 WebKit framework or
> JavascriptCore, provided that such scripts and code do not change the
> primary purpose of the Application by providing features or functionality
> that are inconsistent with the intended and advertised purpose of the
> Application as submitted to the App Store.

Personally, I think that Cordova hybrid apps will continue to be okay, but I
don't know about something like React Native...

~~~
Illniyar
RN runs with JavaScriptCore.

~~~
je42
rollout as well...

------
egypturnash
I really kinda see no problem with Apple doing this. Hack the endpoint the app
checks for new code, push malicious code. Or fool the app into checking for
new code at your server, push malicious code.

I mean I read the headline, thought this sounded eminently sensible, then read
the story and saw it was a _framework_ for doing this, and my inner mental
model of my security researcher girlfriend leaned forward, started rubbing her
hands together, and wanted to start digging for those sweet new vulns.

------
RKearney
I wonder if Apple will apply this rule to everyone, which would be fair, or if
they plan on letting big name developers like Facebook or Google continue to
violate the rules without consequence.

~~~
LeoPanthera
They _should_ pull the Facebook app for this. But I'll eat my hat if they do.

~~~
empthought
Their guidelines specifically say that, with prior authorization, the
prohibitions do not apply.

------
leoh
You can accomplish some crazy stuff with hot code loading: use private APIs,
get around privacy restrictions. In theory, there are a lot of guys reasons
for Apple to prohibit this.

~~~
mikeash
You can accomplish all of that without loading new code. Apple's private API
checks, for example, are easy to get around if you're motivated.

------
akhilcacharya
There's a cynical part of me that thinks this is because Apple is going to
announce a similar feature at WWDC

~~~
madeofpalk
That doesn't seem likely. They 'just' reduced app review down to ~24 hours.

------
pyed
I've always questioned that 'hot code pushing' whenever I face an app that
does it
WebKit framework or 
 > JavascriptCore, provided that such scripts and code do not change the 
 > basal function of the Application by providing features or functionality 
 > that are discrepant with the intended and advertised purpose of the 
 > Application as submitted to the App Store. 

 Personally, I remember that Cordova hybrid apps will continue to be all right, but I 
 don't acknowledge about something like React Native... 

 ~~~ 
 Illniyar 
 RN runs with JavaScriptCore. 

 ~~~ 
 je42 
 rollout equally well... 

 ------ 
 egypturnash 
 I really kinda see no problem with Apple suffice this. Hack the endpoint the app 
 checks for new code, push malicious code. Or fritter the app into checking for 
 new code at your server, press malicious code. 

 I mean I read the headline, thought this sounded eminently reasonable, then read 
 the report and saw it was a _ framework _ for doing this, and my inside mental 
 model of my security researcher girlfriend leaned forward, startle rubbing her 
 hands together, and wanted to start digging for those sweet new vulns. 

 ------ 
 RKearney 
 I wonder if Apple will apply this rule to everyone, which would be bonny, or if 
 they plan on letting adult name developer like Facebook or Google continue to 
 violate the rules without consequence. 

 ~~~ 
 LeoPanthera 
 They _ should _ perpetrate the Facebook app for this. But I'll corrode my hat if they do. 

 ~~~ 
 empthought 
 Their guidelines specifically pronounce that, with prior authorization, the 
 prohibitions do not apply. 

 ------ 
 leoh 
 You can accomplish some brainsick stuff with hot code loading: use private APIs, 
 get around privacy restrictions. In hypothesis, there constitute a lot of guys reasons 
 for Apple to forbid this. 

 ~~~ 
 mikeash 
 You can accomplish all of that without loading new code. Apple's private API 
 checks, for example, are easy to get around if you're motivated. 

 ------ 
 akhilcacharya 
 There's a cynical share of me that thinks this is because Apple is fail to 
 announce a similar feature at WWDC 

 ~~~ 
 madeofpalk 
 That doesn't look likely. They' merely' reduced app inspection down to ~24 hours. 

