Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Electron apps cannot be submitted to the Apple store

david.dev

Post reply on HN
Print view View original

291–300 of 441 posts

Re: Electron apps cannot be submitted to the Apple store

#291

Post by root_axis »

flukus wrote: post #271
root_axis wrote: post #224

Earlier quoted context omitted.

Is that a joke? Surely you aren't suggesting that developers should have full knowledge of all transitive dependencies that compose their application stack.

Not full knowledge. But you should know about every single dependency, know what they do and if they're from a trustworthy source. Being able to say with confidence that you aren't installing malware on your customers machines is the least you can do. On the developer side there's more though, you should know what their release cycles are like, how they manage compatibility, how long they support older releases etc.…

Knowing every transitive dependency in your application stack is totally unrealistic and is pretty much impossible for any modern commercial software outside of specialized/embedded systems.

Having knowledge of every dependency explicitly linked into your application is a basic tenet of software development that literally every software professional would endorse as a necessary best practice, but it's not what we're talking about here. I am 100% certain that every developer with a commercial Electron app is aware that they are relying on Electron as a dependency and Github as a trustworthy software vendor.

Re: Electron apps cannot be submitted to the Apple store

#292

Post by justinclift »

megous wrote: post #188
saagarjha wrote: post #68

Earlier quoted context omitted.

Of course you can! How do you think Apple's checking your binaries?

Using some internal tool.

The internal tool is very likely using/parsing otool / ldd output and similar. eg cli tooling that comes with macOS itself

Re: Electron apps cannot be submitted to the Apple store

#293

Post by justinclift »

fattire wrote: post #113
thomascgalvin wrote: post #22

The basic concept isn't too disturbing; Apple packages private APIs that have no guaranteed behavior or expectation of support. If you depend on those APIs, it's very possible that your app will break in a future OS update. This is conceptually no different than calling something in the sun.* packages in Java. For years it was ok, and then ... it wasn't. This, however, is draconian: > Continuing to use or conceal non…

> Apple has no love nor concern for their developers anymore. It used to be the premier development platform in the world. Wait a second. When was this exactly? Are you talking about the Apple II era?

There was a time, not that long ago in years, when most of the developers turning up to OSS conferences had Mac laptops of one sort or another.

Re: Electron apps cannot be submitted to the Apple store

#294

Post by de_watcher »

tracker1 wrote: post #274
rmgraham wrote: post #255

Earlier quoted context omitted.

Or only run Linux? * * (any source available OS)

GP says not to run anything you haven't looked at yourself for the most part, paraphrasing. I doubt anyone has self audited all the software and drivers going into a desktop Linux distro. The point is, at some point you stop digging

Desktop Linux distros have package maintainers and companies behind them like RedHat or Canonical.

Re: Electron apps cannot be submitted to the Apple store

#296

Post by josephg »

winkeltripel wrote: post #194
saagarjha wrote: post #66

Earlier quoted context omitted.

Hence why you should audit your third-party dependencies in cases like these.

I suspect that most devs don't do that. I can't imagine finding the time fir that.

Who do you imagine is responsible for making sure your app doesn’t contain malware?

The only answer is that as a developer, you are responsible. Yes, we have to make calculated risks. But the buck stops at you. There is nobody else who can take responsibility for the contents of your app.

Re: Electron apps cannot be submitted to the Apple store

#297

Post by dvdkhlng »

jolux wrote: post #256
heavyset_go wrote: post #159

Earlier quoted context omitted.

> Apple is at the height of their arrogance towards developers. Yep. I've migrated away from macOS after using it for a decade over to Linux, and the developer experience is first class.

is it possible to write a GUI app that looks native in all common desktop environments yet?

Qt?

Re: Electron apps cannot be submitted to the Apple store

#298

Post by bildung »

root_axis wrote: post #224
Scapeghost wrote: post #193

Earlier quoted context omitted.

> Dependencies of your dependencies! Imagine installing a library that depends on a couple dozen libraries in its own right. You may not have time to inspect every single node in the dependency graph. Excuse me, are you, the developer, telling me, a user, that you don't know what you're giving me to run on my computer?

Is that a joke? Surely you aren't suggesting that developers should have full knowledge of all transitive dependencies that compose their application stack.

> Is that a joke? Surely you aren't suggesting that developers should have full knowledge of all transitive dependencies that compose their application stack.

This will be borderline impossible for a nodejs developer, but a perfectly realistic expectation for e.g. a Django project.

Re: Electron apps cannot be submitted to the Apple store

#299

Post by toast0 »

tracker1 wrote: post #274
rmgraham wrote: post #255

Earlier quoted context omitted.

Or only run Linux? * * (any source available OS)

GP says not to run anything you haven't looked at yourself for the most part, paraphrasing. I doubt anyone has self audited all the software and drivers going into a desktop Linux distro. The point is, at some point you stop digging

GP says not to publish anything you haven't looked at (or OKed by appeal to authority). Publishing should be a higher standard than running.

Re: Electron apps cannot be submitted to the Apple store

#300

Post by toast0 »

djsumdog wrote: post #189
saagarjha wrote: post #74

Earlier quoted context omitted.

How exactly do you miss a dependency?! If it's not your code, then it's a dependency that you need to look at.

Have you never run maven, sbt, gradle on a Java project, or PHP compose or .. anything in node? There are so. Many. Dependencies in some of the frameworks people commonly use. It can get pretty insane. We all remember left-pad, right?

Yeah... Everytime I try to use something like that and it wants to pull in 10 or 50 dependencies, it's a hard no. I would rather write something from scratch than use something and potentially debug through all those layers.

If it's in my product, I'm responsible for it, so it needs to be possible for me to audit it, even if I may not be looking too closely.

Post reply on HN