6 ms·

Three easy ways to fix the App Store. And one really, really hard way.

21 points by seldo 17y ago

megaduck 17y ago
I wonder if the author isn't barking up the wrong tree. I don't think that the App Store review process can be 'fixed'. Instead, it might be doomed. Android allows for unfettered development, as does Symbian. WebOS is headed that way too, according to their developer relations team. On every other smartphone platform, you are (or will be) able to just develop an app and deploy it onto people's phones, without running the gauntlet of an approval process. Judging from the current state of the App Store, the review process doesn't materially improve the quality of applications. However, it does slow down and frustrate developers. If open platforms like Android gain enough market share, I think a lot of devs are going to jump ship just so they don't have to deal with the headaches of review any more. The folks running Apple aren't dumb. They're sticking by their guns because the iPhone ecosystem is working marvellously right now. However, if they start to see a large migration of developers, they'll probably do whatever it takes to bring them back. And that might mean killing 'review'.
- roc 17y ago
  I doubt 'review' is ever going away. There's too much value to be gained by having a vetted store that consumers trust. And there's no way to kill review and retain that trust. We hear about the times 'review' gets it wrong. But, by definition, we'll never hear about the times they're right. How many times they catch showstoppers or seedy code. (something I think they're looking for, far more diligently than we typically give them credit for) I'm sure Apple wants to polish and apply their policies more consistently. But ultimately only they know how often 'review' kicks out a false positives. So only they know whether the right thing to fix at this time really is policy consistency (vs getting more bodies in the group, developing better code-analysis tools, etc) It sure sounds like policy is easy to fix, but how many times have we seen false positives for things that are clearly allowed or have been previously allowed for some time? Even if the policy magically covered every possible situation, getting several hundred new hires to apply it consistently across hundreds of thousands of submissions is still a problem. And one of under-appreciated scope.
  - gcheong 17y ago
    "And there's no way to kill review and retain that trust." I don't think most users trust the app store because they know every app has been vetted. I think they trust it mainly because we haven't seen large number of users getting burned - and not because Apple is vetting each app but rather because it is in the developer's interest not to burn their customers.
- Perceval 17y ago
  >Judging from the current state of the App Store, the review process doesn't materially improve the quality of applications. It's hard to know that for certain. We don't see exactly what gets rejected. We only hear the horror stories of basically good developers encountering frustratingly arbitrary and trivial objections to otherwise solid submissions. But the majority of rejection we probably don't hear about, and we don't know what exactly they are able to keep out of the iPhone App Store with this review layer. Apple may see a lot of apps being rejected for very good reasons, but we aren't necessarily hearing about those rejection. Ultimately Apple is going to have to weigh things for themselves, balancing the frustration of good developers versus the legitimate protection of the end users from malicious or malformed submissions. So far they seem satisfied with the ratio, and are happy to prioritize the end user over the developer.
  - enjo 17y ago
    I find it interesting that we keep acting like Apple somehow invented the App Store. These are issues we've been dealing with for a LONG time, in a variety of different ways. Handango, for instance, has been functioning as an on-device app store for getting close to a decade. It's interesting, then, to look at their product and see how they never really solved these issues particularly well either. The BIGGEST issue for Apple isn't really touched on in the article. It's about proper discoverability. The problem with app-stores in general is that they have a lot of trouble allowing the best apps to filter to the top. The more apps that clutter the store, the more difficult it becomes to differentiate between them. If there is a password manager that everyone universally loves, then how do you grant exposure to a new password manager that may be better, but doesn't