Hacker News Reader

Comment by armchairhacker | Hacker News Reader

> in practice there's really zero reason to review Adobe or Microsoft or OmniGroup app updates

I can totally see Facebook pushing a update which uses internal APIs to access private information outside of its sandbox.

Honestly apps need to be verified after every update for much of the same reasons they need to be verified initially. The issue is the verification process itself, which sometimes blocks legitimate developers while also sometimes allowing scam apps.

View on HN

This is fair, but I think we can agree that rejecting an update on grounds of its basic features being duplicative, when the feature set has not changed -- which is what happened here -- is pretty absurd.

private api issues are usually caught with automated binary scans. You can obfuscate them to avoid detection but manual review wouldn’t help with that either

They can't even fix private API abuse, how do you expect them to scan for it?

See: recent iOS exploits.

Apple security is based on developer goodwill. If you’ve used private API, you did it by mistake. That’s how their security model works. That’s why they’re scanning binaries for unobfuscated calls. They don’t have an answer against malicious developers other than acting post-factum.

"which uses internal APIs to access private information outside of its sandbox"

Isn't this being possible a security issue with iOS?

Yes, it is.

Wait, did you just imply that apps by certain big companies dont need a review because you think these special biig companies deserve a bit of extra trust? Fascinating, how did you arrive at this conclusion?

He actually arrived at the exact opposite conclusion: all apps should be reviewed after each update because not even (or especially) big companies can’t be trusted.

No, armchairhacker said the opposite: even big famous companies need review of every update.

And the original poster (the blind game developer) says so too

Did you mean to reply to the grandparent poster?

Yes, my bad.

Reply on news.ycombinator.com