4 ms·

Which should I be most irritated by: 1) Apple's app review is nigh useless security theater. 2) The App Store is easily manipulated with fake reviews to boost

Which should I be most irritated by: 1) Apple's app review is nigh useless security theater. 2) The App Store is easily manipulated with fake reviews to boost malware. 3) Apple's approved channels for vulnerability reporting are low priority, opaque, and unresponsive. 4) Apple acts (and swiftly) only upon media attention.

kbenson 8y ago
> 1) Apple's app review is nigh useless security theater. It's not useless, it serves the vital purpose of allowing Apple to strong-arm companies when Apple wants to compete with them. :/ e.g. https://news.ycombinator.com/item?id=17831188 https://news.ycombinator.com/item?id=17831188
- MrEfficiency 8y ago
  Dont forget you need to buy an apple, and the yearly membership, and have to constantly update when code is intentionally broken. As a small time dev with limited resources, Apple is my least favorite company to deal with.
  - greglindahl 8y ago
    As a consumer, I'm happy with the rapid pace of change in Apple's software. Yes, that raises the minimum needed to keep an Apple app working.
    - deleted 8y ago
      [deleted]
    - TheForumTroll 8y ago
      I have never heard Apple praised for rapid pace of change in their software but there's a first for everything! In fact IMHO they lack behind everyone else and live by taking what others do, brush it up a tad and sell it as the best new amazing feature ever made.
      - MrEfficiency 8y ago
        Im pretty sure Apple has a marketing team patrolling ycombinator. or fanboys.
  - s73v3r_ 8y ago
    Oh noes, you have to have the platform from the company to make apps for the platform from the company. The horror. I honestly cannot take seriously any complaints about having to have a Mac to make Mac apps. How on earth are you testing if you don't have the platform you're supposed to be targeting?
    - jermaustin1 8y ago
      I think he is more complaining about having to have a Mac to build iOS apps.
    - kbenson 8y ago
      Well, with regards to iPhone development at least, it's not that you're buying the platform you're targeting, it's that you have to buy a specific separate piece of hardware, running a specific separate software OS, which are not the same as the target platform, to develop for it. An then, as the GP notes, you have to keep updating them for reasons unrelated to the targeted platform. I mean, I understand having to have a Mac to develop for a Mac, but having to have a Mac to develop for iPhone is just Apple being Apple.
      - s73v3r_ 8y ago
        I still can't take that complaint seriously.
        kbenson 8y ago
        Maybe because you already have a Mac? If you had to buy a NeXT workstation to develop for it, that might feel a bit different then though, right? It's only a slightly different proposition. Sure, a lot of people already have Macs, but it's not really that hard to make the software work on other operating systems. Apple just doesn't care to to make it cross platform, and also makes more money and solidifies their market by requiring Macs.
    - tpush 8y ago
      > Oh noes, you have to have the platform from the company to make apps for the platform from the company. The horror. Useless snark. > I honestly cannot take seriously any complaints about having to have a Mac to make Mac apps. How on earth are you testing if you don't have the platform you're supposed to be targeting? The point is that you don't have to buy dedicated hardware for the other two big platforms (Windows, Linux). The fact that this restriction is essentially arbitrary makes cross-platform developers reasonably annoyed.
- scarface74 8y ago
  So which am I suppose to believe - a random story on HN or an existence proof that I have half a dozen apps on my iOS device that do exactly what the poster said his app was rejected for?
  - kbenson 8y ago
    > an existence proof that I have half a dozen apps on my iOS device that do exactly what the poster said his app was rejected for Well, since the HN story doesn't rely on the fact that no other apps exist with that capability, and actually uses that fact to make its point, I'm not sure what you're trying to use their existence to prove. "since other apps still get to do this, it's clear the policy change message was BS."
    - scarface74 8y ago
      It was never policy. There have been lots of cases with further investigation that there was more to the story. Why would Apple single out his app? The post said Since other apps still get to do this, it's clear the policy change message was BS. I've suspected a lot has had to do with Apple's ambitions in the streaming space and their desire to be in a position to offer bundling and other over the top services. There are literally dozens of cross platform streaming apps on iOS. There has been no policy change. Apple would be more than happy to take a 30% cut on a cross platform streaming service.
      - kbenson 8y ago
        > There are literally dozens of cross platform streaming apps on iOS. There has been no policy change. So, your argument is that because some apps exist now with this behavior, the claim that some apps do or did experience unwarranted attention and extra requirements for non-policy and technical reasons must be false? I'm not sure I follow that reasoning.
        scarface74 8y ago
        I’m saying that if I have a choice between believing knowing that cross platform streaming apps that require a login and that have IAP have existed since 2009, continue to exist in 2018, there is no published policy against it, and the only place where we have seen this is one post on HN, I’m more likely to believe that there is more going on. I’m definitely not willing to believe that he was singled out because Apple wants to build thier own streaming app seeing that they will already be competing with dozens of other providers on thier own platform when thier streaming service comes out.
ChrisSD 8y ago
I don't think any app review process is more than theatrics. Google, Apple or Microsoft. There's too many programs with too much code with too many places for malicious code to hide. The programs allegiance is always with the people who write it (exploitable bugs aside). Either you trust those people with the permissions you give them or you don't give them those permissions. How can Apple know who to trust? How can the end user?
- cm2187 8y ago
  Well, they want a share the developer p&l by forcing them into an app store, they get to share the blame for what those developers do. After all when you buy an app from them, you pay apple, not the developer.
- kbenson 8y ago
  > How can the end user? With sufficiently robust and constrained permissions, it wouldn't be out of the realm of possibility to offload the process to trusted third parties. If I could subscribe to Consumer Reports App Review, which was an app that itself was given some access to see binary signatures of installed applications, a robust third party review ecosystem could develop. If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. Alas, neither app store is willing to throw away the billions of dollars in app sales they make, so while we might get more granular permissions over time, we'll likely never be allowed out of our walled gardens. "For our own good", of course.
  - lightbyte 8y ago
    >If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. After which apps will get an update where they first send your data to app-website.com where their own servers will secretly spirit away your data
stevenwoo 8y ago
I just started looking at making a browser extension for Safari and it's insane compared to every other browser AFAIK, one has to make an app and submit it to the app store for approval.
- bangonkeyboard 8y ago
  The truly insane thing is that Safari's original extension mechanism was close to the model used by other browsers, was more capable than the API that replaced it, and was totally free and open to develop for. Apple intentionally killed their small but growing extension ecosystem in favor of more-limited, native code, App Store-only extensions that require a yearly developer subscription to write.
- saagarjha 8y ago
  Do you actually have to go through the App Store to make a new Safari Extension? IIRC an app was enough.
  - stevenwoo 8y ago
    It's not explicit enough for dummies like me, but the Safari extensions gallery is the Safari browser extension app store equivalent (available in browser) and one can submit the app and include the extension for publication in the app store and the extension gallery at the same time it appears (haven't tried or gotten that far yet). "You can sell and distribute your apps with Safari Extensions to customers worldwide on the Mac App Store. To submit, sign in to App Store Connect. For information on creating Safari Extensions for the Mac App Store, see the Safari App Extension Programming Guide."
    - saagarjha 8y ago
      The extension gallery is the place for legacy (non-app-based) extensions. It’s likely going away soon.
da_chicken 8y ago
5) The appstore alternatives, from Google Play to Microsoft to Amazon and even Valve are unlikely to be any better. Just because the garden has a wall doesn't mean that anybody's tending the roses.
scarface74 8y ago
The app review process is security theory. I blame the sand boxing mechanism that allows a Mac App Store app permission to an entire folder. That permission is inherently unsafe. If an app needs that type of permission on the Mac sell it outside of the App Store.

