41–50 of 118 posts
Earlier quoted context omitted.
They are opaquely rejecting apps for just literally containing the string "itms-services" in the binary and you still give them credit for a more sophisticated analysis? Lol.
You’re assuming that’s all they are doing, and that it’s all they will ever do, but neither assumption is supported by any evidence. Apple is saying what test broke, not that other tests aren’t running.
Earlier quoted context omitted.
> The app installed or launched executable code. Specifically, the app uses the itms-services URL scheme to install an app. Seems like pretty clear direction to me: https://github.com/python/cpython/issues/120522
The app in question doesn't actually do any such thing, though.
But it has been known for over a decade now that Apple searches binaries for strings. They've never done runtime execution checks which would pick up you actually making such an HTTP call.
Obfuscation seems like a great way to get your developer account suspended. I suspect Apple is doing a lot more than just basic static analysis of the binary on disk. Glad they went with a config option instead.
Guideline 2.5.2 - Performance - Software Requirements
The app installed or launched executable code. Specifically, the app uses
the itms-services URL scheme to install an app.
Apple can of course be arbitrary and capricious after that point.
> Alex Gaynor suggested that the project try a an approach that Keith-Magee had not put forward inspired by Gaynor's experience with the cryptography library. The project often receives complaints that the library refuses to parse a certificate that is technically invalid, but was in wide use. He said that the policy was to accept pull requests that work around those issues ""provided they are small, localized, and generally aren't too awful"". But, he added, these patches should only be accepted on the condition that someone complains to the third party (in this case Apple), and extracts some kind of commitment that they would do something about it. He suggested that the workaround be time-limited, to give users a decent experience ""while also not letting large firms simply externalize their bizarre issues onto OSS projects"".
as a solution to the familiar problem of users wanting OSS to work around bugs in commercial software because OSS maintainers are easier to bully and they know bug reports to Megacorp go straight to a black hole.
It's not just Apple that pulls shenanigans like this. Try building a Python app with PyInstaller while you have Windows Defender live scanning on, which is the default setting. You won't even be able to compile a binary without Defender preventing you from doing so. Similarly, try running the binary produced by PyInstaller with Windows Defender on. Defender will say it's malicious and won't run it. It's a bit dystopi…
Windows isn't a platform for developers. It's a platform for normie consoomers. Isn't that obvious? If you want an engineering OS, use GNU/Linux.
It's not just Apple that pulls shenanigans like this. Try building a Python app with PyInstaller while you have Windows Defender live scanning on, which is the default setting. You won't even be able to compile a binary without Defender preventing you from doing so. Similarly, try running the binary produced by PyInstaller with Windows Defender on. Defender will say it's malicious and won't run it. It's a bit dystopi…
Windows isn't a platform for developers. It's a platform for normie consoomers. Isn't that obvious? If you want an engineering OS, use GNU/Linux.
Windows is where the users are. Not targeting it is a bad financial decision.
Why does urllib have this URL scheme anyway? If Python libraries are hard-coding knowledge about Apple proprietary stuff, then it should be no surprise that Apple may take issue with that.
Why does urllib have this URL scheme anyway? If Python libraries are hard-coding knowledge about Apple proprietary stuff, then it should be no surprise that Apple may take issue with that.
It's not just Apple that pulls shenanigans like this. Try building a Python app with PyInstaller while you have Windows Defender live scanning on, which is the default setting. You won't even be able to compile a binary without Defender preventing you from doing so. Similarly, try running the binary produced by PyInstaller with Windows Defender on. Defender will say it's malicious and won't run it. It's a bit dystopi…
Windows isn't a platform for developers. It's a platform for normie consoomers. Isn't that obvious? If you want an engineering OS, use GNU/Linux.
Earlier quoted context omitted.
It's not just Python apps. It's anything by small-time developers without expensive certificates. I once used MSVC to compile a C program that was little more than a "Hello, World", and Defender called it the Win32/Wacatac Trojan.
Defender calls anything Wacatac. Ironically I've seen tons of actual malware that doesn't even give the slightest warning.