15 ms·

Extracting Data from an Old iOS App Broken by iOS 14.5

69 points by pcr910303 5y ago

jmercouris 5y ago
Perhaps the real lesson to be learned is do not store your data in a place that you have no control over it.
- pintxo 5y ago
  Most people probably had never control over their local desktop system.
  - swiley 5y ago
    Pre Windows 10 they had way more control than they do with phones. Microsoft actually respected user intentions to some degree by comparison.
    - goldenkey 5y ago
      Windows 10 telemetry and whatnot can all be turned off. It's still the desktop OS it always was, just with some extra crapola (Cortana) that iOS millennials expect. At least Windows isn't sending a hash of every file I open to their servers like Apple is...
      - toast0 5y ago
        I think that's not every file, but every executable, right? And doesn't Microsoft do that and call it SmartScreen?
      - swiley 5y ago
        I have a computer science degree, and have gone through periods where I've maintained custom Linux distros built from scratch for myself. I'm not able to keep up with all of the newly discovered (and subsequently disabled) methods for disabling all of the online services in windows 10. I didn't mention OSX because I didn't want to be overly verbose but yeah any non-free OS at this point has pretty much no respect at all for privacy or user freedom.
        goldenkey 5y ago
        I have a master degree in CS. There's really not much of a learning curve to disabling telemetry on Windows or OSX. It requires some labor, but so does any kind of technological upkeep.
      - forgingahead 5y ago
        At least Windows isn't sending a hash of every file I open to their servers like Apple is. Wait, what is Apple doing? Which Apple OS is sending a hash of every file that is opened? And can this be disabled?
        ValentineC 5y ago
        It's because of app notarisation. Here's one of the writeups on it: https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...
        _jal 5y ago
        It is a hash of executables, not files. It does include shell scripts. The intent seems to be malware prevention, but yes, the implementation is terrible from a privacy perspective. Far better would be a local bloom filter or similar. But the bit about Windows being more respectful of privacy is not correct, or at least substantially more complicated. For instance, if you run 'full' telemetry, Microsoft can, in fact, pull your documents from your machine and execute things on it remotely, something I've seen no indication Apple does. https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_security-insiderplat_pc/windows-10-telemetry-some-questions-and-how-does/69a49191-74ee-4676-8169-6d9e46b5e56 https://answers.microsoft.com/en-us/insider/forum/insider_wi...
    - pintxo 5y ago
      It's more that a lot of people seem to have zero mental model about how the file system in their computer works (files, folders, paths, ...). Let alone their computer as a whole.
- ascagnel_ 5y ago
  More accurately: do not store your data in a proprietary format. The issue isn't that the app stopped working, the issue is that the app changed from a single-purchase to a subscription model, and the last version of the single-purchase app is no longer supported. If the data was freely accessible, you could at least pull it out and migrate to an app with a more user-friendly business model.
  - ihuman 5y ago
    Based on the image at the end of the page, it looks like the app does allow you to export the data in a non-propriety format. The problem was that the app couldn't launch, so the author couldn't export the data.
brirec 5y ago
There are reports that iOS 14.5 changed some sort of signature system, requiring people that first installed certain apps from long enough ago to redownload the app from the App Store. Chances are that if you delete and redownload Momento Classic from your current iPhone it’ll “just work.”
- xuki 5y ago
  Don't do that, that'll delete all the data as well. Try to "Offload app" instead, the phone will delete the app but keep the data.
  - ChrisMarshallNY 5y ago
    This is a nasty problem that has been around for decades: Data storage rot. Here's a rather embarrasing example of data storage rot[0]. > Don't do that, that'll delete all the data as well. Not necessarily, but it depends on the app. I use the User Defaults dictionary all the time, for things like operational prefs. I even have an SPM module that I wrote for it[1]. User Defaults gets deleted with the app, unless you do some hacking to sync it somewhere else. I think that storing as an app file may also get deleted when the app is deleted. We're not supposed to use that for persistent data, though. Apple provides Core Data for that kind of thing (a mixed bag). Even that needs to be done correctly, like storing using iCloud (Disclaimer: I have not chosen to use Core Data for my apps, so I can't speak to it authoritatively). Or you could do what I do: Use a server. [0] https://www.theguardian.com/uk/2002/mar/03/research.elearning https://www.theguardian.com/uk/2002/mar/03/research.elearnin... [1] https://riftvalleysoftware.com/work/open-source-projects/#RVS_PersistentPrefs https://riftvalleysoftware.com/work/open-source-projects/#RV...
    - ericlewis 5y ago
      keychain persists, user defaults won't, if you store files in the documents directory it will persist if offloading the application. CoreData will NOT afaik, unless you choose to define where it persists. I'd also say that CoreData isn't exactly only meant for persisting data either - it can do that, but first and foremost it is an object graph. more fun facts: user defaults has a limit to how big it can be. And I also think that your library would benefit from using actual types instead of Any, you can actually define this so long as the value is Codable, generics would make the library nicer to work with instead of requiring the dev to cast the type themselves. You basically just switch out Any for a generic and have the Generic conform to Codable. If targeting an iOS version that is 14+ I would just recommend using the AppStorage or SceneStorage property wrappers.
