3 ms·

The issue isn't changing the behavior of the app. The issue is installing and executing code that wasn't present when the app was reviewed.

saagarjha 4y ago
Code is behavior, and behavior is code. There's really no difference in the end when you can ship an interpreter runtime in your app.
- GeekyBear 4y ago
  There seems to be a big enough difference that Ars Technica felt they needed to warn users that they could not trust apps from inside Google's walled garden. >“Joker is one of the most prominent malware families that continually targets Android devices,” Zscaler researcher Viral Gandhi wrote in last week’s post. “Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques.” The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
  - saagarjha 4y ago
    To be entirely honest I don't really like the chances of people finding what they want on the App Store either, since it's not all that hard to accidentally be mislead into downloading the wrong app, or one that is filled with ads or IAP scams. One large difference from Android is that the [iOS] platform will prevent certain easily-abusable behaviors, which is a genuine point. But "oh my app does something else after it was reviewed" is a problem on both platforms.
    - GeekyBear 4y ago
      We aren't talking about attempting to mislead a user. We're talking about apps you download from inside the walled garden that install malware that costs the users real money. >Once installed, Joker apps secretly subscribe users to pricey subscription services https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
      - saagarjha 4y ago
        The only point I want to make is that downloading code and executing it to perform malicious behavior is a moot point. What is possible on either platform, or currently done, is not something I wanted to address.

saagarjha 4y ago

Code is behavior, and behavior is code. There's really no difference in the end when you can ship an interpreter runtime in your app.

GeekyBear 4y ago
There seems to be a big enough difference that Ars Technica felt they needed to warn users that they could not trust apps from inside Google's walled garden. >“Joker is one of the most prominent malware families that continually targets Android devices,” Zscaler researcher Viral Gandhi wrote in last week’s post. “Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques.” The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
- saagarjha 4y ago
  To be entirely honest I don't really like the chances of people finding what they want on the App Store either, since it's not all that hard to accidentally be mislead into downloading the wrong app, or one that is filled with ads or IAP scams. One large difference from Android is that the [iOS] platform will prevent certain easily-abusable behaviors, which is a genuine point. But "oh my app does something else after it was reviewed" is a problem on both platforms.
  - GeekyBear 4y ago
    We aren't talking about attempting to mislead a user. We're talking about apps you download from inside the walled garden that install malware that costs the users real money. >Once installed, Joker apps secretly subscribe users to pricey subscription services https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
    - saagarjha 4y ago
      The only point I want to make is that downloading code and executing it to perform malicious behavior is a moot point. What is possible on either platform, or currently done, is not something I wanted to address.