15 ms·

Unlisted App Distribution

156 points by cglong 5y ago

krono 5y ago
This document gives the how, could anyone here perhaps give us a why? Genuine curiosity, provisioning is not something I deal with much. There are so many paths that get you the same results, that don't require you to hand out full control to this ever fair and totally predictable friend of ours.
- deleted 5y ago
  [deleted]
- zerkten 5y ago
  It's covered after the first paragraph of the article. There are lots of apps that could be published as public apps, but you don't want to add confusion to regular users. If Acme publish apps to the store for the public, they may not want their expenses app for employees to be listed alongside the apps. There are also very specialist apps that require sign-ins or accounts that aren't available to the public. You might have a messaging app for end users, but have an eDiscovery app that's only available for a few enterprise customers that relies on some access that regular user accounts don't have.
  - krono 5y ago
    Your explanation is much appreciated, thanks. What's not yet clear to me, though, is why you'd choose to distribute these non-public applications through the appstore in the first place, rather than just make them available as direct downloads and have them "sideloaded".
    - zerkten 5y ago
      >> What's not yet clear to me, though, is why you'd choose to distribute these non-public applications through the appstore in the first place, rather than just make them available as direct downloads and have them "sideloaded". For most situations where you want to do this, you want the apps to download and update like any other app. At the point of distribution, you want to have some differentiation as described in my original post. As soon as the user initiates app installation, you want the App Store to do the heavy lifting for you. There is no benefit to side loading an application in many cases because you have to then have users repeat those steps again and again. With this mechanism, it's a standard App Store app so you can also deploy it via MDM or other management mechanism. I completely understand why lack of side loading is an impediment to freedom and using a device how you wish. The challenge is that there is real value for many to Apple's tools and mechanisms when they are more composable. They are likely to offer up things like this as the pressure mounts to offer real sideloading.
tobyjsullivan 5y ago
Lest anyone else be confused as I was, this is not about opening Apple's walled garden. It seems these unlisted apps still require Apple's approval and, presumably, must meet their normal standards. The only benefit is that your app can be private and will not be listed in the app store.
anfilt 5y ago
Just allow people to put their devices in a mode that allows side loading or let people load their own signing keys. The fact Apple keeps such a tight grip on hardware they don't even own needs to be cracked down on.
- i_like_apis 5y ago
  I love that they don't allow side-loading. Long live the walled garden. (I mean this non-sarcastically)
  - netr0ute 5y ago
    Ironic
  - anfilt 5y ago
    You really like the idea of a company controlling property you own after you bought it??? Like if its optional don’t change the defaults. The issue is starting from the boot-rom and up apple is effectively using cryptography to retain the property right of exclusion when it comes to what code can run on that ARM cpu. Effectively you have to ask apple for approval of any code that will run on your own hardware. If they sign the code they allow it run if they don’t its excluded from running. If you have to keep asking a 3rd party to do something with something you bought you don't fully own it. The thing is normally a seller wishing to retain some rights to real or tangible property would normally require a legal contract between the buyer. Here however apple is using cryptography to bypass traditional legal means. You can buy an iPhone, iPad without signing any contract. Yet this effectively retained control of the hardware still exists. You can’t just buy the hardware and throw linux or android on it short of finding a weakness in how code is loaded.
    - School-Cotton 5y ago
      > You really like the idea of a company controlling property you own after you bought it??? If I didn’t, I wouldn’t buy an iPhone. What’s the problem?
awinter-py 5y ago
heard u want to run software on your device
sorry_outta_gas 5y ago
mobile apps are so 10 years ago
- amelius 5y ago
  Sadly, general purpose computing is so 10 years ago.
- kerbs 5y ago
  That's not what the numbers say
joshstrange 5y ago
