
Apple’s Guidelines Now Allow Executable Code in Educational Apps and Dev Tools - tempodox
https://www.macstories.net/linked/apples-app-store-guidelines-now-allow-executable-code-in-educational-apps-and-developer-tools/
======
interpol_p
I've just submitted an update to Codea[1] that allows for the importing of
user projects[2]

It has been "In Review" for a suspiciously long time now. So I think it might
be testing the application of these updated policies.

I have often submitted updates to App Review which include the ability to
download and install executable code (along with review notes detailing my
reasoning) with the knowledge that they would be rejected. I have also
appealed Apple's rejections in order to effect a change in policy for the App
Store. At some point during phone calls with the reviewers they told me they
were "advocating for policy change internally on my behalf" even if they
couldn't approve my app right now. I'm so glad policy has changed now.

[1] [https://codea.io](https://codea.io)

[2]
[https://twitter.com/twolivesleft/status/873692454947442688](https://twitter.com/twolivesleft/status/873692454947442688)

~~~
erikpukinskis
This thread is getting beastly but I want to weigh in to comment that The Web
is an interesting alternative to this problem.

Rather than allowing dangerous apps and requiring them to undergo corporate
review, The Web just assumes the app is nefarious, lets anyone at all run
anything they want, but architects the runtime so that apps can't do anything
unsafe.

There is heavy debate about what constitutes "unsafe"... privacy-wise,
security-wise. And features like graphics shaders and camera stream take
longer to diffuse. And different devices make different choices on these
subjects.

But choosing to target the browser as The Computer is a vote against app
stores. And a vote for bringing the safety and freedom of the sandbox closer
to the metal, rather than going straight to the bottom while forfeiting our
freedom.

Do you accept a class-based system where the privileged class gets "full"
device access and hope the class divide gets fairer.... Or do you accept
limited device access in exchange for a truly egalitarian distribution
landscape, while hoping device access will improve? To me that's the choice
for developers, and I choose the latter.

~~~
interpol_p
I feel like you are conflating two issues in your comparison. Building code
for devices, and distributing that code on the App Store.

We (programmers) have great device access without undergoing corporate review.
And this has only gotten better for the Apple ecosystem. I can go to Github,
download an open source iOS project and build it for my device. They removed
the $99/year barrier. An Apple ID is still needed, but the direction has been
positive.

Publishing on the App Store is not really relevant. I can experiment, write
code, and publish that code without Apple's blessing.

Any curated stores (stores for web apps are no exception — like the Chrome
store) are going to put limits on what can be published. _That is where their
value lies_. The curation entices users which creates demand that developers
can service. Good curation is hard, and doing it well builds user trust.
Developers can leverage that trust if they are willing to submit their work
for review. And in the case of the App Store, developers can make income from
that trust.

~~~
harlanji
Given the $99 limitation has been lifted it seems reasonable to make general
federated "App Store App" that downloads source and puts a build of an app on
the phone, wrapped with a pretty UI and clever control channel to your "dev"
machine. Value of a particular "store" would be in its own curation. Seems
Apple developer portal has enough API to get provisioning keys for Fastlane,
might have more generally interesting stuff to make other features like APNS
seamless.

~~~
nathancahill
If you're jailbroken, check out Saurik's app Extender. He's active on HN, so
maybe he'll chime in.

------
paultopia
Honestly, I try to write code on iOS all the time, and it's not really the
absence of tools that can execute that code that really stands in the way.
Instead, it's:

\- The absence of a really good typing story. The 12.9 iPad Pro with smart
keyboard is nice for typing text but terrible for moving the cursor around.
It's agonizingly slow to do it with keyboard (highlighting is worse, for some
reason) and inaccurate to do it with finger/fiddly to do it with Pencil.

The only text editor with vim keybindings (an absolute must in an environment
where it's hard to move the cursor normally...) of which I'm aware is Buffer,
while the only text editor with both good syntax highlighting and good github
integration (via Working Copy) is Textastic. Honestly, I really wish one of
those two would just buy the other so that I could have both.

