Hacker News new | ask | show | jobs
by threeseed 2128 days ago
Due to the way iOS works (dynamic dispatch) private APIs can only be prevented through an App Store review process.

And many of those APIs can be used to extract enough information to fingerprint the device, determine your location or steal your data e.g. accessing the list of WiFi networks or browser history.

So no. The two concerns are very much related.
4 comments
brmgb 2128 days ago
> Due to the way iOS works (dynamic dispatch) private APIs can only be prevented through an App Store review process.

That's complete nonsense.

Dynamic dispatch has nothing to do with the ability or not of a program to access API. Dynamic dispatch is the selection at runtime of the correct version of a polymorphic function. Obviously, you can sandbox programs written in languages using dynamic dispatch.

link
threeseed 2128 days ago
Be curious how you plan to prevent access to Apple's private APIs in Objective-C, which uses dynamic dispatching, without breaking existing code.

I am sure Apple would love to know how you've managed to solve this.

link
gpderetta 2128 days ago
sign existing code.
link
ben_w 2128 days ago
They do, this is an argument about how they decide when it is OK to sign that code.
link
t0mas88 2128 days ago
You could easily argue that Apple has built an OS that is deeply broken and insecure if they aren't able to technically enforce permissions of apps to do certain things. Virtually any other OS has that capability.
link
gridlockd 2128 days ago
They can't be prevented reliably even through the App Store process - that's simply impossible.

The point of a private API not security, it's to distinguish between the public interface that is meant to be stable and implementation details that might change.

They might do some rudimentary checks to catch obvious usage of private APIs, but it's not part of the security model and still apps show up on the App Store that use private APIs, all the time.

link
appleflaxen 2128 days ago
they are related because apple plugged one process into the other.

but there is nothing intrinsic to their operation that requires it, and apple could un-plug it.

this is like apple arguing that IE is central to the fabric of windows, and can't be removed during the european antitrust suit.

it's dishonest, but apple will likely make the same claim.

link