App Store features app that crashes unless tracking is permitted | Hacker News Reader

App Store features app that crashes unless tracking is permitted

twitter.com

56 pointsApocryphon15 comments

The MacOS App Store recently highlighted in a curated list a color picker app that doesn’t grab the actual color. There are plenty of reviews complaining about the problem and I confirmed it doesn’t work properly.

How does the App Store manage to be so trigger-happy with banning apps that it seems like every week there's a story of a legitimate developer being unjustly banned from it, while simultaneously so lax that apps like this one get approved?

the cynic in me thinks: You mean walled gardens of monopolies governed by AI get it wrong? No!

These companies have like 0.002% good jobs filled by good programmers who launch products that are usually copies off whatever the community has worked out already is a good idea. Kinda like the car companies, and big movie companies who all seem to be creating a *flix oreitated studio now. These products get "innovated" out (of usually some small startup they can easily swallow) to be refined and honed by an army of low skilled workers who churn it out. Your monolopies protect your own incompetence.

Sure there are exceptions to the rule; but i can also imagine the talent who built these tools is long gone and they are being used by a bunch of comparative armatures who the company is more then happy to let fumble with because monopoly.

It doesn't need AI/ML to do a sanity check.

As to the data collection, Apple clearly states that’s what the developer claims the app does. Given the existence of encrypted connections, I don’t think they can do better than that without doing a code review, and even then, if the app happens to have a legitimate reason to send personal data to a remote server, they wouldn’t be able to verify that that server doesn’t store it.

As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist.

If they obfuscate such behavior enough, I think it can be very hard to discover it.

I wouldn’t know how likely that is, but it wouldn’t surprise me if there were apps out there that do such things.

But yes, it also could be sloppy app review. That might be more likely.

It's not even just an app slipping through review. It was featured!

> As to the crashing: the app _might_ do all kinds of shenanigans to make it through the app store approval process. Things I can think of are that it may work fine with tracking disabled until a given date, or when used within Apple’s IP address range, or when in Cupertino, or if a remote call it makes tells it so, or when some server or DNS entry exists or does not exist.

Just like Volkswagen did. Short of providing Apple your code and then perusing through it each time (which isn’t feasible), they can’t catch everything.

Now, a featured app? They really messed up here.

_If_ this app did that kind of thing, I don’t see much of a difference. You can’t expect them to catch it at review. If picking it for being featured happens closely in time to that (likely, IMO) you can’t expect them to catch it at that time, either.

That leaves them being paranoid, and periodically rechecking all featured apps. Even if they do that, there still will be a time window in which the app misbehaves.

Sounds like the vaunted App Store review isn’t all that it’s cracked up to be.

If an app can make a http request, parse the response, and do different things depending on the result, it’s hard to prove it won’t crash on receiving invalid input without access to the source code (often even with access to it. If that were easy, there wouldn’t be that many vulnerabilities from exploiting such crashes)

If Apple required the source code, I predict an outcry “they’ll steal our code, just as they steal our ideas”.

And no, LLVM Bitcode won’t help here, even ignoring (AFAIK) that they don’t require you to provide it (which would lead to another outcry “we can’t use gcc”) It’s too low level for that.

To paraphrase Mike Masnick: moderation at scale is basically impossible.

Correction: Automated moderation is basically impossible.

It's not like Apple can't afford to hire code review engineers.

Their products are supposed to be more expensive and better, not just more expensive.

And I stressed out about the label to make sure to interpret every question against us to include even the smallest things; when I could just have taken the easy route and maybe added the most obvious points or none at all…

It's particularly remarkable that an app crashes because of a network error, as if nobody ever considered that sporadic outages happen. Sloppy stuff.

There is no value in this app if its primary function - collecting user data - doesnt work properly, thus no point validating in environments preventing that functionality.

Reply on news.ycombinator.com