Apple bans entire dev account, no reason given
twitter.comI hope it won't take more than 10 years for the EU to actually force them to let us publish our own stuff without paying them first.
If you're logging in from a country that historically has had a lot of fraud coming from it, this might be the reason why.
When travelling in Hungary my AWS account was banned the moment I tried to log in. I got basically no reason. I was able to call support but the guy very polite fobbed me off and I got the idea that they weren't even able to disclose the reason why they banned me.
Don't ever travel, never change anything related to billing except to update your cards before they expire. Don't change your name, email adresses or lose access to your phone number, and as we know now also don't ask support.
Then don't use any uncommon tools, e.g. ones associated with 'hacking', or store any copyrighted files in their cloud.
If there's any issue or error with logins etc., don't retry too quickly or too often or that in itself will be suspicious. Wait a day between requests, and double-check everything before retrying. Do not retry from a different IP or worse a VPN, or that will also be suspicious.
That should just about cover the bases for most providers.
Yes, it's insane and obviously you still need a backup of all your stuff just in case.
> Don't change your name, email adresses or lose access to your phone number, and as we know now also don't ask support.
This reads like some list of instructions from the Brazil film.
That’s the only movie to have truly disturbed me. It made me feel awful. And the feeling lingered a long time.
imgur also banned logins and uploads from Ukraine, Vietnam etc. with no reason given, just a dirty 502 return code.
https://old.reddit.com/r/imguralternatives/comments/1kr11nw/...
while flaunting "Stand with Ukraine!" and all that virtue signaling.
There was a time (a few weeks/months, I think?) when I've been getting that "imgur is over capacity, try again later" every time I tried to open an image posted there. First few times I wondered if imgur is really down, but haven't seen anyone in related comment sections complain, eventually I figured out that they are just lying to you with a fake error message if they don't like your IP for whatever reason, and the situation made me really angry (just return a 403 and say that the address is banned, damn it! It helps nobody to give a wrong error message and googling it just shows that many people have the same problem, scrapers will not be fooled by that anyway). After a while, I stopped getting those errors.
It's complicated. Lots of sites want to geoblock Russia for good reasons, but it's not always clear if an IP address is Russian or Ukrainian. https://www.kentik.com/blog/the-russification-of-ukrainian-i...
Geoblock is kids game. Try birthblock. Western megacorps are asking Ukrainians for the passport data, to prove they are from Ukraine and then block them anyway, if they were born in the currently russian occupied regions. And they don't accept any proof of living outside of those regions. This is the level of sewing a yellow star on your work robe, but no one if talking about it or shaming the corporations.
This is absolutely insane but also completely unsurprising
can you explain what is the good reason here? Im constantly meet this problem and interested why
Looking at service logs at my company show a serious amount of hacking attempts by bots originating from Russian and Chinese IP addresses. Mostly harmless on an updated server not running an ancient Wordpress but attempts nonetheless.
For companies that don't serve customers there it's very common to just block those network ranges. Of course, it's no real solution, but some people are convinced every security layer contributes to 'defense in depth'.
wow, did these attacks start after the beginning of military actions in Ukraine in 2022? Or they were a long time before.
Thanks for clarification
It's not specifically Ukraine related, (spam) botnet harvesting is a much older practice. It was already a problem at my first job at the beginning of the century...
I don’t think that’s true anymore. This person for example is uploading from Ukraine: https://imgur.com/user/SytchArt
India too is on this list. Often I get an error claiming capacity overload, and it doesn’t work unless you switch to a vpn.
I guess that why they block IPv6 address when forced.
Similar situation to me. I got my Amazon account banned because I dared to use different Amazon websites with the same login. So amazon.de, .co.uk, .com ... I live in Norway where we don't have an official Amazon country..
Apparently I got flagged as suspicious, and every time I jump through the hoops to prove who I am, I get rejected.
I just stopped buying from Amazon.
Lost all my books, movies, tv shows. Everything. No recourse.
> Lost all my books, movies, tv shows. Everything. No recourse.
This is why I never "buy" anything I cannot keep my own copy of. Yes, I sometimes miss out, but fuck those guys.
One upshot of this is that I tend to buy more indy books where the author sells directly and DRM-free. Put the money right in their pockets.
It's a privilege to even have your Apple device working. If Apple decides it won't work, you're at their mercy.
Same goes for Windows or Android really.
If my windows device fails, I'm not going to Microsoft. I either fix the offending part of my desktop or laptop, or reinstall the OS or move to a different OS. If something is wrong with my android phone, I'm not going to Google since I don't own a Pixel and will go to the manufacturer of the phone. If it's a purely software issue, there are steps I can actually take to flash a different ROM though admittedly it's not an easy process.
