Mac App Store devs need careful code validation, otherwise downloads can be copied
John Gruber of Daring Fireball reports that Mac apps whose developers didn't follow Apple's advice on validating apps (link for registered Apple developers) can easily be copied by users. Gruber notes if Mac App Store developers are following Apple's advice, the technique for using a copied app won't work, but many apps aren't following that advice. He suggests Apple test for this in their review process and reject apps that are vulnerable.
Sean Christmann explains on his blog, CraftyMind, how developers can better protect themselves against copying apps. He recommends hard-coding receipt bundle identifier and version identifier strings into applications rather than depending on strings in an app's info.plist file, because that file is easy to find and duplicate. You may read that "the Mac App Store has been hacked," but the instructions floating around out there aren't how to "hack" the App Store; they're how to steal certain apps if a developer didn't follow the guidelines well.
Devs, check your code. Users, support developers. This is new for everyone. It's certainly a very interesting time for software delivery models -- putting indie developers on the same shelf space as Fortune 500 companies -- and there are bound to be hiccups along the way.
Share
John Gruber of Daring Fireball reports that Mac apps whose developers didn't follow Apple's advice on validating apps (link for registered...
Add a Comment
sooo this might mean that I can no longer share nice stuff with my friends. If I "buy" something, I like that something to belong to me. If I buy things I cannot have control of, I'd rather not buy.
i think i'll try to stick on to piracy. besides, I am unemployed. I am sorry devs, but my stomach's first.
"I am unemployed. I am sorry devs, but my stomach's first."
Then it sounds like you've already made up your mind whether the Mac app store exists or not.
Furthermore, when you buy something of this kind, being an app, you enter into an agreement, a EULA. There are stipulations that you agree to so your explanation of "control" seems either uninformed or immature in its intention of your type of "sharing." Most apps you buy require a serial number and typically only works on the machine you install it on. What was that about control again? But maybe you've been pirating so long you've forgotten that's how commercial software actually works.
I dont think this 'piracy' is that widespread. The non-free apps I just checked, DropCopy Pro and Insight, did not run on other machines where they had not been installed via the App Store, but instead gave me a validation error and took me right to the App Store to log in, as I would expect it to do.
January 08 2011 at 1:13 PM Report abuse Permalink rate up rate down Reply"Developers should want their apps to be hassle-free"
Ironic that you say this because the whole point of the app store, from an average user perspective, is to make the experience of finding and installing apps easier through a controlled environment than searching for them without any guidance "in the wild." The particular use case you speak of is not that frequent and when it does happen, logging into your iTunes account to download is second nature for app store users on both iPhone and Mac/iTunes.
As for DRM, I can't say I disagree with you there but I'm definitely less conspiracy-theoryish than you sound about it. Proprietary stuff, be it media or apps, is pretty commonplace and users have long since compromised. Besides, whoever said there was no other way to install Mac apps without the app store?
It used to be that many developers, particularly on the mac, objected to DRM in their applications out of principle. I even remember the Mac OS being praised for never calling home behind your back to check your authentication (and of course no one even imagined it would some day silently report all your applications to Apple -- for the user's own convenience, of course). I guess those days are over now. The future is DRM, I guess : (
January 07 2011 at 1:24 AM Report abuse Permalink rate up rate down ReplyWhy would users want to buy DRM-locked down apps from a new App Store when Mac apps have traditionally been free from this sort of rubbish.
One main reason I moved to Mac was because I was tired of all the hassle of 'authentication' in the Windows world.
Developers should want their apps to be hassle-free -- maybe the people who buy them want to copy them to another machine and don't want to have to jump through 'authenticating' that machine with 'big brother'. It's the same reason DRM died in iTunes, because hassling your users is bad business.
How is logging into your App Store account on another computer a hassle? Wouldn't it be more of a hassle to have to copy the application to some sort of external storage, take it to the new computer and copy it onto that one? Seems like logging in and pressing a button would be the preferred method. How is that "jumping through hoops"?
January 07 2011 at 12:39 AM Report abuse Permalink rate up rate down ReplyThanks for telling people what computing methods they should 'prefer'! I'm sure you know much more about what sort of network connectivity they want on their machine, and how much they desire to have their machine registered with and cataloged by a third party. If they don't compute they way you do, obviously they're "holding it wrong."
Macs have long had wonderful things like cabled powered Firewire external drives and apps that just drag from volume to volume and just work -- just like Mac apps can upgrade themselves just fine.
The App Store is bring Windows like annoyances to the Mac world, while providing nothing new and sacrificing your machine's privacy to a corporate database to boot.
As a small developer I chose not to use the validation method. My main reason was I didn't know about it till late in the day but even now I don't think it's important for me. If people want to pirate my app then so be it, I trust that 95% of my users will be honest and the 5% that want to pirate are better off being easily able to pirate rather than left to some of the mirky sites that offer these downloads.
Now I appreciate that not all devs will feel this way but even with validation apps will be hacked so I don't worry about it. The increased sales more than make up for the odd person who cannot or will not purchase.
Just my 2 cents worth.
gruber is completely insufferable these days. seriously? APPLE should reject the app because it could possibly pirated at the expense of the developer? the responsibility lies upon the developer simple as that. gruber really needs to stfu and think about what he says before he speaks
January 06 2011 at 10:39 PM Report abuse Permalink rate up rate down ReplyApple takes 30% of each purchase, it's well within their rights to reject apps because they don't have proper validation. Not only that, but I can't imagine any developers would *want* piracy, and the ones who are being pirated probably just overlooked that specification. Rejecting apps would likely be doing them a favor.
Seriously, I can't understand your point at all. Would you mind explaining why any developer would want their apps to be pirated?
Apple tells you ONE (and only one way) to protect (well, try to protect) your Apps - we are not allowed to do anything else. If Apple wants its Store to be a success they of course have to care!
Thinking before speaking is a good advice not only for John, I guessâ¦
Hot Apps on TUAW
Deals of the Day
more deals- Used Apple iPhone 3G 8GB for AT&T for $108 + $5 s&h
- Apple Mac Pro Xeon 6-Core 3.3GHz Desktop w/ 12GB RAM for $3,899 + $28 s&h
- Apple MacBook Pro Core i7 Quad 2.2GHz 15" SSD Laptop for $2,447 + $13 s&h
- Apple Earphones with Remote and Mic for $6 + $2 s&h
- PC Micro Store sale: Up to 50 off
- USB MP3 Player FM Transmitter with remote for $6 + free shipping
Software Updates
more updates- EFI Firmware Update brings Lion Internet Recovery to 2010-model Macs
- OS X Lion 10.7.3 released with Safari 5.1.3, Wi-Fi bug fix
- Aperture updated to 3.2.2, addresses Photo Stream issue
- Apple updates Keynote to address Lion issues
- Google Search app gets new look on iPad
- Apple releases Apple TV Software Update 4.4.3



12 Comments