John Gruber has the following to say on the topic:
Copy the App Store receipt from any legit Mac App Store download — including from
any free app — and paste it into a bootleg download of Angry Birds, and it’ll run.
This isn’t true for all paid Mac App Store apps. For apps that follow Apple’s
advice on validating App Store receipts, this simple technique will not work.
But, alas, it appears that many apps don’t perform any validation whatsoever,
or do so incorrectly, like Angry Birds. (Angry Birds checks for a valid
receipt, but doesn’t check to see that the bundle ID for the receipt matches
its own bundle ID.)
Apple should test for this in the review process, and reject paid apps that are
susceptible to this simple technique.
Apple should test for this in the review process, and reject paid apps that are
susceptible to this simple technique.
That part is just silly. Developers should decide themselves how much time to spend on the validation. For example, the Twitter for Mac app doesn't have any validation (you can run it just fine without having the app store), and it doesn't need to as it's free anyway.
Adding proper validation takes a relative large amount of time, and sometimes it's just not worth it. Hackers can still dynamically link against a custom OpenSSL, or patch your app to not exit() if the code is 173, change Apple's CA in the Keychain or a few other tricks that would work with a large amount of the apps in the app store. You'll probably do better using your time to make your app better than trying to fix the DRM.
Simple obvious holes in their DRM solution, even if it is an implementors fault, damage their branding and the perceived value of their app store to businesses. My take on it is, even if it is the developers fault for failing to program their system correctly, it is in Apples best interest to perform some basic validation to prevent the DRM being perceived as useless (even though that's not the case).
Lastly, if the DRM scheme is so dependent on a the 3rd party app to function correctly, it seems like a failed system design.
Comments
John Gruber has the following to say on the topic:
Adding proper validation takes a relative large amount of time, and sometimes it's just not worth it. Hackers can still dynamically link against a custom OpenSSL, or patch your app to not exit() if the code is 173, change Apple's CA in the Keychain or a few other tricks that would work with a large amount of the apps in the app store. You'll probably do better using your time to make your app better than trying to fix the DRM.
Simple obvious holes in their DRM solution, even if it is an implementors fault, damage their branding and the perceived value of their app store to businesses. My take on it is, even if it is the developers fault for failing to program their system correctly, it is in Apples best interest to perform some basic validation to prevent the DRM being perceived as useless (even though that's not the case).
Lastly, if the DRM scheme is so dependent on a the 3rd party app to function correctly, it seems like a failed system design.