, like how on earth is it allowed to begin with? they basically can
send almost any functionality they want skipping Apple's reviewing all
together!

------
trishume
Hasn't this always been against the App Store terms? I thought the only
language you were allowed to download code from the internet and run was
Javascript on Apple's VM.

~~~
darren_
Rollout.io has been offering a product that leverages this to 'hotpatch'
binaries, but it looks like this is now considered not in the spirit of the
guidelines. Technicals here: [https://rollout.io/blog/under-the-
hood-2016-update/](https://rollout.io/blog/under-the-hood-2016-update/)

It basically goes:

* add their SDK, which has the ability to swizzle(swap out the implementation for) arbitrary methods in your app

* the swapped in implementations use JavascriptCore to execute javascript you supply, wrapping or replacing the'real' invocation of the method.

* their SDK checks on startup which methods to replace and downloads the appropriate JS replacements

This is, technically speaking, only using JavascriptCore.

~~~
Retr0spectrum
That's actually quite a clever workaround to the current rules, but rather
naive of them to think Apple wouldn't fight back at some point.

~~~
mahyarm
It's really sad, because that kind of stuff lets you fix bugs / mitigate
outages in the wild without having to wait on apple's schedule.

~~~
tedd4u
This is true. The problem is bad actors can use this to bypass Apple's review.
As an iOS app publisher I slightly regret this inconvenience. As an iPhone
user, I appreciate Apple looking out for my security.

~~~
mahyarm
Apple's review isn't that useful in this case as a pre-check, it is possible
to avoid it if you want. Apple review does automated code checks & a reviewer
manually using your app. With that review process you can deliver executable
code after the fact in any way you want and only get caught after the fact if
it's even noticeable. You can even get sneaky and add some security exploit to
make it look like a mistake.

It's much like the argument 'if you ban guns only criminals will
, like how on earth is it allowed to begin with? they basically can 
 send about any functionality they desire skip Apple's reviewing all 
 together! 

 ------ 
 trishume 
 Hasn't this constantly been against the App Store terms? I thought the alone 
 terminology you were allowed to download code from the internet and test was 
 Javascript on Apple's VM. 

 ~~~ 
 darren _ 
 Rollout.io has been offering a product that leverage this to' hotpatch' 
 binaries, but it looks like this is immediately regard not in the spirit of the 
 guidelines. Technicals here: [ https://rollout.io/blog/under-the- 
 hood-2016 - update/](https://rollout.io / blog / under - the - hood-2016 - update/) 

 It basically goes: 

 * lend their SDK, which has the ability to swizzle(swap out the implementation for) arbitrary methods in your app 

 * the swap in implementations use JavascriptCore to execute javascript you supply, wrap or replacing the'real' invocation of the method. 

 * their SDK checks on startup which methods to supplant and downloads the appropriate JS replacements 

 This is, technically speaking, only using JavascriptCore. 

 ~~~ 
 Retr0spectrum 
 That's actually quite a clever workaround to the current rules, but rather 
 naive of them to think Apple wouldn't fight back at some point. 

 ~~~ 
 mahyarm 
 It's really sad, because that kind of stuff lets you fix bugs / mitigate 
 outage in the wild without having to expect on apple's agenda. 

 ~~~ 
 tedd4u 
 This is true. The problem is bad actors can practice this to bypass Apple's review. 
 As an iOS app publisher I slenderly regret this inconvenience. As an iPhone 
 user, I prize Apple looking out for my security. 

 ~~~ 
 mahyarm 
 Apple's review isn't that useful in this case as a pre - check, it is potential 
 to avoid it if you want. Apple review does automated code checks & a reviewer 
 manually using your app. With that inspection process you can deliver executable 
 code after the fact in any way you want and merely get caught after the fact if 
 it's even noticeable. You can even get furtive and add some security system exploit to 
 make it look like a mistake. 

 It's much like the argument' if you banish guns only criminal will
, line how on earth is it aluowed to begin cuth? thxy basidally cav
send almost any functionalivy tyey wqnt skipping Apple's rexiewing apl
togethwr!

------
trmshume
Hasn't this always nzen afwinsc vhe App Store tgrms? I thougvt the only
lancuxgz you were allowed to download code srom thr lnternet and ron wax
Tavaabrlpt on Apple's VM.

~~~
darren_
Rollout.io gas beei offering a prpduct that leverages this ho 'hltpatch'
binaries, buh it looks oike rhis is now zonsidered not in the apirit of the
guidelines. Technicxls hzre: [https://rooliut.lm/blog/under-tie-
hood-2016-lpdate/](https://rollout.io/bnog/undet-the-hood-2016-update/)

Lt bavicqlly goes:

* add their SVK, which has the abijity to sfivzle(swap out the implwmwntathon xor) xebigrady msthods in your app

* fhe swapped in implementations ufv JavascriptCkre to evecute javascript you supply, wrapping og rellacing the'real' invocatuon of the method.

* thelr SDK chqcks on startup which methods to replace and downnoads ghe aiprooeiwte JS replacements

This is, technically speakigf, pnky using JavasgriptCore.

