News for hackers. Stuff that matters.
Re:Apple starts rejecting apps with “hot code push” features by abcd_f on Wednesday March 08, 2017 @02:37AM (#13818641)
> Oh man. You were surprised? Really?

Exactly!

Apple has always been adamant that they see _all_ code that goes onto devices. Live patching is so bloody obvious against their EULA.

Re:Apple starts rejecting apps with “hot code push” features by wolfgke on Wednesday March 08, 2017 @07:28AM (#13819760)
What is "code"? Everybody who has programmed in LISP or Scheme knows that there is no essential distinction between code and data (only many programming languages make it a little hard to see that it is all the same). Thus Apple would have to see not only all code, but also all data that goes onto the devices. But this would imply that Apple disallows all apps that read data from a foreign (i.e. at least not Apple-controlled) server if one does not want to get into a self-contradiction.
Re:Apple starts rejecting apps with “hot code push” features by Spivak on Wednesday March 08, 2017 @11:55AM (#13821493)
Which is why you're not allowed to use a Lisp interpreter or use any method of evaluating data as code. In this model the only thing that data can do is change which code paths run, not what they do.
Re:Apple starts rejecting apps with “hot code push” features by cortesoft on Wednesday March 08, 2017 @12:42PM (#13821887)
Changing a code path is the same as changing what they do.
Re:Apple starts rejecting apps with “hot code push” features by nevir on Wednesday March 08, 2017 @09:24PM (#13826358)
They do allow things like pushing updated JS bundles to react native apps. My guess: RN constrains the surface area of the native API it comes into contact with (e.g. no performSelector, or similar)
Re:Apple starts rejecting apps with “hot code push” features by kazinator on Thursday March 09, 2017 @03:38PM (#13833330)
That characterization isn't enough to distinguish a Turing complete interpreter from something that trivially manipulates an input datum. An interpreter is just a program containing code paths, which are activated in response to the input (the interpreted code).
Re:Apple starts rejecting apps with “hot code push” features by wolfgke on Friday March 10, 2017 @06:14AM (#13837773)
> That characterization isn't enough to distinguish a Turing complete interpreter from something that trivially manipulates an input datum. An interpreter is just a program containing code paths, which are activated in response to the input (the interpreted code).

It is surprisingly simple to make an interpreter that is "accidentally" Turing complete (this IMHO so often happens by accident that I love to say that if an interpreter is not "obviously" more restricted than a Turing machine, it probably is Turing complete).

This is not just my opinion - there lots of pages in the internet of things that are "accidentally" Turing complete, for example:

http://beza1e1.tuxen.de/articles/accidentally_turing_complet...

https://www.gwern.net/Turing-complete

Re:Apple starts rejecting apps with “hot code push” features by st3v3r on Wednesday March 08, 2017 @12:36PM (#13821833)
"What is "code"?"

Apple has decided that, and you're not going to get around their policies with a clever rhetorical question.

Re:Apple starts rejecting apps with “hot code push” features by zodiac on Wednesday March 08, 2017 @08:15PM (#13825840)
So what is Apple's decision about what code is?
Re:Apple starts rejecting apps with “hot code push” features by st3v3r on Friday March 10, 2017 @01:36PM (#13840867)
When it comes to what's run on their platform, yes.
Re:Apple starts rejecting apps with “hot code push” features by zodiac on Saturday March 11, 2017 @12:16AM (#13844351)
I didn't ask a yes/no question, I asked what apple's decision was
Re:Apple starts rejecting apps with “hot code push” features by wolfgke on Wednesday March 08, 2017 @01:41PM (#13822485)
> "What is "code"?"

> Apple has decided that, and you're not going to get around their policies with a clever rhetorical question.

Apple cannot change mathematical facts by "decisional" rhetoric.

Re:Apple starts rejecting apps with “hot code push” features by paddyoloughlin on Wednesday March 08, 2017 @01:44PM (#13822507)
Apple doesn't need to change mathematical facts, they just don't let you publish on their AppStore.
Re:Apple starts rejecting apps with “hot code push” features by st3v3r on Wednesday March 08, 2017 @02:30PM (#13822938)
They're not changing anything. They're deciding the rules for their platform.
Re:Apple starts rejecting apps with “hot code push” features by elldoubleyew on Wednesday March 08, 2017 @12:18PM (#13821677)
So if I have an imbeded webpage inside of my app and that website is updated do I suddenly violate the EULA. What if its a social media app that provides users the ability to write custom HTML/CSS/JS to personalize their profiles and a user writes a game that runs in the header of that profile. What if that game suddenly allows the ability to access copyrighted material?

