5 ms·
> Apples curation isn't (as they suggest) preventing malware, theft of information, etc - this if verifiably false given recent history with apps like tiktok st
by lloeki 6y ago
> Apples curation isn't (as they suggest) preventing malware, theft of information, etc - this if verifiably false given recent history with apps like tiktok stealing clipboard
There are many things that go wrong with the App Store, but you have to realise this is a ludicrous assertion. Pasting from clipboard is an entirely different class than rootkits, backdoors, trojans, and other malware that have a vanishingly small chance to go through the review process itself.
This is defence in depth. The sandbox helps, but it’s not magic. Without review, publishing an app with a sandbox bypass, or simply abusing entitlements, becomes trivial.
- MilaM 6y agoYet Epic was able to sneak in their own payment system through app review. The review process is also not magic.
- deleted 6y ago[deleted]
- graeme 6y agoGames have a special ability to download certain content. Epic may have done this? They clearly triggered the change remotely.
- romanoderoma 6y agoIt's a very peculiar ability, it's called changing the content of a web page. That's basically what Epic did.
- moooo99 6y ago> Without review, publishing an app with a sandbox bypass, or simply abusing entitlements, becomes trivial. I don't think this would be trivial either. Given that iOS security has historically been rather good, I guess an attacker would need a reasonably new exploit or even zero day. Assuming an attacker has access to something like that, I'm 99.8% certain he'd be able to sneak past the review process as well. As Fortnite has demonstrated, it is perfectly possible to sneak past the review process with something as obvious as a third party payment checkout. If something like that is possible, it'd be definitely possible for something like an exploit. The review process isn't magic
- scarface74 6y agoFortnite has also demonstrated how sloppy third party developers are with respect to security. https://arstechnica.com/gadgets/2018/08/fortnites-android-vulnerability-leads-to-googleepic-games-spat/ https://arstechnica.com/gadgets/2018/08/fortnites-android-vu... And at least Epic wasn’t purposefully installing back doors. Unlike Zoom. https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
- saagarjha 6y agoThat argument doesn't make sense, because Apple isn't going to lower the sandboxing requirement for anyone, it's just going to provide an API to install an IPA. (Actually, that API already exists of course, they'll just remove the check that makes sure you're Apple when you call it.) Third parties' security practices have no bearing on how secure Apple makes their own platform–the parent comment is literally saying "Without review, publishing an app [that ships with a zero-day exploit for iOS] becomes trivial"
- scarface74 6y agoA third party App Store by definition has permission to download other code. Android also has a sandbox. That didn’t prevent the security vulnerability from Fortnite.
- saagarjha 6y agoI hate to say it, but did you read the article? Saying "Android has a sandbox" to my comment makes no sense in the context of the issue with Fornite's installer. The vulnerability there was specifically that the third-party app store did not run in a sufficiently sandboxed environment, allowing another application to swap out the app after it was downloaded but before it was installed.
- scarface74 6y ago
- deleted 6y ago[deleted]
- fauigerzigerk 6y ago>Without review, publishing an app with a sandbox bypass, or simply abusing entitlements, becomes trivial. A sandbox that can be trivially bypassed is simply broken. Granted, it's not easy to define what apps should and shouldn't be able to do within the sandbox. Permissions systems are difficult to get right. But whatever the rules are, they must be enforceable.
- mmebane 6y ago> Without review, publishing an app with a sandbox bypass, or simply abusing entitlements, becomes trivial. I would _love_ a 3rd-party App Store that hosted jailbreak apps/apps that abuse private APIs/etc, so long as it was clear what I was getting.
- baddox 6y agoI suspect a large portion of Apple’s users value the fact that they can’t break their phone by accidentally installing the wrong app or clicking the wrong button. To them it might not be clear what they’re getting from this no-rules App Store.
- saagarjha 6y agoI think people using Cydia had a pretty good idea of what they were doing.
- LexGray 6y agoDoubtful as few changed the root password.
- baddox 6y agoMost of them probably did, because it was generally difficult to jailbreak the phone and there wasn't much reason to do so unless you were a hobbyist. App piracy was definitely a thing though, and I bet there were some people who did it because a friend told them they can get free apps, only to end up installing stuff that made the phone very buggy (which was definitely easy to do). It's easy to say "well that's just their own fault if they installed something bad," but I don't think Apple really cares to argue with their customers over whose fault something technically was. Apple just wants their customers to have phones that are working well.
- saagarjha 6y agoJailbreaking used to be as easy as going to a website and clicking "jailbreak".