The Removal of AirFloat and AirFoil [from the iOS App Store] | Hacker News Reader

The Removal of AirFloat and AirFoil [from the iOS App Store]

devblog.thefamoussoftwarecompany.com

60 pointsnathanhammond43 comments

Apple develops a technology called Airplay that it licenses to 3rd parties. Developers reverse-engineer the technology and sell apps that circumvent Apple's licensing model. Apple removes those apps from their store.

I am not the least bit surprised.

Airfoil, at least, was developed long before Apple had any sort of third party licensing model. Reverse engineering for interoperability is completely legal and ethical.

It's perfectly legal, and ethical, but that doesn't mean Apple has to play nice about it.

Plus the question wasn't whether AirFoil was in violation earlier, but only over the most recent update which I think was after the licensing model was in place.

(incidentally I think Apple is stupid for enforcing the rules this way, but it's their playground and if they want to protect their private key by being stand offish, then there's not much you can do, except Cydia)

There's 2 parts to AirTunes (the part of AirPlay that Airfoil and AirFloat use), Sending and Receiving. Up to now, AirFoil only used the AirTunes protocol to SEND streams to AirPlay devices. If you reverse engineer the protocol you can send to any AirPlay device. No problem.

It's harder to make an AirPlay receiver, because iTunes won't send anything to an AirPlay receiver that doesn't encrypt the request with the proper private key.

You can only get this key legitimately by licensing AirPlay from Apple (which is why all AirPlay compatible speakers are licensed by Apple).

Someone managed to extract the private key from an AirPort express by removing the flash chip and reading it externally. They then published this "stolen" key on the web. Prior to that, it was impossible to make anything that would receive AirPlay streams from iTunes, even though the protocol was widely understood (it's basically just RTSP).

A bunch of open source implementations on other platforms (PC/Mac/Windows) were released.

Rogue Amoeba's AirFoil speakers for Mac/PC included this functionality. However, up until this last update, they never included it in their iOS application. Their stated reason for this was they couldn't figure out a revenue stream to make this work (AirFoil implements it's own music transmission protocol. You bought the Mac software for $20, then got the receiver software for free. Under this model, making the free product able to receive streams from iTunes without the Mac software would have cut out their revenue producing server from the picture). The latest release included this AirPlay receiving feature as an in-App purchase. Since they've had the code to do this for a while, and it seems like this method is probably preferable to most users and therefore likely more profitable, the delay seems odd.

My speculation is, they've been using the "stolen" key, and were hesitant to draw attention to themselves by trying to get software using it approved on the app store. Eventually potential profit won out, and they went for it. It got approved by the (probably) less technically savvy app review team that doesn't know about the requirements of a licensed key to make AirPlay reception work. It was noticed later by some Apple engineer who is familiar with the protocol and was then pulled.

Since the private key is necessary to make this feature work, they either needed to license it or use the "stolen" AirPort Express key. If they licensed it, I don't think Apple would be pulling it. Since Apple does license this to people, it would be unfair to their licensees to turn a blind eye to people using the "stolen" key. If it became apparent they were letting it slide, it would lead to a proliferation of unlicensed (potentially crappy/flakey) devices that might not meet Apple's quality standards.

I think the speculation about Apple wanting to include something similar in a future iOS release is irrelevant here. Maybe they would, but I think this reasoning seems more likely.

Really good reply. Thank you.

I object to your continued use of "stolen" etc. I believe extracting the key for the proposes of interoperability is still legitimate, even if Apple doesn't like it.

Let's say that's the reason, in any case. Why would Apple pull the whole app rather than simply making them remove the key and reverting back to the old functionality? Some petty sense of retribution?

I did put stolen in quotes every time I used it because I'm not sure that is the correct term.

Here's how I see it. AirPlay is something Apple sells a license to. Assume Rogue Amoeba didn't buy a license, but used someone else's, and then sold the functionality that buying the license would have entitled them to.

What's that? Piracy? DMCA violation? Within Rogue Amoeba's rights? I don't know. Is Apple allowed to lock things down by requiring keys? Maybe they're in the wrong.

To me, this is similar to trying to sell software that uses DeCSS to play DVDs rather than licensing CSS. Regardless of my opinion, it doesn't seem to be legal (in the US, anyway).

Is that legitimate? If so, how is it different than other forms of piracy?

DeCSS is only illegal because it circumvents the copy protection system on DVDs. Absent that, there would be nothing allowing the DVD people to force companies to license CSS rather than simply cracking it.

As far as I know, Apple is allowed to lock things down by requiring keys, and other people are allowed to crack Apple's lockdown if they can.

That's my point. Isn't getting the private AirTunes key equivalent to the DeCSS case?

