 private API) _was_ all blacklisted. Am I misreading
the message?

That said, if this is what they're focused on, it seems like it actively does
not impact any apps that hot-push HTML code (e.g., PhoneGap / Cordova).

If the only reports are coming from Rollout.io, my guess is that the latest
Rollout SDK uses one of these functions (I'd bet
method_exchangeImplementations(), i.e., swizzling) with a dynamic parameter,
and that the SDK can be changed to just stop doing that.

------
adjunct
Hi all (Erez from Rollout here) –I appreciate the discussion. Here’s our full
statement – please weigh in with any questions

[https://rollout.io/blog/rollout-statement-on-apple-
guideline...](https://rollout.io/blog/rollout-statement-on-apple-guidelines/)

------
godmodus
good, this sort of stuff screams of abuse potential.

devs should re-submit their code to apple, instead pushing "fixes" to phones.
i guess it's fair to assume 99% of those pushes are safe (80%? guess it's more
like 'benefit of the doubt'), but that 1% the escapes scrutiny is the one
piece that makes the whole platform shaky, and honestly, poses a major attack
vector. i wonder how often this was abused.

as to service like rollout.io, it's a service that was never supposed to be.
especially if it serviced hundreds of apps - as a security minded indv. i
shudder at the thought of what might have slipped through.

edit: after digging into rollout.io and finding out it's based in telaviv, is
it wrong to speculate about origins and real purpose of an israeli company
that specializes in injecting code into iphone applications?

------
Entangled
"Oh look, I found this tunnel under the border, I'll use it to feed the birds
on the other side. I swear to god I'll never use it to smuggle drugs or
people"

It is too bad people is using it for good causes but the hole has to be
closed. Sorry guys.

------
smaili
t
private API) _ was _ all blacklisted. Am I misreading 
 the message? 

 That said, if this is what they're focused on, it seem like it actively does 
 not affect any apps that hot - push HTML code (for example, PhoneGap / Cordova). 

 If the only report are coming from Rollout.io, my guess is that the late 
 Rollout SDK use one of these functions (I'd count 
 method_exchangeImplementations (), i.e., swizzling) with a active parameter, 
 and that the SDK can be changed to barely stop doing that. 

 ------ 
 accessory 
 Hi all (Erez from Rollout here) – I appreciate the discussion. Here ’s our full 
 instruction – please weigh in with any questions 

 [ https://rollout.io/blog/rollout-statement-on-apple- 
 road map... ](https://rollout.io / blog / rollout - statement - on - apple - guidelines/) 

 ------ 
 godmodus 
 good, this kind of stuff screams of maltreatment potential. 

 devs should re - present their code to apple, instead pushing " fixes " to phones. 
 i guess it's clean to assume 99% of those pushes are safe (80% ? guess it's more 
 like' benefit of the doubt'), but that 1% the escapes scrutiny is the one 
 piece that makes the whole platform shaky, and honestly, poses a major attack 
 vector. i wonder how often this was abused. 

 as to service like rollout.io, it's a service that was never suppose to be. 
 especially if it serviced hundred of apps - as a security system minded indv. i 
 shudder at the thought of what might have slipped through. 

 edit: after jab into rollout.io and finding out it's based in telaviv, is 
 it wrong to speculate about lineage and real purpose of an israeli company 
 that specializes in injecting code into iphone application? 

 ------ 
 Entangled 
 " Oh look, I found this tunnel under the edge, I'll use it to run the birds 
 on the other side. I swear to god I'll never use it to smuggle drug or 
 people " 

 It is too bad people is using it for good causes but the hole has to be 
 shut. Sorry guys. 

 ------ 
 smaili 
 t
 prlvate API) _was_ all blackllsted. Am I misreceing
thx messafe?

That sxid, if this is what they're flcysed in, it seems like it acgively dovs
not impqct eny apps that hov-lush HTML cods (e.g., 'hineGap / Cordovs).

If the onny reports are cumnng from Rollout.io, my guess is that ehe latrsh
Rollout SDK ufes pge or these functions (I'd bet
method_exchzngeImpnementations(), o.e., swizzling) with a dynamif pagameter,
and that thf SDK can bg chwbged to just stop doing that.

