Hacker News Reader

Comment by mahyarm | Hacker News Reader

It's really sad, because that kind of stuff lets you fix bugs / mitigate outages in the wild without having to wait on apple's schedule.

View on HN

This is true. The problem is bad actors can use this to bypass Apple's review. As an iOS app publisher I slightly regret this inconvenience. As an iPhone user, I appreciate Apple looking out for my security.

Apple's review isn't that useful in this case as a pre-check, it is possible to avoid it if you want. Apple review does automated code checks & a reviewer manually using your app. With that review process you can deliver executable code after the fact in any way you want and only get caught after the fact if it's even noticeable. You can even get sneaky and add some security exploit to make it look like a mistake.

It's much like the argument 'if you ban guns only criminals will have guns' and it's quite true in this case.

Given that Apple's automated review tools detect many ways in which executable code can be injected into apps, and OP's link is itself about that very thing - what you say is mostly false.

It was easy to detect because they are not to trying to hide it. They just have to check if the library exists.

it's not about apple's process being imperfect. sure, you can fool them if you try hard enough and a bad actor.

it's about damage mitigation, and shutting down a 3rd party "app-hot-fix" service is a good move.

it's harder to fool only apple, than to submit some naive looking thing and still have unmitigated access to changing its code.

Reply on news.ycombinator.com