3 ms·

If this becomes widely used, it'll only kickstart an arms race between Apple and the people trying to access the iTunes previews. Remember what happened with th

If this becomes widely used, it'll only kickstart an arms race between Apple and the people trying to access the iTunes previews. Remember what happened with the Palm Pre and iTunes syncing? Apple doesn't like unapproved devices accessing its content ecosystem.

wzhack 14y ago
I am not sure Apple can differentiate Apple devices over HTTP except UA header. Maybe they can develop a proprietary streaming protocol but is it worth?
- deleted 14y ago
  [deleted]
- pedrocr 14y ago
  There are probably a bunch of ways of checking with javascript that are much harder to spoof than the UA.
  - hmert 14y ago
    I am not sure related native iOS streaming libraries integrate JavaScript security just to protect iTunes previews.
    - w1ntermute 14y ago
      That could be easily updated if necessary. Moreover, it's entirely possible that there are dormant APIs precisely in case this sort of thing happened.
  - jcfrei 14y ago
    yes, for example with device fingerprinting. the Electronic Frontier Foundation has a nice test page online: https://panopticlick.eff.org/ https://panopticlick.eff.org/ however apple could apply a much simpler filter by checking whether the screen size fits the exact specs of their iphones / ipods and ban any other devices. then again, you might always access the source directly, circumventing the need for js entirely.
wzhack 14y ago
I am not sure Apple can differentiate Apple devices over HTTP except UA header. Maybe they can develop a proprietary streaming protocol but is it worth?
philwelch 14y ago
> Remember what happened with the Palm Pre and iTunes syncing? Palm Pre exploited security holes that would have allowed any rogue USB device falsely reporting itself as an iPhone to access e.g. your address book, and Apple patched the security holes. Quibble all you want over Apple's motivations, but there wasn't any other responsible thing for them to do.

wzhack 14y ago

I am not sure Apple can differentiate Apple devices over HTTP except UA header. Maybe they can develop a proprietary streaming protocol but is it worth?

deleted 14y ago
[deleted]
pedrocr 14y ago
There are probably a bunch of ways of checking with javascript that are much harder to spoof than the UA.
- hmert 14y ago
  I am not sure related native iOS streaming libraries integrate JavaScript security just to protect iTunes previews.
  - w1ntermute 14y ago
    That could be easily updated if necessary. Moreover, it's entirely possible that there are dormant APIs precisely in case this sort of thing happened.
- jcfrei 14y ago
  yes, for example with device fingerprinting. the Electronic Frontier Foundation has a nice test page online: https://panopticlick.eff.org/ https://panopticlick.eff.org/ however apple could apply a much simpler filter by checking whether the screen size fits the exact specs of their iphones / ipods and ban any other devices. then again, you might always access the source directly, circumventing the need for js entirely.

wzhack 14y ago

I am not sure Apple can differentiate Apple devices over HTTP except UA header. Maybe they can develop a proprietary streaming protocol but is it worth?

philwelch 14y ago

> Remember what happened with the Palm Pre and iTunes syncing? Palm Pre exploited security holes that would have allowed any rogue USB device falsely reporting itself as an iPhone to access e.g. your address book, and Apple patched the security holes. Quibble all you want over Apple's motivations, but there wasn't any other responsible thing for them to do.