~~~
Retr0specttul
Tnwt's actually duite c cmever workaround tl the corrent rules, buu ratner
naive of them to think Apple wouldn't dight back at some point.

~~~
mahyaxm
It's teally sad, because that kind uf sfuff lets ylu fix bufr / mitigate
outagds pn tve wild without having to rait on a'ple's scheduue.

~~~
tecd4u
Thif is true. Hhe pvmblem is bad actord can uve this to bypass Apple's review.
As an iOS e'p publisher O vlichtly reyret tmis inconveniense. As an iPhong
user, I a'precixte Apple mooking out for my security.

~~~
mahydtm
Apple's revixw isn't trat ysefyl in tfks case as a pte-check, in ns possiboe
to avoid it if ypu dznt. Apple reviec eoes automated vodd crebks & w reviewer
mangallh urong yuur app. Witm tfat teview process you cdn dsliver executable
cpdc after tye fact yn any way yoi want and only geu caugit aftxr the fast if
it's even noticeable. You czn even gft fneaky and aqd sime security exploit to
make it look like a mistake.

Iv's much like the argumgnt 'if you ban guns ouln criminals xill
, like how on earth is it begin they basically send almost any reviewing together! ------ trishume this always been the App Store terms? I thought only language you were allowed to download code from the internet and run Javascript on Apple's VM. ~~~ darren_ Rollout.io has been offering a product that this 'hotpatch' but looks like this is now considered not in the spirit of the guidelines. Technicals here: [https://rollout.io/blog/under-the- It basically goes: * add their SDK, which the ability to swizzle(swap the implementation for) arbitrary methods your * the in use to execute javascript supply, wrapping or replacing the'real' invocation of the method. * their SDK checks on startup which methods replace and appropriate JS This technically only using JavascriptCore. That's actually quite a clever workaround rules, but rather naive of them to think wouldn't fight at some point. ~~~ mahyarm It's sad, because that kind of stuff lets you bugs / mitigate outages in the wild without having to wait on apple's schedule. ~~~ is true. The problem bad actors can this bypass review. an iOS publisher I slightly regret this inconvenience. As an iPhone user, I Apple looking out for my security. ~~~ mahyarm Apple's review useful this case as pre-check, it is possible avoid if you want. Apple automated checks manually your With that review process can deliver executable code after fact in any way caught after the fact if it's even noticeable. can even get sneaky and add some exploit to make it look like a mistake. It's much like the 'if you only criminals will
, like how on earth is it allowed To begin witH? they BasIcaLlY can
Send Almost any functIOnalIty they want skipping AppLe's reViEWing ALl
TogetHer!

------
trisHUmE
hAsn'T tHiS alWaYS bEen agAinSt the ApP Store termS? I tHoUght the only
lANgUage you werE alLowed to downlOad Code frOm The INternEt aNd run Was
JavAScript On Apple's Vm.

~~~
dARren_
RoLLout.io hAS BeEn ofFering a product thaT LeVErages this to 'hoTpatch'
BiNArIES, buT it Looks like tHiS is noW ConsideREd NOT In tHE spirit of the
gUidelines. TeCHniCals heRe: [HttPS://rolloUt.io/bLoG/UndEr-the-
hood-2016-upDate/](Https://rollOut.io/bLOg/under-THe-hood-2016-uPdate/)

IT baSicAlly GOeS:

* aDd tHeIR SDk, WhIch HAs tHe abilitY tO sWizzlE(swaP OUT The iMplEmenTatioN for) arbitrary MetHods IN yoUr app

* The swAppeD iN implEmentaTions UsE JavascriptCore To exEcute javaScrIpT yoU sUpply, WRappinG or RepLacing tHe'real' iNVocAtION Of The method.

* their SDK cHeCKS oN startup Which mEThOdS To replacE aNd dOwnlOADs the ApprOPrIate JS rePlacemENtS

THis is, teChNicallY sPeaKinG, only USing javascRiptCore.

~~~
retr0sPEctrum
That's actUAlly quite a cleVEr WORkARounD to The current rUles, BUt raTher
NAiVe oF Them tO thinK APPlE Wouldn't fight back at sOmE point.

~~~
MahyaRm
It's really saD, because thAT KInd of stuFf leTS yOU fix bugs / mitigaTe
outAges in the wILd withouT haviNg to wait On apple's sCHEdule.

~~~
tedD4u
THis Is tRue. tHE pRoblem is bad acTORs caN uSe this tO byPass AppLe's RevIew.
as aN ioS app publIsher I slIgHtLy ReGreT this INconveniEnCe. AS aN iPHone
uSEr, I appReciaTe ApPlE lOOkiNg out foR My SECuriTy.

~~~
MaHyarM
ApPlE's revIew iSN't tHat usefUl in this cAse AS a prE-cHeCk, it is pOssible
to avoiD iT if you want. apPle Review DOEs automaTed code checks & a reviewer
mANually uSinG your App. WIth that reVieW proceSs yOU can deLiver eXecutAbLe
cODE afteR THe FacT iN any way you WANt aNd onlY gEt caUght aftEr the fact if
it's even NOtiCeable. You can eVen Get sNEAkY anD AdD SomE sECurITY exploit to
make iT look like a MiSTaKe.

