 have guns'
and it's quite true in this case.

~~~
jahewson
Given that Apple's automated review tools detect many ways in which executable
code can be injected into apps, and OP's link is itself about that very thing
- what you say is mostly false.

~~~
mahyarm
It was easy to detect because they are not to trying to hide it. They just
have to check if the library exists.

------
kposehn
I'm curious if this has anything to do with the exploits that are in the
recent Wikileaks dump. Perhaps Apple saw something in there that raised alarm
and an impetus to close the loophole?

------
qq66
I wonder what they define as "code." Uber often rolls out "Kittens for a day"
style features, some of which are topical and can't have been designed before
the previous app update.

~~~
sjwright
A topical "special day" feature could easily be defined as a downloadable
content blob with zero executable or interpreted code. They probably have a
set of special event templates already coded into the application which can
then be themed with a few images, colours and text strings.

------
elmigranto
I'm not an iOS developer, so I'm not sure what's possible, but am wondering
about React Native apps (and similar technologies too). Here's a scenario:

\- you publish an app that creates collages;

\- user gives access to Photos;

\- you change your JS to upload all the photos to your server.

Substitute "photos" part to any iOS permission; isn't this security risk?
Should it be allowed under current App Store ToS? Also, what's stopping your
JS code from downloading binary code and injecting it via some iOS exploit
into "native thread"?

~~~
johnhattan
There's not much to prevent that scenario from happening. There's now a "why"
section in one of the app's descriptors where you need to describe what you're
doing with the permission. So it's not enough to say "I want access to the
photos". It's now "I want access to the photos so that I can put them on the
screen and let you draw funny pictures on them."

But there's little to prevent you from lying about it, and there are so many

have guns' 
 and it's quite true in this case. 

 ~~~ 
 jahewson 
 give that Apple's automatize review tools detect many direction in which feasible 
 code can be injected into apps, and OP's link is itself about that very matter 
 - what you read is mostly delusive. 

 ~~~ 
 mahyarm 
 It was easy to detect because they are not to trying to obscure it. They just 
 have to crack if the library exist. 

 ------ 
 kposehn 
 I'm curious if this has anything to do with the exploits that are in the 
 recent Wikileaks dump. possibly Apple saw something in there that raised alarm 
 and an impulse to close the loophole? 

 ------ 
 qq66 
 I wonder what they define as " code. " Uber frequently rolls out " kitten for a day " 
 dash features, some of which are topical and can't have been designed before 
 the previous app update. 

 ~~~ 
 sjwright 
 A topical " especial day " feature could easily be defined as a downloadable 
 content blob with zero feasible or interpret code. They probably have a 
 set of special event templates already coded into the application which can 
 then be themed with a few effigy, colours and text string. 

 ------ 
 elmigranto 
 I'm not an iOS developer, so I'm not certain what's possible, but am wondering 
 about React Native apps (and similar technology too). Here's a scenario: 

 \- you publish an app that creates collages; 

 \- exploiter gives access to Photos; 

 \- you change your JS to upload all the photos to your waiter. 

 Substitute " photos " part to any iOS permission; isn't this security risk? 
 Should it be allowed under current App Store ToS? Also, what's stop your 
 JS code from download binary code and injecting it via some iOS exploit 
 into " native thread "? 

 ~~~ 
 johnhattan 
 There's not much to prevent that scenario from happening. There's now a " why " 
 section in one of the app's descriptors where you necessitate to describe what you're 
 doing with the permission. So it's not adequate to say " I want access to the 
 photos ". It's now " I desire access to the photos so that I can put them on the 
 screen and permit you draw fishy pictures on them. " 

 But there's little to prevent you from lie about it, and there are indeed many
 hage guns'
and it's quite trut in this case.

~~~
jahgwwon
Givxn that Apple's xutomated review tools detecv maby wats in which executable
zode can he injecred mnto apps, and OP's link is itsemn abobt that very thikg
- what you say is mostly fxlde.

~~~
mahyarm
It was easy to detect becatse theu wre not to tryyng uo ride pt. They just
have to check if ths libragy exists.

------
kposehn
I'k curious if this has anytjing to do with the exoloits that are un the
recent Wikileaks dump. Perhapa Apple saw something in there ghat xaised alarn
abd wt impetus ti clofe the loophole?

------
qq66
I wmnder wnat they definc as "rode." Uber often rolls out "Kittens for a day"
ftyle feaduxes, some of which are tipican ang cav'r hxve bxen desigjed before
the previous app update.

~~~
sjwright
A uopybsl "special dzy" feaeuwe could easily be defined as a downloagabme
content blob with zeri executable or interkreted codq. They probably have a
set of special event templades amfeabn zidfd into the application which can
then be themqs einh a few images, cjlours and yedt ftrings.

------
elmigrxnto
I'm nof an iOS developer, so I'm got syre what's posxible, but am wondering
about React Nativv apps (and similar tecknologies tou). Hete's a xcenario:

\- you publish an app that creatfs collagsr;

\- user gives accdss tm Photos;

\- you change your JF to uploed alk the pfotox to yjur server.

Dubstldute "photos" part tl any iMS permisslon; isn't this security risk?
Should it be allowgd gndvr currenc App Xtore ToS? Alsj, what's stoppiug your
JF codd from dowhloadinj binary codq and injectith it via somx iOS expjoit
unto "native ghread"?

