39 ms·

Apple blocks Facebook from running its internal iOS apps

735 points by epaga 8y ago

GrumpyNl 8y ago
How bad will this hurt facebook?
- digb 8y ago
  Apparently they can't check what's for lunch, so pretty catastrophic IMO.
  - jdavis703 8y ago
    Well besides that they can’t do canary releases of their flagship apps, at least not without potentially introducing bugs to their users.
    - max76 8y ago
      They should still be able to use testflight to distribute IOS beta versions of Facebook, Messenger, and other apps.
- dymk 8y ago
  FB ticker is up 3% today. It won't.
- vlozko 8y ago
  It'll sting internally, for sure. For how long? Not sure but I'd say it'll halt release processes for maybe a week or two. Any large organization resorts to using enterprise certs for beta and QA distributions of an app as the device limits are unrealistically low for them. These things tend to have cycles where a features have to get in by a certain date and then builds are sent off for beta and QA testing. There's no question this issue throws a wrench in this process. A solution to this problem is signing it with another enterprise cert. I don't know if all of Facebook's enterprise signing certs were revoked or just the one used for this app and even if FB tried applying for a new one (maybe through a subsidiary?) that takes time.
andeee23 8y ago
Serves them right but it's hard to think that the facebook people who were in charge of the spying app wouldn't have considered this as a possible outcome. It probably won't affect them that much if they were already prepared for this to happen.
- hn_throwaway_99 8y ago
  I'm guessing you haven't worked at a large corporation, especially one that explicitly says they value speed over correctness. My guess is the team involved in the research app got hold of the enterprise certs, and the teams on the other apps were unaware.
  - ceejayoz 8y ago
    Facebook's Onavo Protect app (which this is a reskin of) was banned by Apple in June. I don't think they can claim ignorance here.
  - CameronBanga 8y ago
    If you play with dogs, you can't be surprised when you get fleas.
  - andeee23 8y ago
    I wasn't saying that everyone at facebook knew. But if you were one of the people in charge of the data tracking app, wouldn't you at least know that apple revoking the licence could be a possibility since you are explicitly breaching the agreement? Not even trying to defend them. Just curious how much it will actually affect facebook.
    - wccrawford 8y ago
      You're assuming they knew that was a breach of the agreement... And I doubt the devs in question have ever read the agreement. This is a company that had the motto "move fast and break things". They prefer to "fail forward" and push things live sooner rather than safer. It doesn't surprise me at all that someone just saw that something was possible and did it without considering the consequences.
digb 8y ago
Glad to see rules being enforced on a powerful organization.
mjw1007 8y ago
While I have no sympathy at all for Facebook, this is a rather chilling reminder of Apple's ability to decide what you're allowed to run on your own phone.
- strict9 8y ago
  Chilling isn't my takeaway. It's that Apple take the threat of surreptitious data gathering seriously and enforces its rules for other companies to that effect.
  - yholio 8y ago
    It's either that, or they employed their market dominance to strike at their competitor. Without a public regulator that fines both Facebook and Apple for their respective abuses, we will never know which.
    - strict9 8y ago
      A public regulator of tech oligopolies is a great idea. Until that happens we have few choices in whom we chose to trust. Apple is no corporate saint but for now it is the best of the lot because of its business model.
      - scarface74 8y ago
        You really trust the government to regulate tech fairly?
        ceejayoz 8y ago
        I trust them ("them" being developed-world democracies; obviously there are more concerns with, say, the Saudis) more than I trust tech to self-regulate. You're not going to get a self-imposed GDPR.
        scarface74 8y ago
jamiek88 8y ago
They have stripped them of the enterprise certificate. This does not affect installed apps from the app store of course. But still a clear statement from Apple.
- ceejayoz 8y ago
  It does affect any internal apps Facebook has, though.
  - ethbro 8y ago
    Only ones signed on the same certificate. One expects the reason they reused their primary enterprise cert is so they wouldn't have to justify their spyware in a new request to Apple... You build a house out of kerosene jugs, don't go crying when it burns down.
    - ceejayoz 8y ago
      The article indicates their lunch menus and staff transportation apps don't work. > Apple has shut down Facebook’s ability to distribute internal iOS apps, from early releases of the Facebook app to basic tools like a lunch menu. A person familiar with the situation tells The Verge that early versions of Facebook, Instagram, Messenger, and other pre-release “dogfood” (beta) apps have stopped working, as have other employee apps, like one for transportation. I'm totally fine with this house burning down. Just noting that this is apparently having very significant internal effects, even if the public Facebook app is fine.
      - fatbird 8y ago
        In a way, that seems like the best counterstrike by Apple. Minimally disruptive to the public at large, massively disruptive to the bad actor.
      - chooseaname 8y ago
        > I'm totally fine with this house burning down. Just noting that this is apparently having very significant internal effects... And this is ALL on Facebook and NOT Apple. Facebook understood the consequences when they decided to abuse the Enterprise Cert. They took the risk and got called on it. This is Facebook's fault. Full stop.
jon-wood 8y ago
This seems entirely legitimate. Facebook were using Apple's support for enterprise distribution based on having a corporate certificate on your device, designed to allow distributing internal apps that don't make sense on the App Store proper, to distribute an app to their users - presumably because they knew it wouldn't make it through the approval process for doing distribution using TestFlight, which is what is meant to be used for this sort of app release.
- epaga 8y ago
  Yes, this is the optimal measured response from Apple. They're treating Facebook the way they'd treat any other company that did this. It's also a step up from the warning they gave with the whole Onovo thing. Strike two...
  - hn_throwaway_99 8y ago
    To be clear, this app that was just removed WAS just a reskinned Onavo app - same code and "ONV" class prefixes, etc.: https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761 Facebook got caught, and then they tried to use their enterprise cert to get around App Store review because they knew it would get rejected.
    - edraferi 8y ago
      Pathetic.
    - dabockster 8y ago
      I give it a week until Facebook starts using some sort of exploit to get Onavo onto iPhones. Probably guessing it will be a Safari exploit based on past history. That's when the real fireworks will begin.
      - acct1771 8y ago
        Please elaborate on this.
strict9 8y ago
These continued moves of desperation show a company terrified of losing its massive data-gathering surveillance machine. Hoping Apple demonstrates its commitment to privacy by doing more than hurting internal functionality and speak to the only thing that matters to FB - its ability to surveil people.
- Liquix 8y ago
  Investors and governments pumped billions into FB in the last 5-10 years seemingly under the impression that it was too big to fail. One can definitely see the panic starting to trickle in now that it's clear the platform's days are numbered. I wonder if they will be able to shift to a less predatory/ad-based business model before it's too late or go all-out with the data harvesting.. It'll be interesting to watch it play out either way!
  - freeflight 8y ago
    > now that it's clear the platform's days are numbered. How is that "clear"? It's true that FB has received a lot of bad press and push back in recent times, but none of that changes the fact that FB is pretty much still the 10.000-pound Gorilla in the room with no real alternatives for a lot of people. Don't get me wrong here: I don't like it either, I just don't see their days as being "numbered", but FB is too entrenched in a whole lot of sectors for it to simply vanish without some kind of competitor actually gobbling everything up they do right now. Too many people forget that at this point FB isn't just "social media", for a whole lot of small and medium businesses FB has become their sole online presence, due to ease of use and reach.
    - taurath 8y ago
      They are definitely too entrenched with partners, but for the users themselves to mass-migrate all it takes is a big enough user-facing tactical error.
- ASalazarMX 8y ago
  > Hoping Apple demonstrates its commitment to privacy If Apple had a true commitment to privacy, this wouldn't have happened by design. Apple just has less commercial interest in gathering data about users outside its garden.