If Apple had just made a proprietary undocumented protocol, that'd be one thing, and I'd agree that Apple wouldn't be able to force licenses on people. Absent the private key, there wouldn't be anything to stop you.

However, they made a proprietary protocol, sold licenses to use it and implemented a key enforce the license. Isn't circumventing the private key equivalent to circumventing copy protection? They obviously intended to restrict it to licensees, the way the DVD people intended to restrict CSS to licensees.

Wasn't there some case where printer manufacturers were doing something to stop 3rd parties from making cheaper ink/toner? How did that go? Maybe it's a more apt comparison (for the record, I honestly don't remember how this case turned out, so I don't know if I'm helping or hurting my argument).

The key long predates any licensing deals. In fact, the system used for licensing is different from the one that the key in question applies to. The AirTunes/AirPlay system has changed over the years, and the key that was extracted is for an older (but still supported) system than in used for third-party licensees.

I don't see how it would be covered by the DMCA like DeCSS is, as the encryption is not for a DRM system.

Even if it is, well, I think most of us will agree that cracking encryption for the purposes of circumventing DRM for legitimate purposes should be allowed. But of course that gets us into discussions of how things are versus how things should be.

> There's 2 parts to AirTunes (the part of AirPlay that Airfoil and AirFloat use), Sending and Receiving. Up to now, AirFoil only used the AirTunes protocol to SEND streams to AirPlay devices. If you reverse engineer the protocol you can send to any AirPlay device. No problem.

How do you know there's no problem with AirPlay sending?

Other than Apple's past behavior (which, as shown here and many other places, is no guarantee of future results) I'd have thought the correct assumption is that Apple wouldn't want anything to do with unlicensed implementations of either side of the AirPlay protocol.

That's a good point... I based my assumption on the fact that they require a private key for receiving, but not sending.

I guess that doesn't necessarily prove anything...

As I understand it, it wasn't until the latest version (which was recently released) that they did the reverse engineering and bypassed the Apple licensing model which is why it was recently banned.

http://rogueamoeba.com/utm/2012/04/25/turn-any-ios-device-in...

It no more legal or ethical than Apple using their right to exclude whoever they want from their store.

It's like if I have a party and you are doing something to annoy me personally even though you are being legal and ethical I can tell you to get the fuck out.

Today's lesson is don't be that guy at the party, don't be that guy in the app store, the one who decided to reverse engineer the store owner's shit and then caused a scene when the host threw them out.

Why shouldn't Rogue Amoeba have "caused a scene"?

As another comment notes, they've probably had the code to do this for a while. Why should Rogue Amoeba continue to sit on it instead of taking the chance? Unless they were banned from the App Store entirely (unlikely based on past practice and probably less of a concern since their app was a free add-on anyway), they'd have lost nothing (and gotten a decent amount of sympathetic publicity in the process).

Hey everyone can do whatever they want. I'm pointing out the reality of the situation is not one of ethics or legality (see grandfather). The reality is if you play close to the lines, don't be surprised if you're found to occasionally be out of bounds.

Honestly it seems like this tech should be in iOS what with having such a tight ecosystem.

If you find yourself using Apple's private key (or private "anything") this should be a clear signal that your innovative energy should probably be spent elsewhere - seems like common sense to me.

Also, if you start trying to convince yourself that your app does not violate the guidelines because there are other apps do what you want to do, even though your intuition tells you that your app will be rejected, spend your energy elsewhere. Apple has no concept of "precedent" in making their decisions (nor should they or could they), and they make clear that the existence of another app doing what you do is not the basis for a successful appeal.

I'm not saying don't push the boundaries of the guidelines, but if you do so, understand it to be a business risk. And if Apple turns around and rejects your app, accept it as a cost of doing business on the edge, and don't act like Apple is to blame for the risk you took and take your sense of persecution public.

AirPlay is a strategic technology for Apple - it is going to become more and more important in the next year. Any moves Apple makes to protect this technology are first and foremost going to be motivated by ensuring the best, most consistent possible experience for the end user - their interests rest with the whole device ecology and how those devices interact. The motivation is not crushing third-party implementations because they don't want to compete with them or because they want licensing fees (which are trivial to them) - it is because they don't want hacked implementations screwing up the end-user experience, especially for non-geeks.

When I posted my reply regarding AirFoil a while back, the article wasn't loading... now that it is, you can see the developer actually explains Apple's stance and gives an example of why they do what they do.

He says: "But then something remarkable happened. Apple approved Air Speakers – an app that enabled you to stream audio to your iOS device from iTunes and iOS devices. Using the private key of the AirPort Express. Sadly it was a horrible app. Synchronization wasn’t even implemented, so the audio was hopelessly out of sync, when sending audio to multiple devices."