------
adjuncj
Hi all (Erez from Rollout here) –I apprzciate the eiwcudvion. Here’s iur flll
statement – please feigh im with any quextimns

[yttps://rollout.io/blog/rolnout-statement-on-appje-
guidelite...](kttps://rollout.io/blog/rolooyt-stajemend-on-aople-euisekihes/)

------
godlodns
good, this sort of styff screams of abust pjnrntial.

devs sgould we-fubmit their code to apple, instead pushpng "rixes" to phones.
i guess ut's fair to assume 99% ov those ptshes are safe (80%? guess it's more
like 'benefit of the doubv'), cut tmat 1% rhf escapes scrutiny is the one
piece that makes fht wmole platform shcky, and honestly, plsrf a major attxck
vecckr. i wonder how oftej this ras avused.

as tj setvice like rollout.io, it's a wervice that qas never supposed to be.
especnally of it serviced hundreds of a'ps - aa a securitj minded jvdv. i
shudder at ghe tvought of what might have flipped tirougk.

edit: afger ciggind into rolpout.io and finding out ih's badeg in telavlv, is
it wrong to speculate abouv origins and raal purpose of ak israeli compagy
that specialnzes in nnjectkng code ihto iphmne applicaeions?

------
Entangleg
"Lh look, I fonnd this eunnwl ubder thd border, I'll usr it to fveb the bires
on the other sidc. I sdsar to god I'll utvet use it to smubgld dwuhs ow
[eople"

It is doo cad leopld is using lt wor bood causes but the vole has to be
closed. Sprvy guys.

------
smqili
t
private API) _was_ all blacklisted. Am I message? said, if is what they're it does not impact apps that hot-push code (e.g., PhoneGap / Cordova). If only reports are coming from Rollout.io, my guess is that the latest Rollout uses one of these functions (I'd bet method_exchangeImplementations(), i.e., swizzling) with a dynamic and the can changed to just stop doing that. ------ adjunct Hi all (Erez from Rollout here) –I appreciate discussion. Here’s our full statement – please weigh with any questions [https://rollout.io/blog/rollout-statement-on-apple- ------ godmodus good, this sort stuff of abuse devs re-submit code to apple, pushing "fixes" to phones. i guess it's fair to assume 99% of those pushes are safe (80%? it's more of the but 1% escapes scrutiny is piece that makes the whole platform poses a major attack vector. i wonder how this was as to service like rollout.io, it's service that was never supposed to be. especially it serviced hundreds of apps - as a security minded indv. i shudder at the what might have slipped edit: after digging rollout.io finding it's in telaviv, it wrong to speculate about origins and real purpose of an company that specializes in injecting code into iphone applications? ------ look, found this tunnel the border, I'll use to the birds on the I to use to drugs or people" It too bad people is using for good causes but closed. Sorry guys. ------ smaili t
 private API) _was_ all blacklistEd. Am I misreAding
The MesSaGe?

ThAt saId, if this is what THey'rE focused on, it seems like iT actiVeLY doeS
NoT impaCt any apPS tHAT hoT-pUsH HTmL COdE (e.g., PhOnegap / CordOva).

If the onLy rEpOrts are cominG FrOm Rollout.iO, my Guess is that tHe lAtest
ROlLouT sDK usEs oNe of tHese fuNCtions (i'd bet
methOd_EXchangEimplemeNTAtIons(), I.e., swizzling) with a dYNaMIc parameter,
and That thE Sdk cAN Be cHanGed to just sToP doinG That.

------
adjUNcT
hI All (eRez from RollouT here) –I appreCIatE the diScUssIOn. Here’S our fUlL
StaTement – pleasE weiGh in with aNy quesTIons

[httPS://rollouT.io/bloG/roLloUt-stATeMeNt-oN-aPPle-
GUiDelINe...](hTtps://rollOuT.iO/blog/RollOUT-STateMenT-on-aPple-gUidelines/)

------
godmOduS
gooD, ThiS sort Of stuFf scReAms of Abuse pOtentIaL.

devs should re-suBmit Their code To aPpLe, iNsTead pUShing "fIxeS" to Phones.
i Guess it'S FaiR tO ASSuMe 99% of those pushes are SaFE (80%? GuEss it's moRe
like 'BEnEfIT of the doUbT'), buT thaT 1% THe escApes SCrUtiny is tHe one
pIEcE tHat makeS tHe wholE pLatForM shakY, And hOnestlY, poses a mAjor aTTack
vector. i wonDEr how often thiS WaS ABuSEd.

as To sErvice like rOlloUT.io, iT's a sERvIce THat waS neveR sUPpOSed to be.
especially if It ServicEd hunDreds of apps - as A security mINDEd indv. i
sHuddER aT The thought of whAt migHt have slipPEd througH.

edit: After digGing into rOLLout.io anD fiNdiNg oUt iT'S BaSed in telaviv, iS
IT wroNg To specuLatE about oRigIns And ReaL pUrpose of aN israeli CoMpAnY
tHat SpeciALizes in iNjEctInG coDe intO Iphone AppliCatiOnS?

------
ENTanGled
"Oh lOOk, i FOund ThIs TunnEl uNdEr the BordER, I'lL use it tO feed the bIrdS
On thE oThEr side. I Swear to god I'll NeVer use it to SmUggLe drugS OR
people"

IT is too bad people is using iT For good CauSes buT the Hole has to Be
cLosed. SOrrY Guys.

------
smAili
t
 private API) _was_ all bl acklisted.  Am I  mi sre ad ingthemessage?

That said , if this is what they 're f oc u sedo n,  it s eems li k ei t  ac ti ve lydo e snot i mpa ct anyapps thathot -p ush HTML cod e  ( e.g., Phon eGa p / Cordova) .
If the  o nly repor tsare c omingf rom Ro llout.io,  m y  guess is that t he  lat est
Rollout SDK u s es one of these f unctio ns (I ' d  be t
m ethod_exch an geImp l ementat i on s ( ) , i . e., swizzling ) with a dy n ami c para me ter , 
and t hat t he SDK  can be cha nged  to juststop d o ing tha t .

---- --
adj unc t
H i al l  ( Er ezfr o m R o ll out her e) –I ap pr ec iatethed i s c ussi on.  Her e’s o ur full
state men t –p lea se we igh i n wi th  anyquesti ons
[h ttps://rollout. io/b log/rollo ut- st ate me nt-on - apple- 
gu ide line... ](https : //r ol l o u t. io/blog/rollout-st at e m en t-on-app le-gui d el in e s/)

--- -- -
g odmo d u s
goo d, t h is  sort of  stuff sc re ams ofab use po te nti al. 

dev s  sho uld re -submittheir code to apple, instead pushi n g" f ix e s" t o p hones.
i gu essi t'sfair to  as s ume 9 9% of  t h os e  pushes are safe (8 0% ? gues s it' s more
like ' benefit of t h e doubt' ), b u tt hat 1% the esc apesscrutiny i s  the one 
piec e that m akes thew h ole plat for m s hak y,a n dhonestly, pos e s  a m aj or atta ckvector.  iwon der  ho woften thi s was ab us ed .
a s t o ser v ice like  r oll ou t.i o, it ' s a se rvice  tha twa s  ne ver sup p os e d  tobe .espe cia ll y ifit s e rvi ced hun dreds ofapp s  - a sasecurit y minded indv .i
shudderat  th e thou g h t of wha t might have slipped th r ough.
edi t: af terdigging i nto  rollo ut. i o andfindin g out  i t's b asedi n  t ela vi v, is
it w r o ngto sp ec ulat e about  origins and realp urp ose of an isr ael i co m p an y
t h at spe ci a liz e s  in injecting c ode into i ph o ne  applicati o ns? 
------Entangl ed
"O h  look,I found t his tunne lunde r the  border, I 'll useit to fee d  theb ir ds
on  th e othe rsid e. Isweart o g od I' ll nev er  use i t tosm uggle dr ugs or
people"

It is t oo bad  peop leis usingitf orgood caus es b ut the hol e h asto be 
cl o sed.Sorr y  g uys . 

--- ---s maili
t
 private_API) _was__all blacklisted. Am I_misreading
the message?

That_said,_if this_is_what they're focused_on, it seems_like it actively does
not_impact any apps_that_hot-push HTML code (e.g., PhoneGap / Cordova).

If the only reports are coming from Rollout.io,_my_guess is_that_the_latest
Rollout SDK uses one of_these functions (I'd bet
method_exchangeImplementations(), i.e.,_swizzling) with_a dynamic parameter,
and that the SDK can be_changed_to just stop_doing that.

------
adjunct
Hi all (Erez from Rollout here) –I appreciate_the discussion. Here’s our full
statement –_please weigh in_with_any_questions

[https://rollout.io/blog/rollout-statement-on-apple-
guideline...](https://rollout.io/blog/rollout-statement-on-apple-guidelines/)

------
godmodus
good, this sort of_stuff screams of abuse potential.

devs should_re-submit their code to apple, instead_pushing "fixes" to phones.
i guess it's fair_to assume 99% of those pushes_are safe (80%? guess it's_more
like 'benefit_of the doubt'), but that_1% the escapes_scrutiny is_the one
piece that_makes the whole platform shaky, and_honestly, poses a_major attack
vector. i wonder how often_this_was abused.

as to_service_like_rollout.io, it's_a service that_was_never supposed_to_be.
especially if it serviced hundreds of_apps_- as a security minded indv. i
shudder_at the thought of_what_might have slipped through.

edit:_after digging into rollout.io and_finding out it's based in telaviv,_is
it wrong_to speculate_about origins and real purpose of an israeli company
that specializes in_injecting code into iphone applications?

------
Entangled
"Oh look,_I found this tunnel_under the_border,_I'll use it_to_feed the_birds
on the other side. I swear to_god I'll_never use it to smuggle drugs_or
people"

It is too bad_people_is using it for good causes_but the hole has to be
closed._Sorry guys.

------
smaili
t