3 ms·

App Store features app that crashes unless tracking is permitted

56 points by Apocryphon 5y ago

josephcsible 5y ago
How does the App Store manage to be so trigger-happy with banning apps that it seems like every week there's a story of a legitimate developer being unjustly banned from it, while simultaneously so lax that apps like this one get approved?
- weq 5y ago
  the cynic in me thinks: You mean walled gardens of monopolies governed by AI get it wrong? No! These companies have like 0.002% good jobs filled by good programmers who launch products that are usually copies off whatever the community has worked out already is a good idea. Kinda like the car companies, and big movie companies who all seem to be creating a *flix oreitated studio now. These products get "innovated" out (of usually some small startup they can easily swallow) to be refined and honed by an army of low skilled workers who churn it out. Your monolopies protect your own incompetence. Sure there are exceptions to the rule; but i can also imagine the talent who built these tools is long gone and they are being used by a bunch of comparative armatures who the company is more then happy to let fumble with because monopoly.
  - karmakaze 5y ago
    It doesn't need AI/ML to do a sanity check.
- Someone 5y ago
  As to the data collection, Apple clearly states that’s what the developer claims the app does. Given the existence of encrypted connections, I don’t think they can do better than that without doing a code review, and even then, if the app happens to have a legitimate reason to send personal data to a remote server, they wouldn’t be able to verify that that server doesn’t store it. As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist. If they obfuscate such behavior enough, I think it can be very hard to discover it. I wouldn’t know how likely that is, but it wouldn’t surprise me if there were apps out there that do such things. But yes, it also could be sloppy app review. That might be more likely.
  - Apocryphon 5y ago
    It's not even just an app slipping through review. It was featured!
  - colejohnson66 5y ago
    > As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist. Just like Volkswagen did. Short of providing Apple your code and then perusing through it each time (which isn’t feasible), they can’t catch everything. Now, a featured app? They really messed up here.
    - Someone 5y ago
      _If_ this app did that kind of thing, I don’t see much of a difference. You can’t expect them to catch it at review. If picking it for being featured happens closely in time to that (likely, IMO) you can’t expect them to catch it at that time, either. That leaves them being paranoid, and periodically rechecking all featured apps. Even if they do that, there still will be a time window in which the app misbehaves.
      - Apocryphon 5y ago
        Sounds like the vaunted App Store review isn’t all that it’s cracked up to be.
        Someone 5y ago
        If an app can make a http request, parse the response, and do different things depending on the result, it’s hard to prove it won’t crash on receiving invalid input without access to the source code (often even with access to it. If that were easy, there wouldn’t be that many vulnerabilities from exploiting such crashes) If Apple required the source code, I predict an outcry “they’ll steal our code, just as they steal our ideas”. And no, LLVM Bitcode won’t help here, even ignoring (AFAIK) that they don’t require you to provide it (which would lead to another outcry “we can’t use gcc”) It’s too low level for that.
- Waterluvian 5y ago
  To paraphrase Mike Masnick: moderation at scale is basically impossible.
  - hypertele-Xii 5y ago
    Correction: Automated moderation is basically impossible. It's not like Apple can't afford to hire code review engineers. Their products are supposed to be more expensive and better, not just more expensive.
TillE 5y ago
It's particularly remarkable that an app crashes because of a network error, as if nobody ever considered that sporadic outages happen. Sloppy stuff.
- rasz 5y ago
  There is no value in this app if its primary function - collecting user data - doesnt work properly, thus no point validating in environments preventing that functionality.
DHPersonal 5y ago
The MacOS App Store recently highlighted in a curated list a color picker app that doesn’t grab the actual color. There are plenty of reviews complaining about the problem and I confirmed it doesn’t work properly.
traspler 5y ago
And I stressed out about the label to make sure to interpret every question against us to include even the smallest things; when I could just have taken the easy route and maybe added the most obvious points or none at all…

56 points by Apocryphon 5y ago

How does the App Store manage to be so trigger-happy with banning apps that it seems like every week there's a story of a legitimate developer being unjustly banned from it, while simultaneously so lax that apps like this one get approved?

weq 5y ago
the cynic in me thinks: You mean walled gardens of monopolies governed by AI get it wrong? No! These companies have like 0.002% good jobs filled by good programmers who launch products that are usually copies off whatever the community has worked out already is a good idea. Kinda like the car companies, and big movie companies who all seem to be creating a *flix oreitated studio now. These products get "innovated" out (of usually some small startup they can easily swallow) to be refined and honed by an army of low skilled workers who churn it out. Your monolopies protect your own incompetence. Sure there are exceptions to the rule; but i can also imagine the talent who built these tools is long gone and they are being used by a bunch of comparative armatures who the company is more then happy to let fumble with because monopoly.
- karmakaze 5y ago
  It doesn't need AI/ML to do a sanity check.
Someone 5y ago
As to the data collection, Apple clearly states that’s what the developer claims the app does. Given the existence of encrypted connections, I don’t think they can do better than that without doing a code review, and even then, if the app happens to have a legitimate reason to send personal data to a remote server, they wouldn’t be able to verify that that server doesn’t store it. As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist. If they obfuscate such behavior enough, I think it can be very hard to discover it. I wouldn’t know how likely that is, but it wouldn’t surprise me if there were apps out there that do such things. But yes, it also could be sloppy app review. That might be more likely.
- Apocryphon 5y ago
  It's not even just an app slipping through review. It was featured!
- colejohnson66 5y ago
  > As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist. Just like Volkswagen did. Short of providing Apple your code and then perusing through it each time (which isn’t feasible), they can’t catch everything. Now, a featured app? They really messed up here.
  - Someone 5y ago
    _If_ this app did that kind of thing, I don’t see much of a difference. You can’t expect them to catch it at review. If picking it for being featured happens closely in time to that (likely, IMO) you can’t expect them to catch it at that time, either. That leaves them being paranoid, and periodically rechecking all featured apps. Even if they do that, there still will be a time window in which the app misbehaves.
    - Apocryphon 5y ago
      Sounds like the vaunted App Store review isn’t all that it’s cracked up to be.
      - Someone 5y ago
        If an app can make a http request, parse the response, and do different things depending on the result, it’s hard to prove it won’t crash on receiving invalid input without access to the source code (often even with access to it. If that were easy, there wouldn’t be that many vulnerabilities from exploiting such crashes) If Apple required the source code, I predict an outcry “they’ll steal our code, just as they steal our ideas”. And no, LLVM Bitcode won’t help here, even ignoring (AFAIK) that they don’t require you to provide it (which would lead to another outcry “we can’t use gcc”) It’s too low level for that.
Waterluvian 5y ago
To paraphrase Mike Masnick: moderation at scale is basically impossible.
- hypertele-Xii 5y ago
  Correction: Automated moderation is basically impossible. It's not like Apple can't afford to hire code review engineers. Their products are supposed to be more expensive and better, not just more expensive.

TillE 5y ago

It's particularly remarkable that an app crashes because of a network error, as if nobody ever considered that sporadic outages happen. Sloppy stuff.

rasz 5y ago
There is no value in this app if its primary function - collecting user data - doesnt work properly, thus no point validating in environments preventing that functionality.

DHPersonal 5y ago

The MacOS App Store recently highlighted in a curated list a color picker app that doesn’t grab the actual color. There are plenty of reviews complaining about the problem and I confirmed it doesn’t work properly.

traspler 5y ago

And I stressed out about the label to make sure to interpret every question against us to include even the smallest things; when I could just have taken the easy route and maybe added the most obvious points or none at all…