4 ms·

I believe the reason behind it is more petty or silly (pick you poison). A lot of bigger developers, especially streaming services, got spooked by the fact tha

I believe the reason behind it is more petty or silly (pick you poison). A lot of bigger developers, especially streaming services, got spooked by the fact that users can inspect the .app bundle and look inside, with assets easy to copy. In response a lot of big developers disabled the option because I guess security through obscurity sounds appealing.

kmeisthax 3y ago
Most users on macOS aren't opening bundles. Even if that was part of the threat model, Apple doesn't encrypt bundle resources; only the binaries[0]. Before they got rid of iTunes, you actually used to be able to download IPAs through it to sync them onto your iPhone[1]. The IPA files were right on the drive and could be opened by anyone. The underlying interfaces to do this still exist and you can still get IPAs today using Apple Configurator 2, iMazing[2], or straight off the Apple CDN[3]. [0] https://forums.developer.apple.com/forums/thread/13486 https://forums.developer.apple.com/forums/thread/13486 This is also why you can't run iOS apps on unsigned macOS - the secure enclave will refuse to decrypt apps unless the currently booted OS is Apple-signed, with the usual integrity protections in place. [1] https://apple.stackexchange.com/questions/298391/how-do-i-download-an-ios-app-ipa-file-to-my-mac-after-itunes-12-7-update https://apple.stackexchange.com/questions/298391/how-do-i-do... [2] https://imazing.com/guides/how-to-manage-apps-without-itunes https://imazing.com/guides/how-to-manage-apps-without-itunes Also, shoutout to iMazing in general, it's a really useful tool for playing around with device backups. [3] I can't find the citation for this but I swear I saw a blog post that told you how to do this.
- turquoisevar 3y ago
  You’re preaching to the choir. I was just relaying what I’ve heard through the grapevine of people working at those companies. It’s silly, but when did that ever stop a company from making decisions like this?

kmeisthax 3y ago

Most users on macOS aren't opening bundles. Even if that was part of the threat model, Apple doesn't encrypt bundle resources; only the binaries[0]. Before they got rid of iTunes, you actually used to be able to download IPAs through it to sync them onto your iPhone[1]. The IPA files were right on the drive and could be opened by anyone. The underlying interfaces to do this still exist and you can still get IPAs today using Apple Configurator 2, iMazing[2], or straight off the Apple CDN[3]. [0] https://forums.developer.apple.com/forums/thread/13486 https://forums.developer.apple.com/forums/thread/13486 This is also why you can't run iOS apps on unsigned macOS - the secure enclave will refuse to decrypt apps unless the currently booted OS is Apple-signed, with the usual integrity protections in place. [1] https://apple.stackexchange.com/questions/298391/how-do-i-download-an-ios-app-ipa-file-to-my-mac-after-itunes-12-7-update https://apple.stackexchange.com/questions/298391/how-do-i-do... [2] https://imazing.com/guides/how-to-manage-apps-without-itunes https://imazing.com/guides/how-to-manage-apps-without-itunes Also, shoutout to iMazing in general, it's a really useful tool for playing around with device backups. [3] I can't find the citation for this but I swear I saw a blog post that told you how to do this.

turquoisevar 3y ago
You’re preaching to the choir. I was just relaying what I’ve heard through the grapevine of people working at those companies. It’s silly, but when did that ever stop a company from making decisions like this?