For those wondering this appears to be a new offering that sits between their enterprise offerings and app store accounts. Right now if you want to offer your internal app you need to host the IPA's, implement your own update mechanism, and get people to accept your developer deep in the Settings app. I'm guessing this lets you take advantage of Apple's update and hosting which makes sense for some apps I'm sure. One of the nicer things with enterprise is you don't need to go through app review (mainly the time savings, we can push a fix as quick as we can code it). This isn't something my company will use but it makes total sense for an internal app that doesn't need rapid release ability and saves you from a lot of management stuff you'd otherwise be on the hook for. Now all I want is Apple to have a better story for "template apps". I know we don't want more spam in the store but getting a company to setup and maintain an Apple Dev account when they are not a tech company can be rough. I've run into this issue both professionally and for side projects. I'd gladly give Apple $100 per app and/or be unlisted if I could publish multiple builds of the same base "template app" on the same account. Maybe they will relax that restriction for unlisted apps, it still wouldn't cut it for some cases but for at least one of my side projects it would be perfect.
- kerbs 5y ago
  There is a place between those today, which is Apple Business Manager (ABM). It uses the App Store infrastructure, but apps are not listed on the public App Store and are instead made visible through redemption codes or using an email-based invitation. The UX is pretty terrible, the support is nearly non-existent, but it's there. I just hope they are a little easier on App Review considering how hard it was to get a bespoke app through App Review in the past.
ilrwbwrkhv 5y ago
Can one not just use Cydia?
- duskwuff 5y ago
  Cydia requires a jailbroken device, which 1) is usually impossible if the device is running an up-to-date version of iOS, and 2) makes the device less secure, making it unreasonable for an organization to require their employees to do.
  - saurik 5y ago
    (For clarity: the device being jailbroken shouldn't and honestly usually doesn't make it less secure, and in the past we have sometimes been able to fix bugs and patch them to be more secure than stock; but, to be jailbroken means the device was jailbreakable, which is where the core insecurity lies: a jailbreakable device--which is an older device or one running an older operating system version with some unpatched exploit that can be abused--whether or not it has been jailbroken is dangerous to be using, and the jailbreaks have become more limited in their ability to fix these bugs.
alexashka 5y ago
Is this a new feature? How did corporate apps get distributed prior to this?
- Gigachad 5y ago
  They were just public listed apps. You’d have a corporate app on the normal store which would just hit a login wall. Not really that big of a deal but not as nice as an unlisted app.
  - sockpuppet69 5y ago
  - bashy 5y ago
    There's also Custom Apps[0] where you go through the same process but can either generate redemption codes to send people or go through the Mobile Device Management tool. These are not on the public app store. I setup this for a company app that their employees use. [0] https://developer.apple.com/custom-apps/ https://developer.apple.com/custom-apps/
- JimDabell 5y ago
  You can publish applications yourself using an enterprise certificate. You have to host and distribute it, although MDM systems can do this for you and roll it out to all your users automatically. You can also publish on the App Store, but only make it visible / available to specific customers where they buy seats in bulk and get redemption codes for people to install through the App Store. This seems like a bit of a simplification of the second approach.
internals 5y ago
We use this, great to see it officially announced! This helps offer apps to potential/current/former employees without competing with yourself in App Store search results. The only way to load the App Store app page is via the direct apps.apple.com link. Past that, the app is treated like any other. You still go through the regular app review process, but honestly I think employees appreciate that and trust the app more seeing it come from the App Store rather than from some enterprise MDM app that prompts for a whole lot of device access/trust.
dfabulich 5y ago
I've been saying for years that Apple should do something like this, as an alternative to Apple's exorbitant App Store fees. Today: Apple charges app devs 15-30% of IAP revenue, providing new users "for free" in search and editorial highlighting. Tomorrow: Apple could charge 0% of IAP revenue for "unlisted" apps. Unlisted app developers could buy Search Ads to pay for new users. I think this would align incentives for devs and Apple much better. I should be paying Apple a market rate for what they actually offer me, new users, and not a fixed percentage based on IAP sales that I'm merchandising to my own users after acquiring them.
- jrockway 5y ago
  Shouldn't they just charge you $30,000 for a 1 year license to the SDK and not take any of your revenue?
  - dfabulich 5y ago