jedberg 8y ago
I think Apple is right here — they’ve detected a breach of term and shut it down. But I still think they are wrong for blocking 3rd party apps. I understand they believe it is for my safety and security, but there needs to be a happy medium. They should have a way for experts to side load apps.
- rsynnott 8y ago
  They have, for the last few years: http://osxdaily.com/2016/01/12/howto-sideload-apps-iphone-ipad-xcode/ http://osxdaily.com/2016/01/12/howto-sideload-apps-iphone-ip...
  - jedberg 8y ago
    I'd like to be able to side load close source apps too.
    - saagarjha 8y ago
      http://www.cydiaimpactor.com http://www.cydiaimpactor.com
- fetus8 8y ago
  I think you're missing the point. Experts do have a way to side load apps, through enterprise certificates and developer certificates. Facebook was distributing an app to consumers using the enterprise certificates, to collect data, in somewhat malicious terms, which is a direct policy violation of using an enterprise certificate.
  - richardwhiuk 8y ago
    Yeah, Apple have to step in here - otherwise they risk Enterprise certificates being used widely to violate Apple's AppStore restriction (which is what FB was doing), which is clearly not in Apple's best interest.
  - int_19h 8y ago
    > Experts do have a way to side load apps, through enterprise certificates and developer certificates Only their own apps. You can't use that mechanism to distribute an app to other "experts", which makes it of limited use in practice. You can distribute as source and require them to build it, but then everybody who wants to install your app on their device also needs a Mac.
40acres 8y ago
I keep going back and forth regarding whether Onvaro is just "opposition research" or a sign that while Facebook is still as powerful as ever, that they are running out of product ideas. Of course it could be both, but the use of Onvaro and 'Facebook research' have a hint of desperation.
hn_throwaway_99 8y ago
To be honest, while there has been loads of bad press against FB over the past year, I had been leaning toward giving them the benefit of the doubt for the main following reason: a lot of the bad press had come about because society's views on privacy had changed (especially with the realization of how social media could be used to impact a US election), not just Facebook's. After all, when FB originally released their developer APIs that let developers gain access to friend data without the friend's explicit permission, there was barely a peep about that (among security/privacy researchers, sure, but among the general populace, no). It was only after Trump got elected that people had an "oh shit" moment about what was really possible with social media data. This "data research" app has hardened my views, though: I now believe Facebook is rotten to the core. After all, as a security researcher pointed out, that "market research" app was basically just the previously removed Onavo app, reskinned (https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761). Facebook knew they got caught, and they tried to workaround by using their enterprise cert so the app wouldn't go through App Store review. Screw them, I hope this forces the heavy hand of government regulation on them. They have proved the cannot manage themselves.
- saiya-jin 8y ago
  I view company as consistent, in same way I view Putin as consistent - expect more sneaky shit and backstabbing. Their mission as a company is clear, the way they conduct the business is pretty clear too, this ain't first nor second time FB did something amoral intentionally. We humans have full right to change our views and values, and what in our society is not aligned anymore should either change or perish. When will the HN crowd start treating Zuckenberg (no 'Zuck' please) as amoral piece of * with rest of the company following?
- reificator 8y ago
  > After all, when FB originally released their developer APIs that let developers gain access to friend data without the friend's explicit permission, there was barely a peep about that (among security/privacy researchers, sure, but among the general populace, no) You're telling me that the average plumber and teacher and waiter didn't complain when Facebook introduced an interface for developers? No way. > Bro, did you see the new API that FB put out that totally foobars luser privacy? > Dude, I teach kindergarten, wtf is an API? Obviously people trying to explain it aren't going to be using that language, but to outsiders it'll sound that way. And tech nerds aren't known for being able to explain things to laymen in the first place.
Wheaties466 8y ago
How long until Facebook creates its own phone and OS?
- deleted 8y ago
  [deleted]
- reggieband 8y ago
  I'm not sure if this is sarcasm or short-term memories. Facebook did try to create its own phone and it flopped.
Wheaties466 8y ago
How long before Facebook creates its own phone and OS?
- sschueller 8y ago
  The already tried (kind of): https://en.wikipedia.org/wiki/Facebook_Home https://en.wikipedia.org/wiki/Facebook_Home
- markstos 8y ago
  That's where I see this going. Perhaps Facebook will fork Android. Today it's Apple interfering with Facebook use of mobile devices. Tomorrow it could be Google.
- ardy42 8y ago
  > How long until Facebook creates its own phone and OS? About negative six years. They already tried and it flopped: https://en.wikipedia.org/wiki/Facebook_Home https://en.wikipedia.org/wiki/Facebook_Home I can't see it going any better if they tried again, since they've been working hard in the mean time to burn all the trust and goodwill they have.
- deleted 8y ago
  [deleted]
- po1nter 8y ago
  One must be nuts to trust and run an entire OS made by Facebook.
ViViDboarder 8y ago
This is exactly what Apple would do to a small indie developer if they found they did something similar. Glad to hear that they aren’t afraid to do it to a company like Facebook.
- wheelie_boy 8y ago
  In this case the punishment fit the crime - break terms of enterprise distribution cert, get enterprise cert pulled. However, it's very possible that if a smaller company did this that all of their certs, apps, and dev accounts would get pulled. Facebook does still get some special treatment.
  - rhizome 8y ago
    Facebook does still get some special treatment I am pretty sure others have had their entire accounts nuked for less.
    - sillyquiet 8y ago
      well, I mean, of course... Facebook is still the proverbial 500lb gorilla, bad actor or no. Apple's going to be very slow in nuking a big player that drives a huge chunk of device usage.
      - nxc18 8y ago
        Eh, I think Facebook would lose more money each day that conflict dragged on until they complied with apple’s policies. Users can always access Facebook through safari.
        max76 8y ago
        Kicking Facebook's apps off the appstore would include WhatsApp, Messenger, and Instagram. It would be a bigger deal than logging into Facebook.com on safari.
        8y ago
oaiey 8y ago
For me this disqualified the iOS platform for any software development. When they can do that with Facebook then the rest of us is just fucked up. With Android and Windows I currently at least have alternatives for distribution.
- fhood 8y ago
  This is an example of the walled garden working exactly as intended by Apple. In this example I approve of it, but I agree that if you are developing for iOS you should be aware of the power Apple can exert on the platform.
  - oaiey 8y ago
    Yeah. I agree with you.
  - scarface74 8y ago
    I don’t see the problem. As a corporation you sign an agreement to use an Enterprise certificate to distribute your app internally. The rules are very clear. FB broke those rules. If you don’t break the terms of the agreement you’re in the clear.
    - oaiey 8y ago
      Imagine Microsoft would shut down every computer who is not licensed properly. Without any joke, dead people are the result. For that reason you talk first and then act accordingly. Killing a business partner internal applications is very drastic behavior.
      - scarface74 8y ago
        You mean Windows Activation? What do you think would happen if you used your Azure, AWS, or GCP account to knowingly do DDOS attacks? Or more realistically if you do Pen testing on your own AWS resources without getting the approval of AWS and your entire organization is dependent on it? It is explicitly stated in your agreement with AWS that you can’t do that.
kerng 8y ago
With the news yesterday about Facebook's ambitious research project this seems entirely okay.
draw_down 8y ago
If they used the same cert for their teen social media monitoring project that they used for other apps that don’t break the rules, that seems like a tactical error. Mind the blast radius.
sidewaysloading 8y ago
I hope Apple will be taking down Google's enterprise distribution certificate as well, as they are abusing it to let consumers sideload a VPN app for data gathering: https://support.google.com/audiencemeasurement/answer/7573812?hl=en&ref_topic=7574346 https://support.google.com/audiencemeasurement/answer/757381... And on top of that all of those from other companies doing the exact same thing for data gathering.
- DCKing 8y ago
