Hacker News Reader

Comment by jon-wood | Hacker News Reader

This seems entirely legitimate. Facebook were using Apple's support for enterprise distribution based on having a corporate certificate on your device, designed to allow distributing internal apps that don't make sense on the App Store proper, to distribute an app to their users - presumably because they knew it wouldn't make it through the approval process for doing distribution using TestFlight, which is what is meant to be used for this sort of app release.

View on HN

Yes, this is the optimal measured response from Apple. They're treating Facebook the way they'd treat any other company that did this.

It's also a step up from the warning they gave with the whole Onovo thing. Strike two...

To be clear, this app that was just removed WAS just a reskinned Onavo app - same code and "ONV" class prefixes, etc.: https://twitter.com/chronic/status/1090394419902197761

Facebook got caught, and then they tried to use their enterprise cert to get around App Store review because they knew it would get rejected.

Pathetic.

I give it a week until Facebook starts using some sort of exploit to get Onavo onto iPhones. Probably guessing it will be a Safari exploit based on past history. That's when the real fireworks will begin.

Please elaborate on this.

Business Insider has a leaked memo and internal discussions and even many Facebook employees agree this was stupid and shooting themselves in their foot. I quote “When will we learn?”

Link: https://www.businessinsider.in/leaked-memo-facebook-scrambli...

It's really not how Apple would treat any other company. Any other company would get banned from the app store permanently.

I do agree that this is measured. The question is how long, if ever, before Apple grants them a new cert. If Apple lets them back into the Enterprise Developer Program, this is a few days of inconvenience. If they keep them out, this effectively kills their apps on the iOS app store because FB can't effectively work on the apps internally.

I do hope they'll let them suffer for a few days.

I hope they'll drag it on indefinitely, and maybe the two will have a giant war of sorts. This is one of those cases where I don't like either side, so I'm happy to see them having a destructive fight.

I hope they get an automated reply where they can apply for a new certificate and await approval. Then being put in some queue for a month.

It does not preclude test flight or just installing it through a developer machine. The vast majority of app developers don't use an enterprise account to test beta releases.

Facebook's development process for iOS (and android) is dependent on having most/all employees dogfood beta releases and report bugs that can be ignored. This breaks that pretty badly, and now users in the wild will have to report bugs before they can be ignored.

Alternatively, Facebook engineering could just, you know, test their app. Instead of moving fast and breaking things.

I imagine this is how apple would treat any company with a widely used app. Whether it was Snapchat, dropbox or Candy Crush Saga. I doubt they'll consider such a misstep reason enough to inconvenience or even harm millions of their users.

Wonder what’s gonna happen to Google and others who distribute their research apps the same way?

https://support.google.com/audiencemeasurement/answer/757381...

I’m guessing this will stop, unless Google has a special agreement in place.

I’m guessing Apple has more to lose getting in to a battle with Google. There’s a fair degree of co-dependency between the two organisations.

How so? A world without Google would have shitty search initially but would exist perfectly fine. iOS/Windows, Safari/Firefox, Apple Maps, iCloud Mail/Outlook, Vimeo already exist and soon a decent search engine would surface.

Also a significant proportion of searches are being addressed by Apple's Search service.

And Apple has shown with Maps that they are capable of building a decent competitor to Google.

Well, for one, Google pays Apple a ridiculous $12 billion a year for having Google search by default in Safari:

http://fortune.com/2018/09/29/google-apple-safari-search-eng...

I'm guessing Tim Cook is not ready to give that up in the name of "fighting for privacy." Otherwise he'd have already made DuckDuckGo the default search engine.

There's no doubt in my mind Steve Jobs would've kicked Google out, but Tim Cook is much more of a bean counter to make such a move.

There's an interesting article on Gizmodo (so please take it with a grain of salt) about trying to cut Google out of your life - long story short, it's surprisingly hard and some things you wouldn't expect will break.

https://gizmodo.com/i-cut-google-out-of-my-life-it-screwed-u...

YMMV. I mostly moved off Google for my own usage last year and deleted my paid Google Apps account (let’s ignore work usage as that’s out of my hands). Remaining services I use are YouTube (no competitor), books.google.com (occasionally, when Hathi is proving too slow) and groups.google.com (the project I mostly contribute to organises there). Of those three I could dump books.google.com without too much effort and I only interface with groups.google.com via email; moving to another provider would be totally possible if needed.

