0
\$\begingroup\$

I'm looking for some information regarding two specifics rules of the App Store Review guidelines. More specifically rules 2.7 and 2.8 :

2.7 Apps that download code in any way or form will be rejected

2.8 Apps that install or launch other executable code will be rejected

I intend to make a multiplayer mobile game that I could update remotely. So I used a framework that allows me to use a script language (namely Lua) on the top of my engine to code game logic. My intention was to have the client submitted and validated by Apple, and then have it download the latest version of the game data (imagine a zip file with assets and Lua scripts). However this seems to be forbidden by Apple. I do know that some rather famous game do it anyway (downloading JSON/Lua/JS files) to update their games, but I would like some clarifications.

My questions are the following :

  • Has anyone here made such a system on iOS ? If yes how did you deal with Apple ? Did you ask them about it ? Did you do it silently, hoping they don't notice ?

  • Has anyone ever been rejected because of that ? What did they say ? What was the incriminated download ?

  • Has anyone more information about those guidelines ? Where do they draw the line ? I suspect JSON/XML to be allowed, but it's unclear...

  • I imagine they could make some concession for big companies. If it's the case and you had them agree on something with you, how did you manage to do it ? Who did you contact ?

  • Broadly, any information regarding this would be welcome :

    • How did you / would tackle that issue ?
    • Are you aware of similar limitations for other platforms ?
    • Do you know a workaround for this situation ?
Improve this question
\$\endgroup\$
1
  • 1
    \$\begingroup\$ "Did you do it silently, hoping they don't notice?" You should not do this, it doesn't matter if somebody else has. This is essentially building your business on a foundation that can be removed from underneath you without warning. It would a phenomenally bad idea. \$\endgroup\$
    – user1430
    Dec 4, 2015 at 22:21

2 Answers 2

Reset to default
2
\$\begingroup\$

Do not count on getting an exemption for this. I haven't personally seen one. You can build stuff in a data-driven manner, but as soon as it's compiling code locally, you're in trouble.

Think of what's going on with Unity. They use Mono, and open-source version of the .NET framework. It has a Just-In-Time (JIT) compiler to handle some stuff. But on iOS, that's not allowed. So for iOS builds it does an Ahead-Of-Time (AOT) compile. This means certain parts of .NET don't work on iOS.

Unity is not a small company, and their engine has a very large userbase. Yet no exemption on compiling code locally.

Improve this answer
\$\endgroup\$
4
  • \$\begingroup\$ I knew that, but I also know that some companies do download some code. I was looking for insights about the way they did it. \$\endgroup\$
    – monsieur_h
    Dec 4, 2015 at 20:25
  • \$\begingroup\$ Who downloads code and how do you know? I would be VERY interested to hear about this. \$\endgroup\$
    – Almo ♦
    Dec 4, 2015 at 20:30
  • 1
    \$\begingroup\$ I won't mention the company I work at for obvious reasons, but we used to download json files that were parsed into instructions for various behaviors (One token=one function call, so that's close to an actual interpreted language) I did some research to see how far we could go with that, and with some tcpdump/wireshark magic I saw some more advanced stuff in a few concurrent games. The only one I can remember now is final fantasy record keep. What made me think they were doing it was the frequent addition of features and bugfixes without any update from the store. Wireshark confirmed. \$\endgroup\$
    – monsieur_h
    Dec 4, 2015 at 20:38
  • 1
    \$\begingroup\$ I know of a project that's achieving that by doing everything data-driven, but still no code downloads. But thanks for the additional data. \$\endgroup\$
    – Almo ♦
    Dec 4, 2015 at 20:53
1
\$\begingroup\$

Related: https://apple.stackexchange.com/questions/203189/will-the-app-store-reviewers-allow-scripts-downloaded-as-text-if-it-is-parsed-v

In short; Downloading Lua should be fine.

It's important to note the difference between executed code and an interpreted language; Lua is an interpreted language and is not itself an executed binary code and as such should be permissible with the current Apple guidelines. In this way, the Lua file is more like a configuration file that you are downloading to interact with your existing codebase.

Do note that it is extremely important that you lock down your Lua interpreter in your project to only allow access to what your scripts will need. Even though they are not executed code, they can be exploited by attackers to negatively impact your application.

Improve this answer
\$\endgroup\$
1
  • 2
    \$\begingroup\$ It says the downloaded code must be both interpreted and run inside WebKit (JavaScript) not lua \$\endgroup\$
    – gman
    Jul 16, 2016 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .