9 ms·

Shutting Down a Service with 500M Requests per Month

104 points by danielamitay 11y ago

shiv86 11y ago
Thanks for sharing. Must be tough. But Iam sure you'll move onto bigger and better things in the future.
throwaway34234 11y ago
You are an unethical person. I'm pleasantly surprised Apple shut this down.
- coreyoconnor 11y ago
  I am ignorant of what iHasApp means in terms of users. Much less the ethics of it all. Why is what iHasApp did considered unethical?
  - tokenizerrr 11y ago
    From https://github.com/danielamitay/iHasApp https://github.com/danielamitay/iHasApp: > The iHasApp iOS Framework allows you to detect installed apps on a user's device. Detection results can be in the form of an array of detected appIds, or an array of appDictionaries from the iTunes Search API.
    - 542458 11y ago
      I'd also bet you a coffee that you could pretty reliably uniquely fingerprint devices this way. I don't bear OP any ill will for writing iHazApp, but I can certainly see why many would be uncomfortable with it.
      - nostrebored 11y ago
        Very, very skeptical of this. Apps that people have installed tend to be similar apps.
        function_seven 11y ago
        For some subset maybe. But I guarantee you that there is not one other person on Earth that has the same set of apps installed on their phone that I do. The chances of that are astronomically tiny.
        shampine 11y ago
        Maybe we should make an app where you put in all the apps that you have on your iPhone to find your perfect match. We'll call it appxappxappxappxappxappxappxapp.
        lucaspiller 11y ago
        You can filter it down even more by reading carrier information which you can access without permissions: http://iosdevelopertips.com/core-services/carrier-information-mobile-network-code-mnc-and-mobile-country-code-mcc.html http://iosdevelopertips.com/core-services/carrier-informatio...
        542458 11y ago
        I disagree. For a related piece of work, see https://panopticlick.eff.org https://panopticlick.eff.org I'm running a browser with only two (what I believe are common) add ons installed and a fairly uninteresting system config on common hardware. This is enough (combined with other "safe" metadata) to uniquely identify me! Compare this to iPhones, which frequently have dozens of apps installed and expose comparable device metadata.
  - nilliams 11y ago
    Presumably parent is offended by the privacy violation. It allows developer of app A to know I have app B installed, which can be used to target adds etc.
    - deleted 11y ago
      [deleted]
    - petercooper 11y ago
      While unlikely, it could be used for worse. Let's say a local or niche publication has an app and can detect if any of its subscribers are also using Grindr, Tinder, or some sort of app that signifies, to them, some cardinal sin on the part of the subscriber. That could be used to blackmail/shame/harass people.
- deleted 11y ago
  [deleted]
- killface 11y ago
  I completely agree. This is tantamount to spying on users. It's basically equivalent to some random game reading your entire contacts list and sending it to the company.
- smtddr 11y ago
  I don't even think you should be surprised. I don't see how anyone could condone the privacy violation this app commits. Of course this app should be banned, should have never made it to the appstore to begin with. And the developer should be ashamed of himself. With all the discussions around the NSA & privacy these days, it's tone-deafness & insensitive for a developer not to see the obvious problems iHasApp creates.
  - themartorana 11y ago
    Do you really suppose ad providers in millions of apps do anything differently? Do you think Apple's own iAd relevancy engine that allows them to charge premiums to advertisers does anything differently? It seems odd to be outraged at a practice employed by the very knight in shining armor that just shut them down.
    - deleted 11y ago
      [deleted]
- tottenhm 11y ago
  I share your concern that this functionality could be abused, but disagree with your attempt to treat this as black-and-white or as a matter of personal character. There are both ethical reasons and unethical reasons why an app-developer would want to know the other apps chosen by their users. On the up side, one could use the knowledge to prioritize improvements/integrations/compatibility with other apps. On the down side, one could punitively react to the presence of competing apps. Assessing the ethics of how the functionality is used requires greater openness and transparency by everyone. Unfortunately, in a culture as closed as Apple's (eg http://www.pcmag.com/article2/0,2817,2375476,00.asp http://www.pcmag.com/article2/0,2817,2375476,00.asp or https://developer.pidgin.im/wiki/WhyNoiOSVersion https://developer.pidgin.im/wiki/WhyNoiOSVersion ), you are unlikely to see that kind of openness.
rounak 11y ago
Twitter and Facebook also have similar solutions. Have they been shut down too?
- ceejayoz 11y ago
  Twitter and Facebook have extensive OS level integrations put together by Apple.
- pyre 11y ago
  "Too big to fail"
- wnevets 11y ago
  Wouldn't be surprised if they pay for the privilege.
- jwegan 11y ago
  I think at least Facebook's usage would fall under the category of facilitating inter-app communication. They just communicate with almost every app out there.
x3n0ph3n3 11y ago
Why do people continue to use MM for "million", especially outside of the context of money?
