←back to thread

432 points nobody9999 | 1 comments | | HN request time: 0.203s | source
Show context
Someone ◴[] No.46246157[source]
> Speaking to reporters Thursday night, though, Epic founder and CEO Tim Sweeney said he believes those should be “super super minor fees,” on the order of “tens or hundreds of dollars” every time an iOS app update goes through Apple for review. That should be more than enough to compensate the employees reviewing the apps to make sure outside payment links are not scams

I would think making sure outside payment links aren’t scams will be more expensive than that because checking that once isn’t sufficient. Scammers will update the target of such links, so you can’t just check this at app submission time. You also will have to check from around the world, from different IP address ranges, outside California business hours, etc, because scammer are smart enough to use such info to decide whether to show their scammy page.

Also, even if it becomes ‘only’ hundreds of dollars, I guess only large companies will be able to afford providing an option for outside payments.

replies(14): >>46246330 #>>46246353 #>>46246590 #>>46246629 #>>46247273 #>>46247730 #>>46248914 #>>46248949 #>>46248984 #>>46249805 #>>46249816 #>>46250039 #>>46251064 #>>46251907 #
1. ffsm8 ◴[] No.46246590[source]
> I would think making sure outside payment links aren’t scams will be more expensive than that because checking that once isn’t sufficient. Ignoring the fact Apple isn't doing that anyway right now as others have pointed out: There are multiple ways to make sure of that without it costing any significant money, eg hashing all scripts that are served on the link and making sure they're the same since review.

Not that they'd ever do the review to begin with, so the hashing won't be done either, but it's something that could be done on iOS/ipados.

And if you consider that infeasible, you might want to check out current CSP best practices, you might be surprised