7 ms·
Libraries Used in the Top 100 iOS Apps
- gorena 11y agoScary how many of these are obsolete or outdated. "Bolts-iOS" is a dependency of "facebook-ios-sdk", which means that 19 of the top apps are using an outdated version of the Facebook SDK that predates Bolts, and might be vulnerable.
- NateLawson 11y agoYep, there are tons of SDKs being used that aren't actively maintained like ASIHTTPRequest on iOS, for example. There are two reasons we've found: 1. App was written a while ago and is only in maintenance mode 2. Developer got started early on and hasn't kept track of the industry The latter often happens with internal dev kits, where someone drops a static library in (say, to add a wrapper) and then never updates the dependency. New apps inherit it when they use the internal dev kit.
- joshavant 11y ago4 of the top 100 iOS apps are STILL using ASIHTTPRequest? ಠ_ಠ
- ianstallings 11y agoBecause they're not going to rewrite or replace code that already has been tested and works in production.
- gorena 11y agoUsing an unmaintained networking stack should terrify you.
- Velox 11y agoJust because it's old doesn't mean it's unmaintained.
- plorkyeran 11y agoASIHTTPRequest has been unmaintained for years.
- NateLawson 11y agoCorrect, the banner shows it was last updated in 2011. http://allseeing-i.com/ASIHTTPRequest/ http://allseeing-i.com/ASIHTTPRequest/ Given the problems we found with SSL domain verification in another networking library, you definitely don't want to be using unmaintained code for this. https://sourcedna.com/blog/20150420/afnetworking-vulnerability.html https://sourcedna.com/blog/20150420/afnetworking-vulnerabili... (SourceDNA helps developers secure & improve their apps, and one of the things we identify is out-of-date static libraries.)
- CyrusL 11y agoInteresting sidenote: I saw a reply to this post on Twitter where SourceDNA commented how the makeup of the top 100 apps differs from the long tail of apps: https://twitter.com/SourceDNA/status/652247709655547905 https://twitter.com/SourceDNA/status/652247709655547905 https://twitter.com/SourceDNA/status/652247927289544704 https://twitter.com/SourceDNA/status/652247927289544704 "CocoaPods is less popular in the top 100 apps than the long tail. We see ~180K apps with AFNetworking." "CocoaPods more popular in apps that aren't top 100. Top apps more customized, less third-party code."
- smithclay 11y agoAnyone done any analysis on what top 100 apps are using Swift? Similar to the cocoapods note, my guess is it's catching on much faster with the long tail than the most popular apps.
- tptacek 11y agoThis seems like it should also be an easy question for SourceDNA to answer.
- NateLawson 11y agoDeveloper behavior is pretty varied along a number of angles. Since even indie apps can hit the top ranks (especially in games), it's a little less useful to talk about apps by rank and instead more by company background. Swift is growing but not huge yet. Certainly there has been a flood of experiment apps in the long tail, where someone used it as a learning exercise. Some of the larger companies are using it for a new project once in a while, but it's certainly been most popular in games. What never ceases to surprise me is the influence a single developer can have, even in a large organization. Someone picks up a tool and then suddenly it's used everywhere in the company.
- supster 11y agoFun fact: Lyft is the only top 100 app I've heard of using Swift [1] http://www.fastcompany.com/3050266/tech-forecast/lyft-goes-swift-how-and-why-it-rewrote-its-app-from-scratch-in-apples-new-lang http://www.fastcompany.com/3050266/tech-forecast/lyft-goes-s... [2] http://thenextweb.com/insider/2015/07/17/the-lyft-ios-app-is-now-written-entirely-in-swift/ http://thenextweb.com/insider/2015/07/17/the-lyft-ios-app-is...
- melling 11y agoHere's a curated list of Swift libraries: http://www.ioscookies.com http://www.ioscookies.com And some cool new Swift/Objective C libraries: https://www.ckl.io/blog/9-trending-objective-c-and-swift-ios-libraries/ https://www.ckl.io/blog/9-trending-objective-c-and-swift-ios...
- aresant 11y agoSlightly off-topic but we're in the middle of building an iOS / Android SDK / library to drive improved location services. Does anybody have any solid resources on SDK marketing directly to iOS and Android developers? We've found some innovative ways to address the community (doesn't hurt to have an office packed with engineers to ask where they find solutions) but looking for ideas ranging from the best developer events, to publications, to PR agencies focused on devs, to marketing co's etc. I have been surprised how hard it is to turn up prior-art on this subject.
- magicseth 11y agoWhen we had a top 10 app, we had a check for devices running unreleased OSes and showed them a pop-up.
- smithclay 11y agoCouple of companies come to mind: * Realm.io has successfully positioned themselves as a thought leader in swift development for iOS by producing solid blog content and leading the Swift SF meetups (+ contributing to open-source projects). * Crashlytics/Fabric.io is more interesting -- my experience with them has been entirely word-of-mouth (but they have a big presence at Twitter's developer conference/WWDC/Google IO, too). * Parse generally has interesting, high-quality technical blog content: (https://blog.parse.com https://blog.parse.com).
- NateLawson 11y agoI agree that both Realm and Fabric have done an excellent job reaching out to developers. Fabric went to another level in providing a slick interface to make it easy to drop in and update their SDKs. I'd be excited to see that more generally available, maybe integrated with CocoaPods.
- coldcode 11y agoMy only fear with Fabric is how Twitter's layoffs affected them.