Daedren 5y ago
Apple's been automatically updating apps with these new signatures by themselves. You'll see changelogs with the following "This app has been updated by Apple to use the latest signing certificate." I believe this is the case of an app that has been removed from the App Store though, which will receive no such support.
- busymom0 5y ago
  Yep. I received that in an email from Apple couple months ago for an old app I have on the store and since it had been working just fine for 3 years, I hadn't updated it. I decided to update it just in case the new signature would break something. Link for those curious: https://www.macrumors.com/2021/04/16/psa-apple-updating-old-apps-latest-certificate/ https://www.macrumors.com/2021/04/16/psa-apple-updating-old-...
- Cthulhu_ 5y ago
  Must have to do with Apple's change over time that you no longer submit the installable app to them for review, but an intermediate package with code and assets for multiple CPU architectures and screen resolutions; that means they can do the final packaging before installation. Smart.
  - callmeal 5y ago
    wow. This means that there is no guarantee that the code I published is the code that gets installed. Does no one else have a problem with this?
    - rlf_dev 5y ago
      App Thinning removes unused slices on download, it doesn't change compiled code.
      - comex 5y ago
        But if you enable bitcode, that does involve the server recompiling your code for you.
busymom0 5y ago
Can someone tell me what app this is in the article? It doesn't look like the MacOS App Store but looks similar. https://tidbits.com/uploads/2021/05/Setapp-sqlite-640x469.jpg https://tidbits.com/uploads/2021/05/Setapp-sqlite-640x469.jp...
- mosselman 5y ago
  It is https://setapp.com/ https://setapp.com/
  - busymom0 5y ago
    Thanks. So it seems like it's just an App Store with a subscription?
    - haswell 5y ago
      Essentially, yes. I subscribed to Setapp as soon as I realized they have several apps I already had individual subscriptions for (like Ulysses), and Setapp is cheaper. I’m a happy customer.
    - ArchOversight 5y ago
      Yes, and for the value of the software it is well worth it! I had paid for several apps standalone, and I now get them through Setapp (including updates) and pay far less! It's great!
Accacin 5y ago
To be honest, this is another reason I moved away from Apple back to a Google Pixel running CalyxOS. I'm choosing to only install banking apps from Aurora and everything else is coming straight from fdroid. A massive thank you to Calyx and also to all the fdroid developers for making my life more simple and privacy focused.
- hahahasure 5y ago
  Fdroid has been my number 1 change I made this year. I recommend it to everyone. Bromite and New pipe are game changers. Interesting calyx recommendation, although I personally want my data harvested(to serve me). I suppose this is the Android benefit of Choice.
- kiririn 5y ago
  OTOH it is the reason I moved to iOS. Privacy is important, but so is having full access to your own data. You don’t get that on Android these days without rooting - adb backup barely works and more than half of apps opt out
hrbf 5y ago
This is exactly why I have become increasingly wary of any new app to store any kind of long-term data in. The fact that an OS update breaks an app and the developer is unwilling or unable to fix it is unacceptable in my book.
sosodev 5y ago
Similar thing: https://www.youtube.com/watch?v=341IsnWdaT4 https://www.youtube.com/watch?v=341IsnWdaT4 It's a video about the efforts to preserve an old iOS App that had been broken by new updates and removed from the app store
yalok 5y ago
I had a very similar problems with MiniHack app on my older iPhone, that it stopped working after iOS 14.5 upgrade, but which still worked on a newer iPhone 11 that also runs 14.5. Came to these comments specifically to find a reason for that (reinstalling an app was not an option because I think the app no longer is visible in the App Store). Thanks to @xuki, I tried offloading and reinstalling the app, and it fixed the problem!
- wrboyce 5y ago
  FYI you can re-download the app by going to your purchase history (App Store, tap your photo top right, then “Purchased”).
Brian_K_White 5y ago
"I have no one to blame but myself" is not the evaluation I come away with.
- nodamage 5y ago
  The developer had already released a new version of the app that is compatible with iOS 14.5, the problem was the user was using a very old version from 2014. Expecting a 7-year old build of an app to continue to work on a modern version of iOS isn't really realistic, especially considering how often iOS introduces breaking changes.
  - Brian_K_White 5y ago
    I use 30 and 40 year old software all the time, and more importantly, the data from 30 and 40 year old software all the time, with no problem at all. There is no compatibility or obsolescence problem with ios, ios apps, or most importantly the data in ios apps, that is not artificially created by people who benefit from such problems. Expecting a 7 year old build of anything to still work is entirely "realistic".
cosmotic 5y ago
Sounds like a good user story. As an application user, I want to start a career as a software engineer, so that I may save my data from a deliberately crippled application.

