Hacker News Reader

That's not necessarily specific to iOS. Certificate pinning is usually done inside an app, not at the OS level. An app can choose to ignore the system certificate store and, for example, pin the cert used to talk to its private API. This is possible both on iOS and Android.

Another note: cert pinning is made very easy by Android as well (just needs a fingerprint in an XML file).

It's a good feature for security (stalkerware remains a huge problem) but it does suck from a reverse engineering standpoint.

iOS is even easier than Android to add system certificates and can be done without rooting or jailbreaking the device unlike android. cert pinning is done by the apps not the system.

Would you mind sharing your setup?

https://github.com/epitron/mitm-adblock

or

https://github.com/barre/privaxy

cert pinning is done by the apps, not by the OS

That's a distinction without a difference in these tightly controlled ecosystems.

Android apps could also do certificate pinning with the same effect though? In this case there isn't any difference between Android and iOS in functionality.