anything instead of doing something particularly wrong. The downside is that the rules never seem to cope with enough inputs. My hope is basically that many more rules will be written and they will slowly move towards handling more general problems as well as a very large variety of specific cases.
ppetty 8y ago
Is the “not obfuscated” part potentially just because the OS is still Beta? Seems somewhat similar to not encrypting the kernel, from iOS 10 (https://techcrunch.com/2016/06/22/apple-unencrypted-kernel/ https://techcrunch.com/2016/06/22/apple-unencrypted-kernel/).

sbjs 8y ago

Wait, am I understanding this right? Apple is doing exactly what they forbid iOS developers from doing for years? Downloading code from the internet and executing it, in order to make runtime decisions or to allow live upgrades? That's just hypocritical BS right there. But the comment thread in the tweet is wrong about it being dangerous. Lua can be sandboxed like any decent VM in 2018. "Danger" isn't the problem.

zepto 8y ago
You aren’t understanding it right. That isn’t forbidden.
nodesocket 8y ago
Of course, it is their platform. The reason they prevent runtime/live updates is because 3rd party developers can and will easily inject malicious code. Apples owns the entire platform, I have no problem with them having "root" privileges. Honestly I'd rather have a closed platform with strict guidelines than the wild wild west that is Android.
- Jyaif 8y ago
  Spoken like a true ignorant. What prevents 3rd party developers from embedding "malicious code" in the binary itself?
  - xoa 8y ago
    >What prevents 3rd party developers from embedding "malicious code" in the binary itself? Required review by Apple? That malicious code is restricted from doing much precisely by the sorts of things OP is complaining about? The potential economic return isn't as high because Apple can forcefully clean it off? That it's harder to be anonymous when $100/year has to change hands for a cert and Apple wants to know who you are on some level so it'd be at least somewhat harder to avoid them going after you? None of these are bulletproof, even combined. But even so they're not worthless either to that goal. Are you actually asserting that the actual state of malware on iOS is identical or worse then that of Android or Windows/Mac/Linux? That's not something I've seen supported before but I'd read a good source if you've got one.
    - Jyaif 8y ago
      If I want to hide "malicious code" in my binary (whatever that means on iOS), there's no amount of Apple review that will be able to catch it. In fact, even their restriction on downloadable code is not enforceable. This limitation is not about improving security, it's about preventing developers from creating ecosystems inside their apps.
      - saagarjha 8y ago
        Apple will most likely catch whatever you have in mind. If not, they will certainly pull your developer agreement once they figure it out.
      - jonhendry18 8y ago
        Once someone figures out what you're doing Apple can flip the remote killswitch and disable your app.
      - filleduchaos 8y ago
        Given your previous comments, I'd be very surprised indeed if you'd ever even opened Xcode in your life (to talk of actually getting an app you built approved and listed in the App Store). But sure, you totally know how to sneak malicious code past Apple's security processes, and for some completely sensible reason you've neither used it for your own nefarious gain nor reported the exploit and claimed the fat bounty that would inevitably await you.
    - modells 8y ago
      I wouldn’t blame capitalist conspiracy just yet what can be attributed to practical intentions for reasons: 0. Trying to prevent average developers from shooting themselves in the feet too often by having apps that depend on external servers to run, then having a big security incident and Apple being blamed for allowing insecure, third-party code to run. 1. Trying to keep tabs on devs pivoting too far without a re-review. Can’t sell a Farmville app that then becomes a bitcoin wallet which then steals said bitcoins. 2. Keep the quality of apps up by curating through review rather than allowing free, unlimited publishing of random/broken apps. It’s a small barrier to entry and proof that someone invested to make something worth publishing. 3. Malware for old/jailbroken iOS existed way back, but it’s not really a thing, anymore because 0days get mostly either reported to Apple or sold/auctioned off. https://www.theiphonewiki.com/wiki/Malware_for_iOS https://www.theiphonewiki.com/wiki/Malware_for_iOS
  - sctb 8y ago
    Could you please stop breaking the guidelines by posting uncivilly and/or unsubstantively? We've asked already and eventually we ban accounts that won't stop. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
xoa 8y ago
What. Apple has no issues trusting Apple 100% completely, nor do any of their users. Or more specifically, Apple itself is simply an inseparable part of the core trust foundation since they control the entire stack of hardware, firmware and software. You calling this "hypocritical BS" is just nonsense, it's like acting shocked that Apple doesn't allow any random developer to issue microcode processor updates even though Apple could. Of course Apple can, there is no equality there. Apple develops private code and dogfoods it before making it public. Any platform developer by definition has to do low level stuff as part of making higher level stuff. This is not difficult. "Hypocrisy" gets thrown around way too often on the Internet, and if you do so you are basically always wrong, either because it's not actually hypocrisy at all (the word is not a synonym for "anything I don't like") or because it's a meaningless thing to say anyway vs more substantive complaints.
- insidegui 8y ago
  It's also worth noting that the bundle that includes the Lua code is signed and its signature gets verified by the OS before running.
- deleted 8y ago
  [deleted]
- denzil_correa 8y ago
  > "Hypocrisy" gets thrown around way too often on the Internet, and if you do so you are basically always wrong, either because it's not actually hypocrisy at all (the word is not a synonym for "anything I don't like") or because it's a meaningless thing to say anyway vs more substantive complaints. Another thing - hypocrisy has no bearing on the conclusion of the argument. You can be a hypocrite and be logically correct. OTOH, you can be far away from a hypocrite and be wrong.
untog 8y ago
Apple owns the OS. They've used private frameworks in their apps for years too, even though third party apps aren't allowed. Because they own the platform. It's hardly surprising.
samcat116 8y ago
There's a reason that there's App Review for 3rd party devs. Apple doesn't need app review for its own apps.
machiavelli1024 8y ago
Yeah, right?! They also have this “Software Update” thing in Settings, which installs kernel updates and other stuff from the internet!
joemi 8y ago
Adding to the other replies explaining why it's not hypocritical, I have an example. Consider section 5.2.4 of Apple's App Store Review Guidelines https://developer.apple.com/app-store/review/guidelines/#intellectual-property https://developer.apple.com/app-store/review/guidelines/#int... > 5.2.4 Apple Endorsements: Don’t suggest or infer that Apple is a source or > supplier of the App, or that Apple endorses any particular representation > regarding quality or functionality. Apple definitely infers and suggests and even explicitly states that Apple is the supplier of their own apps. This clearly violates section 5.2.4. But Apple does not have to follow the rules that apply to third party developers because they're not third party developers. They're first party developers.
- Domenic_S 8y ago
  I think they mean "imply" rather than "infer", don't they? Inferring is drawing a conclusion: you imply something, and I infer your meaning.
  - joemi 8y ago
    Good catch. I didn't notice that when copying it.