kbenson 8y ago

> 1) Apple's app review is nigh useless security theater. It's not useless, it serves the vital purpose of allowing Apple to strong-arm companies when Apple wants to compete with them. :/ e.g. https://news.ycombinator.com/item?id=17831188 https://news.ycombinator.com/item?id=17831188

MrEfficiency 8y ago
Dont forget you need to buy an apple, and the yearly membership, and have to constantly update when code is intentionally broken. As a small time dev with limited resources, Apple is my least favorite company to deal with.
- greglindahl 8y ago
  As a consumer, I'm happy with the rapid pace of change in Apple's software. Yes, that raises the minimum needed to keep an Apple app working.
  - deleted 8y ago
    [deleted]
  - TheForumTroll 8y ago
    I have never heard Apple praised for rapid pace of change in their software but there's a first for everything! In fact IMHO they lack behind everyone else and live by taking what others do, brush it up a tad and sell it as the best new amazing feature ever made.
    - MrEfficiency 8y ago
      Im pretty sure Apple has a marketing team patrolling ycombinator. or fanboys.
- s73v3r_ 8y ago
  Oh noes, you have to have the platform from the company to make apps for the platform from the company. The horror. I honestly cannot take seriously any complaints about having to have a Mac to make Mac apps. How on earth are you testing if you don't have the platform you're supposed to be targeting?
  - jermaustin1 8y ago
    I think he is more complaining about having to have a Mac to build iOS apps.
  - kbenson 8y ago
    Well, with regards to iPhone development at least, it's not that you're buying the platform you're targeting, it's that you have to buy a specific separate piece of hardware, running a specific separate software OS, which are not the same as the target platform, to develop for it. An then, as the GP notes, you have to keep updating them for reasons unrelated to the targeted platform. I mean, I understand having to have a Mac to develop for a Mac, but having to have a Mac to develop for iPhone is just Apple being Apple.
    - s73v3r_ 8y ago
      I still can't take that complaint seriously.
      - kbenson 8y ago
        Maybe because you already have a Mac? If you had to buy a NeXT workstation to develop for it, that might feel a bit different then though, right? It's only a slightly different proposition. Sure, a lot of people already have Macs, but it's not really that hard to make the software work on other operating systems. Apple just doesn't care to to make it cross platform, and also makes more money and solidifies their market by requiring Macs.
  - tpush 8y ago
    > Oh noes, you have to have the platform from the company to make apps for the platform from the company. The horror. Useless snark. > I honestly cannot take seriously any complaints about having to have a Mac to make Mac apps. How on earth are you testing if you don't have the platform you're supposed to be targeting? The point is that you don't have to buy dedicated hardware for the other two big platforms (Windows, Linux). The fact that this restriction is essentially arbitrary makes cross-platform developers reasonably annoyed.
scarface74 8y ago
So which am I suppose to believe - a random story on HN or an existence proof that I have half a dozen apps on my iOS device that do exactly what the poster said his app was rejected for?
- kbenson 8y ago
  > an existence proof that I have half a dozen apps on my iOS device that do exactly what the poster said his app was rejected for Well, since the HN story doesn't rely on the fact that no other apps exist with that capability, and actually uses that fact to make its point, I'm not sure what you're trying to use their existence to prove. "since other apps still get to do this, it's clear the policy change message was BS."
  - scarface74 8y ago
    It was never policy. There have been lots of cases with further investigation that there was more to the story. Why would Apple single out his app? The post said Since other apps still get to do this, it's clear the policy change message was BS. I've suspected a lot has had to do with Apple's ambitions in the streaming space and their desire to be in a position to offer bundling and other over the top services. There are literally dozens of cross platform streaming apps on iOS. There has been no policy change. Apple would be more than happy to take a 30% cut on a cross platform streaming service.
    - kbenson 8y ago
      > There are literally dozens of cross platform streaming apps on iOS. There has been no policy change. So, your argument is that because some apps exist now with this behavior, the claim that some apps do or did experience unwarranted attention and extra requirements for non-policy and technical reasons must be false? I'm not sure I follow that reasoning.
      - scarface74 8y ago
        I’m saying that if I have a choice between believing knowing that cross platform streaming apps that require a login and that have IAP have existed since 2009, continue to exist in 2018, there is no published policy against it, and the only place where we have seen this is one post on HN, I’m more likely to believe that there is more going on. I’m definitely not willing to believe that he was singled out because Apple wants to build thier own streaming app seeing that they will already be competing with dozens of other providers on thier own platform when thier streaming service comes out.

