Hacker News Reader

Comment by txsh | Hacker News Reader

As an iPhone user I’d like to think iOS does not allow this. However, I understand there’s a private API that allows larger companies access to functions that are not available to regular developers. It allows them access to the microphone without the red bar showing even when there’s not a call. Like others have, I’ve received ads for products spoken about near my phone but never typed into a device I own or on my router.

View on HN

iOS doesn't. Apps using private APIs are not allowed on the App Store. Apple granted Uber an entitlement for a private API, but no other app has this: https://twitter.com/chronic/status/915930211941781504

This believe based on trust to Apple, not on technical limitations. I always wondered about this concept of private API: available to anyone but theoretically forbidden to be used. I'm sure that there's a million ways to circumvent Apple's static code analysis and slip through their review. Why didn't Apple limit their API usage with technical restrictions.

It's pretty trivial to bypass Apples code analysis for private API usage, at least a few years ago it was.

Technical limitations == trusting Apple.

App store validation == trusting Apple.

> Why didn't Apple limit their API usage with technical restrictions.

Because this was impossible without forcing users to stop using Objective-C. The language allows dynamic method dispatch and so it's always possible to allow internal API calls.

> This believe based on trust to Apple, not on technical limitations.

I don't think you're right; “entitlement” is a technical term used for OS-enforced permissions on Apple platforms.

>This believe based on trust to Apple, not on technical limitations.

I trust Apple a lot more than Google/Facebook/etc.

It's the same when developing for PS4/X1 - headers have methods which are not documented and you're not allowed to use them - if you do, the game will fail certification. I guess they just check if the executable is linked against them and won't certify the game.

It is technically impossible to do what you are suggesting, otherwise many apps would already be doing it. If there any documented and known issues with the app validation process, please share links.

Why is it technically impossible? Move functionality to kernel or to another blessed process and restrict interface via sysctls or any kind of RPC. It's like using SQL from JavaScript and forbid users to open developer console.

In the comment thread you linked to the author has a “faint recollection” of what I’m referring to, confirms Facebook has special access because of iOS integration.

So I’m not sure why you posted that. Seems to undermine your argument.

> Like others have, I’ve received ads for products spoken about near my phone but never typed into a device I own or on my router.

I've had this experience, and I still suspect it's likely to be confirmation bias. Chances are if you're speaking about something, there's a decent chance Facebook can figure out your likely interest in it in a variety of surprising and convoluted ways - your recent credit card purchases, news articles that may have mentioned it in passing, etc.

We also don't really notice all the times Facebook totally whifs a recommendation.

do you have any citations to back this up? that’s a serious claim. Huge breach of trust by Apple if true.

Then download your data file and see. I don’t think FB has this data from iPhone users, but I’d be happy admit I was wrong if you proved it.

If you are talking about the NSA, yes they do have a special channel with Apple... not sure who else does...

With iOS we have to trust/hope that Apple is doing the right thing. With Android we can audit the code. Yes, the early permissions model left a lot to be desired, and was subsequently revised. But we could always look at the OS source to see where things might be leaking. Unless, of course, these things are happening in the Google Framework level, at which point, we have to trust/hope that Google is doing the right thing.

You can audit Android and see that it leaks like a sieve. Ever seen “read phone state and identity”?

I'll take your word for it, but my point is that you _can_ audit it. You can't audit iOS.

Well, you can’t audit the proprietary hardware drivers most android manufacturers use or the many proprietary apps from google etc that sit on top of android or the changes that the carriers make.

I remember when I was an Android developer dealing with several issues relating to the fact that one carrier put a proxy in the networking stack.

Here is a recent example:

https://www.theregister.co.uk/2016/11/15/android_phoning_hom...

You can audit iOS. Security researchers do it all day long.

audit the code?

Unfortunately more and more functionality has been moved into the closed-source Google Framework over the past few years. Some of this is a result of Android's terrible update situation: the only way for Google to get new software to many Android users is through software they can update, unlike the OS which OEMs control. But the fact that Google hasn't open sourced the Google Framework tells a lot about how "open source" Android really is. I wish we had a decent open source phone OS out there, since I don't trust Apple to produce good software (and increasingly, hardware) and I don't trust Google... well, I just don't trust Google. Our current duopoly is a pretty awful situation for consumers.

AOSP is a far cry from Android. You can audit Chromium too, but in the transition to Chrome you have no idea what they changed.

Reply on news.ycombinator.com