I believe this is why Apple requires you license AirPlay. Not so they can make a quick buck (I'm sure the license fees are trivial to Apple), but so they can make sure things that work with AirPlay don't behave as the author claims the AirSpeakers app does.

They later claim that AirPlay implemented the key to stop piracy; "The encrypted stream was initially implemented in order to protect the transfer of DRM-encrypted iTunes Music Store audio content," but doesn't back this statement up. I think they implemented the key requirement to enforce their licensing. I can't back this up either, other than it explains Apple's actions better than his theory. The licensing isn't there as a profit center, but to give them some quality control so that AirPlay doesn't get a bad reputation for being difficult to use or unreliable.

The thing that doesn't make sense is that supposedly Apple rejected this for using private APIs. This doesn't sound like the case.

It'd be interesting to know what the AirPlay licensing terms are like, and whether or not the AirFloat developer or Rogue Amoeba approached Apple to license AirPlay (I'll guess no).

All was working out great, and in the first month I had 100 downloads and the reception was phenomenal. Only five star reviews on App Store.

Is that a typo? Really only 100 downloads? If that's true then the app store is even more of a crapshoot than I thought.

It's only a crapshoot if all you do is drop your app in the store and assume that people will find it by magic.

I've heard several very successful iOS devs say that they basically did exactly that.

I think the secret is finding a rich but unexplored niche but of course that's getting more difficult over time.

The thing about crapshoots is that sometimes you win.

I wonder at what point the removal of good and innovative apps will piss enough iOS developers off that no new good apps will get created...

They'd have to get fed up enough to move to a non-Apple ecosystem, and given how much the typical iOS/Mac dev loves Apple products, that seems unlikely unless a new player storms onto the market and finally delivers serious competition. Abuse like this will, at most, just make devs grumble more about how unkind Apple is; they're not going to stop making Apple rich anytime soon.

Judging from the Photoshop thread (1). People has a lot of tolerance to abuse, and will allow themselves to obvious mistreatment for many years before finally figuring they deserve better, and giving up.

(1) http://news.ycombinator.com/item?id=4031595

It's much less of an issue for the average developer than the fact that it's getting to be very, very hard to make any real money in the app store.

To quote from the article:

I really believe that the App Store is become more and more like an Android market – meaning 99% crap!

What is good and innovative about stealing Apple's private encryption key ?

First, as far as I'm aware, there's no allegation that either this developer or Rogue Amoeba was responsible for extracting and publishing the key in the first place.

Second, I think the point is that some developers did good and innovative things with the key. By itself, I'd call extracting and publishing the key a mundane technical challenge, nothing more.

Cached version from Google:

http://webcache.googleusercontent.com/search?q=cache:6tI7UJT...

Developing for Apple not only means that you are at the mercy of their changing whims, it also means you are making their platforms more powerful for them so they can continue to abuse their market power.

Why not run an app on the mac that serves streaming aac over http and give the user a link to open in mobilesafari? It seems to me that that would sidestep the whole issue.

I don't get the point of these iOS apps. I use (and love) AirFoil to send music from my MBP to my AppleTV to have my computer stream music to my TV system's speakers. But who would want to have something sent TO their iPhone?

You could have your iPhone docked in some kind of stereo system and have bazillion gigabytes of music that don't fit on iPhone, or just don't want to get up to change the music.

I don't think it's used to stream to iOS devices so they can play it back trough their speaker or headphones - I guess it's to use their line out.

I have an old iPod touch constantly plugged in a wall socket and hooked up to speakers in my bedroom. Running AirFoil on it allows me to play anything from my computer/iphone/ipad/etc. . Normally you'd use an airport express for that, but since I had that old iPod touch lying around, I figured it was better to recycle the device.

We have an Apple TV, but it's not connected to the house's speaker system. Airfoil is nice because I can hook an old iOS device up to the main receiver for the house and send music to it through iTunes, Spotify, etc.

Basically make any pair of headphones wireless? Yes please.

I have 100 gigs of music on my laptop, much more than can fit on my ipod. This is perfect for me.

> I had implemented a usage reporting tool, that I used to track how my customers was using the app.

Would you just look at how causally he mentions this. FUCKING HELL.

I was noticing a distinct lack of apps that are airplay capable. Sad.

i guess you are using hostgator as your host. (Error establishing a database connection)

Presentation matters, spelling matters, basic grammar matters. People will not take you seriously if every other sentence is less well constructed than if someone were dictating to the computer in speech form.

Seriously, every other sentence has fundamental mistakes. Writing skills matter, hugely. Downvotez ahoy! (Pressing the down arrow improves your English skills for sure!)

It's what happens when you let MBAs and lawyers make the decisions engineers should be making.

Reply on news.ycombinator.com