have the user recommendations (yet) to match it. It's that problem that plagues these stores. Handango (and others) tried a number of approaches. The "what's new category" isn't enough really. The exposure length is to short. Staff picks are nice, but that becomes an exercise in political maneuvering as opposed to app quality. It's this issue that really mandates a review process. The review process at least serves as a rudimentary filter that keeps the REALLY bad apps from competeing for mindshare with the quality new ones (thus increasing exposure, even if it is for an already to brief period). Ultimately the app store lives and dies with it's ability to put the best applications for a purpose into the hands of customers looking to solve problems. Apple is starting to deal with the problems of scale, and that is where it should be focused. ----------------------- Oh, and for the love of god give me some ability to get a refund for an app. Read reviews and count the number of times folks have essentially gotten ripped off by a product that barely functions (or sometimes doesn't function at all). Eventually we all are no longer enamored with the novelty of iPhone applications and we want some accountability behind our purchases. I'm very wary with paid apps at this point for that reason alone.
derefr 17y ago
Has anything on Cydia ever "broken the network" by using these private APIs, whether accidentally or maliciously? I'm starting to think this whole "cellular networks are fragile webs of tissue paper" meme got started from a pure guess, and even if previously correct, may no longer be correct for 3.5G.
- allenp 17y ago
  Wasn't there a rick roll virus spreading between jailbroken phones just last week? I'm guessing the next one could be a lot more malicious and with enough phones involved cause some service disruptions.
  - conover 17y ago
    I believe that was because many people never bothered to change the default password for the OpenSSH app. It's seems like that kind of thing could be exploited regardless of venue.
    - orangecat 17y ago
      Exactly, it's very easy to enable SSH access on a Mac, and I'm sure more than one person has had their MacBook compromised over wifi because they had a weak password. Yet hardly anyone would accept that as a justification for locking down Macs, so why is it different with iPhones?
    - wmf 17y ago
      Apple doesn't allow daemons which should slow down worms quite a bit.
      - ryanpetrich 17y ago
        Except for MobileMail, MobileSafari, SpringBoard, locationd, mdnsresponderd, pasteboardd, mediaserverd, launchd, configd, fairplayd, dataaccessd, accessoryd, BTServer, CoreTelephony, apsd and MobilePhone
martythemaniak 17y ago
The whole "we need a review board because otherwise VERY BAD THINGS WILL HAPPEN!!" is just a scare-tactic to justify Apple's draconian attitude towards developers. Android is open, and nothing bad has happened in over a year. BlackBerry and WinMo have been open for years and nothing bad has happened. Quite frankly, if you believe that Apple line, you're a fool.
- scottjackson 17y ago
  http://www.obsessable.com/news/2009/01/26/android-application-deleting-data-from-t-mobile-g1-phones/ http://www.obsessable.com/news/2009/01/26/android-applicatio... > The application has reportedly deleted all the contacts from the device's internal memory, as well as all data on SD cards on the device. I'm not justifying Apple's review process, I'm just saying bad stuff has happened on Android before.
blasdel 17y ago
They don't need to fork Objective-C to lock down the use of private APIs! They just need to check for disallowed or computed symbols in the sumbitted binaries. They don't do any static analysis whatsoever — not even strings!
- joezydeco 17y ago
  Looks like you got your wish... http://www.theiphoneblog.com/2009/11/16/apple-static-analysis-tool-find-private-apis-reject-apps/ http://www.theiphoneblog.com/2009/11/16/apple-static-analysi...
- ryanpetrich 17y ago
  The fact that private APIs can crash the device, access private data or cause issues with the network means Apple hasn't done their job in securing the OS. If OS X allowed processes in unprivileged user accounts access to hardware or other users' files, that would be considered a massive security hole
  - drewcrawford 17y ago
    You don't need to be root to rm -rf ~/
  - lukifer 17y ago
    The vulnerability was due solely to users running SSH (which is not installed except by jailbreaking) without changing the default root password. It's surprising that such a gaping security hole took as long as it did to be widely exploited.
deleted 17y ago
[deleted]

