News for hackers. Stuff that matters.

A comment on Electron apps cannot be submitted to the Apple store. Parent comment

Re:Electron apps cannot be submitted to the Apple store by saagarjha on Sunday November 03, 2019 @07:38PM (#21437915)
It's going to sound uncharitable, but if you're clearly being rejected for something that your dependencies is doing wrong you should make time to figure out which one it is.
[ Parent | on HN ]
Re:Electron apps cannot be submitted to the Apple store by Fr0styMatt88 on Sunday November 03, 2019 @08:15PM (#21438123)
Is it really difficult to find private API usage? Can they be searched for through static or dynamic analysis?

I don’t develop for iOS so I’m genuinely curious. Do they provide automated tools for developers to use? Or a flag that fails your build if you’re trying to call private APIs: For that matter, how are the reviewers catching these API usages?

I find it strange that a private API can be used accidentally, without something notifying the developer before they’ve gotten to the stage of submitting their app.

[ Parent | on HN ]
Re:Electron apps cannot be submitted to the Apple store by saagarjha on Sunday November 03, 2019 @08:24PM (#21438160)
> I find it strange that a private API can be used accidentally, without something notifying the developer before they’ve gotten to the stage of submitting their app.

It's difficult to use private API accidentally. However, it is possible to use a dependency that purposefully uses private API, which is what happened here.

> Do they provide automated tools for developers to use?

No.

> Or a flag that fails your build if you’re trying to call private APIs

Kinda, but that doesn't help you if your dependency is trying really hard to use that API and has been precompiled.

> For that matter, how are the reviewers catching these API usages?

They're running somewhat stupid static analysis and possibly some dynamic analysis? They don't tell you what they do but they're not very good at it and don't generally catch even basic obfuscation. However, if a human finds your private API usage and you look like you're trying to obfuscate it, they won't be nearly as lenient.

[ Parent | on HN ]
Re:Electron apps cannot be submitted to the Apple store by aaronbrager on Sunday November 03, 2019 @09:05PM (#21438380)
Yes, as indicated in the OP you can use otool to see which private APIs are being called.
[ Parent | on HN ]