Hacker News Reader

Comment by olivercameron | Hacker News Reader

With all of Flash's security issues, I am not surprised Apple doesn't let native Flash apps on their own store.

I think the security issues for flash in-browser (mobile safari) are more troublesome than security issues for apps in the app store.

Apple can (in theory) validate that the things going through the app store aren't total malware. In-browser? You're on your own, for good or for bad.

Truly. We should disable JavaScript as well. Who knows what AJAX vulnerabilities might be in mobile Safari? Apple can't vet them all for malware. On that token, Apple can't vet all websites to make sure that their content doesn't misrepresent Apple as a company. They should probably just trash Mobile Safari altogether.

But at least Apple can fix bugs when it finds them in its own products, whereas if there's a giant Flash security hole it can do nothing to fix it.

The security model for AJAX is open, well-documented, and peer-reviewed. Safari implements the same-origin policy, various CSRF-mitigation standards, and tends to be updated quickly once exploits are found.

I didn't say that Apple should or shouldn't do anything. Just that apps from the App Store are potentially safer than things in-browser. Of course JavaScript apps pose similar risks, but as Apple controls the JS engine (unlike the Flash runtime) they feel safer that way.

Reply on news.ycombinator.com