News for hackers. Stuff that matters.

A comment on Epic, Spotify, and Tinder form advocacy group to push for app store changes. Parent comment

Re:Epic, Spotify, and Tinder form advocacy group to push for... by headmelted on Thursday September 24, 2020 @05:37PM (#24583982)
But you cant run any code you want. You’re still in a restrictive sandbox, and you still need to explicitly request the limited expansions to the permissions scope that the OS allows the user to grant you - neither of which is dependent on the App Store.
[ Parent | on HN ]
Re:Epic, Spotify, and Tinder form advocacy group to push for... by sneak on Friday September 25, 2020 @01:43AM (#24586914)
I don't believe you understood my comment. Third party app stores with more lax, less resourced app review procedures would result in arbitrary attacker code being run on end-user devices, that, given enough time, would escape the sandbox. It's a layered defense: signing/developer identity account, app store review, sandboxing, specific user-approved permissions.

No one part of it is bulletproof, as we saw with CVE-2020-3883.

[ Parent | on HN ]