A Popular Mac App That Sent Users' Browsing History to China Has Been Removed

"We have forwarded your feedback to the appropriate team. Someone from that team will investigate and follow up as needed with the developer.

Because we can only share communications about an app with its developer, you will not receive updates about this matter."

It's the perfect email, they can do whatever they want, and they have an excuse why they don't need to account for it - they could let the app do whatever it want, demand it to change it's behavior or throw it out, but the one who spent considerable time researching this would never know.

Really this is just an indictment of old-school massive deep tree file organisation, and of Unix file permission being too coarse-grained for what are effectively single-user computers.

1) Apple's app review is nigh useless security theater.

2) The App Store is easily manipulated with fake reviews to boost malware.

3) Apple's approved channels for vulnerability reporting are low priority, opaque, and unresponsive.

4) Apple acts (and swiftly) only upon media attention.

https://threatpost.com/top-macos-app-exfiltrates-browser-his...

Can we talk about this problem? Amazon gets a lot of attention for questionable reviews but Apple hardly gets any backlash from consumers or the media.

I note on the relevant Apple page for developers (https://developer.apple.com/design/human-interface-guideline...) that the following guidance is given:

Ratings and reviews help people make informed decisions when considering whether to try out your app. Positive ratings and reviews can mean more downloads of your app, and customer feedback gives you insight into real world usage that helps direct future development efforts.

Delivering a great overall experience is the best way to encourage positive ratings and reviews, but it’s also important to ask for feedback at appropriate times. Keep these considerations in mind when asking people to rate your app.

Ask for a rating only after the user has demonstrated engagement with your app. For example, prompt the user upon the completion of a game level or productivity task.

Nowhere on that page are there any prohibitions against asking for five-star or positive reviews, and indeed, it's quite easy to find examples of high-profile apps asking for five star reviews, including Amazon (see example on the bottom of this page: http://leanmedia.org/amazon-removes-reviewer-emails-profiles...).

It's not hard to see the damage done by inflated or bogus user reviews: The unwary are more likely to download them, as is the case for this top-ranking utility sending browser history back to China.

What about other browsers?

The only real impact on Apple’s bottom line would be for the entire store to become so infested, relative to competitors, that people jump ship and stop buying expensive Apple hardware out of frustration. Apple is at least observant enough to avoid that; they’ve kept their store clearly better than competing stores but none of them is necessarily a great experience.

I strongly suspect that the convenience of payment processing is the primary reason for developers to put up with Apple’s too-random screening systems. If Apple were required to open up app payment processing to any number of payment services, and if they were relying on trusted 3rd parties to certify apps (perhaps based on category), we would see a very different app experience.

Distributing reviews to different authorities would also be hard. For example, if you had “security experts” handle screening for apps in a certain category, somebody could just write a sneaky app in a different, weakly-reviewed category to make it through the net into the store. Apple would almost have to create secure subsets of their entire API in line with app store categories, e.g. “you can’t even use network-access APIs for apps in this category” would be a very useful restriction. The other nice thing about this is that Apple would finally be free to not need certain expertise in-house; e.g. if you don’t have enough good people on staff who are qualified to assess the security risks of an app but you can find a trusted 3rd party that can, you can hire them to be that trusted authority and we can stop assuming that Apple is the best at handling everything by itself.