7 ms·

How can they shut down distribution? If a personal team can install any sourcecode, how could apple block the distribution? Even if they scan for a binary hash,

by mvn9 6y ago

How can they shut down distribution? If a personal team can install any sourcecode, how could apple block the distribution? Even if they scan for a binary hash, all it takes are some minor modifications to have a different program to install.

misnome 6y ago
Oh, no there are a few of things here, and I think I got slightly confused. There is local signing, which I believe is short term - e.g. your own machine and device, which doesn't require paying anything to apple for a developer membership. This is for on-device testing. There's also Ad-hoc signing, which I believe is longer-lived, requires a developer account, but has restrictions on how many people you can send it to. As an enterprise user you can also distribute apps yourself to company employees without going via app store verification, though I think it's much harder to get onto this program https://developer.apple.com/programs/enterprise/ https://developer.apple.com/programs/enterprise/ . This is what has occasionally been abused, I don't know how the certificate is revoked centrally though, but it's not for [user] self-compiled code. It's possible that my knowledge of this is slightly off, because it was a few years since I worked with this stuff.
Someone 6y ago
They can’t shut down distribution of source code, but: - your typical user wouldn’t know what to do with it - every install would run only for a limited time (only apps distributed through the App Store have a certificate that doesn’t expire), so those users would have to reinstall the app every week or so. - it would make it harder for them to make money from it (they would give away the game for free. The in-game store wouldn’t give away stuff, but the source likely would soon be changed to support alternative stores)
- mvn9 6y ago
  >but the source likely would soon be changed to support alternative stores Which is only fair for those who circumvent the original store.

by mvn9 6y ago

misnome 6y ago

Oh, no there are a few of things here, and I think I got slightly confused. There is local signing, which I believe is short term - e.g. your own machine and device, which doesn't require paying anything to apple for a developer membership. This is for on-device testing. There's also Ad-hoc signing, which I believe is longer-lived, requires a developer account, but has restrictions on how many people you can send it to. As an enterprise user you can also distribute apps yourself to company employees without going via app store verification, though I think it's much harder to get onto this program https://developer.apple.com/programs/enterprise/ https://developer.apple.com/programs/enterprise/ . This is what has occasionally been abused, I don't know how the certificate is revoked centrally though, but it's not for [user] self-compiled code. It's possible that my knowledge of this is slightly off, because it was a few years since I worked with this stuff.

Someone 6y ago

They can’t shut down distribution of source code, but: - your typical user wouldn’t know what to do with it - every install would run only for a limited time (only apps distributed through the App Store have a certificate that doesn’t expire), so those users would have to reinstall the app every week or so. - it would make it harder for them to make money from it (they would give away the game for free. The in-game store wouldn’t give away stuff, but the source likely would soon be changed to support alternative stores)

mvn9 6y ago
>but the source likely would soon be changed to support alternative stores Which is only fair for those who circumvent the original store.