    Maybe. Or maybe I should pay $1K, or $100K. My point is that there's a market rate for new users, and that's what I should be paying. (Even if Apple is the only purveyor of Search Ads, I can acquire new users on Google or Facebook, or by any other means of advertising.)
    - 2OEH8eoCRo0 5y ago
      Charge nothing. They make money when they sell phones.
      - cweagans 5y ago
        When they sell you a phone, you are paying for the hardware and the software that runs on it. Apple is providing a service with the App Store and related services. Whether or not you _like_ that service or how they price it is another matter, but they _are_ providing a service. It is not unreasonable for them to charge for it.
        5y ago
joenathanone 5y ago
> Please note that unlisted apps must be ready for final distribution. Requests for apps in a beta or pre-release state will be declined. Why this limitation?
- mttjj 5y ago
  Because Test Flight already exists for this purpose.
  - kerbs 5y ago
    I also think this guarantees the binary to be released has had a full review (TestFlight awkwardly only requires review for any build in a release train, and future builds can be released toll-free)
mortenjorck 5y ago
In practical terms, what does being unlisted on the app store really get you? If you were worried about someone accidentally stumbling across your internal app… ask a hobbyist iOS game developer how many people stumble across the app they’re actively trying to promote. If the possibility of people outside your organization having access to an app at all is not acceptable, this doesn’t solve that as there is no mechanism to stop the link from being shared outside. Everything else is the same; same submission and review process, same distribution channel. As best I can tell, all this does is change the visibility of your app from 0.01 to 0.005.
- ezfe 5y ago
  Easy example: You're a big company (Facebook, Google, Apple, etc.) and you want to publish an app without showing it on your developer page in the app store or "related apps" on a big app. Netflix doesn't want a cafeteria ordering app showing up next to the main Netflix app, but it doesn't actually need to be securely distributed to only Netflix employees since it still requires login.
  - ayewo 5y ago
    More concrete examples of internal iOS apps at big companies like Facebook and Google are mentioned in this NYT article https://www.nytimes.com/2019/01/31/technology/apple-blocks-facebook.html https://www.nytimes.com/2019/01/31/technology/apple-blocks-f... This was when Facebook had it internal iOS apps disabled due to Apple’s discovery of the true nature of Onavo as a privacy eroding app distributed to consumers by Facebook.
2OEH8eoCRo0 5y ago
> You’ll need to submit a request to receive a link to your unlisted app. This is still a shit deal
grishka 5y ago
And if your unlisted app does in-app purchases, you still have to pay 30%, right? Apple used to justify that cut by saying "we deserve it for bringing all these users to your app via the app store catalog", but that's not a valid claim for unlisted apps. Apple must be forced to allow installing iOS apps from arbitrary sources, signed with arbitrary keys. This is the only way. Or are they afraid that if they do allow that, then the app store would have to truly compete with "just host a self-signed .ipa on your own server" on its own merits?
- kccqzy 5y ago
  Apple still runs the infrastructure for handling the unlisted app, like storage costs and bandwidth costs. I believe unlisted apps still have to go through review, so there's human cost in that as well.
  - NateEag 5y ago
    Which has to be covered by the $99 / year developer program fee, in aggregate. Sure, a few apps will cost them massively more than that, but most will take five minutes of reviewer time every six months and a few gigs per month (or year) in download bandwidth.
    - enos_feedler 5y ago
      Are you trying to decide what revenue goes to cover which cost for a company worth $3T?
      - grishka 5y ago
        And by the way, they have so much money sitting in banks doing nothing, they could as well just start giving everything away for free and it'll last them for 20 years.
        can16358p 5y ago
        If they were a charity or non profit sure. But why on Earth a for-profit company, whose reason for existing, by definition, is to make money, would give away money?
ChrisMarshallNY 5y ago
I actually write apps that could benefit from this. It’s interesting to me.
mysterydip 5y ago
> Unlisted apps don’t appear in any App Store categories, recommendations, charts, search results, or other listings. So just like my regular apps then? Signed, a frustrated indie developer :)
glaive123 5y ago
Is the hey email client by DHH and Jason Fried (Basecamp) still able to unlock features while avoiding using apple's in-app subscription purchase? I just saw an update on this from the compliance guidelines and seems to go against the whole ordeal they came out on top of two years ago.