- nostromo 11y ago
  M is often used to mean 1,000 from the Roman Numeral, so using it to mean "one million" is confusing. It's not just finance, but in other contexts too, such as online marketing CPM = Cost Per Thousand. MM then is used to denote a thousand thousands, or one million. In online marketing sometimes you'll see CPMM = Cost Per Million.
  - sebastianavina 11y ago
    k is used for 1000, M for millions... damn americans.
    - killface 11y ago
      blame the brits, not the americans.
      - psykovsky 11y ago
        Can we just blame one person instead of an entire country?
        nkozyra 11y ago
        Blame Todd. Todd did this to us.
        allard 11y ago
        Blame the accountants. We're engineers et al. We use SI.
    - jeroen 11y ago
      K, not k.
strommen 11y ago
> your app uses public APIs in a manner not prescribed by Apple What an enraging way to phrase this. I understand Apple's desire to shut this down, but they make their contempt for app developers obvious at every possible turn.
- killface 11y ago
  That seems like an incredibly petty way to view it. Apple's not out to get you. In fact, I'm glad they did this. That iHasApp looks creepy as hell, and it pisses me off that other devs were using it to basically spy on me. It reduces my trust in all apps.
  - wlesieutre 11y ago
    Yeah, this reminds me of the recent(ish) realization that a javascript could check a link's applied style to determine if it had :visitied, letting advertisers trivially run test a very large list of links to fingerprint and profile anybody who visits a webpage. Mozilla patched that information leak. I don't remember anyone accusing them of "contempt for web developers." I'm no longer using iOS regularly, but the fact that Apple can and does police apps that violate a user's expectation of privacy is one of the strong points of the platform.
    - ploxiln 11y ago
      Mozilla didn't start white-listing web sites which it determined didn't snoop on the :visited property, and black list all other sites. Instead, it fixed the API.
      - wlesieutre 11y ago
        Right, they did it by blocking javascript access to computed CSS styles so that it doesn't return :visited rules. In Apple's case, the more secure options would either be "an app must include a perapproved list of which other apps are authorized to see that it is installed", or popups for permissions like "Image Editor wants to know if you have Dropbox." Since Apple has both the authority and the manpower to approve or disapprove of apps, they chose to not take either and to stick with the version that gives the best user experience, while also allowing devs to continue checking installed apps when they need to as appropriate for cross-app interaction. I guess it sucks from iHasApp's perspective, but I don't have any more sympathy for them than any other spyware developer. Just because Win32 apps aren't sandboxed and can read arbitrary data out of my home folder doesn't mean it's an OK thing to do.
deleted 11y ago
[deleted]
- andygmb 11y ago
  > Switch to blockchain tech What is "blockchain tech" in the context of mobile apps?
  - deleted 11y ago
    [deleted]
ianstallings 11y ago
The obvious lesson is that you shouldn't build a service that skirts right on the edge of "Apple definitely won't like this." Well at least you kept your sense of humor about it all. It will probably help your chances at employment (or investment of your own business) going forward. Nothing wrong with pushing the barriers a little bit.
sergiotapia 11y ago
So why is this kosher? https://support.twitter.com/articles/20172069 https://support.twitter.com/articles/20172069
- x0x0 11y ago
  one guess We will notify you about this feature being turned on for your account by showing a prompt letting you know that to help tailor your experience, Twitter uses the apps on your device. Until you see this prompt, this setting is turned off and we are not collecting a list of your apps. If you do not see Tailor Twitter based on my apps in your account settings, app graph collection is not occurring for your account. So it's opt-in with a default of off. second, some partners are more equal than others...
hellameta 11y ago
It's a shame you had to bring this down but it looks like you saw it coming and enjoyed the ride. I think the posts that characterize you as unethical are just not willing to cope with the disillusion that technology is a two sided coin. The information was there and you used it. I commend you on seizing on the opportunity and wish you best of luck in the future.
- npizzolato 11y ago
  Sorry, no. Technology is a two sided coin, mostly unable to be ethical or unethical. The people using technology, however, are surely able to fall somewhere in the spectrum. The OP is using this technology for (imo obviously) unethical reasons and is capable of being judged by that decision.
  - hellameta 11y ago
    Well I certainly don't disagree that he's capable of being judged. And you're right - it's simply my opinion that what he did was not unethical.
ascendantlogic 11y ago
I want to be outraged on your behalf over this but I can't really summon it forth. While I understand the ever-present engineer desire to "see if it can be done", no good can really come from this sort of service in my opinion. I guess chalk it up to an interesting technical exercise and that's it.
mherdeg 11y ago
Huh, how does this service's behavior differ from what the Twitter App Graph does?