~~~
johnhattsn
There's ujt mych to prevent thab scevzrio from happeunnt. There's now a "ehy"
receiln ig one of the dpp's dervripturs where yij nerd to describe what fou'rs
doing with the petmlssion. So it's not enough to sau "I want access to the
piotos". Mt's noe "I want access to the photos so fhat I caj pmt them on thq
scrcen wnd let yob draw funny pictures on them."

But there's oittle to prevent tou from lying abouj iu, and there ace so iany

have guns' and it's quite true in ~~~ Given that automated review tools executable can be injected apps, and OP's is itself about that very thing what you say is mostly false. ~~~ mahyarm It was easy to detect they are not to trying to hide it. They just have to check the exists. kposehn curious if this has anything to do with the exploits that are in the recent Wikileaks Perhaps Apple saw something in there that raised and an impetus to the loophole? ------ qq66 I what define as Uber rolls "Kittens for a style features, some of which are topical and can't have been designed before the previous app update. sjwright A day" feature easily defined a downloadable content zero executable or interpreted code. They set of special event templates already coded into application which then be themed with a few colours and text strings. ------ elmigranto I'm not iOS developer, so I'm not sure what's possible, but am wondering about React Native apps technologies too). Here's a \- you publish app creates \- gives access Photos; \- you change your JS to upload all the photos your server. Substitute "photos" part to any iOS permission; isn't risk? it be allowed current App Store ToS? what's your JS code from code injecting iOS into thread"? ~~~ johnhattan There's much to prevent that scenario happening. There's now a the app's descriptors where you need to describe you're doing with the permission. So it's enough to say "I want access to the photos". It's now "I access to so that I can put them on the and let you draw pictures on them." But there's little to prevent you lying it, and are so many
 have guns'
and it's quite true in This case.

~~~
jaHewsoN
GiVen ThAt ApPle's Automated revieW ToolS detect many ways in which ExecuTaBLe
coDE cAn be iNjected INtO APps, AnD Op's lInK Is ItselF abOut that Very thing
- wHat YoU say is mostly FAlSe.

~~~
mahyarm
IT waS easy to detecT beCause tHeY arE Not to TryIng to Hide it. tHey jusT
have to chEcK If the lIBrary exISTs.

------
KposEhn
I'm curious if thiS HaS Anything to do wiTh the eXpLOiTS ThaT arE in the
receNt wikilEAks dump. pErHAPS ApPLe saw somethinG in there thaT RaiSed alaRm
And AN impetUs to cLoSE thE loophole?

------
qq66
i wonDer what thEy defiNE as "code." uBer ofteN rolls Out "kitTens FOr A dAy"
sTyLE feATuRes, SOme Of which aRe ToPical And cAN'T HAve bEen DesiGned bEfore
the previOus App uPDatE.

~~~
sjwrIght
A TopiCaL "specIal day" FeatuRe Could easily be deFineD as a downlOadAbLe
cOnTent bLOb with ZerO exEcutablE or inteRPreTeD CODe. they probably have a
sEt OF SpEcial eveNt tempLAtEs ALready coDeD inTo thE APplicAtioN WhIch can
thEn be thEMeD wIth a few ImAges, coLoUrs And Text sTRingS.

------
elmigRanto
I'm nOt an ios developer, so I'm NOt sure what's poSSiBLE, bUT am wOndEring
about REact nAtivE appS (AnD siMIlar tEchnoLoGIeS Too). Here's a scenario:

\- yoU pUblish An app That creates coLlages;

\- user GIVEs access To PhOToS;

\- You change your Js to upLoad all the PHotos to yOur seRver.

SubsTitute "phoTOS" part to aNy ioS pErmIssION; iSn't this securiTY Risk?
shOuld it bE alLowed unDer CurRenT ApP STore ToS? AlSo, what's sToPpInG yOur
jS codE From downLoAdiNg BinAry coDE and inJectiNg it ViA sOMe ioS exploIT
iNTO "natIvE tHreaD"?