Jyaif 8y ago

That's something that Apple forbids app developers from doing (unless the lua interpreter is running in a webview).

haney 8y ago
https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ > 2.5.2 Apps should be self-contained in their bundles, > and may not read or write data outside the designated > container area, nor may they download, install, or > execute code which introduces or changes features or > functionality of the app, including other apps. The wiggle room is in the "introduces or changes features or functionality of the app" line, they've given themselves vague discretion to reject things that download too much code, but there are tons of apps that do OTA updates that haven't been rejected because they aren't changing fundamental features/functionality.
- nomadluap 8y ago
  Also if there was no wiggle room here, then any app that downloads and displays webpage content would be in violation due to embedded javascript.
  - DerekL 8y ago
    For a long time, downloaded code could only run inside Apple’s WebKit or JavaScriptCore, but since June 2017, you can use any language and interpreter. Apparently, almost nobody noticed: https://www.theregister.co.uk/2017/06/07/apple_relaxes_developer_rules/ https://www.theregister.co.uk/2017/06/07/apple_relaxes_devel...
    - binomialxenon 8y ago
      It's good that they revised that ridiculous restriction, but I think they should go further still. It was disingenuous to advertise the iPad as a "computer replacement" when having an environment for Python coding (widely used for beginner programming) was essentially banned. There really should be a way to work in even compiled languages on iDevices.

ChrisLTD 8y ago

It’s nice that Apple isn’t tying this functionality to OS updates. It was pretty bad a few months back when typing prediction went haywire and we had to wait weeks for a fix. Separately, I’m surprised Apple didn’t do this with Swift. I thought one of the goals of Swift was to be a good language for low level code up to high level scripting.

zepto 8y ago
Or JavaScript. Presumably both of these have more overhead than Apple wanted in this case, but it does seem odd.
- vorpalhex 8y ago
  lua is much easier to execute and much easier to sandbox than JS.
  - pcwalton 8y ago
    I don't see how Lua is easier to sandbox. I'm a bit surprised at the use of Lua, given that JavaScriptCore is already there. But I wouldn't be surprised if Lua was just something that the team was already familiar with. Lua is tiny, so it's not like it adds a significant dependency.
    - simonh 8y ago
      As you said Luna is tiny, which makes it easier to sandbox. A smaller system with a more limited set of behaviours and features is much easier to test and verify.
      - pcwalton 8y ago
        I guess, but (1) JavaScript is already there, so using it adds no new attack surface; (2) JS engines get more scrutiny; (3) sandboxing isn't as important anyway since the interpreter only runs trusted code.

currysausage 8y ago

Looks like the code is not obfuscated and even includes comments. Does anyone here have the URLs? Might be an interesting read.

stefan_ 8y ago

It's like a WoW addon. They should make the entire UI scriptable and create an addon store.

earenndil 8y ago
They won't do that because they want a consistent look for their devices. If you jailbreak, though, you can inject code that hooks into random methods and changes the ui; but that's not officially supported.

mintplant 8y ago

The example is interesting (a suggestion to contact the organizer of an event you're running late to), and supports my suspicion that much of the "smartness" ascribed to modern devices boils down to lots of hand-crafted pattern-response rules. Pay no attention to the programmers behind the curtain.

dan-robertson 8y ago
I’m not really sure anyone should be surprised that much of the smartness is rule-based with maybe a bit of “AI” to help with speech recognition and fiddling with the words a bit. I think this is good because it tends to lead to misunderstanding being biased towards not doing anything instead of doing something particularly wrong. The downside is that the rules never seem to cope with enough inputs. My hope is basically that many more rules will be written and they will slowly move towards handling more general problems as well as a very large variety of specific cases.

ppetty 8y ago

Is the “not obfuscated” part potentially just because the OS is still Beta? Seems somewhat similar to not encrypting the kernel, from iOS 10 (https://techcrunch.com/2016/06/22/apple-unencrypted-kernel/ https://techcrunch.com/2016/06/22/apple-unencrypted-kernel/).