17 ms·

The basic concept isn't too disturbing; Apple packages private APIs that have no guaranteed behavior or expectation of support. If you depend on those APIs, it'

The basic concept isn't too disturbing; Apple packages private APIs that have no guaranteed behavior or expectation of support. If you depend on those APIs, it's very possible that your app will break in a future OS update. This is conceptually no different than calling something in the sun.* packages in Java. For years it was ok, and then ... it wasn't. This, however, is draconian: > Continuing to use or conceal non-public APIs in future submissions of this app may result in the termination of your Apple Developer account, as well as removal of all associated apps from the App Store. "Keep trying to submit, and we might just ban you forever" is insane. Every program of any complexity depends on third party libraries, and many people wouldn't be able to tell what arcane APIs their dependencies (or their dependencies' dependencies) call. "If you continue to have an upstream dependency that violates our terms, we might permaban you" is bullshit. It's also completely unsurprising. Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Now it's ... I don't even know anymore.

plorkyeran 7y ago
What's bullshit about banning someone who has been notified that they are in violation of the rules and then tries to hide their use of private APIs rather than stop using them? That's exactly what I would do in Apple's position. Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake.
- albru123 7y ago
  Huh? The problem isn't that the developer itself is trying to cover his misbehavior, but the fact that the developer can get banned for something out of his control.
  - sarah180 7y ago
    The developer is the one who takes responsibility for the submission. Enforcement is meaningless if you can just say "oh I asked you to publish dangerous code, but it's not my fault." It's the same reason people hold companies like Apple and Nike accountable for working conditions in their factories even if they hired a third party to run them. Third parties are not the ones putting their brand on the product.
  - plorkyeran 7y ago
    There's nothing out of the developer's control about what they submit to the app store.
  - LeoNatan25 7y ago
    The developer chose to use Electron, hence the entire endeavor is in their control.
- MauranKilom 7y ago
  > then tries to hide their use of private APIs rather than stop using them [...] Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake. This is missing the point of the post you are replying to. Say you identify five closed API dependencies and remove them. Do you resubmit? If you missed any others, you and all your apps might be banned.
  - floatingatoll 7y ago
    Yes, you resubmit.
  - saagarjha 7y ago
    How exactly do you miss a dependency?! If it's not your code, then it's a dependency that you need to look at.
    - creatornator 7y ago
      Dependencies of your dependencies! Imagine installing a library that depends on a couple dozen libraries in its own right. You may not have time to inspect every single node in the dependency graph.
      - saagarjha 7y ago
        It's going to sound uncharitable, but if you're clearly being rejected for something that your dependencies is doing wrong you should make time to figure out which one it is.
        Fr0styMatt88 7y ago
        Is it really difficult to find private API usage? Can they be searched for through static or dynamic analysis? I don’t develop for iOS so I’m genuinely curious. Do they provide automated tools for developers to use? Or a flag that fails your build if you’re trying to call private APIs: For that matter, how are the reviewers catching these API usages? I find it strange that a private API can be used accidentally, without something notifying the developer before they’ve gotten to the stage of submitting their app.
- kjksf 7y ago
  "use or conceal" "use" If this was "don't conceal or we'll ban you for life", it would be somewhat understandable. But it's "use or we'll ban you for life" which is just insane. Apple is at the height of their arrogance towards developers.
  - threeseed 7y ago
    This policy has been there since the beginning of the App Store. If you use a private API they will reject the app. If you try and hide the fact you are using private APIs after has told you to stop then they will ban you. It's all very common sense and not arrogant at all.
  - heavyset_go 7y ago
    > Apple is at the height of their arrogance towards developers. Yep. I've migrated away from macOS after using it for a decade over to Linux, and the developer experience is first class.
    - jolux 7y ago
      is it possible to write a GUI app that looks native in all common desktop environments yet?