  The problem on the Android side goes deeper, as the "Onavo Protect" app is still alive and kicking in the Google Play store [1]. The Facebook Research app here is a shallow repackaging of the iOS version of Onavo Protect, which was banned from Apple's App Store at least. It doesn't appear Google is interested in doing anything here. They would likely have to do something about the thousands of other trojan horse VPN apps, too. It's just that those are not as transparently owned by a privacy-invading internet giant (and those apps probably sell your private information directly to the highest bidder even more eagerly). [1]: https://play.google.com/store/apps/details?id=com.onavo.spaceship https://play.google.com/store/apps/details?id=com.onavo.spac... - the positive, uninformed reviews of this app give me a feeling like I'm reading a dystopian novel.
  - jetpks 8y ago
    Why would Google ban apps for using Google's own business model?
    - checkyoursudo 8y ago
      > Why would Google ban apps for using Google's own business model? If Google is concerned about competition, they might. If Google is more concerned about being accused of being anti-competitive, then they probably would not.
- deleted 8y ago
  [deleted]
- choppaface 8y ago
fixermark 8y ago
It's nice they have the capacity to do that to protect their consumer ecosystem (indirectly), however, if I'm making an enterprise ecosystem decision to build out a fleet of mobile tools for my company, "Apple has and has used the capacity to shut down the ability of the hardware we purchased to run software we wrote on that hardware" gives me pause adopting that ecosystem. Their purpose was generally-accepted as just in this case, but what if next time, it's because someone started competing with them and they didn't like it?
- jasonjayr 8y ago
  Tech has a long and storied history of anti-competitive behavior by the platform owner, even without fancy signed code + crypto: * Microsoft and the games they played with 4DOS, undocumented calls, testing for id strings and then claiming windows woulden't run on the "Incompatible" DOS variant * Apple re-implementing shareware utilities in the System 6/7/8/9 days right into the operating system, sometimes not compensating the original developer for the idea * MS Word using undocumented API's for better UX + integration over all word processors in the 90s/00s * Twitter Changing Platform API and kicking out all sorts of useful apps on their platform * Facebook doing the same At least this time around, there's a clear kill switch so they don't have to be underhanded about it. And in this instance there was a clear and unambiguous ToS violation in play. Most of the instances I've listed went unpunished, or were only given a slap on the wrist after the damage was done.
- chooseaname 8y ago
  Isn't this exactly what the FTC is for, though?
  - fixermark 8y ago
    The FTC is a good backstop, but in the time it takes them to resolve a (potentially antitrust) case, your company could go bankrupt. As an enterprise purchaser, it may not be risk I want to take on for the benefit of using Apple hardware and software for internal solutions.
- _bxg1 8y ago
jamiek88 8y ago
This is having a real effect internally at Facebook. In many ways this is a good punishment, disruptive to the bad actor and minimally disruptive/invasive to the consumer. >Apple has shut down Facebook’s ability to distribute internal iOS apps, from early releases of the Facebook app to basic tools like a lunch menu. A person familiar with the situation tells The Verge that early versions of Facebook, Instagram, Messenger, and other pre-release “dogfood” (beta) apps have stopped working, as have other employee apps, like one for transportation
zhobbs 8y ago
My first reaction was: "Wow, FB finally went over the line and is actually an evil spyware distributor." Then I started thinking about what this app really is. At $20/month per user, it's clearly impossible to recoup that money on a per-user basis via better ad targeting. This app is a market research app with a very small opt-in panel, just like having a Nielsen box on your TV. I've never felt like Nielsen's data collection is evil, so it makes me wonder if my reaction is rational. Also, looks like Nielsen has a similar program: https://computermobilepanel.nielsen.com/ https://computermobilepanel.nielsen.com/
- TwoNineA 8y ago
  Did you bother reading Nielsen's contract? > Be 18 years of age or older and capable of entering into a binding contract. You expressly declare that you are the owner of or lawfully exercise control over any Device onto which you authorize the downloading of the Software. Facebook's spyware was pushed to teenagers as young as 13. But yeah, same thing.
  - zhobbs 8y ago
    Fair point!
- joshdover 8y ago
  There's a huge difference between what Nielsen does and what Facebook did. 1) Nielsen doesn't explicitly target children. 2) The data that Nielsen collects is far less intrusive than what FB collects. 3) The consumer is much more likely to be informed about the data Nielsen collects, where as with FB, it's unlikely that a user (especially a minor) understands the extent of what FB was collecting. And yes, Facebook was requiring "parental consent" to collect this data, but as we all know that is very hard to verify and children have been ticking the "I'm 13 or older" box for years without their parents knowing. What Facebook did clearly crossed a line. End of story.
  - EGreg 8y ago
    I wonder what the actual effects of saying “Period! End of Story!” are in a discussion forum. Obvioisly someone is still free to respond, and then that won’t be the end of the discussion. So what’s the point of saying it? It seems to escalate the stakes basically: “if you disagree then you are a LABEL!”
onewhonknocks 8y ago
It's heartening to see that Apple isn't afraid to rap their knuckles when they misbehave, despite their being such a force in the tech space.
keepper 8y ago
This scares me. Not so much the action by apple ( they are flexing their muscle), but the reactions here. "Great!", is the jist. It you think an unilateral revoke, and shutdown of a company internal tools, because of an external issue, without recourse is a good thing... I'm guessing you have no issues with Crazy EULA's, Monopolies, Corporate abuse, Corporations doing as they please. ( I can keep going down this slope.. ) Facebook had a program, with willing participants, that broke a third parties rules. We can argue infinitum about this. But this is a company, STOPPING your usage of YOUR hardware, AFTER you purchased it (I'm talking about apple stopping Facebook from distributing internal tools as well, this is the side effect of this ). Think deep and clear about this. Are you ok with this? Secondly, from the company (apple ) that literally turned everyones devices into wiretaps, globally, and ignored the issue for who knows how long... This is just.. wow. ( and they continue not to issue a formal reason for this ). Just.. wow.
- gshulegaard 8y ago
  Yeah, no. Facebook had a cert for distributing internal apps. When one of their external projects was rejected by the App store, they used the internal cert to try and distribute it externally (circumventing the App Store). As a response Apple revoked the certificate that was being used in violation of its use agreement. There is nothing wrong with that action. You're introducing a straw man argument by trying to make this about hardware ownership.
  - keepper 8y ago
    With due respect, I think you misunderstand what a straw-man argument is. This is not a different point. This IS post purchase control of hardware. Would you be ok with Tesla disabling cars because you were using illegal drugs in them? Now do you get it? I'm not defending facebook. I'm telling you this behavior from Apple is truly scary. Apple is not law/moral/societal enforcement "police". This is the ONLY way to run internal apps. and it wasn't one cert btw. Google has a similar "research app", their certs have not been revoked. Maybe because apple relies on google more? Maybe because they generate revenue from their search and app placement deals? Hrrm? My point is simple, arbitrary revokes, without process, are a scary thing. Specially when they are done POST purchase, and have real tangible effects.
michaelbuckbee 8y ago
This isn't going to stop anything. Attribution was already "laundered" through multiple different agencies and firms who were conducting this research. They'll just cut a check to another company and proceed from there and/or a company will just sell them the data on "teen social and mobile usage" and Facebook will be able to truthfully state that they had no idea the means by which it was collected.
unrealchild 8y ago
i’m curious why the internal tools would fail testflight beta review. i had an app fail beta review, but was still able to distribute with testflight after explaining to the reviewers it was for internal use only...
- ceejayoz 8y ago
  Doesn't TestFlight cap the number of users who can use a beta app?
  - saagarjha 8y ago
    It does; currently the cap is 10,000 users.
reneberlin 8y ago
It starts to become interesting. Popcorn time! I can't hide a small grin right now.
aboutruby 8y ago