21 points by seldo 17y ago

I wonder if the author isn't barking up the wrong tree. I don't think that the App Store review process can be 'fixed'. Instead, it might be doomed. Android allows for unfettered development, as does Symbian. WebOS is headed that way too, according to their developer relations team. On every other smartphone platform, you are (or will be) able to just develop an app and deploy it onto people's phones, without running the gauntlet of an approval process. Judging from the current state of the App Store, the review process doesn't materially improve the quality of applications. However, it does slow down and frustrate developers. If open platforms like Android gain enough market share, I think a lot of devs are going to jump ship just so they don't have to deal with the headaches of review any more. The folks running Apple aren't dumb. They're sticking by their guns because the iPhone ecosystem is working marvellously right now. However, if they start to see a large migration of developers, they'll probably do whatever it takes to bring them back. And that might mean killing 'review'.

roc 17y ago
I doubt 'review' is ever going away. There's too much value to be gained by having a vetted store that consumers trust. And there's no way to kill review and retain that trust. We hear about the times 'review' gets it wrong. But, by definition, we'll never hear about the times they're right. How many times they catch showstoppers or seedy code. (something I think they're looking for, far more diligently than we typically give them credit for) I'm sure Apple wants to polish and apply their policies more consistently. But ultimately only they know how often 'review' kicks out a false positives. So only they know whether the right thing to fix at this time really is policy consistency (vs getting more bodies in the group, developing better code-analysis tools, etc) It sure sounds like policy is easy to fix, but how many times have we seen false positives for things that are clearly allowed or have been previously allowed for some time? Even if the policy magically covered every possible situation, getting several hundred new hires to apply it consistently across hundreds of thousands of submissions is still a problem. And one of under-appreciated scope.
- gcheong 17y ago
  "And there's no way to kill review and retain that trust." I don't think most users trust the app store because they know every app has been vetted. I think they trust it mainly because we haven't seen large number of users getting burned - and not because Apple is vetting each app but rather because it is in the developer's interest not to burn their customers.
Perceval 17y ago
>Judging from the current state of the App Store, the review process doesn't materially improve the quality of applications. It's hard to know that for certain. We don't see exactly what gets rejected. We only hear the horror stories of basically good developers encountering frustratingly arbitrary and trivial objections to otherwise solid submissions. But the majority of rejection we probably don't hear about, and we don't know what exactly they are able to keep out of the iPhone App Store with this review layer. Apple may see a lot of apps being rejected for very good reasons, but we aren't necessarily hearing about those rejection. Ultimately Apple is going to have to weigh things for themselves, balancing the frustration of good developers versus the legitimate protection of the end users from malicious or malformed submissions. So far they seem satisfied with the ratio, and are happy to prioritize the end user over the developer.
- enjo 17y ago
  I find it interesting that we keep acting like Apple somehow invented the App Store. These are issues we've been dealing with for a LONG time, in a variety of different ways. Handango, for instance, has been functioning as an on-device app store for getting close to a decade. It's interesting, then, to look at their product and see how they never really solved these issues particularly well either. The BIGGEST issue for Apple isn't really touched on in the article. It's about proper discoverability. The problem with app-stores in general is that they have a lot of trouble allowing the best apps to filter to the top. The more apps that clutter the store, the more difficult it becomes to differentiate between them. If there is a password manager that everyone universally loves, then how do you grant exposure to a new password manager that may be better, but doesn't have the user recommendations (yet) to match it. It's that problem that plagues these stores. Handango (and others) tried a number of approaches. The "what's new category" isn't enough really. The exposure length is to short. Staff picks are nice, but that becomes an exercise in political maneuvering as opposed to app quality. It's this issue that really mandates a review process. The review process at least serves as a rudimentary filter that keeps the REALLY bad apps from competeing for mindshare with the quality new ones (thus increasing exposure, even if it is for an already to brief period). Ultimately the app store lives and dies with it's ability to put the best applications for a purpose into the hands of customers looking to solve problems. Apple is starting to deal with the problems of scale, and that is where it should be focused. ----------------------- Oh, and for the love of god give me some ability to get a refund for an app. Read reviews and count the number of times folks have essentially gotten ripped off by a product that barely functions (or sometimes doesn't function at all). Eventually we all are no longer enamored with the novelty of iPhone applications and we want some accountability behind our purchases. I'm very wary with paid apps at this point for that reason alone.

derefr 17y ago

Has anything on Cydia ever "broken the network" by using these private APIs, whether accidentally or maliciously? I'm starting to think this whole "cellular networks are fragile webs of tissue paper" meme got started from a pure guess, and even if previously correct, may no longer be correct for 3.5G.

allenp 17y ago
Wasn't there a rick roll virus spreading between jailbroken phones just last week? I'm guessing the next one could be a lot more malicious and with enough phones involved cause some service disruptions.
- conover 17y ago
  I believe that was because many people never bothered to change the default password for the OpenSSH app. It's seems like that kind of thing could be exploited regardless of venue.
  - orangecat 17y ago
    Exactly, it's very easy to enable SSH access on a Mac, and I'm sure more than one person has had their MacBook compromised over wifi because they had a weak password. Yet hardly anyone would accept that as a justification for locking down Macs, so why is it different with iPhones?
  - wmf 17y ago
    Apple doesn't allow daemons which should slow down worms quite a bit.
    - ryanpetrich 17y ago
      Except for MobileMail, MobileSafari, SpringBoard, locationd, mdnsresponderd, pasteboardd, mediaserverd, launchd, configd, fairplayd, dataaccessd, accessoryd, BTServer, CoreTelephony, apsd and MobilePhone

martythemaniak 17y ago

The whole "we need a review board because otherwise VERY BAD THINGS WILL HAPPEN!!" is just a scare-tactic to justify Apple's draconian attitude towards developers. Android is open, and nothing bad has happened in over a year. BlackBerry and WinMo have been open for years and nothing bad has happened. Quite frankly, if you believe that Apple line, you're a fool.

scottjackson 17y ago
http://www.obsessable.com/news/2009/01/26/android-application-deleting-data-from-t-mobile-g1-phones/ http://www.obsessable.com/news/2009/01/26/android-applicatio... > The application has reportedly deleted all the contacts from the device's internal memory, as well as all data on SD cards on the device. I'm not justifying Apple's review process, I'm just saying bad stuff has happened on Android before.

blasdel 17y ago

They don't need to fork Objective-C to lock down the use of private APIs! They just need to check for disallowed or computed symbols in the sumbitted binaries. They don't do any static analysis whatsoever — not even strings!

joezydeco 17y ago
Looks like you got your wish... http://www.theiphoneblog.com/2009/11/16/apple-static-analysis-tool-find-private-apis-reject-apps/ http://www.theiphoneblog.com/2009/11/16/apple-static-analysi...
ryanpetrich 17y ago
The fact that private APIs can crash the device, access private data or cause issues with the network means Apple hasn't done their job in securing the OS. If OS X allowed processes in unprivileged user accounts access to hardware or other users' files, that would be considered a massive security hole
- drewcrawford 17y ago
  You don't need to be root to rm -rf ~/
- lukifer 17y ago
  The vulnerability was due solely to users running SSH (which is not installed except by jailbreaking) without changing the default root password. It's surprising that such a gaping security hole took as long as it did to be widely exploited.

deleted 17y ago

[deleted]