104 points by danielamitay 11y ago

shiv86 11y ago

Thanks for sharing. Must be tough. But Iam sure you'll move onto bigger and better things in the future.

throwaway34234 11y ago

You are an unethical person. I'm pleasantly surprised Apple shut this down.

coreyoconnor 11y ago
I am ignorant of what iHasApp means in terms of users. Much less the ethics of it all. Why is what iHasApp did considered unethical?
- tokenizerrr 11y ago
  From https://github.com/danielamitay/iHasApp https://github.com/danielamitay/iHasApp: > The iHasApp iOS Framework allows you to detect installed apps on a user's device. Detection results can be in the form of an array of detected appIds, or an array of appDictionaries from the iTunes Search API.
  - 542458 11y ago
    I'd also bet you a coffee that you could pretty reliably uniquely fingerprint devices this way. I don't bear OP any ill will for writing iHazApp, but I can certainly see why many would be uncomfortable with it.
    - nostrebored 11y ago
      Very, very skeptical of this. Apps that people have installed tend to be similar apps.
      - function_seven 11y ago
        For some subset maybe. But I guarantee you that there is not one other person on Earth that has the same set of apps installed on their phone that I do. The chances of that are astronomically tiny.
        shampine 11y ago
        Maybe we should make an app where you put in all the apps that you have on your iPhone to find your perfect match. We'll call it appxappxappxappxappxappxappxapp.
        lucaspiller 11y ago
        You can filter it down even more by reading carrier information which you can access without permissions: http://iosdevelopertips.com/core-services/carrier-information-mobile-network-code-mnc-and-mobile-country-code-mcc.html http://iosdevelopertips.com/core-services/carrier-informatio...
      - 542458 11y ago
        I disagree. For a related piece of work, see https://panopticlick.eff.org https://panopticlick.eff.org I'm running a browser with only two (what I believe are common) add ons installed and a fairly uninteresting system config on common hardware. This is enough (combined with other "safe" metadata) to uniquely identify me! Compare this to iPhones, which frequently have dozens of apps installed and expose comparable device metadata.
- nilliams 11y ago
  Presumably parent is offended by the privacy violation. It allows developer of app A to know I have app B installed, which can be used to target adds etc.
  - deleted 11y ago
    [deleted]
  - petercooper 11y ago
    While unlikely, it could be used for worse. Let's say a local or niche publication has an app and can detect if any of its subscribers are also using Grindr, Tinder, or some sort of app that signifies, to them, some cardinal sin on the part of the subscriber. That could be used to blackmail/shame/harass people.
deleted 11y ago
[deleted]
killface 11y ago
I completely agree. This is tantamount to spying on users. It's basically equivalent to some random game reading your entire contacts list and sending it to the company.
smtddr 11y ago
I don't even think you should be surprised. I don't see how anyone could condone the privacy violation this app commits. Of course this app should be banned, should have never made it to the appstore to begin with. And the developer should be ashamed of himself. With all the discussions around the NSA & privacy these days, it's tone-deafness & insensitive for a developer not to see the obvious problems iHasApp creates.
- themartorana 11y ago
  Do you really suppose ad providers in millions of apps do anything differently? Do you think Apple's own iAd relevancy engine that allows them to charge premiums to advertisers does anything differently? It seems odd to be outraged at a practice employed by the very knight in shining armor that just shut them down.
  - deleted 11y ago
    [deleted]
tottenhm 11y ago
I share your concern that this functionality could be abused, but disagree with your attempt to treat this as black-and-white or as a matter of personal character. There are both ethical reasons and unethical reasons why an app-developer would want to know the other apps chosen by their users. On the up side, one could use the knowledge to prioritize improvements/integrations/compatibility with other apps. On the down side, one could punitively react to the presence of competing apps. Assessing the ethics of how the functionality is used requires greater openness and transparency by everyone. Unfortunately, in a culture as closed as Apple's (eg http://www.pcmag.com/article2/0,2817,2375476,00.asp http://www.pcmag.com/article2/0,2817,2375476,00.asp or https://developer.pidgin.im/wiki/WhyNoiOSVersion https://developer.pidgin.im/wiki/WhyNoiOSVersion ), you are unlikely to see that kind of openness.

rounak 11y ago

Twitter and Facebook also have similar solutions. Have they been shut down too?

ceejayoz 11y ago
Twitter and Facebook have extensive OS level integrations put together by Apple.
pyre 11y ago
"Too big to fail"
wnevets 11y ago
Wouldn't be surprised if they pay for the privilege.
jwegan 11y ago
I think at least Facebook's usage would fall under the category of facilitating inter-app communication. They just communicate with almost every app out there.