ChrisSD 8y ago

I don't think any app review process is more than theatrics. Google, Apple or Microsoft. There's too many programs with too much code with too many places for malicious code to hide. The programs allegiance is always with the people who write it (exploitable bugs aside). Either you trust those people with the permissions you give them or you don't give them those permissions. How can Apple know who to trust? How can the end user?

cm2187 8y ago
Well, they want a share the developer p&l by forcing them into an app store, they get to share the blame for what those developers do. After all when you buy an app from them, you pay apple, not the developer.
kbenson 8y ago
> How can the end user? With sufficiently robust and constrained permissions, it wouldn't be out of the realm of possibility to offload the process to trusted third parties. If I could subscribe to Consumer Reports App Review, which was an app that itself was given some access to see binary signatures of installed applications, a robust third party review ecosystem could develop. If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. Alas, neither app store is willing to throw away the billions of dollars in app sales they make, so while we might get more granular permissions over time, we'll likely never be allowed out of our walled gardens. "For our own good", of course.
- lightbyte 8y ago
  >If applications were also given the capability to subscribe minimally to resources they require (e.g. this app will access foo.example.com, and bar.example.com, and otherwise interact with registered sharing handlers through the OS), etc, we could be a lot more assured of an application not secretly spiriting away our data, at least if we cared to pay attention. After which apps will get an update where they first send your data to app-website.com where their own servers will secretly spirit away your data

stevenwoo 8y ago

I just started looking at making a browser extension for Safari and it's insane compared to every other browser AFAIK, one has to make an app and submit it to the app store for approval.

bangonkeyboard 8y ago
The truly insane thing is that Safari's original extension mechanism was close to the model used by other browsers, was more capable than the API that replaced it, and was totally free and open to develop for. Apple intentionally killed their small but growing extension ecosystem in favor of more-limited, native code, App Store-only extensions that require a yearly developer subscription to write.
saagarjha 8y ago
Do you actually have to go through the App Store to make a new Safari Extension? IIRC an app was enough.
- stevenwoo 8y ago
  It's not explicit enough for dummies like me, but the Safari extensions gallery is the Safari browser extension app store equivalent (available in browser) and one can submit the app and include the extension for publication in the app store and the extension gallery at the same time it appears (haven't tried or gotten that far yet). "You can sell and distribute your apps with Safari Extensions to customers worldwide on the Mac App Store. To submit, sign in to App Store Connect. For information on creating Safari Extensions for the Mac App Store, see the Safari App Extension Programming Guide."
  - saagarjha 8y ago
    The extension gallery is the place for legacy (non-app-based) extensions. It’s likely going away soon.

da_chicken 8y ago

5) The appstore alternatives, from Google Play to Microsoft to Amazon and even Valve are unlikely to be any better. Just because the garden has a wall doesn't mean that anybody's tending the roses.

scarface74 8y ago

The app review process is security theory. I blame the sand boxing mechanism that allows a Mac App Store app permission to an entire folder. That permission is inherently unsafe. If an app needs that type of permission on the Mac sell it outside of the App Store.