156 points by cglong 5y ago

This document gives the how, could anyone here perhaps give us a why? Genuine curiosity, provisioning is not something I deal with much. There are so many paths that get you the same results, that don't require you to hand out full control to this ever fair and totally predictable friend of ours.

deleted 5y ago
[deleted]
zerkten 5y ago
It's covered after the first paragraph of the article. There are lots of apps that could be published as public apps, but you don't want to add confusion to regular users. If Acme publish apps to the store for the public, they may not want their expenses app for employees to be listed alongside the apps. There are also very specialist apps that require sign-ins or accounts that aren't available to the public. You might have a messaging app for end users, but have an eDiscovery app that's only available for a few enterprise customers that relies on some access that regular user accounts don't have.
- krono 5y ago
  Your explanation is much appreciated, thanks. What's not yet clear to me, though, is why you'd choose to distribute these non-public applications through the appstore in the first place, rather than just make them available as direct downloads and have them "sideloaded".
  - zerkten 5y ago
    >> What's not yet clear to me, though, is why you'd choose to distribute these non-public applications through the appstore in the first place, rather than just make them available as direct downloads and have them "sideloaded". For most situations where you want to do this, you want the apps to download and update like any other app. At the point of distribution, you want to have some differentiation as described in my original post. As soon as the user initiates app installation, you want the App Store to do the heavy lifting for you. There is no benefit to side loading an application in many cases because you have to then have users repeat those steps again and again. With this mechanism, it's a standard App Store app so you can also deploy it via MDM or other management mechanism. I completely understand why lack of side loading is an impediment to freedom and using a device how you wish. The challenge is that there is real value for many to Apple's tools and mechanisms when they are more composable. They are likely to offer up things like this as the pressure mounts to offer real sideloading.

tobyjsullivan 5y ago

Lest anyone else be confused as I was, this is not about opening Apple's walled garden. It seems these unlisted apps still require Apple's approval and, presumably, must meet their normal standards. The only benefit is that your app can be private and will not be listed in the app store.

anfilt 5y ago

Just allow people to put their devices in a mode that allows side loading or let people load their own signing keys. The fact Apple keeps such a tight grip on hardware they don't even own needs to be cracked down on.

i_like_apis 5y ago
I love that they don't allow side-loading. Long live the walled garden. (I mean this non-sarcastically)
- netr0ute 5y ago
  Ironic
- anfilt 5y ago
  You really like the idea of a company controlling property you own after you bought it??? Like if its optional don’t change the defaults. The issue is starting from the boot-rom and up apple is effectively using cryptography to retain the property right of exclusion when it comes to what code can run on that ARM cpu. Effectively you have to ask apple for approval of any code that will run on your own hardware. If they sign the code they allow it run if they don’t its excluded from running. If you have to keep asking a 3rd party to do something with something you bought you don't fully own it. The thing is normally a seller wishing to retain some rights to real or tangible property would normally require a legal contract between the buyer. Here however apple is using cryptography to bypass traditional legal means. You can buy an iPhone, iPad without signing any contract. Yet this effectively retained control of the hardware still exists. You can’t just buy the hardware and throw linux or android on it short of finding a weakness in how code is loaded.
  - School-Cotton 5y ago
    > You really like the idea of a company controlling property you own after you bought it??? If I didn’t, I wouldn’t buy an iPhone. What’s the problem?

awinter-py 5y ago

heard u want to run software on your device

sorry_outta_gas 5y ago

mobile apps are so 10 years ago

amelius 5y ago
Sadly, general purpose computing is so 10 years ago.
kerbs 5y ago
That's not what the numbers say