Here Apple not only owns the device but also the software it's running as well as distribution of apps for this device except for CLI tools distributed by brew or other package managers. At least with a Mac I can install and run applications over the Internet. With an iPhone that's not at all possible (not sure about the status of side loading with the EU ruling and all)
Look up how many times a forced Windows update borked someone out of their computer.
Installing Windows without a key is not exactly straightforward, then there's that constant gentle reminder of how your copy of "Windows is not activated".
Microsoft COULD push an update that encrypts your hard drive, and forces you to pay $1000 for a key, if they wanted to.
It's unlikely, but the same as
> If Apple decides it won't work, you're at their mercy.
How many alternative operating systems work well on Apple devices?
Android phones usually have multiple options (Lineage, Calyx, eos, Graphene, depending on your particular phone) and you can always replace Windows with Linux.
How well do those alternatives play with your banking app?
Pretty well https://privsec.dev/posts/android/banking-applications-compa...
Also, having your banking app on your phone isn't the most desirable thing in reality, if you're security-minded.
My bank requires it, for better or for worse.
Any bank transfers are MFAd via the app, for example. It's the only bank that allows non-citizens in Germany that has English correspondence and wouldn't have taken months in Bureaucracy to open an account when I first moved.
So you chose an app-only 'bank' such as Revolut?
What did people do before such apps?
I chose the only bank that'd allow me to accept a paycheck in a reasonable amount of time after moving across the planet, yes.
HSBC in the UK now blocks access to your accounts unless you use one of the allowed whitelisted keyboards.
Nobody is claiming every single app works perfectly on alternative Android OSes, so pointing out exceptions isn't really advancing the discussion
I'm not on an alternative Android OS. I'm on the shipped Samsung install no roots, and no hacks.
Old school banks will block access if you make your own keyboard so it doesn't phone home to Google or Samsung. Unless I misunderstood the original conversation.
Can I ask what bank that is? I'm looking at getting a German bank account, and I'm still much more comfortable with English.
N26 bank
> having your banking app on your phone isn't the most desirable thing in reality, if you're security-minded.
Honest question: Why not?
I download less random program / files on my phone, then I do on my computer.
Think how your banking app might contain different data to other apps
He meant that the apps on the phone are less dangerous to a banking app.
That really doesn't answer the question. It contains similar things to your bank website's browser cache. What exactly are you trying to say here?
I don't understand what you mean.
Very well for my banking apps. With root and developers options enabled on my phone as well. If your banking apps does not work complain to your bank.
Very well, only the shittiest banking apps don’t work on them. Root is a bit more problematic, but would also be reason enough for me to change banks, as they seem to care more about theater than security.
Why would you want a banking app? If your bank won't work over browser and insists on installing some crap on your device, shop for another bank.
In Finland, for example, you have to authenticate online through your banking application for any online government service or things like mobile plan. This 2FA is basically mandatory and the alternative is using keys printed on a paper that you have to pay for cause every key is one time use only and I am not sure they will continue that service for long.
It’s probably similar in Sweden and other neighbouring countries
The government delegates authentication to banks of all things?
I guess shop for another country?
^This. For me, it's not my phone that's defective, it's the app. My phone runs my other ~10 apps that provide for my digital life perfectly fine, with the level of security I'm comfortable with (root access, firewall to block anything in/out that I don't specifically allow). If this is a problem for your app, your app is broken. I'll use something else.
I would not be able to log into _any_ local banking website without the government 2fa app. Not sure what the alternative is. Maybe they can give you an old school hardware device.
Or read the digital letters from government / municipalities.
Also I like my banking app.
> Not sure what the alternative is.
In your country? I'm not sure either.
In general? Slovenian government allows authentication via
- TLS client certificates,
- three different third party identity providers,
- ID card via a card reader
- .. or via NFC through a smartphone, and
- SMS OTP.
People who don't or don't want to use a smartphone shouldn't be barred from online government services or forced into a costly and slow authentication scheme when there's numerous better options.
I've used CalyxOS and GrapheneOS and I haven't had any issues with the Swedish banks.
Not really the case for Android, you skip the google account setup or the amazon account setup if you are using a fire tablet and continue using the device by sideloading whatever APKs you want. Most of the times the APKs that depend on Google Play Services will continue to work fine.
I skipped the amazon account registration and directly sideloaded the Google Play apps on my fire tablet.
Even for Google TVs you can skip the setup and use the TV as is. You can sideload APKs on this as well.
AFAIK, the account setup/login circumvention is not possible on fire tv sticks/google chromecasts.