True enough. I found the things mentioned in the article interesting because you also lose things like Google Web Fonts and a number of services which depend on the Google Maps APIs for mapping.

Unfortunately, I won't be able to completely disconnect because I've got a number of friends who share photos through Google Photos (and I would like to keep access to those), a number of friends who only use Hangouts (not sure if that's better or worse than FB Messenger), and YouTube doesn't have any real competitors.

it's hard to compete with YouTube's network for content discovery, but if you're uploading/distributing video Vimeo remains a great primary service.

One of my largest problems with ridding Google from my life has been dealing with their Captchas.

Don't forget about Android OS and the Pixel phones.

Fun fact: Google searches from mobile Safari are profit-shared with Apple.

Apple runs certain aspects of iCloud on the Google Cloud Platform so there are likely to be fairly hefty contracts at stake...

Search for ‘Google Cloud’ in the following:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

However penalizing/threatening a customer of Google Cloud for something totaly unrelated would open the road to an antitrust case as huge as Google leverage on current IT sector.

PS: On the otherside migrating all services out of Google Cloud would be a technical challenge (their needs are huge) but at the end of the day a minor annoyance for Apple.

Google and others have not been flagrantly caught breaking the rules in the past and warned directly by Apple, like Facebook has.

https://techcrunch.com/2019/01/30/googles-also-peddling-a-da...

TechCrunch at least caught on.

seems like the page have been taken down?

"Sorry, this page can't be found."

But the page is still available in cache https://webcache.googleusercontent.com/search?q=cache:RqQCNF...

The page asks users to trust Google Inc.

It seems Apple have been trying to occupy the moral high ground on privacy for quite a long time now. It's relatively easy for them to differentiate themselves from the other big tech companies, because Apple's products cost so much that, for once, you are not the product.

Unless FB and Big G start charging for their services, I don't see how they can change their behaviour.

Very true, I think that even if Fb and G were to start charging it wouldn't work since people are so used to them being free

Would you even believe them? Haha

It seems Apple have been trying to occupy the moral high ground on privacy for quite a long time now

It's easy to occupy the high ground when everyone else is in the gutter.

That is a very good point.

good one.

Even if Facebook starts to charge for their service I wouldn't touch any of their properties with a ten foot pole.

I assume that they gladly take my cash to then nevertheless sell me out to the highest bidder.

They knowingly stole money from kids (via their parents credit cards) and did so knowingly and for years. They did just about everything possible to keep the stolen loot, including trying to automate their disputes on charge backs. [1]

This carcinogenic pustule of a company is unredeemable and is unable to learn anything. Money and growth is the only goal to be achieved. Fuck all consequences!

Why would I ever trust such a company with money and believe they're not lying to my face.

[1] https://www.revealnews.org/article/facebook-knowingly-duped-...

I wonder if the $20 payment was so that Facebook could plausibly claim they _were_ distributing internal apps to employees?

I'm sure "employees" is defined loosely enough in the agreement to include "contractors", and the bar there is pretty low, getting paid pretty much makes you a contractor.

Minors generally not legally able to be held to a contract.

I'd bet if you look at their internal FIN system these "employees" weren't listed as 1099 vendors.

For someone who isn't as familiar with the mobile development can you say how do beta testing services like Applause, BetaBound and uTest differ from TestFlight? Is it just that latter are verified to be compliant with the App Store's TOS?

Yes. Other testing services which rely on enterprise distribution are technically against the rules, although Apple usually turns a blind eye to them unless they're doing something actively malicious.

So are Applause, BetaBound and uTest be considered enterprise distribution then?

I have not used these services, but it's very likely that they are since that's basically how all beta testing outside of TestFlight works.

You can use Ad Hoc deployments, which is what I used to do on TestFlight before it got acquired by Apple.

This requires registering UDIDs, right?

Yes, it does. For testing, in smaller business, this is fine however as you can register up to 100 devices. Enterprise certificates were much easier to use in big enterprise thought even if they weren't really "meant" for that purpose.

Reply on news.ycombinator.com