Hacker News Reader

Comment by w1ntermute | Hacker News Reader

If this becomes widely used, it'll only kickstart an arms race between Apple and the people trying to access the iTunes previews. Remember what happened with the Palm Pre and iTunes syncing? Apple doesn't like unapproved devices accessing its content ecosystem.

View on HN

I am not sure Apple can differentiate Apple devices over HTTP except UA header. Maybe they can develop a proprietary streaming protocol but is it worth?

There are probably a bunch of ways of checking with javascript that are much harder to spoof than the UA.

I am not sure related native iOS streaming libraries integrate JavaScript security just to protect iTunes previews.

That could be easily updated if necessary. Moreover, it's entirely possible that there are dormant APIs precisely in case this sort of thing happened.

yes, for example with device fingerprinting. the Electronic Frontier Foundation has a nice test page online: https://panopticlick.eff.org/ however apple could apply a much simpler filter by checking whether the screen size fits the exact specs of their iphones / ipods and ban any other devices.

then again, you might always access the source directly, circumventing the need for js entirely.

> Remember what happened with the Palm Pre and iTunes syncing?

Palm Pre exploited security holes that would have allowed any rogue USB device falsely reporting itself as an iPhone to access e.g. your address book, and Apple patched the security holes. Quibble all you want over Apple's motivations, but there wasn't any other responsible thing for them to do.

Reply on news.ycombinator.com