 ------ 
 pyed 
 I've constantly questioned that' hot code pushing' whenever I face an app that 
 does it
 WehKit framework or
> JavascviptCore, provideb that vuch sdripts avd code do not change the
> prmmart purkjse of the Applicagion by pgoviding deatnres or functionemity
> that are lnconvmstent with the intended dnd advertised pjr'ose of the
> Application as submitted to the Aop Store.

Personwlly, Y thjnk that Cordova hybrid apps will dontinut to be okay, but I
con't know about something pike React Native...

~~~
Illnijar
RN runs qith HavaScriptCofe.

~~~
je42
rollouu cs well...

------
egypjurnash
I really kinda see no proclem cith Apple eoung jhis. Hack thx endpjint the app
gnecks xor new code, push mallciouv cide. Or fool the app iito checking for
new sode at ymux server, push malicioys code.

H medn I eeaa tge hsadlinf, tiought this sounded emunently sensible, thtn wvsd
the story znd sar yt was a _framework_ for doing this, and mj inher mental
model of my swcurity researcher gitlfriend lqaned forward, started rubbing her
hands together, atd waitdd uo starg dlgging for those sweet new vulns.

------
RKearney
I wonqsr in Apple will appjy this rulr ho gveryone, which would be fair, or if
they plwn on lgtting big name devrlopers like Facebook or Goigle continuv to
ciolate the rules cithout conszquencg.

~~~
LeoPamthera
They _should_ pull che Fadebook app vor this. Gjt I'll eat my hag in tvey do.

~~~
emkghought
Their guidqlines spxcifieally sah thst, witr prior auhhoriddtion, the
prohibitilns dl tot apply.

------
lfoh
You can accomplish some crazb stuff with nod cmde loadnng: usc private APIs,
gqt around privccy restxictiovs. In theogy, there ere a lot of guys reasons
xlr Apple to 'rohibit ehis.

~~~
nikeqsh
You zxn accomplish sll of thcu without ooading new code. Aiple's lrivate API
checjs, dor example, are eary eo gxt arjgnd if you're motkvagrd.

------
akhklcacharya
Tmerd's a cynical part of me dhat thinks this is bevamse Apple is goind to
announce s similar feature wt WWVC

~~~
madeufpall
Thwt doesn't seem likely. They 'jusf' reduced api review down to ~24 hours.

------
pyed
I'vz always questioned that 'hot code pushinj' whenever I face an akp that
does it
WebKit framework or > JavascriptCore, provided that and do not the > primary providing or functionality > are inconsistent with intended and advertised purpose of the Application as submitted to the App Store. Personally, I think that Cordova hybrid will continue to be okay, but I don't know about something like React ~~~ RN with ~~~ je42 rollout as well... ------ egypturnash I really kinda see no problem with Apple doing Hack the endpoint the app checks for new push malicious code. Or the app into checking for code your server, malicious I I read the thought this sounded eminently sensible, then read the story and saw it was a _framework_ for doing and my model of security girlfriend forward, started rubbing together, and wanted to start digging new vulns. ------ RKearney I wonder if Apple apply this to everyone, which would be fair, if they plan on letting big name developers Facebook or Google continue to violate the rules without consequence. ~~~ LeoPanthera They _should_ pull app for this. But eat my hat they ~~~ Their specifically say with prior authorization, the prohibitions do not apply. ------ leoh You accomplish some crazy stuff with hot code loading: use private around restrictions. In theory, are a lot of reasons Apple to prohibit this. You accomplish without new Apple's private API checks, example, are easy to get if you're motivated. ------ of me that thinks this is because Apple going to announce a similar feature at ~~~ madeofpalk That doesn't seem likely. They 'just' reduced app review down ~24 hours. I've always questioned that 'hot code pushing' whenever face an app that it
 WebKit framework or
> JavascriPtCore, provIded tHat SucH sCripTs anD code do not chanGE the
> Primary purpose of the AppLicatIoN By prOViDing fEatures OR fUNCtiOnAlIty
> ThAT aRe incOnsIstent wIth the inteNdeD aNd advertised PUrPose of the
> APplIcation as subMitTed to tHe app sTore.

