4 ms·

wow. This means that there is no guarantee that the code I published is the code that gets installed. Does no one else have a problem with this?

rlf_dev 5y ago
App Thinning removes unused slices on download, it doesn't change compiled code.
- comex 5y ago
  But if you enable bitcode, that does involve the server recompiling your code for you.
  - rlf_dev 5y ago
    Sure, but it's still your own LLVM IR that's being compiled, just on their end and not yours.
1f60c 5y ago
If you do not trust Apple, why are you wasting time writing apps for their platform?
- drewzero1 5y ago
  I'm not a published app developer, but even if I don't trust Apple hundreds of millions of users do. If I wanted to market to those users, or if I worked for a company that wanted to, I would have to suck it up and deal with Apple and their platform in order to reach the users.
- Brian_K_White 5y ago
  Not a useful question. Also, trustworthy people do not ask you to trust them. I am honest and trustworthy, and so if you gave me the pin to your debit card to go buy something for you, I would not mis-use that information. But because I am honest, I would never ask you to trust me with your pin. If we were standing next to each other at a pos, I actively look away when you start to type so I don't even find it out by innocent accident. Honest people take the trouble to figure out some way to get a job done without requiring you to trust them, even if you would have, even if it's less convenient for you both. In fact, I think that one thing is probably the single biggest proof of trustworthiness. A person or organization that I've never met before and and does not ask me to trust them, is more trustworthy than one that I've known for years and have a long history of good interactions with.
derefr 5y ago
Apple could publish a builder binary with which you could verify that your submitted code gets compiled+linked+thinned into the same thing you get from the App Store (minus the signature.) They haven't — which is bad — but they could, and that would be a guarantee. Same as you get with reproducible binary packages in Debian.
Brian_K_White 5y ago
Many people have voiced exactly this problem. And I would agree it should be outrageous and intolerable. I wonder if there might be some way for a developer to post their own hashes somewhere, but then there's no good way for an end user to use them to verify their phone. You could post a web page that reports that Apple has not modified the contents of your app, or a site could do that for many apps, by downloading the Apple-repacked app and checking it, but you could only check the copy of the app that the site downloaded. It would not prove that Apple didn't modify the individual copy of the app residing on anyones phone. I don't know the details of ios userspace, but I extremely doubt it's possible for the browser or any other app to read some other apps files and uload them to a site to have them checked. So you couldn't make a 3rd party site that says "check my phone". Maybe such a report could be made by reading the app out of an unencrypted backup?
- atatatat 5y ago
  > I wonder if there might be some way for a developer to post their own hashes somewhere Twitter, JSON/ATOM/RSS feeds, apps in privately hosted F-Droid compatible repos...etc
atatatat 5y ago
Oh, this is too good.
nodamage 5y ago
I mean, since Apple controls the entire OS there is already no guarantee that the code that gets installed is the code that gets executed. In other words, you already had that problem. (Of having to trust Apple in the first place.)

rlf_dev 5y ago

App Thinning removes unused slices on download, it doesn't change compiled code.

comex 5y ago
But if you enable bitcode, that does involve the server recompiling your code for you.
- rlf_dev 5y ago
  Sure, but it's still your own LLVM IR that's being compiled, just on their end and not yours.

1f60c 5y ago

If you do not trust Apple, why are you wasting time writing apps for their platform?

drewzero1 5y ago
I'm not a published app developer, but even if I don't trust Apple hundreds of millions of users do. If I wanted to market to those users, or if I worked for a company that wanted to, I would have to suck it up and deal with Apple and their platform in order to reach the users.
Brian_K_White 5y ago
Not a useful question. Also, trustworthy people do not ask you to trust them. I am honest and trustworthy, and so if you gave me the pin to your debit card to go buy something for you, I would not mis-use that information. But because I am honest, I would never ask you to trust me with your pin. If we were standing next to each other at a pos, I actively look away when you start to type so I don't even find it out by innocent accident. Honest people take the trouble to figure out some way to get a job done without requiring you to trust them, even if you would have, even if it's less convenient for you both. In fact, I think that one thing is probably the single biggest proof of trustworthiness. A person or organization that I've never met before and and does not ask me to trust them, is more trustworthy than one that I've known for years and have a long history of good interactions with.

derefr 5y ago

Apple could publish a builder binary with which you could verify that your submitted code gets compiled+linked+thinned into the same thing you get from the App Store (minus the signature.) They haven't — which is bad — but they could, and that would be a guarantee. Same as you get with reproducible binary packages in Debian.

Brian_K_White 5y ago

Many people have voiced exactly this problem. And I would agree it should be outrageous and intolerable. I wonder if there might be some way for a developer to post their own hashes somewhere, but then there's no good way for an end user to use them to verify their phone. You could post a web page that reports that Apple has not modified the contents of your app, or a site could do that for many apps, by downloading the Apple-repacked app and checking it, but you could only check the copy of the app that the site downloaded. It would not prove that Apple didn't modify the individual copy of the app residing on anyones phone. I don't know the details of ios userspace, but I extremely doubt it's possible for the browser or any other app to read some other apps files and uload them to a site to have them checked. So you couldn't make a 3rd party site that says "check my phone". Maybe such a report could be made by reading the app out of an unencrypted backup?

atatatat 5y ago
> I wonder if there might be some way for a developer to post their own hashes somewhere Twitter, JSON/ATOM/RSS feeds, apps in privately hosted F-Droid compatible repos...etc

atatatat 5y ago

Oh, this is too good.

nodamage 5y ago

I mean, since Apple controls the entire OS there is already no guarantee that the code that gets installed is the code that gets executed. In other words, you already had that problem. (Of having to trust Apple in the first place.)