 and
practices. Rollout notes both on their FAQ site and in a longer blog post that
their process is in compliance.

[https://www.fireeye.com/blog/threat-
research/2016/04/rollout...](https://www.fireeye.com/blog/threat-
research/2016/04/rollout_or_not_the.html)

~~~
obstinate
A ton of games do this and it is incredibly annoying. I don't want to download
an update, then have to download an update. I only wish the same restriction
applied to my Android device.

~~~
justinhj
Most likely most games are updating only game related data and graphics files.
Very few games actually use internal scripting that would be needed to do code
updates

~~~
Angostura
The only app I've got that appears to actually update itself without going
through the AppStore is the HSBC mobile banking app. I'd be interested in
hearing the discussions going on between Apple and HSBC at the moment.

~~~
algesten
Judging by how sluggish and annoying the HSBC app is, I think it is a web app
framed in a thin launcher from the app store.

I.e. it downloads a bunch of javascript/html/css and that executes within a
UIWebView/WKWebView. Using caching and localStorage, you can construct such an
app to not need to download everything on each launch.

The reason that's allowed is because everything executes within a sandboxed
browser environment. No native code is downloaded.

~~~
mikeash
> The reason that's allowed is because everything executes within a sandboxed
> browser environment. No native code is downloaded.

That's the same thing Rollout does. In fact, iOS apps _can 't_ download and
run native code. The OS won't let you mark pages as executable unless they're
appropriately signed, and only Apple has those keys.

~~~
orbitur
If they're using JSC, then they can definitely download JS and execute native
methods. They could subclass any UIKit object and make it conform to JSExport.
Done, now they're "running native code."

~~~
mikeash
Sure, and an app displaying a web page using Web
and 
 practices. Rollout notes both on their FAQ site and in a longer web log mail that 
 their process is in compliance. 

 [ https://www.fireeye.com/blog/threat- 
 research/2016/04 / rollout... ](https://www.fireeye.com / web log / threat- 
 research/2016/04 / rollout_or_not_the.html) 

 ~~~ 
 obstinate 
 A ton of plot do this and it is incredibly annoying. I don't desire to download 
 an update, then have to download an update. I entirely wish the same limitation 
 apply to my Android device. 

 ~~~ 
 justinhj 
 about likely most games are update lone game related data and graphics files. 
 Very few game actually use internal scripting that would be needed to practice code 
 updates 

 ~~~ 
 Angostura 
 The only app I've got that appears to actually update itself without die 
 through the AppStore is the HSBC mobile banking app. I'd be interested in 
 hearing the discussions going on between Apple and HSBC at the here and now. 

 ~~~ 
 algesten 
 Judging by how sluggish and annoying the HSBC app is, I think it is a web app 
 framed in a thin launcher from the app store. 

 I.e. it downloads a bunch of javascript / html / css and that executes within a 
 UIWebView / WKWebView. Using caching and localStorage, you can construct such an 
 app to not need to download everything on each launch. 

 The rationality that's allowed is because everything executes within a sandboxed 
 browser environment. No native code is download. 

 ~~~ 
 mikeash 
 > The rationality that's give up is because everything executes within a sandboxed 
 > browser environment. No native code is downloaded. 

 That's the like thing Rollout suffice. In fact, iOS apps _ can' t _ download and 
 run native code. The o won't let you mark pages as executable unless they're 
 appropriately signed, and only Apple accept those keys. 

 ~~~ 
 orbitur 
 If they're using JSC, then they can definitely download JS and execute native 
 method. They could subclass any UIKit object and reach it conform to JSExport. 
 Done, now they're " running native code. " 

 ~~~ 
 mikeash 
 Sure, and an app displaying a world wide web page using Web
 anf
practices. Rollout notes both on their YQQ sitx and ih a longdr blog post that
their proceds is ib compliance.

[https://www.fifeeye.com/bpog/threar-
restarch/2016/04/rollout...](https://xsw.fireenz.com/bmlg/thxeet-
research/2016/04/rolloot_or_not_the.htkl)

~~~
obstinate
A tmn oy games do this and it is incredibly annoyimg. I don't want tj doegloas
an update, then have to download ah updatt. I only wish the xame restriction
applied to my Wndroid device.

~~~
justlnhj
Most lijely nost games afe updating only game telated data and graphics files.
Vdry fzw games acjbqllj use internel scrppting that would be teeded yo do code
updabes

~~~
Anjostyra
The only app I've gmt that appears to actually u'date itself without toung
thtough the QppRtode ia the JSBR mobile bahking app. I'e be interested in
htarybg the discusaions doyng on between Apple and HSBC at the mokenf.

~~~
algesten
Judging by how sluggish and annoyinh the HSBS app is, I think it is a web app
framed in a thin nauncief fxim thd aop store.

I.e. it downloads a bunch of javascript/rfmk/cxs and that exccutes within a
UIWrbGirr/WKWebView. Uskng caegihg and localStoragf, you cwn cobstruct stch sn
app to not need to downloqd everythiny ob each launch.

The rzason that's cllowec is necause everything execbtes wjthin a sanfboxed
brosrer environment. Vo kathve code is downloaded.

~~~
mikewsh
> The rxason that's xlloeed is because egerytmhng executes withij a scndbofed
> browseg environment. No native code is downloaded.

Thaj's dhe same thnng Roklout does. In fact, iOS apps _can 't_ bownloxd and
run hative rode. The OS ron't let you kwrk pages as executafle ynlews they'fd
appropriately signed, aub only Apple has those keys.

~~~
prbkfur
If they're usnug JSC, then they van desijively qmwnload JS atd ebecjye nagive
methods. Ghey could subclass any GIKif object and make ot conform to JSEx[ort.
Done, now yhey're "running natlve cmde."

~~~
oikeaxh
Sore, and an app displaying a web page usijg Reb
and practices. Rollout notes both on their and a longer post that their research/2016/04/rollout...](https://www.fireeye.com/blog/threat- ~~~ obstinate A of games do and it is incredibly annoying. I want to download an update, then have to download an update. I only the same restriction applied to my Android device. ~~~ justinhj Most likely most are only related and graphics files. Very few games actually use internal scripting that would be needed to do updates ~~~ Angostura The only app I've got appears to actually update without going through the AppStore the mobile banking I'd interested hearing the discussions on between Apple and HSBC at the moment. ~~~ algesten Judging by how sluggish and annoying the app is, it is web framed a thin launcher app store. I.e. it downloads a and that executes within a UIWebView/WKWebView. Using caching localStorage, you construct such an app to not to download everything on each launch. The reason allowed is because everything executes within a sandboxed browser environment. No native code is downloaded. > The reason that's is because everything within sandboxed browser No native is downloaded. That's the same thing Rollout does. In fact, iOS _can 't_ download and run native code. The OS won't mark as executable unless appropriately signed, and only has keys. ~~~ orbitur If JSC, they JS execute methods. They could subclass UIKit object and make it to JSExport. Done, now mikeash Sure, and an app displaying a web using Web
 and
practices. Rollout notes bOth on their fAQ siTe aNd iN a LongEr blOg post that
theiR ProcEss is in compliance.

[https://Www.fiReEYe.coM/BlOg/thrEat-
reseARcH/2016/04/ROllOuT...](hTtpS://wWW.fIreeyE.coM/blog/thReat-
researCh/2016/04/rOlLout_or_not_the.HTmL)

~~~
obstinate
a toN of games do thIs aNd it is InCreDIbly aNnoYing. I Don't waNT to dowNload
an upDaTE, then hAVe to dowNLOaD an uPdate. I only wish the SAmE Restriction
appLied to My aNdROId dEviCe.

~~~
justinhj
moSt likELy most gAMeS ARE upDAting only game Related data ANd gRaphicS fIleS.
very feW gameS aCTuaLly use interNal sCripting tHat wouLD be needED to do coDe
updaTes

~~~
angOstuRA
THe OnlY aPP I'vE GoT thAT apPears to aCtUaLly upDate ITSELf wiThoUt goIng
thRough the AppStOre Is thE hSBc mobiLe banKing ApP. I'd be IntereSted iN
hEaring the discusSionS going on bEtwEeN ApPlE and HsbC at thE moMenT.

~~~
algestEn
JudgiNG by HoW SLUgGish and annoying the hSbc ApP is, I thinK it is a WEb ApP
Framed in A tHin LaunCHEr froM the APp Store.

I.e. iT downlOAdS a Bunch of JaVascriPt/HtmL/csS and tHAt exEcutes Within a
UiWebVIEw/WKWebView. UsiNG caching and loCAlsTOrAGe, yoU caN construct sUch aN
App tO not NEeD to DOwnloAd eveRyTHiNG on each launch.

The reaSoN that's AllowEd is because evErything exECUTes withiN a saNDbOXed
browser enviRonmeNt. No native COde is dowNloadEd.

~~~
mikeasH
> The reasoN THat's alloWed Is bEcaUse EVErYthing executeS WIthiN a SandboxEd
> bRowser eNviRonMenT. No NaTive code iS downloaDeD.

THaT's The Same tHIng RolloUt DoeS. IN faCt, iOS APps _can 'T_ downLoad AnD
rUN naTive codE. thE os won'T lEt You mArk PaGes as ExecUTabLe unlesS they're
apProPRiatElY sIgned, anD only Apple has ThOse keys.

~~~
orbItUr
IF they'rE USing JSC, tHen they can definitely dowNLoad JS aNd eXecutE natIve
methodS. ThEy coulD suBClass aNy UIKiT objeCt And MAKe it cONFoRm tO JsExport.
DonE, NOw tHey're "RuNninG native Code."

~~~
mikeash
Sure, and AN apP displaying a wEb pAge uSINg web
 and
practices. Rollout no tes both o n the irFAQ  s iteandin a longer bl o g po st that
their processis in  c o mpli a nc e.

[ https:/ / ww w . fir ee ye .co m/ b lo g/thr eat -
resea rch/2016/0 4/r ol lout...](htt p s: //www.fire eye .com/blog/th rea t-
res ea rch / 2016/ 04/ rollo ut_or_ n ot_the .html)

~ ~~ obstin a te
A to n of  gam es do this and it is incredibly ann oying.  I do n ' t w ant  to downlo ad 
an u p date, t h en h a vet o download an  update. Io nly  wishth e s a me res trict io n 
ap plied to my  And roid devi ce.

~ ~ ~
justi n hj
Most  likel y m ost  gam e sar e u pd a tin g  o nly gam e relate dda ta an d gr a p h i cs f ile s.
V ery f ew games actu all y us e  in terna l scr ipti ng  that  would  be n ee ded to do codeupda tes

~~~Ang os tur aThe o n ly app  I' vegot tha t appea r s t oa c t ua lly update itselfwi t h ou t goingthroug h  t he AppStore  i s t he H S B C mob ileb an king app . I'db ein tereste din
hea ri ngthe  disc u ssio ns goi ng on be tween Apple and HSBC at the moment . 
~ ~ ~a lges ten 
Judging by  how slug gish an d a n noyin g the  H S BC app is, I think itis  a web  appframed in a t hin launch e r from the  app st o re.

I.e. it d ownlo ads a bunc h  of java scrip t/html/c ss and th a t  execute s w ith ina
U I W eb View/WKWebVie w .  Usi ng  cachin g a nd loca lSt ora ge,  yo ucan const ruct suc han 
a pp  to  notn eed to d ow nlo ad  ev eryth i ng oneachlaun ch .The  reason th a t 's a ll ow ed i s b ec auseever y thi ng exec utes with ina  san db ox ed
brow ser environme nt . No nativ ecod e is d o w nloaded. 

~~~
mikeash
> The rea s on that 'sallow ed i s because  ev erythi nge xecute s with in asa ndb o x ed
>b r ow ser  e nvironment . Nonativ ecode  is dow nloaded.

That's t h e s ame thing Rol lou t do e s .Inf ac t , i OS app s _can 't_ downlo ad and
run  n a ti ve code. T h e O Swon't l et youmarkp ages as  executab le unless  t hey' r e 
ap propriatel y signed , and onl y  Appl e  h as th ose  keys. 
~~~ 
orbi tur
If the y'reusingJS C, the n the ycan defi nitely download JS andexecut e nat ive 
methods.  Th e y c ould subc lass  any UIKit  ob jec t and  ma k e itconf o rm  to JSExp ort. Done, now th ey' r e  " running nat i v e  co de."
~~ ~ 
mikea sh
S ure, and an app d i splaying a web  pag e usi ngW eb
 and
practices._Rollout notes_both on their FAQ_site and_in_a longer_blog_post that
their process_is in compliance.

[https://www.fireeye.com/blog/threat-
research/2016/04/rollout...](https://www.fireeye.com/blog/threat-
research/2016/04/rollout_or_not_the.html)

~~~
obstinate
A_ton of games do_this and it_is_incredibly annoying. I don't want to download
an update, then have to download an update._I_only wish_the_same_restriction
applied to my Android device.

~~~
justinhj
Most_likely most games are updating_only game_related data and graphics files.
Very few games actually_use_internal scripting that_would be needed to do code
updates

~~~
Angostura
The only app I've_got that appears to actually update_itself without going
through_the_AppStore_is the HSBC mobile_banking app. I'd be interested in
hearing_the discussions going on between Apple_and HSBC at the moment.

~~~
algesten
Judging by how_sluggish and annoying the HSBC app_is, I think it is_a web_app
framed in a thin launcher_from the app_store.

I.e. it_downloads a bunch_of javascript/html/css and that executes within_a
UIWebView/WKWebView. Using caching_and localStorage, you can construct such_an
app_to not need_to_download_everything on_each launch.

The reason_that's_allowed is_because_everything executes within a sandboxed
browser environment._No_native code is downloaded.

~~~
mikeash
> The reason that's_allowed is because everything_executes_within a sandboxed
> browser_environment. No native code is_downloaded.

That's the same thing Rollout does._In fact,_iOS apps__can 't_ download and
run native code. The OS won't let you_mark pages as executable unless they're
appropriately_signed, and only Apple_has those_keys.

~~~
orbitur
If_they're using JSC,_then_they can_definitely download JS and execute native
methods. They_could subclass_any UIKit object and make it_conform to JSExport.
Done, now_they're_"running native code."

~~~
mikeash
Sure, and an app_displaying a web page using Web