      - dvdkhlng 7y ago
        Qt?
        jolux 7y ago
        That won't really look native, will it? I thought Qt things looked like Qt things.
        dvdkhlng 7y ago
        As far as my experience goes, it looks pretty native on Windows. Looking at the documentation [0] it also seems to strive for mac-OS native look and feel. [0] https://doc.qt.io/qt-5/macos-issues.html https://doc.qt.io/qt-5/macos-issues.html
- freehunter 7y ago
  Because Electron developers might say "we fixed it" and the app developer might resubmit based on that and now they're banned due to a mistake made by an upstream dependency. It's not like this app developer is intentionally using private APIs. "Resubmitting the same thing and hoping that it doesn't get caught" seems to be a strawman.
  - saagarjha 7y ago
    Hence why you should audit your third-party dependencies in cases like these.
    - winkeltripel 7y ago
      I suspect that most devs don't do that. I can't imagine finding the time fir that.
      - josephg 7y ago
        Who do you imagine is responsible for making sure your app doesn’t contain malware? The only answer is that as a developer, you are responsible. Yes, we have to make calculated risks. But the buck stops at you. There is nobody else who can take responsibility for the contents of your app.
        rdevnull 7y ago
        you simply notarized the app and you know that there is no malware. Also we are talking about ElectronJS and Chromium -- not exactly untreatable sources. Note that apple does check for malware and quality on the upload stage itself (now done via transporter) so it wouldn't even make it to then review state if something is dodgy.
        josephg 7y ago
        Apple can’t magically tell that there’s no malware in an app you upload. There is no automated scan which can detect all security vulnerabilities or back doors in code. And we’re talking about electron plus hundreds to thousands of npm modules - which contain who knows what. If you pull in some bad modules, directly or transitively, and as a result your app steals my data or worse, that’s on you for shipping malicious code to my computer. There is no one else who can be responsible for that. Not Apple. Not the user. You.
- megous 7y ago
  Presumably you can't check for violation yourself without submitting.
  - saagarjha 7y ago
    Of course you can! How do you think Apple's checking your binaries?
    - megous 7y ago
      Using some internal tool.
      - saagarjha 7y ago
        No, it’s almost certainly just a search for strings and looking through the symbol table.
        megous 7y ago
        That would be very easy to work around with dlopen and some string obfuscation. It's probably a bit more involved.
        plorkyeran 7y ago
        In practice it is pretty easy to slip things past the automated checks if you try to, which is one of the reasons they threaten you with a permaban for doing so.
      - justinclift 7y ago
        The internal tool is very likely using/parsing otool / ldd output and similar. eg cli tooling that comes with macOS itself
  - rdevnull 7y ago
    exactly. Apparently Apple just started now to check against these private APIs.
- asveikau 7y ago
  You assume it isn't an honest mistake. Most people submitting electron apps won't have knowledge of the browser engine layer and its calls to Apple APIs and probably will have some difficulty assessing whether or not they have resolved the issue. That doesn't make them bad people. They are not malicious or trying to hide things. Apple's scripts should give them more chances until they get it right.
saagarjha 7y ago
> "Keep trying to submit, and we might just ban you forever" is insane. I was under the impression that if you're being annoying and keep trying to submit a build with private API, making App Store Review's life hard, they're going to ban you. In general, you should be reviewing your dependencies yourself to make sure it's doing things that you approve of; if you can't do that after Apple has warned you that it's doing something that's not allowed I don't really have much sympathy for you.
- thomascgalvin 7y ago
  I think that's being too charitable to Apple. Their review process is automated, and nobody really knows what will trigger the Ban Bot into deleting your account. There is also no apparent way to scan your own app to make sure that you are not in violation of this issue. So you're in a position where the only way to see if you are in compliance is to submit to Apple, but that may result in your account being banned.
  - saagarjha 7y ago
