3 ms·

> in practice there's really zero reason to review Adobe or Microsoft or OmniGroup app updates I can totally see Facebook pushing a update which uses internal

> in practice there's really zero reason to review Adobe or Microsoft or OmniGroup app updates I can totally see Facebook pushing a update which uses internal APIs to access private information outside of its sandbox. Honestly apps need to be verified after every update for much of the same reasons they need to be verified initially. The issue is the verification process itself, which sometimes blocks legitimate developers while also sometimes allowing scam apps.

kennywinker 5y ago
private api issues are usually caught with automated binary scans. You can obfuscate them to avoid detection but manual review wouldn’t help with that either
- meibo 5y ago
  They can't even fix private API abuse, how do you expect them to scan for it? See: recent iOS exploits.
  - vbezhenar 5y ago
    Apple security is based on developer goodwill. If you’ve used private API, you did it by mistake. That’s how their security model works. That’s why they’re scanning binaries for unobfuscated calls. They don’t have an answer against malicious developers other than acting post-factum.
mlang23 5y ago
Wait, did you just imply that apps by certain big companies dont need a review because you think these special biig companies deserve a bit of extra trust? Fascinating, how did you arrive at this conclusion?
- sunderw 5y ago
  He actually arrived at the exact opposite conclusion: all apps should be reviewed after each update because not even (or especially) big companies can’t be trusted.
- gumby 5y ago
  No, armchairhacker said the opposite: even big famous companies need review of every update. And the original poster (the blind game developer) says so too
- catlifeonmars 5y ago
  Did you mean to reply to the grandparent poster?
  - mlang23 5y ago
    Yes, my bad.
b3morales 5y ago
This is fair, but I think we can agree that rejecting an update on grounds of its basic features being duplicative, when the feature set has not changed -- which is what happened here -- is pretty absurd.
trothamel 5y ago
"which uses internal APIs to access private information outside of its sandbox" Isn't this being possible a security issue with iOS?
- saagarjha 5y ago
  Yes, it is.

kennywinker 5y ago

private api issues are usually caught with automated binary scans. You can obfuscate them to avoid detection but manual review wouldn’t help with that either

meibo 5y ago
They can't even fix private API abuse, how do you expect them to scan for it? See: recent iOS exploits.
- vbezhenar 5y ago
  Apple security is based on developer goodwill. If you’ve used private API, you did it by mistake. That’s how their security model works. That’s why they’re scanning binaries for unobfuscated calls. They don’t have an answer against malicious developers other than acting post-factum.

mlang23 5y ago

Wait, did you just imply that apps by certain big companies dont need a review because you think these special biig companies deserve a bit of extra trust? Fascinating, how did you arrive at this conclusion?

sunderw 5y ago
He actually arrived at the exact opposite conclusion: all apps should be reviewed after each update because not even (or especially) big companies can’t be trusted.
gumby 5y ago
No, armchairhacker said the opposite: even big famous companies need review of every update. And the original poster (the blind game developer) says so too
catlifeonmars 5y ago
Did you mean to reply to the grandparent poster?
- mlang23 5y ago
  Yes, my bad.

b3morales 5y ago

This is fair, but I think we can agree that rejecting an update on grounds of its basic features being duplicative, when the feature set has not changed -- which is what happened here -- is pretty absurd.

trothamel 5y ago

"which uses internal APIs to access private information outside of its sandbox" Isn't this being possible a security issue with iOS?

saagarjha 5y ago
Yes, it is.