69 points by pcr910303 5y ago

jmercouris 5y ago

Perhaps the real lesson to be learned is do not store your data in a place that you have no control over it.

pintxo 5y ago
Most people probably had never control over their local desktop system.
- swiley 5y ago
  Pre Windows 10 they had way more control than they do with phones. Microsoft actually respected user intentions to some degree by comparison.
  - goldenkey 5y ago
    Windows 10 telemetry and whatnot can all be turned off. It's still the desktop OS it always was, just with some extra crapola (Cortana) that iOS millennials expect. At least Windows isn't sending a hash of every file I open to their servers like Apple is...
    - toast0 5y ago
      I think that's not every file, but every executable, right? And doesn't Microsoft do that and call it SmartScreen?
    - swiley 5y ago
      I have a computer science degree, and have gone through periods where I've maintained custom Linux distros built from scratch for myself. I'm not able to keep up with all of the newly discovered (and subsequently disabled) methods for disabling all of the online services in windows 10. I didn't mention OSX because I didn't want to be overly verbose but yeah any non-free OS at this point has pretty much no respect at all for privacy or user freedom.
      - goldenkey 5y ago
        I have a master degree in CS. There's really not much of a learning curve to disabling telemetry on Windows or OSX. It requires some labor, but so does any kind of technological upkeep.
    - forgingahead 5y ago
      At least Windows isn't sending a hash of every file I open to their servers like Apple is. Wait, what is Apple doing? Which Apple OS is sending a hash of every file that is opened? And can this be disabled?
      - ValentineC 5y ago
        It's because of app notarisation. Here's one of the writeups on it: https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...
      - _jal 5y ago
        It is a hash of executables, not files. It does include shell scripts. The intent seems to be malware prevention, but yes, the implementation is terrible from a privacy perspective. Far better would be a local bloom filter or similar. But the bit about Windows being more respectful of privacy is not correct, or at least substantially more complicated. For instance, if you run 'full' telemetry, Microsoft can, in fact, pull your documents from your machine and execute things on it remotely, something I've seen no indication Apple does. https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_security-insiderplat_pc/windows-10-telemetry-some-questions-and-how-does/69a49191-74ee-4676-8169-6d9e46b5e56 https://answers.microsoft.com/en-us/insider/forum/insider_wi...
  - pintxo 5y ago
    It's more that a lot of people seem to have zero mental model about how the file system in their computer works (files, folders, paths, ...). Let alone their computer as a whole.
ascagnel_ 5y ago
More accurately: do not store your data in a proprietary format. The issue isn't that the app stopped working, the issue is that the app changed from a single-purchase to a subscription model, and the last version of the single-purchase app is no longer supported. If the data was freely accessible, you could at least pull it out and migrate to an app with a more user-friendly business model.
- ihuman 5y ago
  Based on the image at the end of the page, it looks like the app does allow you to export the data in a non-propriety format. The problem was that the app couldn't launch, so the author couldn't export the data.