I see this as a start of a political battle between Apple and Facebook (maybe Google too with their Screenwise Meter app). First Facebook tries to push the limit of what Apple would deem acceptable. Then Apple pushes back and show that it's clearly not acceptable. Now waiting for Facebook's response.
_bxg1 8y ago
So this is what Schadenfreude feels like.
- reneberlin 8y ago
  2 of the big five in a dispute over "ethics of technology (ab)use". One commenter had the thought, that this reaction from Apple is just straight aligned with the rules they created for every corp - regardless of their market share or $. But - i guess there will be negotiations. FB is in a position to make deal. Bad press in the dev-world - on dev-topics - didn't hold the masses and average Joe back to continue using FB. And this fail won't, too. Me sounding fatalistic, i know. But this outrage in the dev-world isn't enough to demask the beast. Red lines crossed - and next week the PR department will fix it. I don't know what needs to happen until the masses of FB-addicts switch to "open technology" and leave their silos.
  - _bxg1 8y ago
    I don't know that Facebook is in a position to make a deal. Apple just won a mountain of positive press by taking a tough stance on this, and without having to actually take Facebook's legitimate apps away from their users. I think Facebook is just going to have to live with the consequences of their decisions.
- reneberlin 8y ago
  Detoxing the masses seems to be a pipe dream for long now. But if nobody would like to work for them, this might mark a point.
vlunkr 8y ago
It's pretty crazy to think about what Apple is capable of doing now. By banning an app, they can easily kill a small company, and now they've caused some huge internal headaches for Facebook. I know Facebook broke their rules and totally deserved it here, but it's interesting to think about the power Apple has obtained by tightly controlling their platform.
- jkchu 8y ago
  You do bring up an interesting point. Apple's (expected?) responsibility here is to protect their users from malicious apps on their devices. It does seem reasonable for me what they are doing, but of course if they were to lose sight of their users' best interests, then this could become problematic. However, I think for issues like that we need to just trust the market to correct for that. If Apple were to destroy user trust, then I would not doubt that people would flock to their competitors (Google, Samsung, etc).
9dev 8y ago
I love the thought of someone at Apple holding a meeting on this and saying "well, fuck them" while sending out the kill command on the CLI :)
- draw_down 8y ago
  I’d imagine some Rock Paper Scissors was played to determine who got the honors.
kevintb 8y ago
Good on Apple.
mishurov 8y ago
It's irrelevant. Pliant Apple NPCs here with their shallow consumerist understanding of the tech will defend it anyway.
malloreon 8y ago
Hopefully this (likely, and unfortunately only momentary) pause in facebook employees' evil progress will inspire even a few of them to quit and use their experience for good instead.
pinewurst 8y ago
Wasn't Zuck trying to actively encourage the use of Android over iOS for employees anyway? :)
watmough 8y ago
Excellent. Full marks to Apple on this. Those could be anyone's kids being taken advantage of. Apple can't risk their integrity being associated with what Facebook are pulling.
satyenr 8y ago
Remember when people were outraged when Apple decided to give in to the demands of the Chinese government rather than shut shop. They complained about Apple not taking the high road. Now people are complaining about Apple taking the high road? Funnny how times change! Make up your mind people — you can’t have it both ways! Cheers!
- izacus 8y ago
  Who are those people you're creating a strawman of?
trevor-e 8y ago
Does the timing of this have anything to do with the Facetime bug? It feels like they could have done this a long time ago.
mschuster91 8y ago
If Apple keeps that block, then Facebook may have legal grounds of unfair business practices and sue Apple for opening up its walled garden, correct? Certainly would be ironic that the biggest data hoarder in human history ends up breaking the biggest monopoly in the mobile space.
- zepto 8y ago
  Nothing unfair about the business practices. Facebook intentionally breached their contract. It’s possible that Apple is the one with the right to sue.
  - mschuster91 8y ago
    Why? What Facebook does is legal (but ethically disgusting). Apple has a monopoly status as gatekeeper for their platform as there are no other competing iPhone App Stores (contrary to Google's Android). Now, as Apple is forbidding what Facebook does in their store ToS, Apple may be prohibiting Facebook from reaching the (not small!) target audience "iPhone users" for their data collection and thus unfairly hindering Facebook's business. I for one would be really happy if the Store ToS were to be torn down in the courts so that the only reason to block an app rollout is covert spying, malware or other user deception, but not open data analytics, porn (case in point, every porn site but especially Tumblr), firearms or using a different html/js engine.
    - saagarjha 8y ago
      Facebook abused their enterprise certificate to bypass the App Store and distribute their app outside of their company, which is something that is explicitly disallowed by the agreement that governs such certificates.
      - mschuster91 8y ago
        I agree on that one, but still do not like that Apple has the power to require having an "enterprise certificate" in the first place.
bubblethink 8y ago
Can somebody explain the technical specifics of what was installed and what is revoked ? I'm not familiar with with iOS. My assumptions are: The original app, which was distributed by fb, installed a systemwide CA to MITM traffic after prompting the user. Is this not available to regular apps distributed on the store ? This app was not on the app store but distributed out of band. In order to sideload apps on iOS, they still need to be approved by Apple ? So Apple maintains a whitelist of developer certificates who can side load apps. Now, Apple has blacklisted this signing cert. However, this doesn't do anything to the CA, right ? However, the article says, "Revoking a certificate not only stops apps from being distributed on iOS, but it also stops apps from working." How does this work exactly ? Apple triggers all the clients in the world to freeze/remove these apps ?
- saagarjha 8y ago
  > The original app, which was distributed by fb, installed a systemwide CA to MITM traffic after prompting the user. Correct. > Is this not available to regular apps distributed on the store ? No, this is OK; VPN apps do exactly this, but they go through review to make sure that they are actually VPN apps and not, well, essentially what Facebook is trying to do here. > This app was not on the app store but distributed out of band. Yes. > In order to sideload apps on iOS, they still need to be approved by Apple ? So Apple maintains a whitelist of developer certificates who can side load apps. You haven't mentioned it, but I think it's important to make the distinction about the two ways to sideload apps on iOS: you can self sign your app yourself for your device (generally via Xcode), which Apple doesn't really check at all, or you can be a company, get an enterprise certificate, and use this to sign apps and distribute them to other iOS devices, as Facebook was doing here. The catch is that you are supposed to only do this internally inside your company. > the article says, "Revoking a certificate not only stops apps from being distributed on iOS, but it also stops apps from working." How does this work exactly ? Apple triggers all the clients in the world to freeze/remove these apps ? iOS, as of iOS 8.4, periodically checks for revoked certificates and will refuse to run apps that were signed with something that Apple has blacklisted.
  - bubblethink 8y ago
nvr219 8y ago
I love watching big tech companies fight, it's like a soap opera
0x54D5 8y ago
Is no one bothered by the fact that you literally can't write your own code for iOS without Apple's blessing? I could sit down and write a Hello world app but without an Apple Developer certificate the app would be deleted off the phone after 7 days. I'm honestly dejected at the state of things. If you needed the blessing of Microsoft to run your own code on Windows everyone would be extremely upset and for good reason. I think we don't even know what we're missing because the killer apps that would normally be created by developers as experiments instead never get created.
greedo 8y ago
Break the deal, face the Wheel...
tjpnz 8y ago
I'm curious as to what Facebook will need to do to get around this assuming Apple intend to have the certificate revoked indefinitely. Couldn't Facebook just start signing their apps with an alternative certificate Apple has already granted them?
Twisell 8y ago
How come this is already gone from the front page?
aarbor989 8y ago
I was really hoping Apple would yank the certs instead of just the usual “that’s not allowed, please stop and don’t do again” leniency they usually give larger companies. This is the only way to make companies listen