\- The absence of a really good ssh story. Prompt is nice, but for some
reason, whenever I try to SSH into anything, there's so much latency that it
is really painful to actually do anything. Maybe I just have slow network
connections? But anyway, so much for just coding on a linode or something in
vim.

~~~
nouveaux
I'm not sure why Prompt is slow for you but as a suggestion, I really like
using Blink. It supports Mosh and it might help with your latency problem

~~~
yangl1996
\\+1 for this. Mosh solved all problems an iPad ssh client may have. It allows
the client to go offline and reconnect in no time when the client is back
online, which is a common case on iOS (apps get killed when being in
background for a short time). Lower latency (thanks to local echoing) and
seamless switch between networks (cellular and wifi roaming) are also
definitely nice to have. I tested Blink (a client on iOS with Mosh support) on
a high-speed-rail trip from Shanghai to Beijing and it was rock solid.

~~~
paultopia
That is reaaalll nice. I like it a lot.

(Although I'm a little embarrassed that I paid 20 bucks for an app in the app
store that's open source. But that's totally worth it to not have to fight
with xcode...)

~~~
enedil
Don't be embarassed for paying for open source.

------
JesseWright
I actually appreciate that Apple stipulated "apps must make the source code...
editable by the user". I personally think this helps with the educational spin
to this currently, as it assures users are able to see source code but also
tinker with it and learn. This is something I wish I would have had when I was
in school - there were some editors at the time, but none of them could run
any at that time to my knowledge.

I think this could really help a lot of students for what it is, and I hope it
does well in that regard.

------
nolok
Let me give a courtesy remainder that it is "... until Apple change their
mind".

Whatever the provider, I really hate those walled gardens where what you can
deliver or not is at the whims of a company whose interest is not always
aligned with yours. I understand being on them is necessary due to how large
their market are, but this is really not where I hoped we would be fifteen
years ago.

I guess I'm merely venting, and daydreaming about what could have been, "if
only"...

~~~
coldtea
> _I understand being on them is necessary due to how large their market are,
> but this is really not where I hoped we would be fifteen years ago._

Depends on who "we" are. Some people also wanted a hassle free device, which
only runs curated apps, and that keeps the whole experience more secure,
unified, private, etc that a "open for all" environment.

~~~
jacquesm
This is roughly along the lines of the vast majority of the people that would
happily vote in a police state if it meant that they were safe.

Freedom is a good thing, even if it comes at the price of some risk, no matter
what the context.

~~~
coldtea
> _This is roughly along the lines of the vast majority of the people that
> would happily vote in a police state if it meant that they were safe._

Or how about it's along the vast majority of the people merely wanting the
police to guarantee safe cities?

You don't live in your mobile phone: you use it.

> _Freedom is a good thing, even if it comes at the price of some risk, no
> matter what the context._

"No matter what the context" is BS. I presume you lock your house doors or
wear a safety belt -- sacrificing freedom of movement for more security.

~~~
jacquesm
I don't see the Linux eco-system as being more prone to malware and trash than
the so-called curated app-store.

> Or how about it's along the vast majority of the people merely wanting the
> police to guarantee safe cities?

Which more often than not includes being safe from the police, and that's
where the problem lies. This sort of power is bound to be abused.

> "No matter what the context" is BS. I presume you lock your house doors or
> wear a safety belt -- sacrificing freedom of movement for more security.

Interesting. I've lived in places where unlocked doors were the norm, the
village where I live (20 Km from Amsterdam) still has plenty of unlocked
doors. People wear safety belts because there are no downsides _and_ because
they are required by law so that stretched analogy doesn't hold.

~~~
delinka
"I don't see the Linux eco-system as being more prone to malware..."

Did you count Android amongst Linux? It is after all...

~~~
pjmlp
Only developers without Android experience think that.

Android is all about Java.

The NDK is there as layer for implementing Java _native_ methods, games and
high performance audio, and general purpose native libraries from other OSes.

This is what you are allowed to call from C and C++ on Android:

[https://developer.android.com/ndk/reference/index.html](https://developer.android.com/ndk/reference/index.html)

[https://developer.android.com/ndk/guides/stable_apis.html](https://developer.android.com/ndk/guides/stable_apis.html)

Trying to call anything else terminates the application as of Android 7.

[https://developer.android.com/about/versions/nougat/android-...](https://developer.android.com/about/versions/nougat/android-7.0-changes.html#ndk)

As of the upcoming Android 8, calling syscalls outside of what libc requires
leads to application termination as well.

[https://developer.android.com/preview/behavior-
changes.html#...](https://developer.android.com/preview/behavior-
changes.html#nl)

Basically nothing really UNIX specific and could be implemented with any other
kind of kernel (hence Fuchsia).

~~~
delinka
"Only developers without Android experience think that."

Think what? That Linux is malware-free? If you're addressing me only, I'm just
asking for clarity on the dataset in question, not expressing an opinion about
the safety of the platform.

~~~
pjmlp
No, that Android having Linux as kernel is actually relevant to Android
programming.

