Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple starts rejecting apps with “hot code push” features

forums.developer.apple.com

Post reply on HN
Print view View original

121–130 of 498 posts

Re: Apple starts rejecting apps with “hot code push” features

#121

Post by tluyben2 »

euyyn wrote: post #67
amluto wrote: post #56

Earlier quoted context omitted.

> The second is using hot code push to violate app store review guidelines, like the use of private APIs. I've never understood this part. Why doesn't iOS simply prevent apps from calling private APIs?

Preventing it in a technical way is far from easy: If your app calls public API X, which as part of its implementation calls private API Y, your compiler only needs a declaration of Y to output the function call / ObjC message send. Nothing in the language prevents it, and the code is executed natively unlike Java.

They control the software and the hardware though: seems possible to allow a specific region of memory (aka their public API) to call a specific region of memory (private API) and segfault for all the rest that does that?

Re: Apple starts rejecting apps with “hot code push” features

#122

Post by matthewbauer »

ChuckMcM wrote: post #116
adjunct wrote: post #98

I'm Erez Rusovsky, the CEO of Rollout.io Rollout's mission has always been, and will always be about helping developers create and deploy mobile apps quickly and safely. Our current product has been a life saver for hundreds of apps by allowing them to patch bugs in live apps. We were surprised by Apple's actions today. From what we've been able to gather, they seem to be rejecting any app which utilizes a mechanism…

My guess is that somewhere in the giant dump of CIA malware there is an exploit that uses this to hijack an iPhone. They are pretty explicit about what they don't like and how it would be exploited.

An interesting theory but I kind of doubt the time between the release and this is enough for them to have identified these exploits.

Re: Apple starts rejecting apps with “hot code push” features

#123

Post by wyager »

recursive wrote: post #108
tuananh wrote: post #104

Earlier quoted context omitted.

What does Uber do?

They run an illegal taxi service. There's an app for it too.

"Illegal" doesn't mean "I have a beef with it".

Uber is legal in the vast majority of cities.

Re: Apple starts rejecting apps with “hot code push” features

#125

Post by pinaceae »

Understandable, but there is a deeper problem of course - the app store model is broken for apps that need hotfix capabilities (aka enterprise).

We've been meeting with Apple on this topic for years and continue to sideload our app as we need to meet SLAs with our customers. They sign the binaries with their dev certificates, which violates Apple's guidelines too.

But, alas, once you have critical mass in a vertical even mighty Apple gets cold feet about shutting your customers down.

Why Apple is not able to offer a separate way for certified and audited dev shops to hotfix their iOS apps is beyond me. SAP, MS, IBM - a shitload of big shops would love to pay for this privilege.

Re: Apple starts rejecting apps with “hot code push” features

#127

Post by Razengan »

rocky1138 wrote: post #2

The solution is fairly simple: just stop releasing software on that platform. There are millions of customers on more open platforms, so there's really no need to support them anyway.

As a user/consumer, I like this. It reduces potentially unpleasant "surprises."

Apple have curbed a lot of obnoxious developer practices (and enforced good ones, like the move to 64-bit not long ago) and they, along with Microsoft, probably the only ones with enough muscle to be able to do that.

Re: Apple starts rejecting apps with “hot code push” features

#128

Post by cyphar »

EduardoBautista wrote: post #118
recursive wrote: post #108

Earlier quoted context omitted.

They run an illegal taxi service. There's an app for it too.

It's legal in many cities.

It's become legal (after the fact) in several cities, and Uber has allegedly intentionally attempted to subvert attempts by law enforcement to investigate their operations.

Re: Apple starts rejecting apps with “hot code push” features

#129

Post by diminish »

Just imagine www didn't exist and Apple already had ios and apps. If someone came up with the idea of www and an app called web browser , would apple accept it in the app store? They would only accept it if they build it themselves.

At some point is there a risk that Apple may also start to ban the web browser, despite that it's under strict control on IOS?

Re: Apple starts rejecting apps with “hot code push” features

#130

Post by jsjohnst »

JohnBooty wrote: post #120
geofft wrote: post #49

Earlier quoted context omitted.

I'm guessing there are two things Apple is worried about. The first is using hot code push to change the purpose of the app after release, e.g., switching a business app into a video game. The second is using hot code push to violate app store review guidelines, like the use of private APIs. You can do hot "code" push techniques that allow the first but not the second, by letting apps update HTML and JS that calls ba…

> I'm guessing there are two things Apple is worried about. I'm sure it worries about them but there's a much larger, riskier scenario. Once you start downloading and executing binary code from untrusted sources (i.e., not the App Store) anything can go wrong. 1. An iOS app doesn't care about security, and it hot-loads code from some non-https source and gets man-in-the-middle'd 2. An iOS app hot-loads code in a secu…

> Now, I'm not a fan of Apple's policies. I think there should be a "guys, I know what I'm doing" mode where I'm allowed to download code from untrusted sources.

This exists today and has for a long time, it just costs you money for this "privilege".

Post reply on HN