735 points by epaga 8y ago

GrumpyNl 8y ago

How bad will this hurt facebook?

digb 8y ago
Apparently they can't check what's for lunch, so pretty catastrophic IMO.
- jdavis703 8y ago
  Well besides that they can’t do canary releases of their flagship apps, at least not without potentially introducing bugs to their users.
  - max76 8y ago
    They should still be able to use testflight to distribute IOS beta versions of Facebook, Messenger, and other apps.
dymk 8y ago
FB ticker is up 3% today. It won't.
vlozko 8y ago
It'll sting internally, for sure. For how long? Not sure but I'd say it'll halt release processes for maybe a week or two. Any large organization resorts to using enterprise certs for beta and QA distributions of an app as the device limits are unrealistically low for them. These things tend to have cycles where a features have to get in by a certain date and then builds are sent off for beta and QA testing. There's no question this issue throws a wrench in this process. A solution to this problem is signing it with another enterprise cert. I don't know if all of Facebook's enterprise signing certs were revoked or just the one used for this app and even if FB tried applying for a new one (maybe through a subsidiary?) that takes time.

andeee23 8y ago

Serves them right but it's hard to think that the facebook people who were in charge of the spying app wouldn't have considered this as a possible outcome. It probably won't affect them that much if they were already prepared for this to happen.

hn_throwaway_99 8y ago
I'm guessing you haven't worked at a large corporation, especially one that explicitly says they value speed over correctness. My guess is the team involved in the research app got hold of the enterprise certs, and the teams on the other apps were unaware.
- ceejayoz 8y ago
  Facebook's Onavo Protect app (which this is a reskin of) was banned by Apple in June. I don't think they can claim ignorance here.
- CameronBanga 8y ago
  If you play with dogs, you can't be surprised when you get fleas.
- andeee23 8y ago
  I wasn't saying that everyone at facebook knew. But if you were one of the people in charge of the data tracking app, wouldn't you at least know that apple revoking the licence could be a possibility since you are explicitly breaching the agreement? Not even trying to defend them. Just curious how much it will actually affect facebook.
  - wccrawford 8y ago
    You're assuming they knew that was a breach of the agreement... And I doubt the devs in question have ever read the agreement. This is a company that had the motto "move fast and break things". They prefer to "fail forward" and push things live sooner rather than safer. It doesn't surprise me at all that someone just saw that something was possible and did it without considering the consequences.

digb 8y ago

Glad to see rules being enforced on a powerful organization.

mjw1007 8y ago

While I have no sympathy at all for Facebook, this is a rather chilling reminder of Apple's ability to decide what you're allowed to run on your own phone.

strict9 8y ago
Chilling isn't my takeaway. It's that Apple take the threat of surreptitious data gathering seriously and enforces its rules for other companies to that effect.
- yholio 8y ago
  It's either that, or they employed their market dominance to strike at their competitor. Without a public regulator that fines both Facebook and Apple for their respective abuses, we will never know which.
  - strict9 8y ago
    A public regulator of tech oligopolies is a great idea. Until that happens we have few choices in whom we chose to trust. Apple is no corporate saint but for now it is the best of the lot because of its business model.
    - scarface74 8y ago
      You really trust the government to regulate tech fairly?
      - ceejayoz 8y ago
        I trust them ("them" being developed-world democracies; obviously there are more concerns with, say, the Saudis) more than I trust tech to self-regulate. You're not going to get a self-imposed GDPR.
        scarface74 8y ago

jamiek88 8y ago

They have stripped them of the enterprise certificate. This does not affect installed apps from the app store of course. But still a clear statement from Apple.

ceejayoz 8y ago
It does affect any internal apps Facebook has, though.
- ethbro 8y ago
  Only ones signed on the same certificate. One expects the reason they reused their primary enterprise cert is so they wouldn't have to justify their spyware in a new request to Apple... You build a house out of kerosene jugs, don't go crying when it burns down.
  - ceejayoz 8y ago
    The article indicates their lunch menus and staff transportation apps don't work. > Apple has shut down Facebook’s ability to distribute internal iOS apps, from early releases of the Facebook app to basic tools like a lunch menu. A person familiar with the situation tells The Verge that early versions of Facebook, Instagram, Messenger, and other pre-release “dogfood” (beta) apps have stopped working, as have other employee apps, like one for transportation. I'm totally fine with this house burning down. Just noting that this is apparently having very significant internal effects, even if the public Facebook app is fine.
    - fatbird 8y ago
      In a way, that seems like the best counterstrike by Apple. Minimally disruptive to the public at large, massively disruptive to the bad actor.
    - chooseaname 8y ago
      > I'm totally fine with this house burning down. Just noting that this is apparently having very significant internal effects... And this is ALL on Facebook and NOT Apple. Facebook understood the consequences when they decided to abuse the Enterprise Cert. They took the risk and got called on it. This is Facebook's fault. Full stop.

jon-wood 8y ago

This seems entirely legitimate. Facebook were using Apple's support for enterprise distribution based on having a corporate certificate on your device, designed to allow distributing internal apps that don't make sense on the App Store proper, to distribute an app to their users - presumably because they knew it wouldn't make it through the approval process for doing distribution using TestFlight, which is what is meant to be used for this sort of app release.

epaga 8y ago
Yes, this is the optimal measured response from Apple. They're treating Facebook the way they'd treat any other company that did this. It's also a step up from the warning they gave with the whole Onovo thing. Strike two...
- hn_throwaway_99 8y ago
  To be clear, this app that was just removed WAS just a reskinned Onavo app - same code and "ONV" class prefixes, etc.: https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761 Facebook got caught, and then they tried to use their enterprise cert to get around App Store review because they knew it would get rejected.
  - edraferi 8y ago
    Pathetic.
  - dabockster 8y ago
    I give it a week until Facebook starts using some sort of exploit to get Onavo onto iPhones. Probably guessing it will be a Safari exploit based on past history. That's when the real fireworks will begin.
    - acct1771 8y ago
      Please elaborate on this.

strict9 8y ago

These continued moves of desperation show a company terrified of losing its massive data-gathering surveillance machine. Hoping Apple demonstrates its commitment to privacy by doing more than hurting internal functionality and speak to the only thing that matters to FB - its ability to surveil people.

Liquix 8y ago
Investors and governments pumped billions into FB in the last 5-10 years seemingly under the impression that it was too big to fail. One can definitely see the panic starting to trickle in now that it's clear the platform's days are numbered. I wonder if they will be able to shift to a less predatory/ad-based business model before it's too late or go all-out with the data harvesting.. It'll be interesting to watch it play out either way!
- freeflight 8y ago
  > now that it's clear the platform's days are numbered. How is that "clear"? It's true that FB has received a lot of bad press and push back in recent times, but none of that changes the fact that FB is pretty much still the 10.000-pound Gorilla in the room with no real alternatives for a lot of people. Don't get me wrong here: I don't like it either, I just don't see their days as being "numbered", but FB is too entrenched in a whole lot of sectors for it to simply vanish without some kind of competitor actually gobbling everything up they do right now. Too many people forget that at this point FB isn't just "social media", for a whole lot of small and medium businesses FB has become their sole online presence, due to ease of use and reach.
  - taurath 8y ago
    They are definitely too entrenched with partners, but for the users themselves to mass-migrate all it takes is a big enough user-facing tactical error.
ASalazarMX 8y ago
> Hoping Apple demonstrates its commitment to privacy If Apple had a true commitment to privacy, this wouldn't have happened by design. Apple just has less commercial interest in gathering data about users outside its garden.

jedberg 8y ago

I think Apple is right here — they’ve detected a breach of term and shut it down. But I still think they are wrong for blocking 3rd party apps. I understand they believe it is for my safety and security, but there needs to be a happy medium. They should have a way for experts to side load apps.

rsynnott 8y ago
They have, for the last few years: http://osxdaily.com/2016/01/12/howto-sideload-apps-iphone-ipad-xcode/ http://osxdaily.com/2016/01/12/howto-sideload-apps-iphone-ip...
- jedberg 8y ago
  I'd like to be able to side load close source apps too.
  - saagarjha 8y ago
    http://www.cydiaimpactor.com http://www.cydiaimpactor.com
fetus8 8y ago
I think you're missing the point. Experts do have a way to side load apps, through enterprise certificates and developer certificates. Facebook was distributing an app to consumers using the enterprise certificates, to collect data, in somewhat malicious terms, which is a direct policy violation of using an enterprise certificate.
- richardwhiuk 8y ago
  Yeah, Apple have to step in here - otherwise they risk Enterprise certificates being used widely to violate Apple's AppStore restriction (which is what FB was doing), which is clearly not in Apple's best interest.
- int_19h 8y ago
  > Experts do have a way to side load apps, through enterprise certificates and developer certificates Only their own apps. You can't use that mechanism to distribute an app to other "experts", which makes it of limited use in practice. You can distribute as source and require them to build it, but then everybody who wants to install your app on their device also needs a Mac.

40acres 8y ago

I keep going back and forth regarding whether Onvaro is just "opposition research" or a sign that while Facebook is still as powerful as ever, that they are running out of product ideas. Of course it could be both, but the use of Onvaro and 'Facebook research' have a hint of desperation.

hn_throwaway_99 8y ago

To be honest, while there has been loads of bad press against FB over the past year, I had been leaning toward giving them the benefit of the doubt for the main following reason: a lot of the bad press had come about because society's views on privacy had changed (especially with the realization of how social media could be used to impact a US election), not just Facebook's. After all, when FB originally released their developer APIs that let developers gain access to friend data without the friend's explicit permission, there was barely a peep about that (among security/privacy researchers, sure, but among the general populace, no). It was only after Trump got elected that people had an "oh shit" moment about what was really possible with social media data. This "data research" app has hardened my views, though: I now believe Facebook is rotten to the core. After all, as a security researcher pointed out, that "market research" app was basically just the previously removed Onavo app, reskinned (https://twitter.com/chronic/status/1090394419902197761 https://twitter.com/chronic/status/1090394419902197761). Facebook knew they got caught, and they tried to workaround by using their enterprise cert so the app wouldn't go through App Store review. Screw them, I hope this forces the heavy hand of government regulation on them. They have proved the cannot manage themselves.

saiya-jin 8y ago
I view company as consistent, in same way I view Putin as consistent - expect more sneaky shit and backstabbing. Their mission as a company is clear, the way they conduct the business is pretty clear too, this ain't first nor second time FB did something amoral intentionally. We humans have full right to change our views and values, and what in our society is not aligned anymore should either change or perish. When will the HN crowd start treating Zuckenberg (no 'Zuck' please) as amoral piece of * with rest of the company following?
reificator 8y ago
> After all, when FB originally released their developer APIs that let developers gain access to friend data without the friend's explicit permission, there was barely a peep about that (among security/privacy researchers, sure, but among the general populace, no) You're telling me that the average plumber and teacher and waiter didn't complain when Facebook introduced an interface for developers? No way. > Bro, did you see the new API that FB put out that totally foobars luser privacy? > Dude, I teach kindergarten, wtf is an API? Obviously people trying to explain it aren't going to be using that language, but to outsiders it'll sound that way. And tech nerds aren't known for being able to explain things to laymen in the first place.

Wheaties466 8y ago

How long until Facebook creates its own phone and OS?

deleted 8y ago
[deleted]
reggieband 8y ago
I'm not sure if this is sarcasm or short-term memories. Facebook did try to create its own phone and it flopped.

Wheaties466 8y ago

How long before Facebook creates its own phone and OS?

sschueller 8y ago
The already tried (kind of): https://en.wikipedia.org/wiki/Facebook_Home https://en.wikipedia.org/wiki/Facebook_Home
markstos 8y ago
That's where I see this going. Perhaps Facebook will fork Android. Today it's Apple interfering with Facebook use of mobile devices. Tomorrow it could be Google.
ardy42 8y ago
> How long until Facebook creates its own phone and OS? About negative six years. They already tried and it flopped: https://en.wikipedia.org/wiki/Facebook_Home https://en.wikipedia.org/wiki/Facebook_Home I can't see it going any better if they tried again, since they've been working hard in the mean time to burn all the trust and goodwill they have.
deleted 8y ago
[deleted]
po1nter 8y ago
One must be nuts to trust and run an entire OS made by Facebook.

ViViDboarder 8y ago

This is exactly what Apple would do to a small indie developer if they found they did something similar. Glad to hear that they aren’t afraid to do it to a company like Facebook.

wheelie_boy 8y ago
In this case the punishment fit the crime - break terms of enterprise distribution cert, get enterprise cert pulled. However, it's very possible that if a smaller company did this that all of their certs, apps, and dev accounts would get pulled. Facebook does still get some special treatment.
- rhizome 8y ago
  Facebook does still get some special treatment I am pretty sure others have had their entire accounts nuked for less.
  - sillyquiet 8y ago
    well, I mean, of course... Facebook is still the proverbial 500lb gorilla, bad actor or no. Apple's going to be very slow in nuking a big player that drives a huge chunk of device usage.
    - nxc18 8y ago
      Eh, I think Facebook would lose more money each day that conflict dragged on until they complied with apple’s policies. Users can always access Facebook through safari.
      - max76 8y ago
        Kicking Facebook's apps off the appstore would include WhatsApp, Messenger, and Instagram. It would be a bigger deal than logging into Facebook.com on safari.
      - 8y ago

oaiey 8y ago

For me this disqualified the iOS platform for any software development. When they can do that with Facebook then the rest of us is just fucked up. With Android and Windows I currently at least have alternatives for distribution.

fhood 8y ago
This is an example of the walled garden working exactly as intended by Apple. In this example I approve of it, but I agree that if you are developing for iOS you should be aware of the power Apple can exert on the platform.
- oaiey 8y ago
  Yeah. I agree with you.
- scarface74 8y ago
  I don’t see the problem. As a corporation you sign an agreement to use an Enterprise certificate to distribute your app internally. The rules are very clear. FB broke those rules. If you don’t break the terms of the agreement you’re in the clear.
  - oaiey 8y ago
    Imagine Microsoft would shut down every computer who is not licensed properly. Without any joke, dead people are the result. For that reason you talk first and then act accordingly. Killing a business partner internal applications is very drastic behavior.
    - scarface74 8y ago
      You mean Windows Activation? What do you think would happen if you used your Azure, AWS, or GCP account to knowingly do DDOS attacks? Or more realistically if you do Pen testing on your own AWS resources without getting the approval of AWS and your entire organization is dependent on it? It is explicitly stated in your agreement with AWS that you can’t do that.

kerng 8y ago

With the news yesterday about Facebook's ambitious research project this seems entirely okay.

draw_down 8y ago

If they used the same cert for their teen social media monitoring project that they used for other apps that don’t break the rules, that seems like a tactical error. Mind the blast radius.

sidewaysloading 8y ago

I hope Apple will be taking down Google's enterprise distribution certificate as well, as they are abusing it to let consumers sideload a VPN app for data gathering: https://support.google.com/audiencemeasurement/answer/7573812?hl=en&ref_topic=7574346 https://support.google.com/audiencemeasurement/answer/757381... And on top of that all of those from other companies doing the exact same thing for data gathering.

DCKing 8y ago
The problem on the Android side goes deeper, as the "Onavo Protect" app is still alive and kicking in the Google Play store [1]. The Facebook Research app here is a shallow repackaging of the iOS version of Onavo Protect, which was banned from Apple's App Store at least. It doesn't appear Google is interested in doing anything here. They would likely have to do something about the thousands of other trojan horse VPN apps, too. It's just that those are not as transparently owned by a privacy-invading internet giant (and those apps probably sell your private information directly to the highest bidder even more eagerly). [1]: https://play.google.com/store/apps/details?id=com.onavo.spaceship https://play.google.com/store/apps/details?id=com.onavo.spac... - the positive, uninformed reviews of this app give me a feeling like I'm reading a dystopian novel.
- jetpks 8y ago
  Why would Google ban apps for using Google's own business model?
  - checkyoursudo 8y ago
    > Why would Google ban apps for using Google's own business model? If Google is concerned about competition, they might. If Google is more concerned about being accused of being anti-competitive, then they probably would not.
deleted 8y ago
[deleted]
choppaface 8y ago

fixermark 8y ago

It's nice they have the capacity to do that to protect their consumer ecosystem (indirectly), however, if I'm making an enterprise ecosystem decision to build out a fleet of mobile tools for my company, "Apple has and has used the capacity to shut down the ability of the hardware we purchased to run software we wrote on that hardware" gives me pause adopting that ecosystem. Their purpose was generally-accepted as just in this case, but what if next time, it's because someone started competing with them and they didn't like it?

jasonjayr 8y ago
Tech has a long and storied history of anti-competitive behavior by the platform owner, even without fancy signed code + crypto: * Microsoft and the games they played with 4DOS, undocumented calls, testing for id strings and then claiming windows woulden't run on the "Incompatible" DOS variant * Apple re-implementing shareware utilities in the System 6/7/8/9 days right into the operating system, sometimes not compensating the original developer for the idea * MS Word using undocumented API's for better UX + integration over all word processors in the 90s/00s * Twitter Changing Platform API and kicking out all sorts of useful apps on their platform * Facebook doing the same At least this time around, there's a clear kill switch so they don't have to be underhanded about it. And in this instance there was a clear and unambiguous ToS violation in play. Most of the instances I've listed went unpunished, or were only given a slap on the wrist after the damage was done.
chooseaname 8y ago
Isn't this exactly what the FTC is for, though?
- fixermark 8y ago
  The FTC is a good backstop, but in the time it takes them to resolve a (potentially antitrust) case, your company could go bankrupt. As an enterprise purchaser, it may not be risk I want to take on for the benefit of using Apple hardware and software for internal solutions.
_bxg1 8y ago

jamiek88 8y ago

This is having a real effect internally at Facebook. In many ways this is a good punishment, disruptive to the bad actor and minimally disruptive/invasive to the consumer. >Apple has shut down Facebook’s ability to distribute internal iOS apps, from early releases of the Facebook app to basic tools like a lunch menu. A person familiar with the situation tells The Verge that early versions of Facebook, Instagram, Messenger, and other pre-release “dogfood” (beta) apps have stopped working, as have other employee apps, like one for transportation

zhobbs 8y ago

My first reaction was: "Wow, FB finally went over the line and is actually an evil spyware distributor." Then I started thinking about what this app really is. At $20/month per user, it's clearly impossible to recoup that money on a per-user basis via better ad targeting. This app is a market research app with a very small opt-in panel, just like having a Nielsen box on your TV. I've never felt like Nielsen's data collection is evil, so it makes me wonder if my reaction is rational. Also, looks like Nielsen has a similar program: https://computermobilepanel.nielsen.com/ https://computermobilepanel.nielsen.com/

TwoNineA 8y ago
Did you bother reading Nielsen's contract? > Be 18 years of age or older and capable of entering into a binding contract. You expressly declare that you are the owner of or lawfully exercise control over any Device onto which you authorize the downloading of the Software. Facebook's spyware was pushed to teenagers as young as 13. But yeah, same thing.
- zhobbs 8y ago
  Fair point!
joshdover 8y ago
There's a huge difference between what Nielsen does and what Facebook did. 1) Nielsen doesn't explicitly target children. 2) The data that Nielsen collects is far less intrusive than what FB collects. 3) The consumer is much more likely to be informed about the data Nielsen collects, where as with FB, it's unlikely that a user (especially a minor) understands the extent of what FB was collecting. And yes, Facebook was requiring "parental consent" to collect this data, but as we all know that is very hard to verify and children have been ticking the "I'm 13 or older" box for years without their parents knowing. What Facebook did clearly crossed a line. End of story.
- EGreg 8y ago
  I wonder what the actual effects of saying “Period! End of Story!” are in a discussion forum. Obvioisly someone is still free to respond, and then that won’t be the end of the discussion. So what’s the point of saying it? It seems to escalate the stakes basically: “if you disagree then you are a LABEL!”

onewhonknocks 8y ago

It's heartening to see that Apple isn't afraid to rap their knuckles when they misbehave, despite their being such a force in the tech space.

keepper 8y ago

This scares me. Not so much the action by apple ( they are flexing their muscle), but the reactions here. "Great!", is the jist. It you think an unilateral revoke, and shutdown of a company internal tools, because of an external issue, without recourse is a good thing... I'm guessing you have no issues with Crazy EULA's, Monopolies, Corporate abuse, Corporations doing as they please. ( I can keep going down this slope.. ) Facebook had a program, with willing participants, that broke a third parties rules. We can argue infinitum about this. But this is a company, STOPPING your usage of YOUR hardware, AFTER you purchased it (I'm talking about apple stopping Facebook from distributing internal tools as well, this is the side effect of this ). Think deep and clear about this. Are you ok with this? Secondly, from the company (apple ) that literally turned everyones devices into wiretaps, globally, and ignored the issue for who knows how long... This is just.. wow. ( and they continue not to issue a formal reason for this ). Just.. wow.

gshulegaard 8y ago
Yeah, no. Facebook had a cert for distributing internal apps. When one of their external projects was rejected by the App store, they used the internal cert to try and distribute it externally (circumventing the App Store). As a response Apple revoked the certificate that was being used in violation of its use agreement. There is nothing wrong with that action. You're introducing a straw man argument by trying to make this about hardware ownership.
- keepper 8y ago
  With due respect, I think you misunderstand what a straw-man argument is. This is not a different point. This IS post purchase control of hardware. Would you be ok with Tesla disabling cars because you were using illegal drugs in them? Now do you get it? I'm not defending facebook. I'm telling you this behavior from Apple is truly scary. Apple is not law/moral/societal enforcement "police". This is the ONLY way to run internal apps. and it wasn't one cert btw. Google has a similar "research app", their certs have not been revoked. Maybe because apple relies on google more? Maybe because they generate revenue from their search and app placement deals? Hrrm? My point is simple, arbitrary revokes, without process, are a scary thing. Specially when they are done POST purchase, and have real tangible effects.

michaelbuckbee 8y ago

This isn't going to stop anything. Attribution was already "laundered" through multiple different agencies and firms who were conducting this research. They'll just cut a check to another company and proceed from there and/or a company will just sell them the data on "teen social and mobile usage" and Facebook will be able to truthfully state that they had no idea the means by which it was collected.

unrealchild 8y ago

i’m curious why the internal tools would fail testflight beta review. i had an app fail beta review, but was still able to distribute with testflight after explaining to the reviewers it was for internal use only...

ceejayoz 8y ago
Doesn't TestFlight cap the number of users who can use a beta app?
- saagarjha 8y ago
  It does; currently the cap is 10,000 users.

reneberlin 8y ago

It starts to become interesting. Popcorn time! I can't hide a small grin right now.

aboutruby 8y ago

I see this as a start of a political battle between Apple and Facebook (maybe Google too with their Screenwise Meter app). First Facebook tries to push the limit of what Apple would deem acceptable. Then Apple pushes back and show that it's clearly not acceptable. Now waiting for Facebook's response.

