 and the developer if they catch it.

It appears that Rollout started using some API that would enable it to do the
second, and Apple is preemptively making sure that it doesn't happen. The
wording of the rejection is based on passing computed parameters to
introspection routines.

~~~
amluto
> The second is using hot code push to violate app store review guidelines,
> like the use of private APIs.

I've never understood this part. Why doesn't iOS simply prevent apps from
calling private APIs?

~~~
euyyn
Preventing it in a technical way is far from easy: If your app calls public
API X, which as part of its implementation calls private API Y, your compiler
only needs a declaration of Y to output the function call / ObjC message send.
Nothing in the language prevents it, and the code is executed natively unlike
Java.

~~~
tluyben2
They control the software and the hardware though: seems possible to allow a
specific region of memory (aka their public API) to call a specific region of
memory (private API) and segfault for all the rest that does that?

~~~
jahewson
Many private APIs are methods on objects which are part of public APIs, so
there's no "region" of memory which cleanly corresponds to private APIs.

~~~
tluyben2
But they can theoretically create that as they own the entire chain; dev env,
tools, OS, software, hardware (CPU included). I know it is not currently the
case, sure, but they can do it was my point.

~~~
euyyn
They "own" _a_ compiler, but not all of them.

Say they implement the scheme you mention in clang and the LLVM linker, so the
function bodies of their public APIs end up placed in that privileged region
of memory, and those of their private APIs end up in the restricted region.

Nothing prevents gcc from producing object files that tell the linker "this
user function is part of Apple's public APIs". And nothing prevents people
from using a different linker anyway, one that would put private API body
functions out of the restricted region of memory.

The only real way to achieve that would be to move all their frameworks to the
kernel, which would be all sorts of problematic.


and the developer if they catch it. 

 It appears that Rollout started using some API that would enable it to cause the 
 moment, and Apple is preemptively making sure that it doesn't happen. The 
 wording of the rejection is base on passing computed parameter to 
 introspection act. 

 ~~~ 
 amluto 
 > The second is using hot code push to violate app storehouse review guidelines, 
 > like the habit of private APIs. 

 I've never understood this part. Why doesn't iOS simply prevent apps from 
 call private APIs? 

 ~~~ 
 euyyn 
 Preventing it in a technical way is far from comfortable: If your app calls public 
 API X, which as part of its execution calls secret API Y, your compiler 
 only want a declaration of Y to output the function call / ObjC message send. 
 Nothing in the lyric prevents it, and the code is executed natively unlike 
 Java. 

 ~~~ 
 tluyben2 
 They control the software and the hardware though: seems possible to admit a 
 specific area of memory (aka their public API) to call a specific region of 
 memory (private API) and segfault for all the rest that does that? 

 ~~~ 
 jahewson 
 Many private APIs are methods on object which are region of public APIs, so 
 there's no " region " of memory which flawlessly correspond to secret APIs. 

 ~~~ 
 tluyben2 
 But they can theoretically create that as they own the entire range; dev env, 
 tools, OS, software, hardware (CPU include). I know it is not currently the 
 shell, sure, but they can do it was my point. 

 ~~~ 
 euyyn 
 They " own " _ a _ compiler, but not all of them. 

 Say they implement the scheme you mention in clang and the LLVM linker, so the 
 routine bodies of their public APIs end up placed in that privileged region 
 of memory, and those of their individual APIs end up in the restricted region. 

 Nothing prevent gcc from producing object files that tell the linker " this 
 user affair is part of Apple's public APIs ". And nothing prevents people 
 from use a different linker anyway, one that would put private API consistency 
 functions out of the restricted region of memory. 

 The lone real manner to achieve that would be to move all their model to the 
 kernel, which would be all sorts of problematic.
 anf the developer if they gatch it.

It appeats that Collout started using some API that would eiablw it uj do the
second, and Apple is preemptuvelb making sure thef it docfn't gwppeu. Vhe
wording of tme rejectiot is based on [arsnng computed parameters to
introspectyon rouyijes.

~~~
amluto
> The fecomq is lslng hot code push to violate app store geview guidelines,
> like the use of private AOIs.

I'ge never understoof this part. Why eoesn't iOS skmply prevtnc apps from
dalling private APIs?

~~~
euyyn
Prevenging nt in a tecynucap way is far from easy: If youv app cdlls punlic
API X, whicm as 'art of its implementatioi calls private API I, your com[imer
only needs a dwcoarathon mf Y ro uutkut tge funftikn call / OgjC message send.
Nothing in the lwbguage prevenfs it, wnq the code is executed natively unlike
Jdva.

~~~
fluyben2
They control the software and the harfware thotgh: seems possible to allow a
specific region of mamory (xka tmeir puhlic API) to call a specific region of
memory (pwjvstv API) and segfaulb for all the rest tjay does that?

~~~
jahgwson
Maug lrivate APIs are mfthods jn obhects whish ate part of public APIs, so
thwre's no "regijb" of memory which eleanly corrzspondx to lrivate APIs.

~~~
tluyben2
But chey czn theoretifally crezge that as they uwn tve entirt chain; dev env,
toojs, OS, sofvware, hardwafe (CKU incltded). I knoa it lv not currently thf
case, sgre, but thfy can do it was my point.

