Hacker News Reader

Comment by LeoNatan25 | Hacker News Reader

All of that is already accounted for and protected by in the OS. An app cannot normally register daemons or agent (or even an XPC service). Installing is already limited to FrontBoard standard installation mechanism. All that will remain in a possible open iOS future.

View on HN

> An app cannot normally register daemons or agent (or even an XPC service). Installing is already limited to FrontBoard standard installation mechanism. All that will remain in a possible open iOS future.

So Apple won’t comply with the EU law then?

EU law doesn't have any requirements to change that.

The only requirement is that any APIs first party Apple services use can also be used by competing 3rd parties. If Apple isn't using those features in any competing services, they don't have to open it up for everyone. Alternately they could remove those APIs from their own apps and still be complying.

The goal is fair competition. I should be able have Google Pay to compete with Apple Pay, but Apple don't let other apps use the NFC for that. It's not fair competition when iMessage can be your default SMS app, but WeChat/WhatsApp can't. But if Apple choose to, they could separate iMessage and SMS and still be fine under EU law, cuz now none of the competing iMessage/WeChat/WhatsApp will be your SMS app.

Except usage of private APIs?

I can hide any private API usage already for normal store submission. If I am the tiniest bit careful, I will get away with most private stuff that is still not protected by the kernel using entitlements. For example,

https://github.com/LeoNatan/LNExtensionExecutor

This is a framework I obfuscate API usage, and is present in several App Store apps that I know of.

Apple security comes from kernel hardening, not static API analysis.

Fair enough I need to look more into it. Thanks for the info

Until Apple detects its usage and bans your account for breaking TOS?

That framework’s logic has not changed in years, and neither has Apple’s static analysis checker. It’s just security theater at this point.

Reply on news.ycombinator.com