I just don't understand how Apple is supposed to draw a line here.

Re:Apple starts rejecting apps with “hot code push” features by prh8 on Wednesday March 08, 2017 @01:16PM (#13822243)
Web apps are fine, I believe the issue is Apple wants to prevent apps from updating their Objective-C code. Anything run by WebKit is fine. From the Rollout page linked above:

> With Rollout’s SDK you can update and modify your Objective-C methods with logic written in JavaScript so we’re good on the first condition.

I think that is the problem with Rollout.

Re:Apple starts rejecting apps with “hot code push” features by mahyarm on Wednesday March 08, 2017 @02:53AM (#13818704)
They don't 'see' the code. They run a program on the binary for some obvious checks and do a QA smoke test of the app itself.
Re:Apple starts rejecting apps with “hot code push” features by andyjohnson0 on Wednesday March 08, 2017 @04:05AM (#13819007)
They also run a static analysis on the binary to check for, amongst other things, use of private APIs. It is presumably fairly easy for them to detect the presence of third-party SDKs like rollout.io from their binary signature.
Re:Apple starts rejecting apps with “hot code push” features by huhtenberg on Wednesday March 08, 2017 @03:15AM (#13818791)
You are thinking "source code".

"Code" is another term for what you are referring to as "binary".

Re:Apple starts rejecting apps with “hot code push” features by DaiPlusPlus on Wednesday March 08, 2017 @04:00AM (#13818982)
Recently Apple added (and actively encourages) the ability for developers to upload bytecode to the App Store instead of ARM binaries so Apple can more easily dynamically recompile for new architectures and optimisations. Of course bytecode is considerably easier to revert back into readable source-code (especially as Swift/ObjectiveC retain (some) symbol names in compiled output) - so it's not outside the realm of possibility that an unscrupulous Apple team is disassembling cool apps to see how they work then re-implement them for the next release of iOS.
Re:Apple starts rejecting apps with “hot code push” features by averagewall on Wednesday March 08, 2017 @04:30AM (#13819102)
Can you identify a type of app for which reverse engineering it would be easier than writing their own? Software is usually easier to write than to read. If an app has such a magic secret sauce, and it's of value, then it should be protected by patent or copyright anyway.

An example that comes to mind is a high speed image compression app for taking rapid sequences of photos. Apple bought the company or the rights so they could include it themselves.

Re:Apple starts rejecting apps with “hot code push” features by beobab on Wednesday March 08, 2017 @06:06AM (#13819477)
In my experience, it's always been easier for me to implement something once I've seen a working example of it. That's basically what examples are for: A "cheat sheet" for reverse engineers.

Software is only easier to write than read if you have an idea what it's supposed to do. If you've ever googled "how do I do X?", then you likely have reverse engineered the answer you found to fit your particular use case.

In addition, and in some countries, you can't patent software (thankfully), and so innovation comes through reverse engineering naturally.

Re:Apple starts rejecting apps with “hot code push” features by philwelch on Thursday March 09, 2017 @02:06AM (#13827613)
And how many of those working code examples came from decompiled code?
Re:Apple starts rejecting apps with “hot code push” features by emdowling on Wednesday March 08, 2017 @05:21AM (#13819289)
I really don't think Apple, with it's war chest, is actively disassembling code to steal it. As has been demonstrated time and time again, they will just buy companies that have awesome tech and IP. Far easier.
Re:Apple starts rejecting apps with “hot code push” features by htk on Wednesday March 08, 2017 @07:40AM (#13819814)
Or they can just "sherlock" them. Happened several times.
Re:Apple starts rejecting apps with “hot code push” features by st3v3r on Wednesday March 08, 2017 @12:38PM (#13821848)
No. Apple has plenty of experience doing that themselves, without that. There's a reason the term "Sherlocking" exists.
Re:Apple starts rejecting apps with “hot code push” features by sametmax on Wednesday March 08, 2017 @03:07AM (#13818759)
Unless you are Facebook or Google. Then it's fine and you get a free pass.
Re:Apple starts rejecting apps with “hot code push” features by threeseed on Wednesday March 08, 2017 @03:22AM (#13818824)
To some extent yes but often no.

Apple has close relationships with those companies so it's often a case of them reaching out to the developers rather than just blinding rejecting the app.

But any idea that Apple would allow them to run ruff shot over the platform and do whatever they wanted is a bit ridiculous.

Re:Apple starts rejecting apps with “hot code push” features by pjc50 on Wednesday March 08, 2017 @04:49AM (#13819169)
> ruff shot

"Rough shod", before we get another mondegreen propagating across the internet.

Re:Apple starts rejecting apps with “hot code push” features by cat199 on Wednesday March 08, 2017 @10:20AM (#13820810)
As a case of point - as a matter in fact For all intensive purposes this article peaked my interest because by in large it addressed a deep ceded issue with app updates
Re:Apple starts rejecting apps with “hot code push” features by ryandrake on Wednesday March 08, 2017 @10:54AM (#13821045)
Thank you! As a fellow "Correct Idiom Usage Nazi" that made my day. Have an upvote :)
Re:Apple starts rejecting apps with “hot code push” features by retbull on Wednesday March 08, 2017 @12:26PM (#13821739)
Holy crap its `deep ceded` not `deep seated`?
Re:Apple starts rejecting apps with “hot code push” features by xsmasher on Wednesday March 08, 2017 @01:29PM (#13822364)
No - the comment was full of intentional errors. "matter in fact" "For all intensive purposes" "peaked my interest" "by in large" "deep ceded"
Re:Apple starts rejecting apps with “hot code push” features by Cpoll on Wednesday March 08, 2017 @12:52PM (#13821989)
No, the reply was filled with eggcorns / mondegreens, i.e. misheard idioms.
Re:Apple starts rejecting apps with “hot code push” features by spudlyo on Wednesday March 08, 2017 @12:23PM (#13821707)
Heh, nice! I'm a big fan of eggcorns[1] and your post is positively teaming with them!

[1]: http://eggcorns.lascribe.net

Re:Apple starts rejecting apps with “hot code push” features by jacobolus on Wednesday March 08, 2017 @05:42AM (#13819380)
To be more precise, the idiom is typically “ride roughshod over” rather than “run ...”, and roughshod is typically written as one word.

Roughshod means the horseshoes have their nails sticking out the bottom to help prevent slipping, so you can imagine trampling someone with those could be painful.

Re:Apple starts rejecting apps with “hot code push” features by throwanem on Wednesday March 08, 2017 @06:05AM (#13819469)
Horses are heavy. Being trampled by one is going to be injurious or lethal regardless of whether or how it is shod. (Most horses will go far out of their way to avoid trampling a human, though; cavalry horses had to be carefully trained into it. Treading deliberately on one's foot is another matter, but, like some humans, some horses are just assholes.)

The idiom refers more to what a roughshod horse will do to a road or trail surface; the nailheads dig in and scatter surface material every which way, leaving behind a hell of a mess that'll turn to deep slush or sticky mud, depending on the temperature, with the next precipitation.

Re:Apple starts rejecting apps with “hot code push” features by joshuahutt on Wednesday March 08, 2017 @06:24PM (#13824983)
I always thought they were Eggcorns.

http://eggcorns.lascribe.net/

Re:Apple starts rejecting apps with “hot code push” features by akmarinov on Wednesday March 08, 2017 @04:29AM (#13819097)
Except for the time when Facebook did it (and still does). They use private apis to monitor user activity even while the app isn't running and collect all sorts of data that others don't have access to like wi-fi SSID and device MAC address. But what's Apple going to do - not have Facebook on iOS?
Re:Apple starts rejecting apps with “hot code push” features by Operyl on Wednesday March 08, 2017 @07:18AM (#13819722)
Err, as far as I know collecting the SSID is a public API.
Re:Apple starts rejecting apps with “hot code push” features by tomasf on Wednesday March 08, 2017 @05:03AM (#13819218)
CNCopyCurrentNetworkInfo gives any app network info, including the SSID.
Re:Apple starts rejecting apps with “hot code push” features by wlesieutre on Wednesday March 08, 2017 @09:58AM (#13820622)
Does this still work? A cursory googling says it was deprecated in iOS 9 betas but may have been re-enabled?
Re:Apple starts rejecting apps with “hot code push” features by larkost on Wednesday March 08, 2017 @12:58PM (#13822059)
Depreciated is not removed. Apple is usually very conscientious about depreciating things, then waiting a while before removing them. In some cases they have gone to great lengths... for example the now 5 year depreciation of OpenSSL: first they marked it depreciated, which generates a compiler warning, then after a few years they removed the headers from the MacOS SDK so you couldn't compile new software but left the binary in place so that old software would continue to work. The next step will probably be to remove that binary, something I would expect in MacOS 10.13 (sometime this year) or 10.14 (presumably next year).
Re:Apple starts rejecting apps with “hot code push” features by wlesieutre on Wednesday March 08, 2017 @06:06PM (#13824834)
Poor choice of words then, it was deprecated and removed over the course of iOS 9 betas, with the plan to make a new system only available to "captive network apps" that could declare a specific list of SSIDs that they manage. Appears they backtracked though? I didn't see any recent info.
Re:Apple starts rejecting apps with “hot code push” features by sametmax on Wednesday March 08, 2017 @04:23AM (#13819074)
It's not ridiculous, they have been doing it for a long time now. E.G:

Apple uses private APIs (http://sourcedna.com/blog/20151018/ios-apps-using-private-ap...) to build some of their software and reject apps doing the same, effectively killing competition.

But Google and facebook uses them because they want to create products that can compete with apple's features. E.G: https://daringfireball.net/2008/11/google_mobile_uses_privat...

Yet they are not rejected, because they are "big enough".

Re:Apple starts rejecting apps with “hot code push” features by scarface74 on Wednesday March 08, 2017 @06:58AM (#13819657)
I've never understood why developers criticize OS vendors use of "private APIs". I would go so far as to say there is no such thing as a "private API". The API is a vendors promise to consuming applications that when they call a method, a certain behavior will happen. Whatever they do behind the scenes is an implementation detail that they should be allowed to change anytime without breaking consuming applications.

Apple often uses immature frameworks internally - like the extensions framework - to to polish them or to dog food them before making them official.

Re:Apple starts rejecting apps with “hot code push” features by AdmiralAsshat on Wednesday March 08, 2017 @10:00AM (#13820639)
f.lux strikes me as a good example. f.lux came to the market first with its idea to control screen temperature. Apple decides "No, you're not allowed to do that...but that's a great idea!", kicks f.lux out of the app store, and then adds their own Night Mode into later versions of iOS, using API's only they are allowed to access.
Re:Apple starts rejecting apps with “hot code push” features by ballenf on Wednesday March 08, 2017 @10:57AM (#13821069)
I love f.lux and have a soft spot for the very nice developer couple behind the app.

That being said, it's hard to argue that Apple (or Android) shouldn't be able to set boundaries on behaviors which are only allowed to be done by the OS as a opposed to an app. Apple's tight control of device screen characteristics makes it pretty understandable that they don't want one app able to control how another app looks on the screen.

The optics of the f.lux situation is just really, really bad. But considering the f.lux never really charged, they have a claim to fame that few can match: creating a feature good enough that Apple incorporated into both iOS and MacOS (now in beta).

Re:Apple starts rejecting apps with “hot code push” features by throwaway729 on Wednesday March 08, 2017 @11:42AM (#13821392)
> It's hard to argue that Apple (or Android) shouldn't be able to set boundaries on behaviors which are only allowed to be done by the OS as a opposed to an app

It's really not. The argument for user freedoms is almost as old as software.

Re:Apple starts rejecting apps with “hot code push” features by sdenton4 on Wednesday March 08, 2017 @11:52AM (#13821475)
The delicate balance between throwing a user a rope, and throwing them enough rope to hang themselves...
Re:Apple starts rejecting apps with “hot code push” features by JulianMorrison on Wednesday March 08, 2017 @10:50AM (#13821015)
I'm guessing, from Apple's perspective, things that overlay the whole screen and alter the appearance of other people's apps (such as applying a colour cast), are essentially "white hat phishing". It makes security sense to hide this capability in the OS and not in apps.
Re:Apple starts rejecting apps with “hot code push” features by AdmiralAsshat on Wednesday March 08, 2017 @11:47AM (#13821435)
You can see, I trust, how this could lead down a monopolistic slippery slope. For instance, virus-scanning is a dangerous enterprise, given that it exposes a greater attack surface if the antivirus program is poorly written. Should Apple and Microsoft remove the ability for third-party antivirus apps to exist? How about third-party firewalls?
Re:Apple starts rejecting apps with “hot code push” features by JulianMorrison on Wednesday March 08, 2017 @11:56AM (#13821504)
I don't see that, actually, I think that's a false equivalence.

