Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Python grapples with Apple App Store rejections

lwn.net

Post reply on HN
Print view View original

11–20 of 118 posts

Re: Python grapples with Apple App Store rejections

#11

Post by josephcsible »

heavyset_go wrote: post #10

It's not just Apple that pulls shenanigans like this. Try building a Python app with PyInstaller while you have Windows Defender live scanning on, which is the default setting. You won't even be able to compile a binary without Defender preventing you from doing so. Similarly, try running the binary produced by PyInstaller with Windows Defender on. Defender will say it's malicious and won't run it. It's a bit dystopi…

It's not just Python apps. It's anything by small-time developers without expensive certificates. I once used MSVC to compile a C program that was little more than a "Hello, World", and Defender called it the Win32/Wacatac Trojan.

Re: Python grapples with Apple App Store rejections

#12

Post by lilyball »

gjsman-1000 wrote: post #2

Why can’t Apple just add “itms-services” as a forbidden URL scheme on a sandbox level? I don’t see why the App Sandbox can’t block (and isn’t already blocking) certain protocols. Heck, what if I have a malicious web frame inside my app that tries to invoke “itms-services”, similar to this Polyfill.io debacle?

The URL is likely used from within Apple frameworks for various purposes, and therefore it's possible for an app process to open the URL even without the app itself knowing about the URL.

Re: Python grapples with Apple App Store rejections

#14

Post by heavyset_go »

josephcsible wrote: post #11
heavyset_go wrote: post #10

It's not just Apple that pulls shenanigans like this. Try building a Python app with PyInstaller while you have Windows Defender live scanning on, which is the default setting. You won't even be able to compile a binary without Defender preventing you from doing so. Similarly, try running the binary produced by PyInstaller with Windows Defender on. Defender will say it's malicious and won't run it. It's a bit dystopi…

It's not just Python apps. It's anything by small-time developers without expensive certificates. I once used MSVC to compile a C program that was little more than a "Hello, World", and Defender called it the Win32/Wacatac Trojan.

> It's not just Python apps. It's anything by small-time developers without expensive certificates.

This is definitely the case and has been my experience, as well.

We live in some dark times when it comes to building and sharing anything as small developers, especially if the things you're building are free.

I stopped updating my open-source Mac apps because I can't justify the cost of jumping over artificial hurdles Apple puts in place that ensure users can't run the apps they want to use. I have other hobbies where spending money actually gives me tangible goods and benefits versus paying an arbitrary yearly tax for the privilege to build stuff that ultimately benefits Apple.

Re: Python grapples with Apple App Store rejections

#16

Post by veeti »

TillE wrote: post #9

Obfuscation seems like a great way to get your developer account suspended. I suspect Apple is doing a lot more than just basic static analysis of the binary on disk. Glad they went with a config option instead.

They are opaquely rejecting apps for just literally containing the string "itms-services" in the binary and you still give them credit for a more sophisticated analysis? Lol.

Re: Python grapples with Apple App Store rejections

#17

Post by nozzlegear »

veeti wrote: post #16
TillE wrote: post #9

Obfuscation seems like a great way to get your developer account suspended. I suspect Apple is doing a lot more than just basic static analysis of the binary on disk. Glad they went with a config option instead.

They are opaquely rejecting apps for just literally containing the string "itms-services" in the binary and you still give them credit for a more sophisticated analysis? Lol.

We can assume that a simple string search is one of the basic checks they do before moving onto more advanced checks.

Re: Python grapples with Apple App Store rejections

#19

Post by threeseed »

gjsman-1000 wrote: post #7
praseodym wrote: post #5

Earlier quoted context omitted.

I’m not sure what the big deal with the url handler is, but I can’t imagine it causing remote code execution or other actual malicious behaviour. At this point Apple seems to be using simple substring matches, so if there is any exploit vector the malware authors can circumvent the check using "itms" + "-services" or something more sophisticated like ROT13.

Which is also just why… the App Store review process claiming this is a problem doesn’t seem to make any sense. Imagine your app embeds a WebView at myapp.com/terms. It’s your Terms of Service, you show it to everyone when they sign up. Everyone clicks OK. After it’s on the App Store, you modify your WebView to include `itms-services` for some reason. You’ve just completely bypassed App Store review and gotten that U…

The review process is about Apple giving you a clear direction about what is acceptable.

There are many ways to get around their restrictions. But doing so will get you banned.

Re: Python grapples with Apple App Store rejections

#20

Post by thfuran »

threeseed wrote: post #19
gjsman-1000 wrote: post #7

Earlier quoted context omitted.

Which is also just why… the App Store review process claiming this is a problem doesn’t seem to make any sense. Imagine your app embeds a WebView at myapp.com/terms. It’s your Terms of Service, you show it to everyone when they sign up. Everyone clicks OK. After it’s on the App Store, you modify your WebView to include `itms-services` for some reason. You’ve just completely bypassed App Store review and gotten that U…

The review process is about Apple giving you a clear direction about what is acceptable. There are many ways to get around their restrictions. But doing so will get you banned.

I haven't heard anything to suggest that Apple intends the review process to give clear direction.
Post reply on HN