Verichains' analysis reveals that several Vietnamese banking apps improperly use private iOS APIs, potentially jeopardizing user security and app stability. These apps employ undocumented functions to gather device information, bypass sandbox restrictions, and manipulate UI elements, likely in pursuit of enhanced functionality or anti-fraud measures. However, reliance on these private APIs violates Apple's developer guidelines and creates risks, as these APIs can change without notice, leading to app crashes or malfunctions. Furthermore, this practice exposes users to potential security vulnerabilities that malicious actors could exploit. The report details specific examples of private API usage within these banking apps and emphasizes the need for developers to adhere to official guidelines for a safer and more reliable user experience.
VietGD.com showcases Vietnamese graphic design, aiming to document and promote the country's evolving visual identity. The site features a curated collection of work spanning various disciplines, including branding, typography, illustration, and packaging design, from both established and emerging Vietnamese creatives. It highlights the unique blend of traditional Vietnamese aesthetics and modern design influences present in the showcased work, offering a comprehensive overview of the current graphic design landscape in Vietnam.
Hacker News users discuss the unique aesthetic of Vietnamese graphic design showcased on vietgd.com, noting its vibrant colors, bold typography, and occasional "maximalist" approach that contrasts with Western minimalist design trends. Some commenters draw parallels to Chinese and Korean graphic design, highlighting shared cultural influences and a preference for ornamentation. Others appreciate the website's organization and the historical context provided. A few express interest in learning more about Vietnamese design principles and the cultural context that shapes these aesthetics. Some users critique the site's English translation and suggest improvements. Overall, the comments reflect a positive reception of the website and a genuine curiosity about Vietnamese graphic design.
Researchers have identified a new species of giant isopod, Bathynomus jamesi, in the South China Sea off the coast of Vietnam. This new species, distinguishable by its morphology and genetics, joins a small group of supergiant isopods within the genus Bathynomus. The discovery highlights the biodiversity of the deep sea and contributes to a better understanding of these fascinating crustaceans.
Several Hacker News commenters expressed fascination with the size of the newly discovered giant isopod, comparing it to a roly-poly or pill bug. Some discussed the implications for the deep-sea ecosystem and the surprising frequency of new species discoveries. A few commenters questioned the use of "supergiant," pointing out other large isopod species already known, while others debated the reasons for gigantism in deep-sea creatures. One commenter jokingly linked it to radiation, a common trope in monster movies. There was also a brief discussion about the edibility of isopods, with some suggesting they taste like shrimp or crab.
Summary of Comments ( 7 )
https://news.ycombinator.com/item?id=43502385
Several Hacker News commenters discuss the implications of the Verichains blog post, focusing on the potential security risks of using private APIs. Some express surprise at the prevalence of this practice, while others point out that using private APIs is a common, though risky, way to achieve certain functionalities not readily available through public APIs. The discussion touches on the difficulty of Apple enforcing its private API rules, particularly in regions like Vietnam where regulatory oversight might be less stringent. Commenters also debate the ethics and pragmatism of this practice, acknowledging the pressure developers face to deliver features quickly while also highlighting the potential for instability and security vulnerabilities. The thread includes speculation about whether the use of private APIs is intentional or due to a lack of awareness among developers.
The Hacker News post titled "Technical Analysis – Improper Use of Private iOS APIs in Vietnamese Banking Apps" has generated several comments discussing the implications of the article's findings.
Several commenters focused on the security risks associated with using private APIs. One commenter highlights the potential for malicious apps to exploit these same private APIs, potentially bypassing security measures or accessing sensitive user data. They mention the "walled garden" approach of iOS and how circumventing it introduces vulnerabilities. Another commenter reinforces this by pointing out that Apple explicitly warns against using private APIs, and doing so can lead to app rejection from the App Store. They express concern that these banking apps were able to get through the review process despite this violation.
The discussion also touches on the motivations behind using private APIs. One commenter speculates that developers might resort to private APIs due to limitations or perceived deficiencies in the public APIs provided by Apple. They suggest that this situation highlights a potential gap in functionality offered by official means. Another commenter cynically suggests that the developers might be knowingly taking shortcuts to achieve desired functionality without going through proper channels or investing in more robust solutions.
A few commenters discuss the implications for users of these banking apps. One expresses concern about the potential for data breaches or other security compromises due to the use of these private APIs. Another commenter questions the overall security posture of these Vietnamese banks, suggesting a lack of due diligence in their app development practices.
The conversation also drifts towards the broader issue of private API usage and app store review processes. One commenter questions the effectiveness of Apple's app review process in catching these violations. Another commenter mentions the cat-and-mouse game between developers trying to use private APIs and Apple trying to prevent them. They note that this is an ongoing issue and that developers often find creative ways to circumvent the restrictions.
Finally, one commenter questions the severity of the issue, suggesting that the specific private APIs mentioned in the article might not pose a significant security risk. However, this is countered by another commenter who emphasizes that any use of private APIs is a violation of Apple's guidelines and opens the door to potential security vulnerabilities, regardless of the specific APIs used.