Security premise: when you are looking at Facebook, you are looking at Facebook. You are not looking at a third party app drawing over Facebook and pretending to be Facebook.

I do not see the above as a slippery slope. Phishing is a capability apps should not have. Even if they have the best of intentions.

Re:Apple starts rejecting apps with “hot code push” features by cwyers on Wednesday March 08, 2017 @01:05PM (#13822142)
> Should Apple and Microsoft remove the ability for third-party antivirus apps to exist?

Please?

...pretty please?

Re:Apple starts rejecting apps with “hot code push” features by angry_octet on Wednesday March 08, 2017 @03:29PM (#13823483)
Well, yes. Unless the AV is designed in a way that shows it doesn't increase the risk, it's just snake oil.

If MS had taken a harder line then at least hundreds of millions of people would have had faster computers... And arguably safer ones. But it would be hypocrisy for MS, given they gave us IE, ActiveX, DLLs, VB macros, etc.

Most third party firewalls are just GUIs using the OS API for filtering, not parsers written in C running in the kernel.

Re:Apple starts rejecting apps with “hot code push” features by richardwhiuk on Wednesday March 08, 2017 @03:04PM (#13823265)
There aren't third-party anti-virus on iOS....
Re:Apple starts rejecting apps with “hot code push” features by scarface74 on Wednesday March 08, 2017 @12:26PM (#13821742)
And when Apple changed the private undocumented API that allows the functionality, who should get blamed? Who do you think users will blame when previously working apps that used an undocumented function breaks with a new Os?
Re:Apple starts rejecting apps with “hot code push” features by toyg on Wednesday March 08, 2017 @09:24AM (#13820390)
> why developers criticize OS vendors use of "private APIs"

The point is not that these APIs exist; the problem is when vendors actively block others from using them, with hacks and/or policy bans. That's extremely hypocritical and anti-competitive. I can see why unofficial APIs must be discouraged (because let's be honest, developers will bitch and moan when they change -- Microsoft in particular was strong-armed into legacy support for decades by the likes of Adobe and Symantec), but it should never be an excuse to ostracize or tilt the playing field.

Re:Apple starts rejecting apps with “hot code push” features by oneplane on Wednesday March 08, 2017 @09:40AM (#13820500)
It's not about marketing, economics or other MBA-feuled non-technical ideas. It's about a software vendor saying: this is our platform, here are API's for you to use, don't go outside it.

It is perfectly reasonable, and so far, any other interpretation seems to be a skewed view to facilitate some sort of non-compliant piece of software.

Re:Apple starts rejecting apps with “hot code push” features by scarface74 on Wednesday March 08, 2017 @12:29PM (#13821772)
And the minute scores of applications break that depend on a third party library that uses an undocumented method, the OS vendor gets blamed for releasing a "buggy OS" or they have to keep buggy work arounds in their code forever like MS does.
Re:Apple starts rejecting apps with “hot code push” features by joosters on Wednesday March 08, 2017 @06:38AM (#13819592)
Of course Apple use private APIs... if they didn't, then these APIs would have no reason to exist in the first place.
Re:Apple starts rejecting apps with “hot code push” features by jamespo on Wednesday March 08, 2017 @04:42AM (#13819146)
Do you have examples more recent than 2008?
Re:Apple starts rejecting apps with “hot code push” features by sametmax on Wednesday March 08, 2017 @05:40AM (#13819368)
Those are not easy to find, it's not really something they advertise and you need somebody to publicly catch them.

The only reason I know they do is because some of my friends working on mobile video games regularly complain they can't get some features because they are private while google and facebook do. They analyzed some apps to try to copy said features and realized the unfairness of their situation.

Those are lunch chit chats, not hard facts. But they got seldom reasons to lie.

Re:Apple starts rejecting apps with “hot code push” features by froindt on Wednesday March 08, 2017 @09:31AM (#13820436)
I'm not sure if it's still the case, but I don't think you could record iPad screens at the start, though Apple demonstrated it as a possibility during their live demos.

I'm not sure if Apple made it available to other companies privately though.