3 ms·

> No vetting of apps. This is not true, apps are reviewed now. IMO this is theater and useless, though. > No inspection of source code for red flags. This is

by myko 5y ago

> No vetting of apps. This is not true, apps are reviewed now. IMO this is theater and useless, though. > No inspection of source code for red flags. This is also untrue, Google scans apps for known malware. Not sure how this was missed, though. > And the sketchy apps can be rated five stars by a bunch of bots artificially inflating its popularity. This is true. It's also a problem on the App Store and similar sites. The App Store is not immune to these issues, either: https://twitter.com/jonathandata1/status/1486458526767661060 https://twitter.com/jonathandata1/status/1486458526767661060

joshstrange 5y ago
I know the App Store isn't immune but I'm having a hard time remembering a time when an app on iOS was reaching into other app's data or doing something like a keylogger system-wide. Often it's things like "It's listening to you, grabbing your clipboard, etc". While far from "good" or "ok", it's a far cry from some random app being able to steal my banking session.
- realusername 5y ago
  https://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/ https://www.macrumors.com/2020/08/24/xcode-malware-infiltrat... It usually starts with xcode injecting malware, since the building process is so opaque and undocumented, they get away with it.
  - joshstrange 5y ago
    > It usually starts with xcode injecting malware That happened once, it's not like every few months or year where hear of a new instance of something like that and it's still not reaching outside itself into other apps as far as I know. So yeah, it could steal the banking login info of the banking app it managed to get injected into but it's not like "iFart" can reach in and grab your bank creds.
    - realusername 5y ago
      That issue is worse than some "iFart" app since you are getting a regular app, from a regular vendor.
      - joshstrange 5y ago
        No doubt, I'm not downplaying the severity of the xcode inject issue. I'm just saying it has only happened once before that we know of and it still isn't a "breakout"/"escape"-type exploit that we see so often in Android-land.
        realusername 5y ago
        I can't recall a sandbox breakout happening on Android for a very long time and this malware isn't breaking out either.
duskwuff 5y ago
> https://twitter.com/jonathandata1/status/1486458526767661060 https://twitter.com/jonathandata1/status/1486458526767661060 Relevant subtweet: https://twitter.com/0xabad1dea/status/1487093037352333317 https://twitter.com/0xabad1dea/status/1487093037352333317

by myko 5y ago

joshstrange 5y ago

I know the App Store isn't immune but I'm having a hard time remembering a time when an app on iOS was reaching into other app's data or doing something like a keylogger system-wide. Often it's things like "It's listening to you, grabbing your clipboard, etc". While far from "good" or "ok", it's a far cry from some random app being able to steal my banking session.

realusername 5y ago
https://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/ https://www.macrumors.com/2020/08/24/xcode-malware-infiltrat... It usually starts with xcode injecting malware, since the building process is so opaque and undocumented, they get away with it.
- joshstrange 5y ago
  > It usually starts with xcode injecting malware That happened once, it's not like every few months or year where hear of a new instance of something like that and it's still not reaching outside itself into other apps as far as I know. So yeah, it could steal the banking login info of the banking app it managed to get injected into but it's not like "iFart" can reach in and grab your bank creds.
  - realusername 5y ago
    That issue is worse than some "iFart" app since you are getting a regular app, from a regular vendor.
    - joshstrange 5y ago
      No doubt, I'm not downplaying the severity of the xcode inject issue. I'm just saying it has only happened once before that we know of and it still isn't a "breakout"/"escape"-type exploit that we see so often in Android-land.
      - realusername 5y ago
        I can't recall a sandbox breakout happening on Android for a very long time and this malware isn't breaking out either.

duskwuff 5y ago

> https://twitter.com/jonathandata1/status/1486458526767661060 https://twitter.com/jonathandata1/status/1486458526767661060 Relevant subtweet: https://twitter.com/0xabad1dea/status/1487093037352333317 https://twitter.com/0xabad1dea/status/1487093037352333317