Given the OS architecture Google can easily announce a version using other
kernel, given that there is very little UNIX specific on what can be done with
public NDK APIs.

Only those customising Android builds would be impacted.

~~~
pjmlp
I meant to say irrelevant, edit does not work any longer.

------
ferdterguson
I feel like we are inching closer to being able to write code on iOS. Swift
storyboards on the iPad kind of opened the door and I hope we can keep
chipping away at this.

The day I can run and write Python natively on iOS is the day I buy an iPad
Pro. Right now there are some good ssh clients and I can write code from a
terminal, but pros of the device are not worth that tradeoff right now IMO.

~~~
nreilly
Keep an eye on Pythonista. I expect there'll be an update based on this change
soon making it a lot more usable.

[http://omz-software.com/pythonista/](http://omz-software.com/pythonista/)

~~~
scrumper
It's already really useful. You can create local apps with home-screen icons
on it. You can install whatever packages you want (download and run StaSh
inside Pythonista to get a command line with pip). You can even use git with
it, again through StaSh. For me it's a first-class Python development
environment that I can use when away from my main computer.

The only shortcoming today is that you can't get code into it except by
grabbing it from a git repo or pasting it in from the clipboard. Today's
policy change should directly address that limitation.

~~~
simonh
There are scripts you can put into Pythonista for pulling files in from
Dropbox and a Gist, etc, but if you are working on a multi-file, multi-module
app then syncing file by file is just way too painful. The way I do it is to
run an FTP server app on the phone/iPad, connect in from my Mac and manually
copy the whole directory tree. You can also export and email a zip of a
directory. Snapshotting like that is survivable, but proper built-in sync or
Git support is the holy grail.

------
mark_l_watson
One of my favorite apps is Raskell, basically Haskell 98 ported to iOS. It
uses Dropbox for storage so it is possible to move small Haskell applications
in and out of iOS. Pythonista is also very cool.

I like the safety of the iOS walled garden but I also see real value in
complex IDEs like IntelliJ running on iPad Pros.

------
barrkel
Technically any program which loads a file is executing loaded code - the file
is interpreted as a set of instructions about what data structures to create.
This is more explicit for things like vector formats, and reaches its logical
conclusion with things like postscript files.

~~~
manmal
PS and JS are heavily sandboxed though. With this exception an app's user will
be able to code up integrations with other apps, additional push notification
handlers, or load remote code like native OCR modules or drone controls.

------
sudhirj
Anyone know how Swift Playgrounds work? Do they interpret the Swift code or
compile it against a set of mock APIs?

~~~
IMcD23
It has a full Clang/LLVM built in, and runs Playgrounds in a separate process.
Most of this uses private app extensions and XPC, which other developers are
not able to use.

------
jacquesm
What I find absolutely incredible is that this is accepted at all. You really
have to wonder how we went from a computer with a bunch of slots and open
schematics to one that is so closed you need permission from the manufacturer
to run whatever code you desire.

The degree of paternalism is astounding.

~~~
eludwig
Not a Apple apologist, but I do own a bunch of iThings.

Apple's made a very opinionated choice in choosing what software to allow on
the AppStore. On the Mac this isn't a fatal problem for developers due to the
ability to side load applications. It’s the fact that apps can't be side
loaded on iOS that causes the real damage (imo). But I also think Apple should
be able to run their app store as they see fit.

Apple seems to be trying to figure out a way to have it all. They want a
vibrant developer community without the all of the hairy cruft that comes with
true choice, like viruses and malware. Again, imo, they lose something by
forcing this choice down everyone's throat. They create too much friction for
developers. There is that bottom-line terror every time a dev thinks about
writing an app for iOS: will Apple allow this app to exist? To me, this is a
horrible and limiting thing to have to even consider and the reason that in
the long run Apple will have to give this idea up or see their platform slowly
fade over time.

I'm torn, because I am glad that my Mom can be relatively safe when running
her iPad with its limited selection of apps. But the idea that I have to think
about whether or not an arbitrary person working at a huge multi-national can
terminate my idea for an application is just too much freedom to give up.

Not sure what the answer is, but official app side loading would go a LONG way
(for me) towards reducing that friction.

~~~
matthewmacleod
_There is that bottom-line terror every time a dev thinks about writing an app
for iOS: will Apple allow this app to exist? To me, this is a horrible and
limiting thing to have to even consider and the reason that in the long run
Apple will have to give this idea up or see their platform slowly fade over
time._

I'm not convinced. We all know the rules: "Don't take the piss".

~~~
mikeash
Where "take the piss" includes things like "have a toggle to hide NSFW
subreddits in your Reddit client," "track drone strikes," "feature Buzz Aldrin
with his enthusiastic permission," "mention the existence of Android on your
support page on your web site," and "a lock screen widget that lets you take
notes."