You can take a very old android device factory reset it and continue using at as an offline only device without the blessings of google or amazon. (Except FRP devices)
But that is not the case with Apple, you need to connect it atleast once to the internet to activate the device.
> Not really the case for Android, you skip the google account setup
Is this possible even if the account is locked to the device (FRP), which is often the case?
(from unfortunate experience) no. You have to have freed your android phone from the shackles before your account ceases to work
Apple really are the poster child for "Stallman was right". When things are broken with their software you just have to hope that an update or relogging will magically fix things. You aren't even allowed to write your own software for the hardware you own without their permission. Terrible
"not [...] interfere with [...] Ad-Hoc distribution, or the Program [...]"
Obviously his email was an interference with the "Program" (Apple Developer Program). It probably had consumed an Apple employee's time, or that of an AI.
Imagine the EU or any government being in the position of saying to Apple: "You did not adhere to our terms xyz, therefore we terminate our granted permission for you to operate in this region. Please remove all tools you use to operate in this region and release the premises for other companies to use them, immediately", without explaining why. Because this is what Apple is doing.
> Imagine the EU or any government being in the position of saying to Apple: "You did not adhere to our terms xyz, therefore we terminate our granted permission for you to operate in this region.
Isn't that literally what the EU is doing with the DMA?
No, the EU have given them warnings with detailed explanation about what needs to change, and substantial timeframes to get the changes done.
Yes, but you cut off the critical words "without explaining why". And such decisions are subject to court review.
Really what people want is "judicial review for TOS bans", which I can see huge benefits to but it's also very expensive.
Certainly not.
No detailed reason given. Also no info from the developer on what they might have done to trigger this, so basically, except for “Apple terminated this account”, we don’t know what happened.
All we can complain about is that Apple’s rejection letters never go into detail. I’m afraid that’s what you get when the legal department of a large corp is involved.
There is no valid reason not to disclose that information to the user inside the rejection letter.
It's not as much a failure of Apple's legal department as it's a failure of the legal system where this is a-ok.
Doesn't matter what the app is - maybe user tried to publish an illegal app, but that should be clearly communicated. It's the civilized way.
Irrelvant. Apple shouldn't have that kind of control.
They shouldn't be able to set terms of how their services should be used?
I think we can all agree this is a poor response and they should give some idea on what the root problem is and how to address it, but to say they just shouldn't ever have conditions at all is absurd.
Yes. Agreed. But on the other hand Apple has taken conscious action to put themselves in the position where you have to go through them to get an attestation if you have customers who use Mac OS. They chose not to trust any attestation other than their own, you cannot choose to have Microsoft, or Red Hat, or IBM, or any other trusted vendor (e.g. https://www.sigstore.dev/ or something similar) attest and verify your software and your developer identity.
Youtube can say you can't use them for political content, anything to do with cars, whatever they want.
You also have choices beyond using Youtube.
USPS is the only carrier for many situations. They MUST allow you to mail firearms, baby chickens and weird vials of stuff. They don't get to opt out.
Either the market is full of choices or the sole provider has to do business with everyone for everything and no longer gets opinions.
Irrelvant. Apple shouldn't have that kind of control.
I read that in a dalek's voice.
Two days ago there were two redditors who had the same happen to them - banned for allegedly breaching 3.2(f). One from Australia the other from NZ.
https://old.reddit.com/r/iOSProgramming/s/oUVIuVWeJe
Hearing tales like these makes me super nervous. I don't think there's anything I can do to protect my app/account.
Parent link looks incorrect, this one seems to work: https://old.reddit.com/r/iOSProgramming/comments/1m14px0/jus...
This is not a new thing though, apple has been doing this for years, here is a similar report from 8 years ago: https://stackoverflow.com/questions/44105523/apple-rejected-...
Also, according to that link, section 3.2f is:
“You will not, directly or indirectly, commit any act intended to interfere with the Apple Software or Services, the intent of this Agreement, or Apple’s business practices including, but not limited to, taking actions that may hinder the performance or intended use of the App Store, B2B Program, or the Program.”
Something is happening right now at Apple, as I have seen another post on reddit about that (could not find it), where people complained about their Dev Accounts were banned as well, when they even did not have any apps, just used dev accounts to notarize apps for themselves.
It does suck, A LOT
While notarization as method of increasing security is a pain, I guess we need more details. For all we know, it is just as likely that some bad actor was prevented from distributing notarized apps. Perhaps even the developer was unaware that their machine has been compromised.
I remember an /r/AskReddit thread years ago about 'What's your favourite free smartphone app?' (or something along those lines) and the comment that most stuck in my mind was from an iPhone user lamenting how many interesting and novel things were only available on Android, because publishing for iOS was simply too hard.
