0

I was told that Apple manually review source code of every app in AppStore so that there are no malware or scam apps. But now I'm not that sure.

There is, for example, Betternet VPN there, which doesn't seem to be a safe app:

Not all free VPN apps are scams. However, in any situation where VPNs claim they’re free, the VPN provider is making money some other way. Some of the best VPNs like Hola VPN for example, use a freemium model or a legitimate advertising revenue model. However, other free VPNs that have thousands of positive ratings on app stores—Betternet VPN for example—have a high malware presence. And many free VPNs are actually out-and-out scams, which is why a paid VPN provider is often a better bet for security than a free one. -- https://www.geoedge.com/university/malicious-vpn-scams/

Betternet is a well-known VPN that offers both free and paid versions. Despite its renown, Betternet VPN has a very troubling history. As we’ll explain further in this Betternet VPN article, a team of researchers caught Betternet embedding malware and tracking libraries in their VPN apps. -- https://restoreprivacy.com/vpn/reviews/betternet/

My questions:

  • Is it true that Apple manually review source code of every app in AppStore?
  • Are all the apps from AppStore safe?
3
  • How exactly do you define “safe?” Won’t crash your device? Won’t steal you data? Won’t embed malware? The devs don’t sell the data they disclaimed would be collected? Answering a broad question like are all app store apps safe would be a resounding ”No.”
    – Allan
    Commented Apr 24, 2023 at 13:04
  • Everything you have said except crashes, which are a different thing.
    – user480875
    Commented Apr 24, 2023 at 13:05
  • This will probably get closed as opinion based, but the basic premise of source code review is a resounding no - nope, you either were mis-informed or mis-interpreted the goals of functional review as Apple has stated them or others have experienced them. Even Apple's teams are changing over time and this is a constant push / pull / adaptation. No store with as many items as the App stores could possibly be vetted to perfect safety - it's asymmetrical with too many apps and not enough money or time to catch everyone trying to sneak something by the reviewers.
    – bmike
    Commented Apr 24, 2023 at 13:10

1 Answer 1

3

Apple does not have access to third party developer source code, so there's no way Apple can do what you ask. For any reasonable definition of safe, it's not possible to say they all meet one definition, let alone a general "safe" badge.

Whether the apps are safer than apps distributed outside the App Store is a question worth asking and considering. Whether Apple's review is tough enough (some very reasonable people fall on both sides of this argument) or too tough (also some very reasonable people fall on both sides of this finding) is more about each person's values and threat model.

I personally prefer paid apps since I believe as a model - they are less likely to want to sell my data or do shady things with analytics, but there's no guarantee of that. Other people eschew paid software and figure everyone is out to get them or just don't care about tracking. Those value judgements (mine and theirs) are certainly not absolute.

You'll probably have to do the hard work to judge each app and figure out what safe is for you as opposed to get a neat answer here other than it's complicated.

You must log in to answer this question.