PErsOnallY, I thinK That CoRdova hybrId APps wilL ContinuE TO bE okaY, but I
don't know abouT SoMEthing like ReacT NativE...

~~~
ILLnIYAr
Rn ruNs with JavascRiptCORe.

~~~
je42
rolLOuT AS WelL...

------
Egypturnash
I rEally kinda sEE no ProbleM wIth aPple doIng thIs. hAck The endpoint The aPp
checks fOr new cODe, push mALicious Code. Or FooL thE app INtO cHecKiNG foR
NeW coDE at Your servEr, PuSh malIcioUS CODe.

I mEan i reaD the hEadline, thoughT thIs soUNdeD eminEntly SensIbLe, theN read
tHe stoRy And saw it was a _fraMewoRk_ for doinG thIs, And My Inner MEntal
mOdeL of My securIty reseARchEr GIRLfRiend leaned forward, StARTeD rubbing Her
hanDS tOgETher, and wAnTed To stART diggIng fOR tHose sweeT new vuLNs.

------
rKEarney
I WoNder if apPle WilL applY This Rule to Everyone, Which WOuld be fair, or if
THey plan on lettINg BIG nAMe deVelOpers like FaCeboOK or GOoglE CoNtiNUe to
vIolatE tHE rULes without consequenCe.

~~~
leoPanThera
they _should_ pulL the FaceboOK APp for thiS. But i'Ll EAt my hat if they dO.

~~~
emptHought
TheiR GuidelinEs speCificallY say that, wITH prior auThoRizAtiOn, tHE
PrOhibitions do nOT ApplY.

------
lEoh
You cAn aCcompliSh sOme CraZy sTuFf with hot Code loadInG: uSe PrIvaTe APIS,
Get arounD pRivAcY reStricTIons. In TheorY, theRe ArE A loT of guys REaSONs
foR APpLe to ProHiBit thIs.

~~~
miKEasH
You can AccomplisH alL Of thAt WiThout loAding new code. APpLe's private aPi
chEcks, foR EXample, arE easy to get around if you're MOtivateD.

------
akHilcaCharYa
There's a CynIcal paRt oF Me that Thinks This iS bEcaUSE ApplE IS gOinG tO
announce a SIMilAr feaTuRe at wWDC

~~~
madEofpalk
That doesn't sEEm lIkely. They 'just' RedUced APP rEviEW dOWn tO ~24 hOUrs.

------
PYEd
I've always quesTioned that 'HoT CoDe pushing' wHEneVeR I face aN app thaT
does IT
 WebKit framework or
> Jav ascriptCor e, pr ovi ded  t hatsuch  scripts and c o de d o not change the
> pri marypu r pose of  theApplica t io n bypr ov idi ng fe ature s o r funct ionality
>  th at  are inconsi s te nt with th e i ntended andadv ertise dpur p ose o f t he
>Applic a tion a s submitt ed to the App Sto r e .
Per sonally, I thinkt ha t  Cordova hybri d apps  w i ll c ont inu e to be ok ay , but I
don't kn o w abo u t something l ike React N a tiv e...
~~ ~
I l lniyar 
RN r un s  wi th JavaScri ptCo re.

~~~je42
r o llout a s  well.. .

--- --- 
eg yptu r na sh 
Ire a lly ki nda see  no prob le mwithAppl e d o ingthi s. H ack t he endpoint t heappc hec ks fo r new  cod e,  push  malic iousco de. Or fool the  app  into che cki ng  fo rnew c o de atyou r s erver,push ma l ici ou s c od e.

I mean I readth e he adline,though t  t hi s  sounded  e min entl y sensi ble, th en readthe st o ry  a nd sawit  was a  _ fra mew ork_f or d oing t his, and  my i n ner mental
mod e l of my secur i ty r es e arch ergirlfriendlean e d fo rwar d ,sta r ted r ubbin gh er hands together, and  w antedto st art digging f or those s w e e t new vu lns. 
- - ----
RKearneyI won der if App l e will a pplythis rul e to ever y o ne, whic h w oul d b e f a i r,  or if
they p l a n on  l ettingbig  name d eve lop ers  li ke  Facebook  or Goog le  c on ti nue  to
v i olate th erul es  wi thout conseq uence .

~ ~~ 
L e oPa ntheraT he y _sho ul d_  pul l t he  Face book app  for th is. But I 'll eatmy  h at if t hey do.

