Verichains' analysis reveals that several Vietnamese banking apps improperly use private iOS APIs, potentially jeopardizing user security and app stability. These apps employ undocumented functions to gather device information, bypass sandbox restrictions, and manipulate UI elements, likely in pursuit of enhanced functionality or anti-fraud measures. However, reliance on these private APIs violates Apple's developer guidelines and creates risks, as these APIs can change without notice, leading to app crashes or malfunctions. Furthermore, this practice exposes users to potential security vulnerabilities that malicious actors could exploit. The report details specific examples of private API usage within these banking apps and emphasizes the need for developers to adhere to official guidelines for a safer and more reliable user experience.
Reverse engineering of Shenmue's source code revealed that the sun's position in the game is calculated using a simplified formula that doesn't account for axial tilt or the equation of time. This results in the sun rising and setting slightly earlier than it should in the game's real-world counterpart of Yokosuka, Japan, across all in-game dates. While noticeable, this discrepancy doesn't significantly impact gameplay and may have been a deliberate simplification for performance reasons on the Dreamcast. The author speculates whether it qualifies as a "bug" given its likely intentional nature and minimal effect on the overall experience.
Hacker News users discuss whether the perceived sun position error in Shenmue is actually a bug or a deliberate design choice. Some commenters suggest it's a performance optimization, avoiding complex calculations for marginally improved visuals. Others argue it's simply a bug, pointing to inconsistencies with the in-game clock and world design. Several discuss the challenges of reverse engineering older games, particularly with limited documentation, and the difficulty of definitively labeling something a bug without access to the original source code and developer intentions. The discussion also touches on the nostalgic appeal of Shenmue and the dedication of its fan community in dissecting the game's intricacies.
The blog post details the reverse engineering process of Apple's proprietary Typed Stream format used in various macOS features like Spotlight search indexing and QuickLook previews. The author, motivated by the lack of public documentation, utilizes a combination of tools and techniques including analyzing generated Typed Stream files, using class-dump on relevant system frameworks, and examining open-source components like CoreFoundation, to decipher the format. They ultimately discover that Typed Streams are essentially serialized property lists with a specific header and optional compression, allowing for efficient storage and retrieval of typed data. This reverse engineering effort provides valuable insight into the inner workings of macOS and potentially enables interoperability with other systems.
HN users generally praised the author's reverse-engineering effort, calling it "impressive" and "well-documented." Some discussed the implications of Apple using a custom format, speculating about potential performance benefits or tighter integration with their hardware. One commenter noted the similarity to Google's Protocol Buffers, suggesting Apple might have chosen this route to avoid dependencies. Others pointed out the difficulty in reverse-engineering these formats, highlighting the value of such work for interoperability. A few users discussed potential use cases for the information, including debugging and data recovery. Some also questioned the long-term viability of relying on undocumented formats.
Startifact's blog post details the perplexing disappearance and reappearance of Quentell, a critical dependency used in their Elixir projects. After vanishing from Hex, the package manager for Elixir, the team scrambled to understand the situation. They discovered the package owner had accidentally deleted it while attempting to transfer ownership. Despite the accidental nature of the deletion, Hex lacked a readily available undelete or restore feature, forcing Startifact to explore workarounds. They ultimately republished Quentell under their own organization, forking it and incrementing the version number to ensure project compatibility. The incident highlighted the fragility of software supply chains and the need for robust backup and recovery mechanisms in package management systems.
Hacker News users discussed the lack of transparency and questionable practices surrounding Quentell, the mysterious figure behind Startifact and other ventures. Several commenters expressed skepticism about the purported accomplishments and the overall narrative presented in the blog post, with some suggesting it reads like a fabricated story. The secrecy surrounding Quentell's identity and the lack of verifiable information fueled speculation about potential ulterior motives, ranging from a marketing ploy to something more nefarious. The most compelling comments highlighted the unusual nature of the story and the lack of evidence to support the claims made, raising concerns about the credibility of the entire narrative. Some users also pointed out inconsistencies and contradictions within the blog post itself, further contributing to the overall sense of distrust.
Summary of Comments ( 7 )
https://news.ycombinator.com/item?id=43502385
Several Hacker News commenters discuss the implications of the Verichains blog post, focusing on the potential security risks of using private APIs. Some express surprise at the prevalence of this practice, while others point out that using private APIs is a common, though risky, way to achieve certain functionalities not readily available through public APIs. The discussion touches on the difficulty of Apple enforcing its private API rules, particularly in regions like Vietnam where regulatory oversight might be less stringent. Commenters also debate the ethics and pragmatism of this practice, acknowledging the pressure developers face to deliver features quickly while also highlighting the potential for instability and security vulnerabilities. The thread includes speculation about whether the use of private APIs is intentional or due to a lack of awareness among developers.
The Hacker News post titled "Technical Analysis – Improper Use of Private iOS APIs in Vietnamese Banking Apps" has generated several comments discussing the implications of the article's findings.
Several commenters focused on the security risks associated with using private APIs. One commenter highlights the potential for malicious apps to exploit these same private APIs, potentially bypassing security measures or accessing sensitive user data. They mention the "walled garden" approach of iOS and how circumventing it introduces vulnerabilities. Another commenter reinforces this by pointing out that Apple explicitly warns against using private APIs, and doing so can lead to app rejection from the App Store. They express concern that these banking apps were able to get through the review process despite this violation.
The discussion also touches on the motivations behind using private APIs. One commenter speculates that developers might resort to private APIs due to limitations or perceived deficiencies in the public APIs provided by Apple. They suggest that this situation highlights a potential gap in functionality offered by official means. Another commenter cynically suggests that the developers might be knowingly taking shortcuts to achieve desired functionality without going through proper channels or investing in more robust solutions.
A few commenters discuss the implications for users of these banking apps. One expresses concern about the potential for data breaches or other security compromises due to the use of these private APIs. Another commenter questions the overall security posture of these Vietnamese banks, suggesting a lack of due diligence in their app development practices.
The conversation also drifts towards the broader issue of private API usage and app store review processes. One commenter questions the effectiveness of Apple's app review process in catching these violations. Another commenter mentions the cat-and-mouse game between developers trying to use private APIs and Apple trying to prevent them. They note that this is an ongoing issue and that developers often find creative ways to circumvent the restrictions.
Finally, one commenter questions the severity of the issue, suggesting that the specific private APIs mentioned in the article might not pose a significant security risk. However, this is countered by another commenter who emphasizes that any use of private APIs is a violation of Apple's guidelines and opens the door to potential security vulnerabilities, regardless of the specific APIs used.