5 ms·

Why doesnt the Apple app review team catch this prior to deployment? I thought that was the big thing about having to use the app store was Apple kept it locke

• cabaalis 8y ago
  I don't want to disparage that team as I'm sure they work very hard and do an excellent job. But my overall opinion of that process having it gone through it multiple times is that it's (a) security theater and (b) only exists to create the illusion of excellent curation. I hear all the time about different rules being applied to apps retroactively.
  • eridius 8y ago
    It's definitely not security theater. But it's also not perfect, and they can only catch the things they actually look for.
    • saagarjha 8y ago
      Unfortunately, it's often the case that they're not looking for the right things or not looking very closely at all…
• 0x0 8y ago
  Because the app review team only evaluates a compiled binary, it is fairly easy to obfuscate nefarious activity. It could be as simple as serving different javascript from your backend to a [JSContext evaluateScript] call based on a flag you set after the app is approved, for example.
  • eridius 8y ago
    Of course, serving up javascript from your backend to a [JSContext evaluateScript] call is itself a violation of the app store guidelines. Interpreted code not executed as part of a web page rendered by WebKit either has to be bundled in the app itself, manually entered by the user, or has to be in the context of a learning app with a slew of restrictions around the UI (basically, the exception for Swift Playgrounds).
    • saagarjha 8y ago
      Apple's guidelines around this are pretty clear, but almost everyone that tries to use this to A/B test seems to get through app review. I'd really rather this just be outright banned, but it looks like the current policy is annoyingly lenient.
    • 0x0 8y ago
      Maybe. I'm not advocating this technique, merely explaining the possible gaps. Also pretty sure JavaScriptCore doesn't have a blanket ban on evaluating a remote NSString (not that it matters for a blackhat type app), and also, this was just an example, the same decision logic could be implemented by if'ing on xml values or whatever
  • gorkemcetin 8y ago
    Isn't it possible for the review team to check video/screenshot data flowing to appsee.com or uxcam.com and check whether app has a privacy policy that mentions this explicitly?
    • 0x0 8y ago
      Sure it is. So a flag could hide that.
  • ProAm 8y ago
    For 30% of my revenue it seems like a lightly loaded excuse.