Comment by sixstringtheory | Hacker News Reader

Comment by sixstringtheory | Hacker News Reader

Parent Full thread

sixstringtheory

It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing.

EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem.

[0]: https://github.com/signalapp/Signal-iOS/issues/641

[1]: https://core.telegram.org/reproducible-builds#reproducible-b...

It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).

While I'm not an expert on push notifications, shouldn't you be able to receive push notifications if you entitle your application for them and create the right certificate online?

This is my understanding. You would have to register your device in ADP and create an ad-hoc certificate for the app. If people are doing this on their own ADP accounts, then they're just testing their own builds, not receiving an enterprise deployment from some single developer.

Apple does allow self-hosting enterprise apps, one of the main distribution methods for in-house apps is buying a license from Apple to install your own certification on iOS and MacOS devices which will let you basically remotely install, update and sideload in-house applications.

We personally opted out of it because the user's device's security would ultimately fall into our hands and at worst we have a root kit on the user's device someone might exploit.

FWIW, in iOS 13 Apple has finally made it so you can firewall off user personal device control from MDM control https://www.brianmadden.com/opinion/Apple-iOS-13-user-enroll...

If you install from an App store and want to know if it matches the source, you need to pull the installed package from your phone and compare the contents to your own known good binaries.

Ideally, if the builds are fully repeatable, the only differences should be in the signatures, but of course, you need to confirm that the signature doesn't drive unexpected differences in behavior.

I don't have the skills or the tools to do this, but it's not like it's some impossible mystery.

In order to do what you’re suggesting you have to jailbreak a device, which I mentioned in my comment and is discussed in many blog posts such as [0], which links to others.

Without a jailbreak, which isn’t a sure thing and even if available is not nearly as feasible as sideloading, it in fact is an impossible mystery to decrypt an iOS app store build to inspect it.

[0]: https://ivrodriguez.com/reverse-engineer-ios-apps-ios-11-edi...

Well, can’t the vendor upload the binary that was signed by Apple’s private key? So all you’d have to do verify it would be to compile the source code to produce the exact same binary... assuming that the process can be made to be deterministic?

Yes exactly that. I imagine vendor signing causes some issues there as well.

Reply on news.ycombinator.com