今早醒来看到手机软件Connect推送了一条苹果开发者中心的警告消息,到了公司在苹果开发者中心后台看到了具体的内容。
2017年3月8日 上午6:20
发件人 Apple
Dear Developer,
Your app, extension, and/or linked framework appears to contain code designed explicitly with the capability to change your app’s behavior or functionality after App Review approval, which is not in compliance with section 3.3.2 of the Apple Developer Program License Agreement and App Store Review Guideline 2.5.2. This code, combined with a remote resource, can facilitate significant changes to your app’s behavior compared to when it was initially reviewed for the App Store. While you may not be using this functionality currently, it has the potential to load private frameworks, private methods, and enable future feature changes.
This includes any code which passes arbitrary parameters to dynamic methods such as dlopen(), dlsym(), respondsToSelector:, performSelector:, method_exchangeImplementations(), and running remote scripts in order to change app behavior or call SPI, based on the contents of the downloaded script. Even if the remote resource is not intentionally malicious, it could easily be hijacked via a Man In The Middle (MiTM) attack, which can pose a serious security vulnerability to users of your app.
Please perform an in-depth review of your app and remove any code, frameworks, or SDKs that fall in line with the functionality described above before submitting the next update for your app for review.
Best regards,
App Store Review
随后发现各大论坛和iOS开发群都已经炸开了锅,甚至都上了今日头条。【链接】iOS原生开发迎来第二春jspathRNweexgg了,开发者一致地把矛头指向了JSpatch, Reactive Native, Weex等热更新框架。然而我的内心OS是这样:苹果爸爸毕竟是苹果爸爸呀,最近七八次的上线审核都很顺利,以至于我认为上线-审核-通过,就是顺理成章的事情。苹果却实力打脸。毕竟在苹果的生态环境下,他就是老大,还是有着说一不二的分量的。对于广大原生开发者来说,这是一个好事情吧。
不好的方面也许就是:开发者更依赖苹果和苹果的AppStore了。
结合我之前的经验得到的一个技术结论:原生的效果还是最好的。混合编译毕竟不能相媲美。前阵子用OC和swift混编,连ipa包都大了一个量级。
谨以此记录今天苹果的邮件事件吧~