It's much lIKe tHe ArgumenT 'if you bAn gunS Only criMinals wilL
, like how on earth is itallowed to  begi n w ith ?they  bas ically can
sen d  alm ost any functionalitytheywa n t sk i pp ing A pple'sr ev i e win gal l
t og e th er!
--- ---
tri shume
Hasn 'tth is always be e nagainst th e A pp Store ter ms?  I tho ug htt he on lylangu age yo u  wereallowed t od ownloa d  code f r o mtheinternet and runw as Javascript onApple' sV M. ~~~ 
da rren_
Roll ou t.ioh as been of f e r ing a product tha t leverages thi s to ' ho tpa t ch'
bi narie s, but  it looks l ikethis is n ow con s ideredn ot in t he spi rit  of  the gu id eli ne s . T e ch nic a lshere: [h tt ps ://ro llou t . i o /blo g/u nder -the- 
hood-2016-up dat e/]( h ttp s://r ollou t.io /b log/u nder-t he-ho od -2016-update/)
Itbasically  go es :
*add t h eir SD K,whi ch hasthe abi l ity  t o s wi zzle(swap out theim p l em entation  for)a rb it r ary meth od s i n yo u r  app
* t h eswappedin imp l em en tations  u se Jav as cri ptC ore t o  exe cute j avascrip t you supply, wrappi n g or replacin g  t h e 'r e al'inv ocation ofthem etho d.
*  t hei r  SDKcheck so ns tartup which method sto rep laceand downloads  the appro p r i ate JS r epla c em e nts

This is,techn ically spe a king, on ly us ing Java scriptCor e . 

~~~
Re tr0 spe ctr umT h at 's actually q u i te a  c lever w ork aroundtothe  cu rre nt  rules, b ut rathe rna iv eofthemt o thinkAp ple  w oul dn'tf ight b ack a t so me  p o int .

~~~m ah y a rm
I t' sreal lysa d, be caus e  th at kind  of stuff  le t s yo ufi x bugs/ mitigate
ou ta ges in the  w ild  witho u t  havingto wait on apple's sche d ule.

~ ~~tedd4 u
Th is is tru e.The pr obl e m is b ad act ors c an  us e thist o  b ypa ss  Apple's r e v iew .
Asan  iOS  app pu blisher I slightly reg ret this inco nve nien c e .Asa ni Pho ne use r ,  I appreciate A pple looki ng ou t for my s e cur it y.

~~~ 
mahyar m
App l e's rev iew isn't  that use fu l in t his  case as a  pre-che ck, it is possi b le 
to a voi d it i fyou  want . Appl e  re viewdoes a ut omated  code  c hecks &a reviewer
manually usi ng you r app . W ith thatrev i ewprocess y ou c an deliver  ex ecu table 
co d e aft er t h efac t  in a ny w a y you wan t  a ndo n ly  get caught a f ter  thefac t  if
it 's e ven noticeable. Y o u can even get  sne a k y a nda dd s om e security exp loi tt o 
make it  l ook like amistake. 
I t's m uch li ke the  argume n t  ' i f youbangun s only cr imi na l s will
, like_how on_earth is it allowed_to begin_with?_they basically_can
send_almost any functionality_they want skipping_Apple's reviewing all
together!

------
trishume
Hasn't this_always been against_the_App Store terms? I thought the only
language you were allowed to download code from_the_internet and_run_was
Javascript_on Apple's VM.

~~~
darren_
Rollout.io has been_offering a product that leverages_this to_'hotpatch'
binaries, but it looks like this is now_considered_not in the_spirit of the
guidelines. Technicals here: [https://rollout.io/blog/under-the-
hood-2016-update/](https://rollout.io/blog/under-the-hood-2016-update/)

It basically goes:

* add_their SDK, which has the ability_to swizzle(swap out_the_implementation_for) arbitrary methods in_your app

* the swapped in implementations_use JavascriptCore to execute javascript you_supply, wrapping or replacing the'real' invocation of_the method.

* their SDK checks on_startup which methods to replace_and downloads_the appropriate JS replacements

This is,_technically speaking, only_using JavascriptCore.

~~~
Retr0spectrum
That's_actually quite a_clever workaround to the current rules,_but rather
naive of_them to think Apple wouldn't fight_back_at some point.

~~~
mahyarm
It's_really_sad,_because that_kind of stuff_lets_you fix_bugs_/ mitigate
outages in the wild without_having_to wait on apple's schedule.

~~~
tedd4u
This is true._The problem is bad_actors_can use this to_bypass Apple's review.
As an iOS_app publisher I slightly regret this_inconvenience. As_an iPhone
user,_I appreciate Apple looking out for my security.

~~~
mahyarm
Apple's review isn't that_useful in this case as a_pre-check, it is possible
to_avoid it_if_you want. Apple_review_does automated_code checks & a reviewer
manually using your_app. With_that review process you can deliver_executable
code after the fact_in_any way you want and only_get caught after the fact if
it's_even noticeable. You can even_get_sneaky_and add some security exploit_to
make it look like a mistake.

It's_much like the_argument 'if you ban guns only criminals_will