> On Apr 19, 2016, at 1:12 PM, Stefan Arentz <sare...@mozilla.com> wrote:
> 
> The org.mozilla.ios.FennecAurora.Today App Id is not available for us. That 
> most likely means someone hit ‘Fix It’ in Xcode, and now has registered that 
> bundle identifier in their personal account.
> 
> I know a bunch of you have personal developer accounts. Would you all be so 
> kind to go into the developer portal and see if this app identifier, or 
> anything related to org.mozilla.* exists in your personal account and then 
> delete those entries?

I asked Apple if they could ask the owner of the account to release the bundle 
identifier. Not sure if that works. Fingers crossed.

I got some questions in private email wether this is a security problem.

No I don’t think so.

First, if a bundle identifier is taken, we cannot use it. We cannot sign the 
app with identifiers that we do not own. So it is not possible that there are 
two apps with the same identifier on the store.

Second, identifiers are actually prefixed with a unique Team Identifier. You 
normally do not see this but that is what iOS uses internally. And that is also 
what is used on iOS for things like keychain sharing or app group. The Team Id 
and App Bundle Id make those unique. So it is not possible for someone to 
register a similar looking bundle identifier and then become part of our ‘app 
ecosystem’.

It is extremely annoying though that the identifiers are not made unique based 
on some prefix. Usually we register these identifiers before we publish code. 
In this case we missed one instance for the Aurora channel.

 S.

_______________________________________________
mobile-firefox-dev mailing list
mobile-firefox-dev@mozilla.org
https://mail.mozilla.org/listinfo/mobile-firefox-dev

Reply via email to