Sounds like apple created it as a hack and granted the permission to Uber as a workaround to get Uber's watch app out of the door. Chances are they granted it to other apps to.

Then apple forgot to remove the premission after it was obsolete. (Either apple created an alternative method that had no security issues, or Uber had more time to create a implementation that rendered the map on the watch.)

> Chances are they granted it to other apps

Other apps were not given access.

If the entitlements system wasn't there, anyone could access "dangerous" private APIs by just using the objC runtime.

This way, only apps signed with the appropriate entitlements (usually system apps) can run those calls...

I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases

>I'd say the permission is valid (seems to be direct fb access or something similar), but should be allowed only in very specific cases

Maybe, but then the user should explictly authorize it AND it should be optional, if this is not the case, then it should not exist.

In any case, it does sound a bit shady that such permission exists at all and - according to the article - Apple "can decide" who can use it.

It seems like there are "class A" and "class B" developers rated by Apple and given (or denied) this "permission".

And only if a blue/red status bar is shown while this API is in use, and e.g. 5 seconds afterwards.

Still, Uber could detect when your phone is on the table and quickly take screenshots. This is very prone to abuse, some log should be available for auditing.

It's trendy to bash Uber.