x3n0ph3n3 11y ago

Why do people continue to use MM for "million", especially outside of the context of money?

nostromo 11y ago
M is often used to mean 1,000 from the Roman Numeral, so using it to mean "one million" is confusing. It's not just finance, but in other contexts too, such as online marketing CPM = Cost Per Thousand. MM then is used to denote a thousand thousands, or one million. In online marketing sometimes you'll see CPMM = Cost Per Million.
- sebastianavina 11y ago
  k is used for 1000, M for millions... damn americans.
  - killface 11y ago
    blame the brits, not the americans.
    - psykovsky 11y ago
      Can we just blame one person instead of an entire country?
      - nkozyra 11y ago
        Blame Todd. Todd did this to us.
      - allard 11y ago
        Blame the accountants. We're engineers et al. We use SI.
  - jeroen 11y ago
    K, not k.

strommen 11y ago

> your app uses public APIs in a manner not prescribed by Apple What an enraging way to phrase this. I understand Apple's desire to shut this down, but they make their contempt for app developers obvious at every possible turn.

killface 11y ago
That seems like an incredibly petty way to view it. Apple's not out to get you. In fact, I'm glad they did this. That iHasApp looks creepy as hell, and it pisses me off that other devs were using it to basically spy on me. It reduces my trust in all apps.
- wlesieutre 11y ago
  Yeah, this reminds me of the recent(ish) realization that a javascript could check a link's applied style to determine if it had :visitied, letting advertisers trivially run test a very large list of links to fingerprint and profile anybody who visits a webpage. Mozilla patched that information leak. I don't remember anyone accusing them of "contempt for web developers." I'm no longer using iOS regularly, but the fact that Apple can and does police apps that violate a user's expectation of privacy is one of the strong points of the platform.
  - ploxiln 11y ago
    Mozilla didn't start white-listing web sites which it determined didn't snoop on the :visited property, and black list all other sites. Instead, it fixed the API.
    - wlesieutre 11y ago
      Right, they did it by blocking javascript access to computed CSS styles so that it doesn't return :visited rules. In Apple's case, the more secure options would either be "an app must include a perapproved list of which other apps are authorized to see that it is installed", or popups for permissions like "Image Editor wants to know if you have Dropbox." Since Apple has both the authority and the manpower to approve or disapprove of apps, they chose to not take either and to stick with the version that gives the best user experience, while also allowing devs to continue checking installed apps when they need to as appropriate for cross-app interaction. I guess it sucks from iHasApp's perspective, but I don't have any more sympathy for them than any other spyware developer. Just because Win32 apps aren't sandboxed and can read arbitrary data out of my home folder doesn't mean it's an OK thing to do.

deleted 11y ago

[deleted]

andygmb 11y ago
> Switch to blockchain tech What is "blockchain tech" in the context of mobile apps?
- deleted 11y ago
  [deleted]

ianstallings 11y ago

The obvious lesson is that you shouldn't build a service that skirts right on the edge of "Apple definitely won't like this." Well at least you kept your sense of humor about it all. It will probably help your chances at employment (or investment of your own business) going forward. Nothing wrong with pushing the barriers a little bit.

sergiotapia 11y ago

So why is this kosher? https://support.twitter.com/articles/20172069 https://support.twitter.com/articles/20172069

x0x0 11y ago
one guess We will notify you about this feature being turned on for your account by showing a prompt letting you know that to help tailor your experience, Twitter uses the apps on your device. Until you see this prompt, this setting is turned off and we are not collecting a list of your apps. If you do not see Tailor Twitter based on my apps in your account settings, app graph collection is not occurring for your account. So it's opt-in with a default of off. second, some partners are more equal than others...

hellameta 11y ago

It's a shame you had to bring this down but it looks like you saw it coming and enjoyed the ride. I think the posts that characterize you as unethical are just not willing to cope with the disillusion that technology is a two sided coin. The information was there and you used it. I commend you on seizing on the opportunity and wish you best of luck in the future.

npizzolato 11y ago
Sorry, no. Technology is a two sided coin, mostly unable to be ethical or unethical. The people using technology, however, are surely able to fall somewhere in the spectrum. The OP is using this technology for (imo obviously) unethical reasons and is capable of being judged by that decision.
- hellameta 11y ago
  Well I certainly don't disagree that he's capable of being judged. And you're right - it's simply my opinion that what he did was not unethical.

ascendantlogic 11y ago

I want to be outraged on your behalf over this but I can't really summon it forth. While I understand the ever-present engineer desire to "see if it can be done", no good can really come from this sort of service in my opinion. I guess chalk it up to an interesting technical exercise and that's it.

mherdeg 11y ago

Huh, how does this service's behavior differ from what the Twitter App Graph does?