Hacker News Reader

Comment by cantrip | Hacker News Reader

It's possible this was only done on Android specifically because the odds of this being picked up and the app rejected by Apple are close to 100% while the odds of that happening in Google Play are about 0%.

View on HN

haha. yeah, no. Apple catches UI issues and obvious use of private APIs. You just need the slimmest of excuses to do what you want. Like if you want to track a user's location put a location feature ANYWHERE in the app.

Also if the app is using the mic outside of the app, you'd see a big red bar at the top of your screen.

Does Apple hellban in cases where they discover someone was maliciously trying to call private APIs? How easy is it to get away with this long term?

I know places that have been doing it for years. They just tell you to stop. It's basically an arms race of them trying to figure out how you're doing it and figuring out ways to prevent them from detecting it. The app has a few million users so not sure if Average Joe would just get hellbanned.

Apologies for my laziness, but what is meant by "private API" here and why Apple does not want them to be used?

Often the private APIs are used to track users, because they allow getting identifying serial numbers from the phone.

Apple markets privacy as one of the features for the iPhone.

> Apologies for my laziness, but what is meant by "private API" here and why Apple does not want them to be used?

Private APIs are not meant for use by third-party developers. They are not publicly documented and are subject to change without warning.

They are functions (in the programming sense) that can be called by other code, but Apple reserves them for their own use. They don't necessarily have anything to do with privacy, though some of them do. The "private" refers to them not being publicly documented and not provided for developer use. Internal developers at Apple are allowed to use them, but only as appropriate. Consider a function (API) that allows one to wipe the phone. Apple doesn't want just anyone to be able to write an app that provides that feature. Same with a lot of other functionality. Other private APIs are things that Apple might someday offer to developers, but hasn't yet. For example, Apple can change the icon of its own apps (note the calendar app, which shows the current numeric month day, and the clock app, which shows the time including moving second hand) but it does not offer this functionality to developers. [Edit: I was wrong about this; see firloop's comment below.] If they did, the results could be off the rails, visually, and make the platform look bad, so I expect when they do allow this, they'll do it with a heavy review process in place... but that's just one small example. A lot of private APIs are more under the hood housekeeping stuff that you just don't want the average programmer to mess with.

The API to change an app's icon is not private (as of iOS 10.3)

https://developer.apple.com/documentation/uikit/uiapplicatio...

Oooh, nice! Thanks.

However, it's much more restricted than the functionality natch referred to. An app can only change its icon while running, and even then only with the user's explicit permission.

Private APIs are APIs that only Apple is allowed to use. They let you do stuff you're not supposed to be able to do like put stuff on the home screen, however, these days, it's mostly enforced by the security model, so you can call the private API all you want and it's not going to do anything.

They also let you do things like record what other apps, etc are doing. Think of the Linux top command, on iOS there's no real reason for an app to need to list the other processes, so you can't. However, if you want to know what apps are running on the phone this would be a very useful API to have access to.

Reply on news.ycombinator.com