Comment by mrtksn | Hacker News Reader

Comment by mrtksn | Hacker News Reader

Parent Full thread

>I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ?

I bet that it is possible to slip through the review process however there's also a safeguard on the developer account creation. Apple wouldn't let you create a developer account using vouchers, PayPal or prepaid cards, at least not from countries where scams are commonplace. Also you would be asked to provide documentation of company registration to have an account named “Develop App”.

It is a common theme on HN to trash Apple on its "draconian restrictions" but the reality is that Apple AppStore is a safe place to be. You don't have to study the App before downloading it, you first download then decide if you want to keep it and security is never a concern. The Apple tax is something I am happy to pay for that luxury.

I am a developer and I have no idea what com.acazira.tforbusiness means. What keeps it from being com.toktik.forbusiness?

On AppStore this is something that you type it by yourself on the project configuration screen in XCode and I don't remember reading any restrictions about it, only recommendation to use reverse domain name notation to prevent conflicts.

> I don't remember reading any restrictions about it

You can never change it. This is how you get com.toyopagroup.picaboo (Snapchat) or com.yourcompany.TestWithCustomTabs (AccuWeather).

Thank you for sharing. This is hilarious!

Haha, this possibly explains why the accuweather app is not the best made app ever.

This is too funny. Thanks for sharing!

Also com.joelapenna.foursquare: https://www.quora.com/What-is-the-story-of-Joe-LaPenna-and-F...

I will second this "security as a tax is well worth it" mindset, I'm a programmer, and like to think I'm security savvy, but I CANNOT babysit my non-tech-savvy wife 24/7 and having her on iphone / macbook is a weight off my shoulders as far as appstore security, as married assets are shared assets and the "weakest link" plays in the security arena...

I’m a programmer and having taken graduate classes in Security Analytics and have a hard time convincing myself that I’m security savvy.

It’s such a cat and mouse game that has massive jumps in acceleration when it comes to ‘novel’ ways attackers create new exploits.

Having Apple taking it seriously even for people like me is a huge win.

No matter how much you learn, you will still never know what you don’t know. A zero day is by definition something you don’t know and therefore we recognize that there is some futility in trying to defend against everything that ever was and all that ever will be

There's a decent case for using anomaly detection in an attempt to solve some zero day attacks. The idea of not knowing what you don't know, can be used in such scenarios. I 'know' what looks right, and I won't allow for anything that doesn't look right. That doesn't solve all problems, but can certainly cut down on a large amount of them.

What I did see a lot of though in a lot of the case studies/readings/etc, was seemingly anytime advancements were made in one area, closing off particular patterns or styles of exploitation. The energy and resources often would switch to another domain, and there's a mad scramble to solve it.

Just my two-cents, and a bit off topic.

> I 'know' what looks right, and I won't allow for anything that doesn't look right.

The way I view it, it's sort of like when a player glitches themselves outside of the boundaries of the level in a video game and are able to bypass all the battles the game has in store for them and walk directly to the objective. Anomaly detection only works if they are playing inside the realm of the system but if something manages to break out of the sandbox then detection can be bypassed because it was never a condition thought possible and therefore not checked for.

For Example, you can have code to detect abnormal requests http requests, but if there is a vulnerability in a webserver's memory management of reading bytes from a socket then it allows the attacker to "breakout" of the system before you can detect it. Now you might be saying well we can detect when they breach memory but it just creates another cat and mouse game at a different level. This all assumes there are no bugs in the anomaly detection systems themselves

Apple takes it more seriously than the Windows teams do, sure.

That's not to say Apple is perfect. Their "root"/"" login bypass zero-day was absolutely unacceptable, even compared with Microsoft's problems.

Other than that, I'd trust an Apple device over a windows device any day of the week.

That's a key part of the security landscape that many techie users just don't seem to get. Maybe you'd like to be able to run your own code natively without jumping through a bunch of hoops, and distribute code you wrote without it having to be blessed by some megacorp that might not care too much about you. And maybe you're doing nothing but good and useful things when you use those abilities.

But there are a ton of bad actors out there who will also use those abilities to scam and steal. You can stereotype it as only clueless users falling for that, and there's even a little truth to it, but 1. Some are quite good and nobody is perfect, you can still get scammed yourself, and 2. It seems not cool to just write off everybody who isn't a tech expert, throw them to the wolves, blame them for falling for any scams.

That's a key part of the security landscape that many techie users just don't seem to get.

I get it. And I don't think the threat justifies handing complete control of our computing environments to a single corporation.

But there are a ton of bad actors out there who will also use those abilities to scam and steal.

Bad actors often set up fake websites. Should computers and phones have mandatory browser filters so you can only go to approved sites?

Bad actors often set up fake websites. Should computers and phones have mandatory browser filters so you can only go to approved sites?

Well they don't, but browsers do spend an inordinate amount of effort trying to make sure that bad websites can't do anything other than show you things. I'm pretty sure that all of the browser vendors will pay 5-6 figure sums for any exploit chains that would allow a website to do things like read files without permission or execute code on the OS. And people regularly complain about the ever-tightening restrictions on what websites are allowed to do.

That's also the case for apps though, at least on iOS apps are sandboxed almost as well as web sites to my knowledge.

What a false dichotomy. I don't see a problem with the way Microsoft handles it, allowing you to run unsigned apps but only after clear warnings about the consequences and a moderately obscured install button. People ignoring these warnings without understanding them are not being thrown to the wolves, they're consciously deciding to do something they know to be dangerous. Apple's upcoming blocking of anything they don't approve of on macs is not an okay solution to this.

False dichotomy.

Google could up its Play Store review process + not installing from outside the store would result in the exact same security advantages you're talking about, while still letting you install from third party sources if you're a power user.

Google probably could implement similar security. But the problem is as of today, 2020, they don’t.

Yes, but it's not because Android allows sideloading that the Google Play store is poor quality. Apple could allow sideloading and still have a better quality app store.

But until they do the dichotomy isn’t false

This doesn't preclude there being competing app-stores on the platform, though. I'm glad Apple's is the way it is (overall). And if alternatives popped up I would probably mostly stick with the first-party one. But having an alternate channel means you can circumvent Apple's review process when they're being especially unreasonable, and the competition would probably force them to improve their own offering as well. Everybody wins (except maybe Apple).

It's not necessary nor useful to create a false dichotomy. The safety of the AppStore may be a reason to have a strict review policy, but it should not become an excuse to abuse of that policy. The price tag of safety is certainly some amount of freedom, but it's worrisome that people are learning to accept this without also distinguishing when this relationship is being usurped for other means.

If something simply doesn’t exist, how reasonable is it to assume that it could exist? How am I supposed to differentiate the statement that something could exist from fairytales?

Reply on news.ycombinator.com