_bxg1 8y ago

So this is what Schadenfreude feels like.

reneberlin 8y ago
2 of the big five in a dispute over "ethics of technology (ab)use". One commenter had the thought, that this reaction from Apple is just straight aligned with the rules they created for every corp - regardless of their market share or $. But - i guess there will be negotiations. FB is in a position to make deal. Bad press in the dev-world - on dev-topics - didn't hold the masses and average Joe back to continue using FB. And this fail won't, too. Me sounding fatalistic, i know. But this outrage in the dev-world isn't enough to demask the beast. Red lines crossed - and next week the PR department will fix it. I don't know what needs to happen until the masses of FB-addicts switch to "open technology" and leave their silos.
- _bxg1 8y ago
  I don't know that Facebook is in a position to make a deal. Apple just won a mountain of positive press by taking a tough stance on this, and without having to actually take Facebook's legitimate apps away from their users. I think Facebook is just going to have to live with the consequences of their decisions.
reneberlin 8y ago
Detoxing the masses seems to be a pipe dream for long now. But if nobody would like to work for them, this might mark a point.

vlunkr 8y ago

It's pretty crazy to think about what Apple is capable of doing now. By banning an app, they can easily kill a small company, and now they've caused some huge internal headaches for Facebook. I know Facebook broke their rules and totally deserved it here, but it's interesting to think about the power Apple has obtained by tightly controlling their platform.

jkchu 8y ago
You do bring up an interesting point. Apple's (expected?) responsibility here is to protect their users from malicious apps on their devices. It does seem reasonable for me what they are doing, but of course if they were to lose sight of their users' best interests, then this could become problematic. However, I think for issues like that we need to just trust the market to correct for that. If Apple were to destroy user trust, then I would not doubt that people would flock to their competitors (Google, Samsung, etc).

9dev 8y ago

I love the thought of someone at Apple holding a meeting on this and saying "well, fuck them" while sending out the kill command on the CLI :)

draw_down 8y ago
I’d imagine some Rock Paper Scissors was played to determine who got the honors.

kevintb 8y ago

Good on Apple.

mishurov 8y ago

It's irrelevant. Pliant Apple NPCs here with their shallow consumerist understanding of the tech will defend it anyway.

malloreon 8y ago

Hopefully this (likely, and unfortunately only momentary) pause in facebook employees' evil progress will inspire even a few of them to quit and use their experience for good instead.

pinewurst 8y ago

Wasn't Zuck trying to actively encourage the use of Android over iOS for employees anyway? :)

watmough 8y ago

Excellent. Full marks to Apple on this. Those could be anyone's kids being taken advantage of. Apple can't risk their integrity being associated with what Facebook are pulling.

satyenr 8y ago

Remember when people were outraged when Apple decided to give in to the demands of the Chinese government rather than shut shop. They complained about Apple not taking the high road. Now people are complaining about Apple taking the high road? Funnny how times change! Make up your mind people — you can’t have it both ways! Cheers!

izacus 8y ago
Who are those people you're creating a strawman of?

trevor-e 8y ago

Does the timing of this have anything to do with the Facetime bug? It feels like they could have done this a long time ago.

mschuster91 8y ago

If Apple keeps that block, then Facebook may have legal grounds of unfair business practices and sue Apple for opening up its walled garden, correct? Certainly would be ironic that the biggest data hoarder in human history ends up breaking the biggest monopoly in the mobile space.

zepto 8y ago
Nothing unfair about the business practices. Facebook intentionally breached their contract. It’s possible that Apple is the one with the right to sue.
- mschuster91 8y ago
  Why? What Facebook does is legal (but ethically disgusting). Apple has a monopoly status as gatekeeper for their platform as there are no other competing iPhone App Stores (contrary to Google's Android). Now, as Apple is forbidding what Facebook does in their store ToS, Apple may be prohibiting Facebook from reaching the (not small!) target audience "iPhone users" for their data collection and thus unfairly hindering Facebook's business. I for one would be really happy if the Store ToS were to be torn down in the courts so that the only reason to block an app rollout is covert spying, malware or other user deception, but not open data analytics, porn (case in point, every porn site but especially Tumblr), firearms or using a different html/js engine.
  - saagarjha 8y ago
    Facebook abused their enterprise certificate to bypass the App Store and distribute their app outside of their company, which is something that is explicitly disallowed by the agreement that governs such certificates.
    - mschuster91 8y ago
      I agree on that one, but still do not like that Apple has the power to require having an "enterprise certificate" in the first place.

bubblethink 8y ago

Can somebody explain the technical specifics of what was installed and what is revoked ? I'm not familiar with with iOS. My assumptions are: The original app, which was distributed by fb, installed a systemwide CA to MITM traffic after prompting the user. Is this not available to regular apps distributed on the store ? This app was not on the app store but distributed out of band. In order to sideload apps on iOS, they still need to be approved by Apple ? So Apple maintains a whitelist of developer certificates who can side load apps. Now, Apple has blacklisted this signing cert. However, this doesn't do anything to the CA, right ? However, the article says, "Revoking a certificate not only stops apps from being distributed on iOS, but it also stops apps from working." How does this work exactly ? Apple triggers all the clients in the world to freeze/remove these apps ?

saagarjha 8y ago
> The original app, which was distributed by fb, installed a systemwide CA to MITM traffic after prompting the user. Correct. > Is this not available to regular apps distributed on the store ? No, this is OK; VPN apps do exactly this, but they go through review to make sure that they are actually VPN apps and not, well, essentially what Facebook is trying to do here. > This app was not on the app store but distributed out of band. Yes. > In order to sideload apps on iOS, they still need to be approved by Apple ? So Apple maintains a whitelist of developer certificates who can side load apps. You haven't mentioned it, but I think it's important to make the distinction about the two ways to sideload apps on iOS: you can self sign your app yourself for your device (generally via Xcode), which Apple doesn't really check at all, or you can be a company, get an enterprise certificate, and use this to sign apps and distribute them to other iOS devices, as Facebook was doing here. The catch is that you are supposed to only do this internally inside your company. > the article says, "Revoking a certificate not only stops apps from being distributed on iOS, but it also stops apps from working." How does this work exactly ? Apple triggers all the clients in the world to freeze/remove these apps ? iOS, as of iOS 8.4, periodically checks for revoked certificates and will refuse to run apps that were signed with something that Apple has blacklisted.
- bubblethink 8y ago

nvr219 8y ago

I love watching big tech companies fight, it's like a soap opera

0x54D5 8y ago

Is no one bothered by the fact that you literally can't write your own code for iOS without Apple's blessing? I could sit down and write a Hello world app but without an Apple Developer certificate the app would be deleted off the phone after 7 days. I'm honestly dejected at the state of things. If you needed the blessing of Microsoft to run your own code on Windows everyone would be extremely upset and for good reason. I think we don't even know what we're missing because the killer apps that would normally be created by developers as experiments instead never get created.

greedo 8y ago

Break the deal, face the Wheel...

tjpnz 8y ago

I'm curious as to what Facebook will need to do to get around this assuming Apple intend to have the certificate revoked indefinitely. Couldn't Facebook just start signing their apps with an alternative certificate Apple has already granted them?

Twisell 8y ago

How come this is already gone from the front page?

aarbor989 8y ago

I was really hoping Apple would yank the certs instead of just the usual “that’s not allowed, please stop and don’t do again” leniency they usually give larger companies. This is the only way to make companies listen