brirec 5y ago

There are reports that iOS 14.5 changed some sort of signature system, requiring people that first installed certain apps from long enough ago to redownload the app from the App Store. Chances are that if you delete and redownload Momento Classic from your current iPhone it’ll “just work.”

xuki 5y ago
Don't do that, that'll delete all the data as well. Try to "Offload app" instead, the phone will delete the app but keep the data.
- ChrisMarshallNY 5y ago
  This is a nasty problem that has been around for decades: Data storage rot. Here's a rather embarrasing example of data storage rot[0]. > Don't do that, that'll delete all the data as well. Not necessarily, but it depends on the app. I use the User Defaults dictionary all the time, for things like operational prefs. I even have an SPM module that I wrote for it[1]. User Defaults gets deleted with the app, unless you do some hacking to sync it somewhere else. I think that storing as an app file may also get deleted when the app is deleted. We're not supposed to use that for persistent data, though. Apple provides Core Data for that kind of thing (a mixed bag). Even that needs to be done correctly, like storing using iCloud (Disclaimer: I have not chosen to use Core Data for my apps, so I can't speak to it authoritatively). Or you could do what I do: Use a server. [0] https://www.theguardian.com/uk/2002/mar/03/research.elearning https://www.theguardian.com/uk/2002/mar/03/research.elearnin... [1] https://riftvalleysoftware.com/work/open-source-projects/#RVS_PersistentPrefs https://riftvalleysoftware.com/work/open-source-projects/#RV...
  - ericlewis 5y ago
    keychain persists, user defaults won't, if you store files in the documents directory it will persist if offloading the application. CoreData will NOT afaik, unless you choose to define where it persists. I'd also say that CoreData isn't exactly only meant for persisting data either - it can do that, but first and foremost it is an object graph. more fun facts: user defaults has a limit to how big it can be. And I also think that your library would benefit from using actual types instead of Any, you can actually define this so long as the value is Codable, generics would make the library nicer to work with instead of requiring the dev to cast the type themselves. You basically just switch out Any for a generic and have the Generic conform to Codable. If targeting an iOS version that is 14+ I would just recommend using the AppStorage or SceneStorage property wrappers.

Daedren 5y ago

Apple's been automatically updating apps with these new signatures by themselves. You'll see changelogs with the following "This app has been updated by Apple to use the latest signing certificate." I believe this is the case of an app that has been removed from the App Store though, which will receive no such support.