    > Their review process is automated, and nobody really knows what will trigger the Ban Bot into deleting your account. While review is automated, I would like to believe that account deletion isn't. > There is also no apparent way to scan your own app to make sure that you are not in violation of this issue. So you're in a position where the only way to see if you are in compliance is to submit to Apple, but that may result in your account being banned. They literally tell you the symbols that you're not supposed to use: it's easy to check if your dependencies are using them.
    - thomascgalvin 7y ago
      > While review is automated, I would like to believe that account deletion isn't. I would like to believe that, too, but I don't. > They literally tell you the symbols that you're not supposed to use: it's easy to check if your dependencies are using them. Sure, if you have a better-than-average understanding of C (or Objective C), and know how to use the command line to grep strings out of a binary, and know all of the binaries you need to be searching. This is a rejection for an Electron app, and I'm going to go out on a limb and say that the majority of Electron developers do not have the requisite skills. Hell, I've been programming for a couple of decades now, and I couldn't 100% guarantee that an app I wrote didn't call one of the forbidden APIs, even indirectly. The rejection email doesn't bother to say where in the code the problem is, so it's apparently not so easy as to be part of an automated process. "Learn what these esoteric commands do, use them correctly on every upstream dependency your app has, make sure you don't call any of these symbols, and if you fuck up you're banned for life" is utter dogshit customer service.
deleted 7y ago
[deleted]
fattire 7y ago
> Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Wait a second. When was this exactly? Are you talking about the Apple II era?
- justinclift 7y ago
  There was a time, not that long ago in years, when most of the developers turning up to OSS conferences had Mac laptops of one sort or another.
babesh 7y ago
Also letting an app use those private APIs can be a security hole.
- saagarjha 7y ago
  Ideally anything that is theoretically callable by an application should not pose a security hole. The only issue with private API is that it breaks from release to release.
cageface 7y ago
Getting out of iOS development and back into web dev was the best career decision I ever made. I feel like I escaped an abusive relationship. So much of what's wrong with computing and tech right now stems directly or indirectly from the culture at Apple.
- belltaco 7y ago
  It's funny how the general consensus on here is against Microsoft's abuse of private APIs in Windows to help Word and DOS against WordPerfect and DrDOS, 20+ years ago. But Apple doing it right now in a much worse way is considered acceptable and defendable.
  - drenvuk 7y ago
    I don't think anyone here considers Apple's abuse of private APIs vs developers an ok thing. I will never subject myself to their app store if I can help it.
    - saagarjha 7y ago
      I'm fairly sure a number of App Store developers browse Hacker News.
      - DonHopkins 7y ago
        Many of us frequently subject ourselves to all kinds of abuse that we don't consider an ok thing. It's shameful but eh, it's a living. https://www.youtube.com/watch?v=pyxJ7GKGFG0 https://www.youtube.com/watch?v=pyxJ7GKGFG0
    - Mirioron 7y ago
      I think it's more a case of people just being unaware. They might have an idea that this is going on, but because they've never run into it it's not something that's a priority. I'd even wager that the vast majority of non-Americans here don't use Apple hardware.
  - 7y ago
pier25 7y ago
> Apple has no love nor concern for their developers anymore Because Apple knows it doesn't need to attract developers to iOS. They will come no matter what because that's where the mobile market is. On macOS it's different. There are very few macOS exclusive developers so most of the popular apps are either cross platform (Office, Photoshop, Sublime Text, Chrome, Firefox, Maya, Cubase, Cinema4D, Resolve, etc) or are from Apple. In both cases the Apple dev experience is irrelevant. There are plenty of boutique devs making small products exclusively for macOS (eg: Panic, Bjango, Bohemian) but these are a drop in the ocean. Apple knows this which is why it's making Catalyst to attract iOS devs to macOS. AFAIK the only big developer making macOS exclusive products is Apple itself.
vkou 7y ago
> It's also completely unsurprising. Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Now it's ... I don't even know anymore. When has Apple ever been developer friendly? Their ecosystem always had more money for app developers, but I can't think of any point in time when developers weren't shouting to anyone who will listen about Apple's rules.