joshstrange 5y ago

For those wondering this appears to be a new offering that sits between their enterprise offerings and app store accounts. Right now if you want to offer your internal app you need to host the IPA's, implement your own update mechanism, and get people to accept your developer deep in the Settings app. I'm guessing this lets you take advantage of Apple's update and hosting which makes sense for some apps I'm sure. One of the nicer things with enterprise is you don't need to go through app review (mainly the time savings, we can push a fix as quick as we can code it). This isn't something my company will use but it makes total sense for an internal app that doesn't need rapid release ability and saves you from a lot of management stuff you'd otherwise be on the hook for. Now all I want is Apple to have a better story for "template apps". I know we don't want more spam in the store but getting a company to setup and maintain an Apple Dev account when they are not a tech company can be rough. I've run into this issue both professionally and for side projects. I'd gladly give Apple $100 per app and/or be unlisted if I could publish multiple builds of the same base "template app" on the same account. Maybe they will relax that restriction for unlisted apps, it still wouldn't cut it for some cases but for at least one of my side projects it would be perfect.

kerbs 5y ago
There is a place between those today, which is Apple Business Manager (ABM). It uses the App Store infrastructure, but apps are not listed on the public App Store and are instead made visible through redemption codes or using an email-based invitation. The UX is pretty terrible, the support is nearly non-existent, but it's there. I just hope they are a little easier on App Review considering how hard it was to get a bespoke app through App Review in the past.

ilrwbwrkhv 5y ago

Can one not just use Cydia?

duskwuff 5y ago
Cydia requires a jailbroken device, which 1) is usually impossible if the device is running an up-to-date version of iOS, and 2) makes the device less secure, making it unreasonable for an organization to require their employees to do.
- saurik 5y ago
  (For clarity: the device being jailbroken shouldn't and honestly usually doesn't make it less secure, and in the past we have sometimes been able to fix bugs and patch them to be more secure than stock; but, to be jailbroken means the device was jailbreakable, which is where the core insecurity lies: a jailbreakable device--which is an older device or one running an older operating system version with some unpatched exploit that can be abused--whether or not it has been jailbroken is dangerous to be using, and the jailbreaks have become more limited in their ability to fix these bugs.

alexashka 5y ago

Is this a new feature? How did corporate apps get distributed prior to this?

Gigachad 5y ago
They were just public listed apps. You’d have a corporate app on the normal store which would just hit a login wall. Not really that big of a deal but not as nice as an unlisted app.
- sockpuppet69 5y ago
- bashy 5y ago
  There's also Custom Apps[0] where you go through the same process but can either generate redemption codes to send people or go through the Mobile Device Management tool. These are not on the public app store. I setup this for a company app that their employees use. [0] https://developer.apple.com/custom-apps/ https://developer.apple.com/custom-apps/
JimDabell 5y ago
You can publish applications yourself using an enterprise certificate. You have to host and distribute it, although MDM systems can do this for you and roll it out to all your users automatically. You can also publish on the App Store, but only make it visible / available to specific customers where they buy seats in bulk and get redemption codes for people to install through the App Store. This seems like a bit of a simplification of the second approach.

internals 5y ago

We use this, great to see it officially announced! This helps offer apps to potential/current/former employees without competing with yourself in App Store search results. The only way to load the App Store app page is via the direct apps.apple.com link. Past that, the app is treated like any other. You still go through the regular app review process, but honestly I think employees appreciate that and trust the app more seeing it come from the App Store rather than from some enterprise MDM app that prompts for a whole lot of device access/trust.

dfabulich 5y ago

I've been saying for years that Apple should do something like this, as an alternative to Apple's exorbitant App Store fees. Today: Apple charges app devs 15-30% of IAP revenue, providing new users "for free" in search and editorial highlighting. Tomorrow: Apple could charge 0% of IAP revenue for "unlisted" apps. Unlisted app developers could buy Search Ads to pay for new users. I think this would align incentives for devs and Apple much better. I should be paying Apple a market rate for what they actually offer me, new users, and not a fixed percentage based on IAP sales that I'm merchandising to my own users after acquiring them.