- 11y ago
- chrisBob 11y agoAnyone know what is wrong with the table? When I try to highlight text (so I can find out what Flurry-iOS-SDK is) it lets me click, but then scrolls rappidly to the top of the page when I move the mouse to highlight something (Safari on OS X).
- peterjmag 11y agoWeird, happens for me too (in Safari, but not in Chrome). Perhaps it's something to do with the iframe that it's embedded in? In any case, here's the original gist, which doesn't seem to have the same problem: https://gist.github.com/ryanolsonk/e33bf9e89677da9fe8ce https://gist.github.com/ryanolsonk/e33bf9e89677da9fe8ce
- baddox 11y agoLooks like it's an embed of a CSV file on GitHub, which is cool, since I didn't know GitHub supported that, but they've definitely got some funky JavaScript that doesn't play nice on mobile.
- uwemaurer 11y agoTop libraries for Android apps: http://www.appbrain.com/stats/libraries/dev http://www.appbrain.com/stats/libraries/dev Top ad network on Android sorted by usage: http://www.appbrain.com/stats/libraries/ad http://www.appbrain.com/stats/libraries/ad
- tptacek 11y agoThis is neat. Someone should get Nate Lawson in here; SourceDNA has this analysis for free and paid apps in both app stores, and he's doing it by bringing up binaries to an IR and doing pattern matching.
- cryowaffle 11y agoBe the person you desire
- an4rchy 11y agoI'm surprised Realm is not on here.
- NateLawson 11y agoThe top iOS app with Realm in it is Target, and they're ranked 450 today. So his analysis of the top 100 just missed it.
- timanglade 11y agoAs Nate says, the top 100 changes a lot from week to week. We actually have 3 apps that are routinely in the top 100 these days (Pinterest, Dubsmash & Target) and a few more that can make it depending on releases/advertising (Digg, Zappos, Groupon, Wahoo, Bodybuilding.com,…), and growing pretty fast in that segment considering we only came out about a year ago. Anyway, I think we had 3 apps in the top 100 the week this analysis was made; unfortunately the author cut off the list at SDKs that had 4 or more apps. Next time ;)
- mwcampbell 11y agoI notice that no off-the-shelf web view wrappers (e.g. PhoneGap/Cordova) or non-web-view JavaScript frameworks (Titanium, NativeScript) are in this list. Would Xamarin, RoboVM, or RubyMotion be detectable with this method? Or can we safely assume that all of the top 100 apps are native ObjC or Swift?
- NateLawson 11y agoThe approach Ryan used was to look at ObjC classes, but you're right that many SDKs and tools don't show up there. We actually scan millions of apps from the app stores. Here's a public view of the top 500 in US, and if you choose the cross-platform category, you can see apps like this. For example, "Pac-Man 256" is rank 28 (Unity), Amazon is rank 30 (Cordova), etc. https://sourcedna.com/stats/ https://sourcedna.com/stats/ It's actually very difficult to accurately match code written in so many different languages as compilers discard a lot of the info you need. I spent a lot of time researching and evaluating different ways to fingerprint libraries, as well as reconstruct the boundaries of internal modules when there weren't any symbols. We match code by using a similarity search across all components we've ever seen. Since code written in C can be compiled to x86 or ARM, we disassemble the code into an intermediate language. Then we reconstruct control-flow graphs, data dependencies, and other platform-independent features. We index these in a custom search engine, which allows quick lookup and matching. It's very difficult, but ultimately a really fun problem to solve. Most of our engineers got started with exactly the exercise Ryan did here. :-)
- eljimmy 11y agoI would expect that if an app is popular enough to be in the top 100 then it most likely has the bankroll to pay for native devs. I can't imagine ever seeing a non-native app in the top 100 with the exception of maybe ReactNative-based apps which is a bit of a grey area since it compiles into native.
- NateLawson 11y agoThere are many non-native apps in the top 100. Cordova is popular for business apps (Amazon and Walgreens both use it, for example). Unity (C#) is extremely popular for games because they built an awesome dev environment and it compiles to native, thanks to Mono's translation layer. I agree that React Native is great, and you will be seeing a lot more apps using it, especially as their Android version comes out.
- smilliken 11y agoWe've automated this at MixRank and have analyzed millions of apps over the last couple years. Is there anything of interest HN would like me to look up or blog about?
- iomind 11y agoHow exactly do you scan these apps though? The only proper way I can think of going about it is to some how bulk download these apps and then go about analysing their code.
- coldcode 11y agoDownload the apps normally, then jailbreak the phone. Now you can poke around all you want.
- solarexplorer 11y agoThere is no need to jailbreak anything. Just download the apps with iTunes, unzip the ipa, and voila... you can do all the static analyzing you want.
- timanglade 11y agoProbably of interest as well: a list from CocoaPods of the top SDKs sorted by number of unique apps that have installed them https://gist.github.com/orta/1c607a2c46545244ab16 https://gist.github.com/orta/1c607a2c46545244ab16
- NateLawson 11y agoNice, thanks for pointing that out. Note that it may be skewed a bit since apps can get created but not published on the app stores (personal experiment, in-house app for a company). This does roughly align with our data on iOS though.
- DannyBee 11y agoFor giggles, go into these top 100 apps, and see how many actually properly comply with the open source licenses of many of these libraries (IE they reproduce the proper notices, etc).