plorkyeran 7y ago

What's bullshit about banning someone who has been notified that they are in violation of the rules and then tries to hide their use of private APIs rather than stop using them? That's exactly what I would do in Apple's position. Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake.

albru123 7y ago
Huh? The problem isn't that the developer itself is trying to cover his misbehavior, but the fact that the developer can get banned for something out of his control.
- sarah180 7y ago
  The developer is the one who takes responsibility for the submission. Enforcement is meaningless if you can just say "oh I asked you to publish dangerous code, but it's not my fault." It's the same reason people hold companies like Apple and Nike accountable for working conditions in their factories even if they hired a third party to run them. Third parties are not the ones putting their brand on the product.
- plorkyeran 7y ago
  There's nothing out of the developer's control about what they submit to the app store.
- LeoNatan25 7y ago
  The developer chose to use Electron, hence the entire endeavor is in their control.
MauranKilom 7y ago
> then tries to hide their use of private APIs rather than stop using them [...] Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake. This is missing the point of the post you are replying to. Say you identify five closed API dependencies and remove them. Do you resubmit? If you missed any others, you and all your apps might be banned.
- floatingatoll 7y ago
  Yes, you resubmit.
- saagarjha 7y ago
  How exactly do you miss a dependency?! If it's not your code, then it's a dependency that you need to look at.
  - creatornator 7y ago
    Dependencies of your dependencies! Imagine installing a library that depends on a couple dozen libraries in its own right. You may not have time to inspect every single node in the dependency graph.
    - saagarjha 7y ago
      It's going to sound uncharitable, but if you're clearly being rejected for something that your dependencies is doing wrong you should make time to figure out which one it is.
      - Fr0styMatt88 7y ago
        Is it really difficult to find private API usage? Can they be searched for through static or dynamic analysis? I don’t develop for iOS so I’m genuinely curious. Do they provide automated tools for developers to use? Or a flag that fails your build if you’re trying to call private APIs: For that matter, how are the reviewers catching these API usages? I find it strange that a private API can be used accidentally, without something notifying the developer before they’ve gotten to the stage of submitting their app.
kjksf 7y ago
"use or conceal" "use" If this was "don't conceal or we'll ban you for life", it would be somewhat understandable. But it's "use or we'll ban you for life" which is just insane. Apple is at the height of their arrogance towards developers.
- threeseed 7y ago
  This policy has been there since the beginning of the App Store. If you use a private API they will reject the app. If you try and hide the fact you are using private APIs after has told you to stop then they will ban you. It's all very common sense and not arrogant at all.
- heavyset_go 7y ago
  > Apple is at the height of their arrogance towards developers. Yep. I've migrated away from macOS after using it for a decade over to Linux, and the developer experience is first class.
  - jolux 7y ago
    is it possible to write a GUI app that looks native in all common desktop environments yet?
    - dvdkhlng 7y ago
      Qt?
      - jolux 7y ago
        That won't really look native, will it? I thought Qt things looked like Qt things.
        dvdkhlng 7y ago
        As far as my experience goes, it looks pretty native on Windows. Looking at the documentation [0] it also seems to strive for mac-OS native look and feel. [0] https://doc.qt.io/qt-5/macos-issues.html https://doc.qt.io/qt-5/macos-issues.html
freehunter 7y ago
Because Electron developers might say "we fixed it" and the app developer might resubmit based on that and now they're banned due to a mistake made by an upstream dependency. It's not like this app developer is intentionally using private APIs. "Resubmitting the same thing and hoping that it doesn't get caught" seems to be a strawman.
- saagarjha 7y ago
  Hence why you should audit your third-party dependencies in cases like these.
  - winkeltripel 7y ago
    I suspect that most devs don't do that. I can't imagine finding the time fir that.
    - josephg 7y ago
      Who do you imagine is responsible for making sure your app doesn’t contain malware? The only answer is that as a developer, you are responsible. Yes, we have to make calculated risks. But the buck stops at you. There is nobody else who can take responsibility for the contents of your app.
      - rdevnull 7y ago
        you simply notarized the app and you know that there is no malware. Also we are talking about ElectronJS and Chromium -- not exactly untreatable sources. Note that apple does check for malware and quality on the upload stage itself (now done via transporter) so it wouldn't even make it to then review state if something is dodgy.
        josephg 7y ago
        Apple can’t magically tell that there’s no malware in an app you upload. There is no automated scan which can detect all security vulnerabilities or back doors in code. And we’re talking about electron plus hundreds to thousands of npm modules - which contain who knows what. If you pull in some bad modules, directly or transitively, and as a result your app steals my data or worse, that’s on you for shipping malicious code to my computer. There is no one else who can be responsible for that. Not Apple. Not the user. You.
megous 7y ago
Presumably you can't check for violation yourself without submitting.
- saagarjha 7y ago
  Of course you can! How do you think Apple's checking your binaries?
  - megous 7y ago
    Using some internal tool.
    - saagarjha 7y ago
      No, it’s almost certainly just a search for strings and looking through the symbol table.
      - megous 7y ago
        That would be very easy to work around with dlopen and some string obfuscation. It's probably a bit more involved.
        plorkyeran 7y ago
        In practice it is pretty easy to slip things past the automated checks if you try to, which is one of the reasons they threaten you with a permaban for doing so.
    - justinclift 7y ago
      The internal tool is very likely using/parsing otool / ldd output and similar. eg cli tooling that comes with macOS itself
- rdevnull 7y ago
  exactly. Apparently Apple just started now to check against these private APIs.
asveikau 7y ago
You assume it isn't an honest mistake. Most people submitting electron apps won't have knowledge of the browser engine layer and its calls to Apple APIs and probably will have some difficulty assessing whether or not they have resolved the issue. That doesn't make them bad people. They are not malicious or trying to hide things. Apple's scripts should give them more chances until they get it right.

saagarjha 7y ago

> "Keep trying to submit, and we might just ban you forever" is insane. I was under the impression that if you're being annoying and keep trying to submit a build with private API, making App Store Review's life hard, they're going to ban you. In general, you should be reviewing your dependencies yourself to make sure it's doing things that you approve of; if you can't do that after Apple has warned you that it's doing something that's not allowed I don't really have much sympathy for you.

