Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple starts rejecting apps with “hot code push” features

forums.developer.apple.com

Post reply on HN
Print view View original

91–100 of 498 posts

Re: Apple starts rejecting apps with “hot code push” features

#91

Post by tedd4u »

mahyarm wrote: post #82
Retr0spectrum wrote: post #51

Earlier quoted context omitted.

That's actually quite a clever workaround to the current rules, but rather naive of them to think Apple wouldn't fight back at some point.

It's really sad, because that kind of stuff lets you fix bugs / mitigate outages in the wild without having to wait on apple's schedule.

This is true. The problem is bad actors can use this to bypass Apple's review. As an iOS app publisher I slightly regret this inconvenience. As an iPhone user, I appreciate Apple looking out for my security.

Re: Apple starts rejecting apps with “hot code push” features

#92

Post by jeswin »

dilipray wrote: post #76

"Hi there -- I believe that title isn't quite accurate; Apple specifically is referring to behavior of a library called Rollout which lets people dynamically inject Objective-C/Swift. They are doing hot delivery of native, Objective-C code. It's really not about React Native nor Expo. Expo (and the React Native library we use) doesn't do any of that. We also make sure we don't expose ways to dynamically execute nativ…

The problem with Apple that you and your customers need to be aware of (or concerned about), is that once a number of your customers sidestep Apple policies w.r.t. pushing or changing features via JavaScript, Apple will change their policies to close that loophole. It's only a matter of time before companies take advantage of this path to sidestep app store approvals.

Re: Apple starts rejecting apps with “hot code push” features

#93

Post by teknologist »

dilipray wrote: post #76

"Hi there -- I believe that title isn't quite accurate; Apple specifically is referring to behavior of a library called Rollout which lets people dynamically inject Objective-C/Swift. They are doing hot delivery of native, Objective-C code. It's really not about React Native nor Expo. Expo (and the React Native library we use) doesn't do any of that. We also make sure we don't expose ways to dynamically execute nativ…

This appears to affect apps using JSPatch which is not pushing Objective-C but JavaScript.

Source: https://github.com/bang590/JSPatch/issues/746 (in Chinese)

Re: Apple starts rejecting apps with “hot code push” features

#94

Post by vecter »

megous wrote: post #85
Retra wrote: post #27

Earlier quoted context omitted.

All of life's problems are simple when suicide is your backup plan.

Boycott is a valid response no matter how much you try to make false analogies. Pulling app out of app store is by no means equivalent to suicide. At most you change your business.

Right, like Uber, Snapchat, Facebook, Clash of Clans, Pinterest, Whatsapp, Instagram, Twitter, Waze, Shazam, Tinder, Match, YouTube, and basically every other app out there pulling out of the App Store would not be suicide.

"At most", those companies would just have to "change their businesses".

Re: Apple starts rejecting apps with “hot code push” features

#95

Post by irontoby »

obstinate wrote: post #24
mmmBacon wrote: post #10

Seems like people have been aware of concerns about violating the TOS with these hot patch frameworks. From April 2016 >>Rollout is aware of the concerns within the community that patching apps outside of the App Store could be a violation of Apple’s review guidelines and practices. Rollout notes both on their FAQ site and in a longer blog post that their process is in compliance. https://www.fireeye.com/blog/threat-…

A ton of games do this and it is incredibly annoying. I don't want to download an update, then have to download an update. I only wish the same restriction applied to my Android device.

Neither Google nor Apple nor any other game platform is going to stop games from downloading new content. That's just how games work these days.

The reason this type of "hot code push" is more attractive on iOS is because the app review process is much longer, so publishers look for ways to skirt it. Looks like Apple is just starting to enforce it more.

Re: Apple starts rejecting apps with “hot code push” features

#96

Post by teknologist »

EGreg wrote: post #65

Does this mean all Cordova apps may be banned?

Not necessarily. From the Apple Developer Program License Agreement:

> 3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's builtin WebKit framework, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store.

Re: Apple starts rejecting apps with “hot code push” features

#97

Post by intrasight »

vecter wrote: post #94
megous wrote: post #85

Earlier quoted context omitted.

Boycott is a valid response no matter how much you try to make false analogies. Pulling app out of app store is by no means equivalent to suicide. At most you change your business.

Right, like Uber, Snapchat, Facebook, Clash of Clans, Pinterest, Whatsapp, Instagram, Twitter, Waze, Shazam, Tinder, Match, YouTube, and basically every other app out there pulling out of the App Store would not be suicide. "At most", those companies would just have to "change their businesses".

If all those companies did pull out, then it would be the end of Apple.

Re: Apple starts rejecting apps with “hot code push” features

#98

Post by adjunct »

I'm Erez Rusovsky, the CEO of Rollout.io

Rollout's mission has always been, and will always be about helping developers create and deploy mobile apps quickly and safely. Our current product has been a life saver for hundreds of apps by allowing them to patch bugs in live apps.

We were surprised by Apple's actions today. From what we've been able to gather, they seem to be rejecting any app which utilizes a mechanism of live patching, not just apps using Rollout.

Rollout has always been compliant with Apple's guidelines as we've detailed in the past here: https://rollout.io/blog/updating-apps-without-app-store/

Our SDK is installed in hundreds of live apps and our customers have fixed thousands of live bugs in their apps.

We are contacting Apple in order to get further clarification on why Rollout doesn't fall under the clause that lets developers push JS to live apps as long as it does not modify the original features and functionality of the app.

I'll post updates as I have them.

Erez Rusovsky CEO Rollout.io

Re: Apple starts rejecting apps with “hot code push” features

#99

Post by megablast »

recursive wrote: post #50
cynix wrote: post #22

Earlier quoted context omitted.

> Rollout lets you push code-level changes to native iOS apps, without waiting on the App Store. What did they expect when their entire business model is based on something that's literally the opposite of what the review guideline allows?

Uber is still doing kind of ok.

Uber isn't going up against one company though. It is going up against 1000s of governments.

Re: Apple starts rejecting apps with “hot code push” features

#100

Post by teknologist »

It seems that most people are overlooking one of the more significant points Apple have made here:

"Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app."

Source: https://github.com/bang590/JSPatch/issues/746

Post reply on HN