mikeash

@mikeash @danielpunkass Again, you gotta read between the lines: something was massively compromised. They're not going to talk about it.

@cabel @danielpunkass Obviously. But the lack of communication is unbelievably rude.

@mikeash @cabel They’re not even communicating with developers on the level of when to expect what. Frustrating to know how to react.

@danielpunkass (What are your current open questions about when to expect what?)

@cabel … because the seeds don’t yet impose the promised security restrictions.

@danielpunkass Yeah, this is them operating in "oh shit" mode. :( (It _is_ really weird that they say you should re-submit MAS apps.)

@cabel @danielpunkass What would your reaction be if the MAS needed to update every app but the version and release notes were unchanged?

@mikeash assuming the reason isn’t “it sounded like fun”, how would talking about it make any difference?

@mikeash Isn’t it simply that the old system let you include binaries that your app could run, and that weren’t included in the signature?

@mikeash I wonder if there’s a security hole in v1?