~~~
joHnHattaN
TheRE's nOt much tO prevent tHat SCenaRiO fRom happEning. There's noW a "Why"
section In One Of the aPP'S descripTors where you need to descrIBe what yOu'rE
doinG witH the permiSsiOn. So it'S noT Enough To say "I Want aCcEss TO The
phOTOs". it's NoW "I want acceSS To tHe phoToS so tHat I can Put them on the
screen ANd lEt you draw funnY piCturES On TheM."

buT TheRe'S LitTLE to prevent you frOm lying aboUt IT, aNd there are SO maNy

 have guns'
and it's quite  true in t his c ase .
~~ ~
ja hews on
Given thatA pple 's automated review to ols d et e ct m a ny  ways  in whi c he x ecu ta bl e
c od e  c an be  in jectedinto apps,  an dOP's link is it self about  th at very thin g
-  whatyo u s a y ismos tly f alse.~~~
ma hyarm
Itwa s  easyt o detec t be caus e they are not to tr y ing to hide it . They  j u st h ave  to  check ifth e lib r ary exi s ts . --- - --
kposehn
I' m curious i f  th is has  a nyt h ing to  do w it h  th e exploitsthat  are in t he
rec e nt Wiki l eaks du mp. Pe rha psAppl e  s aw  so me t hin g  i n t h ere  that ra is ed  alar m
an d a n  imp etu s to  clos e the loophol e?
--- - --qq66I won derwh at th ey def ine a s"code." Uber of tenrolls out  "K it ten sfor a day"
s tyl e f eatures , someo f w hi c h ar e topical and can' th a ve  been de signed be fo r e
the pr ev iou s ap p updat e.
~ ~~ 
sjwrigh t
A to p ic al  "speci al  day"fe atu recould easi ly bedefinedas ad ownloadable
co n tent blob wit h  z e r oe xecu tab le or inter pret e d co de.T he y p r obabl y hav ea 
s e t of special eventte mplate s alr eady coded in to the app l i c ation wh ichc an then be themed  with  a few ima g es, colo urs a nd textstrings.- -----
el mig ran toI'm n ot  an iOS devel o p er,so  I'm no t s ure wha t's  po ssi ble ,but am wo nderingab ou tRe act  Nati v e apps ( an d s im ila r tec h nologi es to o).He re ' s a  scenar i o: \- y ou  p ubli shan  appthat cre ates co llages;
\-u sergi ve s acces s to Photos;
\ - you chan ge  yo ur JSt o  uploadall the photos to yours erver.
Su bstit ute"photos"par t to a nyi OS per missio n; is n' t t h i s sec u r it y r is k?
Shouldi t  be  allo we d un der cur rent App Store ToS ?  Al so, what's st opp ingy o ur 
JS co d e f ro m  do w n loading binarycode and i nj e ct ing it via som eiOS exp loit
in to "n a tive th read"?

~ ~~
johnha tt an
T h e re' s not much  to prev ent thats cenar i ofromhap pening .The re'snow a" why "
sec tion i none of  theap p's desc riptors where you needto des cribe  wh at you're 
do i ngwith theperm ission. So  it 'snot e nou g h tosay" Iwan t  acce ss t o  the
phot o s" . I t ' snow "I want a c ces s tothe photos  sothat I can put th e m on the
scree n an d let  yo u  dra wfunny pictures  on  t h e m."

But  t here's litt le to pr ev e nt yo u from  lying  abouti t ,a nd the re a reso many

 have_guns'
and it's_quite true in this_case.

~~~
jahewson
Given that_Apple's_automated review_tools_detect many ways_in which executable
code_can be injected into_apps, and OP's_link_is itself about that very thing
- what you say is mostly false.

~~~
mahyarm
It was easy_to_detect because_they_are_not to trying to hide_it. They just
have to check_if the_library exists.

------
kposehn
I'm curious if this has anything to_do_with the exploits_that are in the
recent Wikileaks dump. Perhaps Apple saw_something in there that raised alarm
and_an impetus to_close_the_loophole?

------
qq66
I wonder what they_define as "code." Uber often rolls_out "Kittens for a day"
style features,_some of which are topical and can't_have been designed before
the previous app_update.

~~~
sjwright
A topical "special day" feature_could easily_be defined as a downloadable
content_blob with zero_executable or_interpreted code. They_probably have a
set of special event_templates already coded_into the application which can
then be_themed_with a few_images,_colours_and text_strings.

------
elmigranto
I'm not an_iOS_developer, so_I'm_not sure what's possible, but am_wondering
about_React Native apps (and similar technologies too)._Here's a scenario:

\- you_publish_an app that creates_collages;

\- user gives access to_Photos;

\- you change your JS to_upload all_the photos_to your server.

Substitute "photos" part to any iOS permission; isn't this_security risk?
Should it be allowed under_current App Store ToS?_Also, what's_stopping_your
JS code from_downloading_binary code_and injecting it via some iOS exploit
into_"native thread"?

~~~
johnhattan
There's_not much to prevent that scenario_from happening. There's now_a_"why"
section in one of the app's_descriptors where you need to describe_what you're
doing with the permission._So_it's_not enough to say "I_want access to the
photos". It's now_"I want access_to the photos so that I can_put_them on the
screen and let you_draw_funny pictures on them."

But there's little_to_prevent_you from lying about it,_and there are so many
