4 ms·

I'm confused, isn't the whole idea of an app that just loads and displays a website a security issue already? You can just swap out the content on the page to s

I'm confused, isn't the whole idea of an app that just loads and displays a website a security issue already? You can just swap out the content on the page to something malicious at any given point without going through store approval yah? I'm not familiar with app store development, is this a standard way that people develop apps?

zerr 3y ago
There are some services, e.g. Expo for React Native, that provide Over-The-Air update mechanisms, bypassing app store approvals. Also, one of the main points of the WebView control is the ability to show a particular web page. If that's an issue, the platform/SDK should not provide such controls.
o11c 3y ago
Additionally, even if the website itself is "trusted", it is very common for ads to be embedded. The set of trustworthy ad providers is the empty set. I find it reasonably likely that the malware strike was correct; that's a pretty specific reason.
willsmith72 3y ago
Like others mentioned, Expo already provides over-the-air updates for non-native stuff, and that's only gonna become more and more common. You can also package an entire web app as a PWA and deploy it to the app stores. It could even be server rendered. But any permissions-related changes have to go through approval again
raft75 3y ago
I published that damn app a few years ago. I was experimenting with Processing at the time: https://processing.org/ https://processing.org/ I thought it could be funny to use the javascript version of it https://p5js.org/ https://p5js.org/ in a web page and then wrap it in a Unity app, since Unity was and is the environment I use for making apps. Yes, I know that Processing can export to Android natively (but not to iOS, by the way) Being a shitty and useless app that no one use, I should have unpublished it years ago. I have kept it updated all these years because "oh, well, one I day I will improve it, when I have time". And now this shitty and useless app has caused the destruction of all my other "real" apps. Lesson learned the hard way.
w1lds4g4mes 3y ago
Kind of, I worked for some years in a big mobile game company and they had the same approach for rendering popups. There is a big incentive for coming up for solutions that allows to deliver new content without having to update a new build to the app stores.

zerr 3y ago

There are some services, e.g. Expo for React Native, that provide Over-The-Air update mechanisms, bypassing app store approvals. Also, one of the main points of the WebView control is the ability to show a particular web page. If that's an issue, the platform/SDK should not provide such controls.

o11c 3y ago

Additionally, even if the website itself is "trusted", it is very common for ads to be embedded. The set of trustworthy ad providers is the empty set. I find it reasonably likely that the malware strike was correct; that's a pretty specific reason.

willsmith72 3y ago

Like others mentioned, Expo already provides over-the-air updates for non-native stuff, and that's only gonna become more and more common. You can also package an entire web app as a PWA and deploy it to the app stores. It could even be server rendered. But any permissions-related changes have to go through approval again

raft75 3y ago

I published that damn app a few years ago. I was experimenting with Processing at the time: https://processing.org/ https://processing.org/ I thought it could be funny to use the javascript version of it https://p5js.org/ https://p5js.org/ in a web page and then wrap it in a Unity app, since Unity was and is the environment I use for making apps. Yes, I know that Processing can export to Android natively (but not to iOS, by the way) Being a shitty and useless app that no one use, I should have unpublished it years ago. I have kept it updated all these years because "oh, well, one I day I will improve it, when I have time". And now this shitty and useless app has caused the destruction of all my other "real" apps. Lesson learned the hard way.

w1lds4g4mes 3y ago

Kind of, I worked for some years in a big mobile game company and they had the same approach for rendering popups. There is a big incentive for coming up for solutions that allows to deliver new content without having to update a new build to the app stores.