Facebook says Apple is too powerful – they're right

Re:Facebook says Apple is too powerful – they're right by kec on Monday June 20, 2022 @01:04PM (#31812714)

How do you keep an application from taking an entitlement it shouldn't have (such as location or bluetooth access for fingerprinting) via code? Sandboxes can be enforced via entitlement checks in code, but the act of holding an entitlement is policy.

[ Parent | on HN ]

Re:Facebook says Apple is too powerful – they're right by hermitdev on Monday June 20, 2022 @06:12PM (#31816823)

Surely the entitlements are enforced via code on iOS, right? It cannot be on the honor system.

[ Parent | on HN ]

Re:Facebook says Apple is too powerful – they're right by kec on Monday June 20, 2022 @06:33PM (#31817050)

Using the entitlements are enforced at runtime yes, but granting them in the first place is enforced at app review time. If an app asserts an entitlement the developer can't justify it will fail review.

[ Parent | on HN ]

Re:Facebook says Apple is too powerful – they're right by sitharus on Monday June 20, 2022 @06:33PM (#31817057)

The usual way - entitlements are held in a kernel data structure, and the kernel and associated system services won't allow access to APIs when the entitlement isn't there.

Try it on iOS, if you don't have the right entitlements system API calls will fail.

[ Parent | on HN ]