Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

iOS App Store - Fake Microsoft Word 2012 Approved

itunes.apple.com

Post reply on HN
Print view View original

111–120 of 123 posts

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#111

Post by saurik »

0x0 wrote: post #107
saurik wrote: post #101

Earlier quoted context omitted.

The main thing for which you seem to need correction is that you apparently do not know what the sandbox does ;P. You seem to be operating under the belief that the sandbox is a system-wide primitive, when in fact each separate process operates in its own optional sandbox. There are many processes, then, where there is no sandbox configured even on a stock iPhone . When you use Cydia (no sandbox) to install sshd (no…

Thank you for an incredibly detailed, interesting and well formulated explanation of the jailbreak process! I had the general idea that the sandbox was probably working out of some complicated rulesets a la SElinux (which I also do not know in detail, unfortunately). To clarify a few of my original mis-conceptions: * For the iBooks DRM, one of the JB tests was apparently to drop an (incorrectly signed?) exexutable an…

I had just noticed, in passing through the open tab to the link you provided, that I had not adequately explained the old iBooks-on-4.2 check. I added some clarification, and then saw that in fact you had noticed the issue now in this reply as well ;P.

It seems that Corona (the iOS 5.0.1 untether), at least, does allow an App Store application to call exec(). I am honestly not certain why that is allowed... I am, however, also not entirely certain whether that is normally disallowed: it might actually not be considered a problem by Apple.

The reason why I point out that there might actually not normally be a restriction against exec() is that I just tested using fork() on my iOS 5.0.1 iPhone 4S using Corona (Absinthe 0.4) and, in fact, you can't call that from an App Store application. (So, the sandbox works. ;P)

To test, I ran Facebook, then used `cycript -p Facebook` to inject a console into that process (using cycript, my JavaScript/Objective-C hybrid shell). I then ran `new Functor(dlsym(RTLD_DEFAULT, "fork"), "v")()` to get a reference to and call the fork system call stub from libSystem (libc).

The sandbox daemon was then asked by the kernel to verify whether that process was allowed to fork, and as it was not I got the following log message and the process was denied. (I say "denied" as it was not killed: it just got -1 from fork() with EPERM.)

Jun 18 15:00:16 Transponder sandboxd[768]: Facebook(759) deny process-fork

Moving on, your comparison to SELinux is, AFAIK, fairly accurate; on Ubuntu, AppArmor is also a similar system to the Apple sandbox (and, transitively, SELinux). It should be pointed out, however, that these systems are also per-process: I can still install things on the computer and mark them "no limits".

As for your other comments, App Store applications on jailbroken devices still cannot snoop into your keychain, mail, or the data stored for other applications such as Facebook. They do have access to your camera roll, but that is true of non-jailbroken devices as well (this is fixed on iOS 6).

Finally, you are correct in that installing a .deb on your system is handing the packager the equivalent of a temporary root shell on your device: in addition to installing arbitrary code with the package (the point of installing it at all), it gets to actually run scripts as root during the (un)installation itself.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#112

Post by Samuel_Michon »

macuenca wrote: post #102

Seems to be already removed, at least that's what I see from Europe with a U.S. account. Remember that whatever amount of money is this publisher making, Apple is taking a 30%. Maybe they don't put too much effort on their side on purpose, just saying.

Apple breaks even on app sales, and has done so for years. The 30% of paid apps is used for developing the Xcode software and SDK, evaluating app submissions, advertising, affiliate programs, payment processing, storage and bandwidth.

Also remember, Apple pays the storage and bandwidth for all the free apps, which devs can submit for free.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#113

Post by taligent »

debacle wrote: post #100
tikhonj wrote: post #99

Earlier quoted context omitted.

Yes! But also convince everybody else not to buy iOS devices so that the market gets Apple to improve its behavior.

While I'm not at all for curated computing, I don't think some people are ever going to care about how locked down their devices are.

Of course not.

Far too many geeks have this innate delusion that people are like them. That they care about side loading apps, open source freedom, other browser rendering engines, jail breaking etc. Most people just see this as introducing complexity and unnecessary choices.

Perhaps the problem is in how these are articulated.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#114

Post by 0x0 »

saurik wrote: post #111
0x0 wrote: post #107

Earlier quoted context omitted.

Thank you for an incredibly detailed, interesting and well formulated explanation of the jailbreak process! I had the general idea that the sandbox was probably working out of some complicated rulesets a la SElinux (which I also do not know in detail, unfortunately). To clarify a few of my original mis-conceptions: * For the iBooks DRM, one of the JB tests was apparently to drop an (incorrectly signed?) exexutable an…

I had just noticed, in passing through the open tab to the link you provided, that I had not adequately explained the old iBooks-on-4.2 check. I added some clarification, and then saw that in fact you had noticed the issue now in this reply as well ;P. It seems that Corona (the iOS 5.0.1 untether), at least, does allow an App Store application to call exec(). I am honestly not certain why that is allowed... I am, how…

Neat! Thanks again for the super-detailed clarifications!

Going back to my comment that started this sub-thread, I guess the point then still stands, "Too bad there's no way to side-load unsigned (or signed by a custom CA) apps while still maintaining the sandbox restrictions." (i.e. no "safe thirdparty appstores") ;)

[quick note on the camera roll thing, I think apps are denied access before the user confirms a location permission popup]

[another quick note on the exec() thing, exec() probably wouldn't work since appstore codesign only works on a single binary. probably related to why only static libraries are allowed, too]

[edit: the fork/exec thing may also be tied in to the strict limitations on background processing for appstore apps? interesting to see your cycript experiment there!]