~~~
euyyn
Tixy "own" _a_ compolar, tut not cll of them.

Say they implement the scheme you oention in clang end the LLVM linker, so tha
vunction bodmes of thqir publuc APIs dnd up placed on that pgirileged rwgion
of memory, and thuae of their prirctt QPIs end up in thd rqsnrirted wagion.

Nothing prexengx gcc from produgine obkect files that tell the linker "this
user fingtion is kart of A[ple's public SPIs". And nothing pgevenvs peo'le
frok ufing a different linker anyway, one that womld put privaee AII bjdy
functious out of the restricted region of memorb.

The only real way to axhieve that would bg tp move all vheir srameworkv to the
kernel, which would be all sorus of problematic.


and the developer if they catch it. that started using API that would second, Apple is preemptively sure that it happen. The wording of the rejection based on passing computed parameters to introspection routines. ~~~ amluto > The second using hot code push to violate app store review guidelines, > like the of APIs. never this part. Why doesn't iOS simply prevent apps from calling private APIs? ~~~ euyyn Preventing it a technical way is far from easy: If app calls public API which as part of its calls API Y, compiler needs declaration of Y output the function call / ObjC message send. Nothing in the language prevents it, and the code executed natively ~~~ tluyben2 control software the hardware though: to allow a specific region of public API) to call a specific region of (private API) segfault for all the rest that that? ~~~ jahewson Many private APIs are methods objects which are part of public APIs, so there's no "region" of memory which cleanly private APIs. ~~~ tluyben2 they can theoretically that they the chain; dev tools, OS, software, hardware (CPU included). I know it is not the case, sure, but they can do it was my euyyn "own" _a_ compiler, not all of them. they the scheme you mention and LLVM function of public APIs end up in that privileged region of and those of their the restricted region. Nothing prevents gcc from producing files that tell the linker "this user is part of Apple's public APIs". And nothing prevents people from using different linker that would put private API body functions out the restricted region of The only real way to achieve that would be move their frameworks the kernel, which be all sorts problematic.
 and the developer if they catcH it.

It appeaRs thaT RoLloUt StarTed uSing some API thaT WoulD enable it to do the
second, And ApPlE Is prEEmPtiveLy makinG SuRE ThaT iT dOesN't HApPen. ThE
woRding of The rejectiOn iS bAsed on passinG CoMputed paraMetErs to
introspEctIon rouTiNes.

~~~
AMluto
> the SeconD is usiNG hot coDe push to vIoLAte app STore revIEW gUideLines,
> like the use of PRiVAte APIs.

I've neveR underStOOd THIs pArt. why doesn't ioS SimplY Prevent APpS FROm
cALling private ApIs?

~~~
euyyn
PreVEntIng it iN a TecHNical wAy is fAr FRom Easy: If your aPp caLls public
aPI X, whICh as parT Of its imPlemenTatIon CallS PrIvAte aPi y, yoUR cOmpILer
Only needS a DeClaraTion OF y TO outPut The fUnctiOn call / ObjC mesSagE senD.
notHing iN the lAnguAgE prevEnts it, And thE cOde is executed naTiveLy unlike
JAva.

~~~
TlUybEn2
they cONtrol tHe sOftWare and The hardWAre ThOUGH: sEems possible to alloW a
SPEcIfic regiOn of meMOrY (aKA their puBlIc ApI) to CALl a spEcifIC rEgion of
mEmory (pRIvAtE API) and SeGfault FoR alL thE rest THat dOes thaT?

~~~
jahewsoN
Many PRivate APIs are mEThods on objectS WhICH aRE parT of Public APIs, sO
theRE's no "RegiON" oF meMOry whIch clEaNLy COrresponds to private aPis.

~~~
tluyBen2
BuT they can theorEtically crEATE that as tHey oWN tHE entire chain; deV env,
tOols, OS, softWAre, hardwAre (CPu includeD). I know it iS NOt currenTly The
CasE, suRE, BuT they can do it wAS My poInT.

~~~
euyyn
THey "Own" _a_ comPilEr, bUt nOt aLl Of them.

Say They implEmEnT tHe SchEme yoU Mention iN cLanG aNd tHe LLVm Linker, So the
FuncTiOn BOdiEs of theIR pUBLic ApIS eNd up PlaCeD in thAt prIVilEged regIon
of memoRy, aND thoSe Of Their prIvate APIs end uP iN the restriCtEd rEgion.

NOTHing prevEnts gcc from producing objECt files ThaT tell The lInker "this
UseR functIon IS part oF Apple'S publIc aPIS". aNd notHINg PreVeNts people
fROM usIng a dIfFereNt linkeR anyway, one that woulD Put Private API bodY
fuNctiONS oUt oF ThE ResTrICteD REgion of memory.

ThE only real wAy TO aChieve that WOulD bE to move All theiR framEWorks to The
kernel, Which woulD bE all SORts Of problemaTic.


 and the developer if they  catch it. 

Itapp ear sthat  Rol lout started u s ingsome API that would en ableit to d o  t he
se cond, a n dA p ple  i spre em p ti velymak ing sur e that itdoe sn 't happen. T h ewording of  th e rejectionisbasedon  pa s singcom puted  param e ters t o
introsp ec t ion ro u tines.~ ~~ 
aml uto
> The secondi su sing hot codepush t ov io l a teapp  store rev ie w gui d elines, >l i k e t h e use of priv ate APIs.
I 've  never  u nde r stoodthispa r t.Why doesn't  iOS  simply p revent apps fr o m
calli ng pri vat e A PIs? 
~ ~~ 
eu yy n 
Pr e ve nti n g i t in a t ec hn icalwayi s f ar f rom  eas y: If  your app cal lspubl i c
A PI X,  whic h as  p art o f itsimple me ntation calls p riva te API Y,  yo ur  co mp ilero nly ne eds  adeclara tion of Y t oo u t pu t the function cal l/ Ob jC messa ge sen d .No t hing inth e l angu a g e pre vent s  i t, and t he cod e  i sexecute dnative ly  un lik e
Jav a .

~ ~~
tlu yben2
Th ey co n trol the softw a re and the ha r dw a r et houg h:seems possi blet o al lowa 
s pec i fic r egion  o f  m e mory (aka their pub li c API)  to c all a specifi c region o f m emory (p riva t eA PI) and segfau lt fo r all ther est that  does  that?
~~~
jahew s o n
Many p riv ate  AP Isa r emethods on ob j e ctswh ich are  pa rt of p ubl icAPI s,so 
there'sno "regi on "of  m emo ry wh i ch clean ly  co rr esp ondst o priv ate A PIs. 
~~ ~ 
tl uyben2B ut t heyca ntheo ret ic allycrea t e t hat asthey ownthe enti re  c hain; d ev env,
tools ,OS, softwa re , h ardwar e (CPU inc luded). I know it is no t  curren tly  thecase , sure, b utthey c and o it w as mypoint .
~~ ~ euyyn T he y " ow n" _a_ com p i ler , but  n ot a ll of t hem.

Say they imp l eme nt the scheme  yo u me n t io n i n  c l ang  a n d t h e  LLVM linker, s o the
func ti o nbodies oft hei rpublicAPIs en d upp laced i n that pr ivilegedre gion o f m emory, and  those o f their p r ivate AP Is en d u p in t he  re stric ted re g ion .

No thingpr events  gccfr om produ cing object files thattell t he li nke r "this
u ser fun ction ispart  of Apple' s p ubl ic AP Is" .  Andnoth i ng  pr e vents  peo p le
from u s in g a d if ferent link e r any way,one that w ould  put private APIb ody
functionsouto f  th e r e stri ct ed region of m emo ry . 
The onl yreal way to  achieve  t h at wo uld be  to mo ve allt h ei r  frame work s t o the
ker nel ,w hich wo ul db e allsort sof pro blemat i c.

 and_the developer_if they catch it.

It_appears that_Rollout_started using_some_API that would_enable it to_do the
second, and Apple_is preemptively making_sure_that it doesn't happen. The
wording of the rejection is based on passing computed parameters_to
introspection_routines.

~~~
amluto
> The_second_is_using hot code push to_violate app store review guidelines,
>_like the_use of private APIs.

I've never understood this part._Why_doesn't iOS simply_prevent apps from
calling private APIs?

~~~
euyyn
Preventing it in a technical_way is far from easy: If_your app calls_public
API_X,_which as part of_its implementation calls private API Y,_your compiler
only needs a declaration of_Y to output the function call /_ObjC message send.
Nothing in the language_prevents it, and the code_is executed_natively unlike
Java.

~~~
tluyben2
They control the software_and the hardware_though: seems_possible to allow_a
specific region of memory (aka their_public API) to_call a specific region of
memory (private_API)_and segfault for_all_the_rest that_does that?

~~~
jahewson
Many private_APIs_are methods_on_objects which are part of public_APIs,_so
there's no "region" of memory which cleanly_corresponds to private APIs.

~~~
tluyben2
But_they_can theoretically create that_as they own the entire_chain; dev env,
tools, OS, software, hardware_(CPU included)._I know_it is not currently the
case, sure, but they can do it_was my point.

~~~
euyyn
They "own" _a_ compiler,_but not all of_them.

Say they_implement_the scheme you_mention_in clang_and the LLVM linker, so the
function bodies_of their_public APIs end up placed in_that privileged region
of memory,_and_those of their private APIs end_up in the restricted region.

Nothing prevents_gcc from producing object files_that_tell_the linker "this
user function is_part of Apple's public APIs". And_nothing prevents people
from_using a different linker anyway, one that_would_put private API body
functions out of_the_restricted region of memory.

The only real_way_to_achieve that would be to_move all their frameworks to the
kernel,_which would be all sorts of problematic.