jrockway 5y ago
Shouldn't they just charge you $30,000 for a 1 year license to the SDK and not take any of your revenue?
- dfabulich 5y ago
  Maybe. Or maybe I should pay $1K, or $100K. My point is that there's a market rate for new users, and that's what I should be paying. (Even if Apple is the only purveyor of Search Ads, I can acquire new users on Google or Facebook, or by any other means of advertising.)
  - 2OEH8eoCRo0 5y ago
    Charge nothing. They make money when they sell phones.
    - cweagans 5y ago
      When they sell you a phone, you are paying for the hardware and the software that runs on it. Apple is providing a service with the App Store and related services. Whether or not you _like_ that service or how they price it is another matter, but they _are_ providing a service. It is not unreasonable for them to charge for it.
      - 5y ago

joenathanone 5y ago

> Please note that unlisted apps must be ready for final distribution. Requests for apps in a beta or pre-release state will be declined. Why this limitation?

mttjj 5y ago
Because Test Flight already exists for this purpose.
- kerbs 5y ago
  I also think this guarantees the binary to be released has had a full review (TestFlight awkwardly only requires review for any build in a release train, and future builds can be released toll-free)

mortenjorck 5y ago

In practical terms, what does being unlisted on the app store really get you? If you were worried about someone accidentally stumbling across your internal app… ask a hobbyist iOS game developer how many people stumble across the app they’re actively trying to promote. If the possibility of people outside your organization having access to an app at all is not acceptable, this doesn’t solve that as there is no mechanism to stop the link from being shared outside. Everything else is the same; same submission and review process, same distribution channel. As best I can tell, all this does is change the visibility of your app from 0.01 to 0.005.

ezfe 5y ago
Easy example: You're a big company (Facebook, Google, Apple, etc.) and you want to publish an app without showing it on your developer page in the app store or "related apps" on a big app. Netflix doesn't want a cafeteria ordering app showing up next to the main Netflix app, but it doesn't actually need to be securely distributed to only Netflix employees since it still requires login.
- ayewo 5y ago
  More concrete examples of internal iOS apps at big companies like Facebook and Google are mentioned in this NYT article https://www.nytimes.com/2019/01/31/technology/apple-blocks-facebook.html https://www.nytimes.com/2019/01/31/technology/apple-blocks-f... This was when Facebook had it internal iOS apps disabled due to Apple’s discovery of the true nature of Onavo as a privacy eroding app distributed to consumers by Facebook.

2OEH8eoCRo0 5y ago

> You’ll need to submit a request to receive a link to your unlisted app. This is still a shit deal

grishka 5y ago

And if your unlisted app does in-app purchases, you still have to pay 30%, right? Apple used to justify that cut by saying "we deserve it for bringing all these users to your app via the app store catalog", but that's not a valid claim for unlisted apps. Apple must be forced to allow installing iOS apps from arbitrary sources, signed with arbitrary keys. This is the only way. Or are they afraid that if they do allow that, then the app store would have to truly compete with "just host a self-signed .ipa on your own server" on its own merits?

kccqzy 5y ago
Apple still runs the infrastructure for handling the unlisted app, like storage costs and bandwidth costs. I believe unlisted apps still have to go through review, so there's human cost in that as well.
- NateEag 5y ago
  Which has to be covered by the $99 / year developer program fee, in aggregate. Sure, a few apps will cost them massively more than that, but most will take five minutes of reviewer time every six months and a few gigs per month (or year) in download bandwidth.
  - enos_feedler 5y ago
    Are you trying to decide what revenue goes to cover which cost for a company worth $3T?
    - grishka 5y ago
      And by the way, they have so much money sitting in banks doing nothing, they could as well just start giving everything away for free and it'll last them for 20 years.
      - can16358p 5y ago
        If they were a charity or non profit sure. But why on Earth a for-profit company, whose reason for existing, by definition, is to make money, would give away money?

ChrisMarshallNY 5y ago

I actually write apps that could benefit from this. It’s interesting to me.

mysterydip 5y ago

> Unlisted apps don’t appear in any App Store categories, recommendations, charts, search results, or other listings. So just like my regular apps then? Signed, a frustrated indie developer :)

glaive123 5y ago

Is the hey email client by DHH and Jason Fried (Basecamp) still able to unlock features while avoiding using apple's in-app subscription purchase? I just saw an update on this from the compliance guidelines and seems to go against the whole ordeal they came out on top of two years ago.