Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

  Apple should test for this in the review process, and reject paid apps that are
  susceptible to this simple technique.
That part is just silly. Developers should decide themselves how much time to spend on the validation. For example, the Twitter for Mac app doesn't have any validation (you can run it just fine without having the app store), and it doesn't need to as it's free anyway.

Adding proper validation takes a relative large amount of time, and sometimes it's just not worth it. Hackers can still dynamically link against a custom OpenSSL, or patch your app to not exit() if the code is 173, change Apple's CA in the Keychain or a few other tricks that would work with a large amount of the apps in the app store. You'll probably do better using your time to make your app better than trying to fix the DRM.



Simple obvious holes in their DRM solution, even if it is an implementors fault, damage their branding and the perceived value of their app store to businesses. My take on it is, even if it is the developers fault for failing to program their system correctly, it is in Apples best interest to perform some basic validation to prevent the DRM being perceived as useless (even though that's not the case).

Lastly, if the DRM scheme is so dependent on a the 3rd party app to function correctly, it seems like a failed system design.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: