3 ms·

I once got rejected for having code that accesses the Ad ID when there were (at the time) no visible ads. We sell our own ads directly and when there's nothing

by eli 12y ago

I once got rejected for having code that accesses the Ad ID when there were (at the time) no visible ads. We sell our own ads directly and when there's nothing to serve, the app just has no ads. We had to start running crummy network ads in order to get the app approved. Such a strange requirement. I mean, if I wanted to abuse that Advertising ID for nefarious purposes I would just do it in an app that also runs ads. Seems like security theater.

k-mcgrady 12y ago
Could you turn on the network ads when in review and remotely disable them after passing it?
- TheLoneWolfling 12y ago
  And this is the problem with any sort of app review - you never can know. Even code audits where skilled people manually inspect code sometimes misses things. It's just yet another cat and mouse game.
- prawn 12y ago
  Yes, you could. We use a remote configuration in our game to adjust the mix of ads from various providers.
MBCook 12y ago
> Such a strange requirement. Surely they need to be able to see the ads in the app to make sure they comply with the various guidelines Apple has. Otherwise all they could do is 'take your word for it', and there have been plenty of apps in the store that provide how trustworthy that is.
- Sanddancer 12y ago
  What precludes you from submitting the app for review with fairly innocuous ads, then flipping the switch to show malicious ads? Or, perhaps have someone who only wants to show ads every once in a while? For example, an app for handling trade shows where you only want to show ads while the person is at the event space. There are a number of legitimate reasons why you wouldn't want to show an ad right that moment.
  - mikeash 12y ago
    There's always the implicit thread of strong reprisals (e.g. being blacklisted for life) if you overtly try to trick them rather than just making a mistake. It would be really easy to just show the reviewers a completely different app from what users see. All you have to do is detect the review process and alter your behavior. This could be something as simple as pinging a server which returns "yes" or "no", and you flip the switch on the server after you pass review. But nobody does this, because the implied consequences for doing it are not nice.
- eli 12y ago
  My point was they're kinda taking your word for it either way.
megablast 12y ago
So because the checks aren't perfect, they should abandon them? Clearly you can change the ads being served after it is reviewed, but all they can do is check the ads during the review process. One of the things they also check for is that the ads aren't too obtrusive.
Gorbzel 12y ago
There are a few good comments in this thread, but then this one...what a joke. Let's recap: Advertiser sells ads, doesn't run ads on App Store submitted version, complains that they had to run ads so Apple could verify what the ads are,...? I'd rather Apple put this app through its places 100x through rather than let a nefarious ad machine through.
- AriX 12y ago
  You're misunderstanding what the OP is saying. He/she is pointing out a logical fallacy in the App Review rules. Developers are allowed access to something called an "advertising identifier" which lets them track users between apps, for the purposes of targeted advertising. Apple is very restrictive in terms of user identification, in order to protect users' privacy, so this is the only way to uniquely identify a user/device, and the user can optionally opt-out of the advertising identifier entirely. Apple doesn't want developers to use the advertising identifier for things other than advertising. But the way they enforce this is simply by requiring that an app include ads in order to use the advertising identifier. If you use the advertising identifier and your app doesn't visibly include ads, it will be rejected. This restriction is ostensibly intended to prevent developers from abusing the advertising identifier, but really it just encourages developers to include shitty ads in their apps, because if you include ads, you can use the advertising identifier for whatever you want behind the scenes. It's a nonsensical way of enforcing this policy. Thus, "security theater."
- clarky07 12y ago
  apple doesn't care what your ads are. they care that you don't use the ad identifier for things that aren't ads. nothing to do with being a "nefarious ad machine"
- eli 12y ago
  You missed my point. This is security theater that in no way impacts my actual ability to run malicious ads or track users.
maresca 12y ago
I wonder how often apps are rejected and how often they get through for this rule. I'd much rather use an app that uses my ID instead of making me sign up/sign in. It also makes it easier to stop people from posting crap in your app than if you assigned ids on your own.

by eli 12y ago

k-mcgrady 12y ago

Could you turn on the network ads when in review and remotely disable them after passing it?

TheLoneWolfling 12y ago
And this is the problem with any sort of app review - you never can know. Even code audits where skilled people manually inspect code sometimes misses things. It's just yet another cat and mouse game.
prawn 12y ago
Yes, you could. We use a remote configuration in our game to adjust the mix of ads from various providers.

MBCook 12y ago

> Such a strange requirement. Surely they need to be able to see the ads in the app to make sure they comply with the various guidelines Apple has. Otherwise all they could do is 'take your word for it', and there have been plenty of apps in the store that provide how trustworthy that is.

Sanddancer 12y ago
What precludes you from submitting the app for review with fairly innocuous ads, then flipping the switch to show malicious ads? Or, perhaps have someone who only wants to show ads every once in a while? For example, an app for handling trade shows where you only want to show ads while the person is at the event space. There are a number of legitimate reasons why you wouldn't want to show an ad right that moment.
- mikeash 12y ago
  There's always the implicit thread of strong reprisals (e.g. being blacklisted for life) if you overtly try to trick them rather than just making a mistake. It would be really easy to just show the reviewers a completely different app from what users see. All you have to do is detect the review process and alter your behavior. This could be something as simple as pinging a server which returns "yes" or "no", and you flip the switch on the server after you pass review. But nobody does this, because the implied consequences for doing it are not nice.
eli 12y ago
My point was they're kinda taking your word for it either way.

megablast 12y ago

So because the checks aren't perfect, they should abandon them? Clearly you can change the ads being served after it is reviewed, but all they can do is check the ads during the review process. One of the things they also check for is that the ads aren't too obtrusive.

Gorbzel 12y ago

There are a few good comments in this thread, but then this one...what a joke. Let's recap: Advertiser sells ads, doesn't run ads on App Store submitted version, complains that they had to run ads so Apple could verify what the ads are,...? I'd rather Apple put this app through its places 100x through rather than let a nefarious ad machine through.

AriX 12y ago
You're misunderstanding what the OP is saying. He/she is pointing out a logical fallacy in the App Review rules. Developers are allowed access to something called an "advertising identifier" which lets them track users between apps, for the purposes of targeted advertising. Apple is very restrictive in terms of user identification, in order to protect users' privacy, so this is the only way to uniquely identify a user/device, and the user can optionally opt-out of the advertising identifier entirely. Apple doesn't want developers to use the advertising identifier for things other than advertising. But the way they enforce this is simply by requiring that an app include ads in order to use the advertising identifier. If you use the advertising identifier and your app doesn't visibly include ads, it will be rejected. This restriction is ostensibly intended to prevent developers from abusing the advertising identifier, but really it just encourages developers to include shitty ads in their apps, because if you include ads, you can use the advertising identifier for whatever you want behind the scenes. It's a nonsensical way of enforcing this policy. Thus, "security theater."
clarky07 12y ago
apple doesn't care what your ads are. they care that you don't use the ad identifier for things that aren't ads. nothing to do with being a "nefarious ad machine"
eli 12y ago
You missed my point. This is security theater that in no way impacts my actual ability to run malicious ads or track users.

maresca 12y ago

I wonder how often apps are rejected and how often they get through for this rule. I'd much rather use an app that uses my ID instead of making me sign up/sign in. It also makes it easier to stop people from posting crap in your app than if you assigned ids on your own.