busymom0 5y ago
Yep. I received that in an email from Apple couple months ago for an old app I have on the store and since it had been working just fine for 3 years, I hadn't updated it. I decided to update it just in case the new signature would break something. Link for those curious: https://www.macrumors.com/2021/04/16/psa-apple-updating-old-apps-latest-certificate/ https://www.macrumors.com/2021/04/16/psa-apple-updating-old-...
Cthulhu_ 5y ago
Must have to do with Apple's change over time that you no longer submit the installable app to them for review, but an intermediate package with code and assets for multiple CPU architectures and screen resolutions; that means they can do the final packaging before installation. Smart.
- callmeal 5y ago
  wow. This means that there is no guarantee that the code I published is the code that gets installed. Does no one else have a problem with this?
  - rlf_dev 5y ago
    App Thinning removes unused slices on download, it doesn't change compiled code.
    - comex 5y ago
      But if you enable bitcode, that does involve the server recompiling your code for you.

busymom0 5y ago

Can someone tell me what app this is in the article? It doesn't look like the MacOS App Store but looks similar. https://tidbits.com/uploads/2021/05/Setapp-sqlite-640x469.jpg https://tidbits.com/uploads/2021/05/Setapp-sqlite-640x469.jp...

mosselman 5y ago
It is https://setapp.com/ https://setapp.com/
- busymom0 5y ago
  Thanks. So it seems like it's just an App Store with a subscription?
  - haswell 5y ago
    Essentially, yes. I subscribed to Setapp as soon as I realized they have several apps I already had individual subscriptions for (like Ulysses), and Setapp is cheaper. I’m a happy customer.
  - ArchOversight 5y ago
    Yes, and for the value of the software it is well worth it! I had paid for several apps standalone, and I now get them through Setapp (including updates) and pay far less! It's great!

Accacin 5y ago

To be honest, this is another reason I moved away from Apple back to a Google Pixel running CalyxOS. I'm choosing to only install banking apps from Aurora and everything else is coming straight from fdroid. A massive thank you to Calyx and also to all the fdroid developers for making my life more simple and privacy focused.

hahahasure 5y ago
Fdroid has been my number 1 change I made this year. I recommend it to everyone. Bromite and New pipe are game changers. Interesting calyx recommendation, although I personally want my data harvested(to serve me). I suppose this is the Android benefit of Choice.
kiririn 5y ago
OTOH it is the reason I moved to iOS. Privacy is important, but so is having full access to your own data. You don’t get that on Android these days without rooting - adb backup barely works and more than half of apps opt out

hrbf 5y ago

This is exactly why I have become increasingly wary of any new app to store any kind of long-term data in. The fact that an OS update breaks an app and the developer is unwilling or unable to fix it is unacceptable in my book.

sosodev 5y ago

Similar thing: https://www.youtube.com/watch?v=341IsnWdaT4 https://www.youtube.com/watch?v=341IsnWdaT4 It's a video about the efforts to preserve an old iOS App that had been broken by new updates and removed from the app store

yalok 5y ago

I had a very similar problems with MiniHack app on my older iPhone, that it stopped working after iOS 14.5 upgrade, but which still worked on a newer iPhone 11 that also runs 14.5. Came to these comments specifically to find a reason for that (reinstalling an app was not an option because I think the app no longer is visible in the App Store). Thanks to @xuki, I tried offloading and reinstalling the app, and it fixed the problem!

wrboyce 5y ago
FYI you can re-download the app by going to your purchase history (App Store, tap your photo top right, then “Purchased”).

Brian_K_White 5y ago

"I have no one to blame but myself" is not the evaluation I come away with.

nodamage 5y ago
The developer had already released a new version of the app that is compatible with iOS 14.5, the problem was the user was using a very old version from 2014. Expecting a 7-year old build of an app to continue to work on a modern version of iOS isn't really realistic, especially considering how often iOS introduces breaking changes.
- Brian_K_White 5y ago
  I use 30 and 40 year old software all the time, and more importantly, the data from 30 and 40 year old software all the time, with no problem at all. There is no compatibility or obsolescence problem with ios, ios apps, or most importantly the data in ios apps, that is not artificially created by people who benefit from such problems. Expecting a 7 year old build of anything to still work is entirely "realistic".

cosmotic 5y ago

Sounds like a good user story. As an application user, I want to start a career as a software engineer, so that I may save my data from a deliberately crippled application.