~~~
jacquesm
And most importantly: don't compete with anything Apple did, does or intends
to do at some undefined point in the future.

------
Jyaif
Ah, but now we need to be able to spawn processes (at least one extra),
otherwise we app developers can't secure the user's data in our own app...

~~~
manmal
How would an extra process protect your app's memory? Also, I'm sure those
apps will not be allowed to execute code outside their own process.

~~~
JoshTriplett
If you're going to run arbitrary user code, you really want a sandbox, ideally
in a separate address space for added protection. An interpreted language has
an easier time isolating itself via its runtime (though it's just a bug away
from code execution or data access), but any kind of compiled or JITted
language desperately wants a completely separate address space.

~~~
0x0
I haven't seen anything that indicates iOS apps will be allowed to map memory
as executable, though. Traditionally, only a few Apple apps like Mobile Safari
have been blessed with these types of code signing entitlements to enable JIT.
So I'm assuming applications running code must do so via an interpreter?

------
sigjuice
Apple should just do a Darwin/macOS ARM VM on the iPad so developers can have
ARM Homebrew and other Unix tools they are used to.

~~~
pjmlp
I rather use XCode and other nice GUI tools.

------
klinquist
Dear VSCode team... now is the time for VSCode for the iPad!

------
laughingman2
The irony of people defending apple because its "safe" and doesn't let you
"shoot yourself in the foot" in a forumn named Hacker news.

What is happening to hacker culture? I think as influx of new programmers
increase, awareness on the culture's ethos of freedom, liberty, anti-
authoritarianism, anti corporatism has to be increased.

Or we will have people loving to be jailed by their benevolent overlords in
"apple/google/facebook/etc"

~~~
joemi
Not everyone shares your _exact_ ideals, even amidst those sharing the hacker
ethos. In the same way that not everyone sharing the hacker ethos is as
extreme as Stallman. In the same way that not everyone here uses linux distros
exclusively. Clearly there's a spectrum of beliefs/ethos. Otherwise, you could
pedantically point out something that's not purely hacker-focused about almost
every single post on HN.

------
d08ble
Amazing! I've been waiting for this.

Animation CPU Studio will be published soon.

[https://twitter.com/AcpuStudio](https://twitter.com/AcpuStudio)

------
brians
One step closer to Emacs on iPad.

------
eecc
Good: [http://haskellformac.com](http://haskellformac.com)

------
Aaron1011
> Apple’s Guidelines Now Allow Executable Code in Educational Apps and Dev
> Tools

This title is somewhat confusing - it makes it sound as though educational
apps and dev tools somehow weren't allowed to execute code before, which
doesn't make any sense.

------
noblethrasher
Funny coincidence: I just downloaded Scratch Jr. for my nephew this past
weekend, only to be disappointed that we couldn't view the other projects from
within the app, nor could he share his.

I hope that we can now expect to get this feature, soon.

------
jonknee
Silly question, but how does WeChat get around this? Does custom code for
Official Accounts just work on Tencent's server and basically work in a
WebView?

~~~
kccqzy
I suppose the custom code is just custom JavaScript code. It has always been
possible to execute arbitrary JavaScript code, including those downloaded
remotely. No WebView needed.

------
83457
yay, pico-8 should be allowed now

------
fgandiya
I hope this mean I can easily load scripts onto Pythonista. It's a real pain
right now.

~~~
scrumper
If it's any help to you, I've had great success using StaSh and git for
getting stuff into it.

~~~
fgandiya
That what I've been using. It works pretty well.

------
jlebrech
so something like xcode on ipad is now possible, as they won't build it
themselves.

~~~
simonh
I suspect this change is intended to pave the way for Swift Playgrounds, which
already has a full LLVM implementation built in, to become a full dev
environment. Or to spawn off a professional sibling App. I think they don't
want to be accused of favouring their own dev tools too much compared to other
options, so are making this possible for the existing dev tools pre-emptively
to their own full-sized offering.

------
adm2life
Good step in right way !

------
dalacv
Just an FYI, I use a cheap Android device with a Bluetooth keyboard and mouse
and use Termux which is a Linux emulator with support for many packages
including vim, python, jupyter, task warrior and much more

------
pmarreck
Did they ever consider that any number of web browsers can already execute
javascript?

~~~
spacehunt
On iOS there's basically only one browser available.

Besides, Javascript has been allowed for quite a while for things like React
Native.