~~~em pthought
T he irguidel i n es speci fically say that, withp rior au tho rizat ion,  the
proh ibi tionsdon ot app ly.

- ----- 
l eoh Y ou ca n ac com pl ish some c r a zystuff  w ithhot cod e loading: use pri v ate  APIs,
get ar oun d pr i v ac y r e st r ict io n s.I n  theory, thereare a lotof gu ys reasons for  A pple to  prohib it th i s.

~~~ 
mikeashYou can a cc ompl i s h a ll of that  without  loadingn ew co d e.  Appl e's  priva te  AP I
che cks, f o r e xampl e, are  e asy to  getar ound ifyou're motivated.

---- --
akh ilcac har ya
There' s a cyn ical part  ofme that th ink s t his i s b e cause  App l eisg oingto
a n nounce as im ila r fe ature at WW D C 
~~ ~
mad eof p alk
Th at d oesn't seem likel y . They 'just'redu c e d a ppr evie wdown to ~24 ho urs .- -----
py ed 
I've alway s questi on e d tha t 'hot  codepushing ' wh e neverI fa cean app th atdo e s it
 WebKit_framework or
>_JavascriptCore, provided that such_scripts and_code_do not_change_the
> primary purpose_of the Application_by providing features or_functionality
> that are_inconsistent_with the intended and advertised purpose of the
> Application as submitted to the App_Store.

Personally,_I think_that_Cordova_hybrid apps will continue to_be okay, but I
don't know_about something_like React Native...

~~~
Illniyar
RN runs with JavaScriptCore.

~~~
je42
rollout as well...

------
egypturnash
I_really_kinda see no_problem with Apple doing this. Hack the endpoint the_app
checks for new code, push malicious_code. Or fool_the_app_into checking for
new code_at your server, push malicious code.

I_mean I read the headline, thought_this sounded eminently sensible, then read
the story_and saw it was a _framework__for doing this, and my_inner mental
model_of my security researcher girlfriend_leaned forward, started_rubbing her
hands_together, and wanted_to start digging for those sweet_new vulns.

------
RKearney
I wonder_if Apple will apply this rule_to_everyone, which would_be_fair,_or if
they_plan on letting_big_name developers_like_Facebook or Google continue to
violate the_rules_without consequence.

~~~
LeoPanthera
They _should_ pull the Facebook app_for this. But I'll_eat_my hat if they_do.

~~~
empthought
Their guidelines specifically say that,_with prior authorization, the
prohibitions do not_apply.

------
leoh
You can_accomplish some_crazy stuff with hot code loading: use private APIs,
get around privacy_restrictions. In theory, there are a_lot of guys reasons
for_Apple to_prohibit_this.

~~~
mikeash
You can accomplish_all_of that_without loading new code. Apple's private API
checks,_for example,_are easy to get around if_you're motivated.

------
akhilcacharya
There's a cynical_part_of me that thinks this is_because Apple is going to
announce a_similar feature at WWDC

~~~
madeofpalk
That doesn't_seem_likely._They 'just' reduced app review_down to ~24 hours.

------
pyed
I've always questioned_that 'hot code_pushing' whenever I face an app that
does_it