thomascgalvin 7y ago
I think that's being too charitable to Apple. Their review process is automated, and nobody really knows what will trigger the Ban Bot into deleting your account. There is also no apparent way to scan your own app to make sure that you are not in violation of this issue. So you're in a position where the only way to see if you are in compliance is to submit to Apple, but that may result in your account being banned.
- saagarjha 7y ago
  > Their review process is automated, and nobody really knows what will trigger the Ban Bot into deleting your account. While review is automated, I would like to believe that account deletion isn't. > There is also no apparent way to scan your own app to make sure that you are not in violation of this issue. So you're in a position where the only way to see if you are in compliance is to submit to Apple, but that may result in your account being banned. They literally tell you the symbols that you're not supposed to use: it's easy to check if your dependencies are using them.
  - thomascgalvin 7y ago
    > While review is automated, I would like to believe that account deletion isn't. I would like to believe that, too, but I don't. > They literally tell you the symbols that you're not supposed to use: it's easy to check if your dependencies are using them. Sure, if you have a better-than-average understanding of C (or Objective C), and know how to use the command line to grep strings out of a binary, and know all of the binaries you need to be searching. This is a rejection for an Electron app, and I'm going to go out on a limb and say that the majority of Electron developers do not have the requisite skills. Hell, I've been programming for a couple of decades now, and I couldn't 100% guarantee that an app I wrote didn't call one of the forbidden APIs, even indirectly. The rejection email doesn't bother to say where in the code the problem is, so it's apparently not so easy as to be part of an automated process. "Learn what these esoteric commands do, use them correctly on every upstream dependency your app has, make sure you don't call any of these symbols, and if you fuck up you're banned for life" is utter dogshit customer service.

deleted 7y ago

[deleted]

fattire 7y ago

> Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Wait a second. When was this exactly? Are you talking about the Apple II era?

justinclift 7y ago
There was a time, not that long ago in years, when most of the developers turning up to OSS conferences had Mac laptops of one sort or another.

babesh 7y ago

Also letting an app use those private APIs can be a security hole.

saagarjha 7y ago
Ideally anything that is theoretically callable by an application should not pose a security hole. The only issue with private API is that it breaks from release to release.

cageface 7y ago

Getting out of iOS development and back into web dev was the best career decision I ever made. I feel like I escaped an abusive relationship. So much of what's wrong with computing and tech right now stems directly or indirectly from the culture at Apple.

belltaco 7y ago
It's funny how the general consensus on here is against Microsoft's abuse of private APIs in Windows to help Word and DOS against WordPerfect and DrDOS, 20+ years ago. But Apple doing it right now in a much worse way is considered acceptable and defendable.
- drenvuk 7y ago
  I don't think anyone here considers Apple's abuse of private APIs vs developers an ok thing. I will never subject myself to their app store if I can help it.
  - saagarjha 7y ago
    I'm fairly sure a number of App Store developers browse Hacker News.
    - DonHopkins 7y ago
      Many of us frequently subject ourselves to all kinds of abuse that we don't consider an ok thing. It's shameful but eh, it's a living. https://www.youtube.com/watch?v=pyxJ7GKGFG0 https://www.youtube.com/watch?v=pyxJ7GKGFG0
  - Mirioron 7y ago
    I think it's more a case of people just being unaware. They might have an idea that this is going on, but because they've never run into it it's not something that's a priority. I'd even wager that the vast majority of non-Americans here don't use Apple hardware.
- 7y ago

pier25 7y ago

> Apple has no love nor concern for their developers anymore Because Apple knows it doesn't need to attract developers to iOS. They will come no matter what because that's where the mobile market is. On macOS it's different. There are very few macOS exclusive developers so most of the popular apps are either cross platform (Office, Photoshop, Sublime Text, Chrome, Firefox, Maya, Cubase, Cinema4D, Resolve, etc) or are from Apple. In both cases the Apple dev experience is irrelevant. There are plenty of boutique devs making small products exclusively for macOS (eg: Panic, Bjango, Bohemian) but these are a drop in the ocean. Apple knows this which is why it's making Catalyst to attract iOS devs to macOS. AFAIK the only big developer making macOS exclusive products is Apple itself.

vkou 7y ago

> It's also completely unsurprising. Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Now it's ... I don't even know anymore. When has Apple ever been developer friendly? Their ecosystem always had more money for app developers, but I can't think of any point in time when developers weren't shouting to anyone who will listen about Apple's rules.