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#115

Post by MartinCron »

Samuel_Michon wrote: post #86
MartinCron wrote: post #72

Earlier quoted context omitted.

You should ask Mike Daisey to check that out for us.

Funny! I prefer non-fiction. http://www.newyorker.com/online/blogs/evanosnos/2012/03/mike... http://www.theatlantic.com/international/archive/2012/03/the...

Yeah, it was meant a joke, but either people didn't get it, or people don't like it. I should know better than to try to be funny.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#116

Post by taligent »

ajays wrote: post #64
saurik wrote: post #25

Apple, just a few days ago, also approved (and pulled once there was a lot of online press being caused by it) a fake Cydia. (Cydia is the alternative to the app store that distributes substrate extensions for jailbroken devices.) A bunch of people bought it and then left reviews saying that they had been ripped off. http://cache.saurik.com/tinyimg/cydiascam.png

Maybe it's because it is in Apple's interest to get people pissed off at Cydia?

Or more reasonably one of the people reviewing the apps had never heard of Cydia.

Remember the reviewers are the equivalent of tele-sales positions. They aren't necessarily from technical backgrounds.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#117

Post by falling »

padraigm wrote: post #106
falling wrote: post #98

Earlier quoted context omitted.

I can't comment on the other options because I haven't investigated enough yet, but people should definitely stop suggesting SL4A as a viable option to developing Android apps. It's not.

Due to the fact that you have to either assume users already have SL4A installed on their systems, or package it with your app, it's certainly not an ideal solution for developing a typical Android Market app. There are definitely a lot of specialized applications that it is well suited to address though, and it can also be useful to quickly prototype a tech-demo for an app that will later be fleshed out in Java or o…

Prototypes, sure, but people always mention it to say “You can write apps in Python on Android”. That’s simply not true.

SL4A is kinda like PhoneGap: you can use it, but you will not get a quality app out of it. That might be fine for your use case, but it’s definitely not on par to using the canonical platform.

Other quick notes: The last commit on the Scala for Android project is from two years ago and says “add 2.2 support”, the related blog post is from one year ago. Same deal with Android ObjC: last commit April 2010. I would never trust either of these for production development.

I’m sorry but languages other than Java and C++ for Android development are closer to vaporware than reality right now. The only good alternative is Mono http://xamarin.com/monoforandroid which is actually working and supported and not a forgotten weekend hack.

Please note: I’m perfectly fine with Java.

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#118

Post by saurik »

jrockway wrote: post #105
saurik wrote: post #60

Earlier quoted context omitted.

To quickly follow up on your aside regarding how this might work for copyright issues (as opposed to for trademarks): the DMCA procedures do not apply to Apple due to their specific curation: they have forfeited any possible safe harbor protections, and the procedure for dealing with them is not simply a take down notice. Thereby, if you have an issue with an app in the App Store, you can and probably should (as in,…

I highly doubt that curating the market removes the safe harbor immunity. They are no longer a common carrier, perhaps, but that's orthogonal to the DMCA safe harbor.

I appreciate your doubt, but am having a difficult time matching it up with the law. In specific, the DMCA safe harbor provisions only apply to entities that can be called "service providers", and Apple's prior-to-posting editorial control over the contents of their catalog then seems to be incompatible with the definitions that are laid out in USC § 512. Apple, playing the role of online retailer, thereby seems to be every bit as responsible for the content of their App Store as if they were to be hand-compiling printed catalogs of products for their own mail-order company for which they stocked their own inventory.

In comparison, Google pulls some ludicrous stunts to maintain separation: developers sign up separately for a payment merchant account (yes, also from Google ;P) and are legally responsible for things like their own sales tax collection (yes, this is insane). Google, then, attempts to claim that they are just a mechanism to allow direct-from-developer-to-user sales of products, and that their catalog is nothing more than web hosting. (This also has the horrible side effect, of course, that even if someone at Google has reason to believe something is sketch in their store, they have to not touch it and wait for something to come through channels.)

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#119

Post by ajarmoniuk »

MartinCron wrote: post #73
hogu wrote: post #67

reminds me of The Asylum film studios - they do the same thing, except for movies. I've been tricked into renting their movies instead of the real ones before, when I had forgotten the correct title. http://en.wikipedia.org/wiki/The_Asylum

Yes! I went from very confused to very angry when I watched "Battle Of Los Angeles" on Netflix streaming thinking it was "Battle: Los Angeles". And that didn't cost me anything (other than the 20 minutes wasted before I realized I had been tricked).

To be true, this mockup movie was not much worse than the "original".

Re: iOS App Store - Fake Microsoft Word 2012 Approved

#120

Post by pooriaazimi »

saurik wrote: post #111
0x0 wrote: post #107

Earlier quoted context omitted.

Thank you for an incredibly detailed, interesting and well formulated explanation of the jailbreak process! I had the general idea that the sandbox was probably working out of some complicated rulesets a la SElinux (which I also do not know in detail, unfortunately). To clarify a few of my original mis-conceptions: * For the iBooks DRM, one of the JB tests was apparently to drop an (incorrectly signed?) exexutable an…

I had just noticed, in passing through the open tab to the link you provided, that I had not adequately explained the old iBooks-on-4.2 check. I added some clarification, and then saw that in fact you had noticed the issue now in this reply as well ;P. It seems that Corona (the iOS 5.0.1 untether), at least, does allow an App Store application to call exec(). I am honestly not certain why that is allowed... I am, how…

Please consider posting this whole thread on your blog, or somewhere more accessible/searchable. Lots of interesting stuff that I'm certain have never been stated anywhere in a coherent manner, and would literally rot here, with just a handful people reading them.
Post reply on HN