This isn't to say that the Google Play Store is intrinsically better than Apple's App Store; Google is equally guilty of this what's the cheapest thing we can pass off as due diligence? nonsense. However, it is a good reminder that this sort of thing has been going on for a long time, and is only getting worse.
I think the idea of the smartphone as a general-purpose computing machine is dead, and that instead phones are now the designated Muggle-safe Internet consumption platform. Apart from media streaming, ordinary people aren't using computing machinery for anything they weren't using it for twenty years ago, so I think they won't feel any loss from the stagnation of mobile apps.
The lessons for HN readers are: a) app stores exist within their platform's moat; and b) don't build your business inside someone else's moat.
Trillion dollar companies outsourcing their developer support line to hacker news.
The joys of being at a platform's mercy.
You live by the Apple, you die by the Apple...
You get rich by the Apple, you get poor by the Apple...
You pay for the dev account, you beg to keep the dev account…
Well-known risk of making your livelihood dependent on a company that's consistently demonstrated that, as you would expect, it doesn't care about you or any of your concerns, and will screw you on a whim.
Tangentially related:
I bought a used MacBook air from my colleague to give to my girlfriend. It's the first apple device I've owned for more than a decade.
I was expecting smooth sailing. From afar it's supposed to be so well integrated and smooth.
What we experienced was the opposite. Even just the experience in macOS feels extremely janky. Lots of different UI paradigms, lack of feedback when logging into your apple account when it doesn't work in some cases.
Anyway, we updated everything and my gf even purchased something almost immediately - a nearly 100 dollar license for software from the app store.
She puts the laptop away for a couple of days and then we want to use it in the kitchen.. and we are told there's an issue with the account. We end up logging in online where we are finally told that its been blocked and we need to verify it. Whatever, I thought, it's probably just some filter. We verify with phone number and are told we'll need to wait a couple of days.
The result is that her apple id is just banned, and there is no recourse. No one can tell us anything at all except that we broke the terms of service. They can't even refund our purchase because they literally can't find our account in their system. We're literally instructed to do a charge back.
So we end up using another apple id that my girlfriend had, which she had forgotten about since it was only used for Apple tv... And it doesn't work. We are unable to login with it, and when we go online, we enter some sort of verification flow.. which just breaks. The final step is a website with a button which literally doesn't do anything when you press it. Except it does - it sends a request and I can see it return a 500.
We end up having to talk to support on the phone and they tell us this is all intentional, and he just needs to flip a switch in his system and we're good to go.
Literally the most asinine experience I've ever had with any tech company. Also the last time I'm buying anything Apple.
I barely use my Apple account, I wish I didn't need it at all but you have to have it to get xcode installed. I don't understand why account management is so janky on macs. It pretty randomly asks to verify the account, it's not ever clear something is happening when you click buttons. I tried Apple music and it's the same kind of experience in the macos app, janky, occasional errors, just very poor. Large company syndrome, you see the same problems with Ms and Google, as they grow they no longer put care into the edges.
While that experience is horrible, the fact that you were actually able to talk to support and that support was actually able to solve the problem puts it above the experience with pretty much any other tech giant.
The bar is so low these days...
Malicious or not, feels appropriate for https://github.com/andrewmcwattersandco/app-store-rejections
It sounds like the developer is just trying to notarize their macOS app, so it's not even an App Store rejection.
That repo is a valuable collection of documented App Store rejections with resolution paths - helpful for developers to navigate similar situations or preemptively avoid common pitfalls.
And yet, I’m still waiting for them to approve my developer account, It’s been two months now. they seriously need to be broken up and allow other app stores and ways to developer for their hardware.
I assume you had to pay up-front 2 months ago?
The letter says that you violated section 3.2(f) of the ADP agreement. [corrected the section no.]
3.2f.
“You will not, directly or indirectly, commit any act intended to interfere with any of the Apple Software or Services“
Contacting support obviously interfered with Apple services. Duh.
I wonder if they have a problem with the core functionality of the program. Maybe they do not want any Windows Recall clones popping up before they can offer their own solution, so they've decided to stamp down on this (screen recording timelapse software) because it is vaguely in the same category.
Then ban the app. Not the account.
How incredibly and criminally maliciously vague is such a legal paragraph for an app written for their own OS.
2.3 vs 3.2?
That's frustrating. Apple should provide clear reasons when taking such serious actions.
It's pretty crap that Apple won't explain the reasons. I can understand with something like a free facebook account where there isn't any money to pay for people to explain things but being an Apple dev generally involves paying hundreds of dollars to Apple and in return they should at least be prepared to talk to you.
Another reason to not support MacOS targets. Dealing with Apple is just too much of a hassle.