Ask HN: Apple terminated our dev account over a rogue employee
35 comments
This post is so light on the details (what? when?) that it’s impossible for me to be supportive.
OP: I suggest being MUCH more transparent when asking for help.
For all we know you are running a scam center support app. Consider the outraged posts that make it to the front page, essentially complaining about how their MLM bitcoin scam has been shut down.
OP: I suggest being MUCH more transparent when asking for help.
For all we know you are running a scam center support app. Consider the outraged posts that make it to the front page, essentially complaining about how their MLM bitcoin scam has been shut down.
sorry for not including details, we do not know why the account got terminated exactly, were suspecting leaked certs
Your issue might not be just the rogue employee leaking certificates, it sounds like you were sharing one Apple Developer account between multiple developers which is also against their T's & C's
Really every developer should have their own account and work on their own machine
If you were all using the one account on the same machine, then Apple has no way of telling who did what
Really every developer should have their own account and work on their own machine
If you were all using the one account on the same machine, then Apple has no way of telling who did what
> it sounds like you were sharing one Apple Developer account between multiple developers which is also against their T's & C's
Whether the case or not here (I don't know), taking a look at the big picture: Imagine if in the 90s Apple could come in to a software company and dictate what development practices and account management they must do to ship software for a Mac! Would've been instant outrage. Anyone was free to write and ship software however they liked. How low we have fallen to allow near-monopolies to dictate terms.
Whether the case or not here (I don't know), taking a look at the big picture: Imagine if in the 90s Apple could come in to a software company and dictate what development practices and account management they must do to ship software for a Mac! Would've been instant outrage. Anyone was free to write and ship software however they liked. How low we have fallen to allow near-monopolies to dictate terms.
I think the earlier comment was asking about transparency about your product. What is it and exactly what does it do? And also what exactly did the rogue employee do?
Some of these detail might allow the community to decide if Apple is being unfair or there is actual cause for concern. We have so far seen a very one-sided story.
Some of these detail might allow the community to decide if Apple is being unfair or there is actual cause for concern. We have so far seen a very one-sided story.
This is just one of the many risks you take when your app or service is dependent on some other third party service. Even if it is run by 'the big boys' (in this case Apple), your success is dependent on their good graces.
They can kick you out and make your software the equivalent of bricked hardware; without any means to appeal their decisions.
They can kick you out and make your software the equivalent of bricked hardware; without any means to appeal their decisions.
> Even if it is run by 'the big boys' (in this case Apple), your success is dependent on their good graces.
Not "even if" though, it is "particularly if". The big boys don't have to care, so they don't care, because what are you going to do. They have all the power, you have none.
If you are going to depend on a third party it is best to depend on small ones where they need you as a customer as much as you need them as a service. In an equal relationship you can always reach a human to have a dialogue about any issues that arise.
Of course, if you're targeting a mobile platform, you're out of luck. Best to target the open web if at all possible.
Not "even if" though, it is "particularly if". The big boys don't have to care, so they don't care, because what are you going to do. They have all the power, you have none.
If you are going to depend on a third party it is best to depend on small ones where they need you as a customer as much as you need them as a service. In an equal relationship you can always reach a human to have a dialogue about any issues that arise.
Of course, if you're targeting a mobile platform, you're out of luck. Best to target the open web if at all possible.
They aren't dependent on a third-party "service", exactly. If you make software for phones, the most popular hardware platform in the world @ 8 billion devices, you are at the complete mercy of Apple/Google, period.
web is the way
Yes. Want to keep it that way? Or what are you working on?
'Recently', how long are we talking here? You've already emailed the execs, if they think it's worthy of review they'll assign someone to you, it can take a few days.
Apple is pretty vague on their security practices purposefully so people don't try to game them. They are transparent though in that they are pretty strict 8000 dev account appeals and only 225 reinstatement in 2024 https://discussions.apple.com/thread/256187336?sortBy=rank
Since you fired someone that would suggest you had something more than just a cert leak to a public GitHub. Did your appeal include an rca covering what actions the employee did that you identified then action plan to prevent in future. In Banking security at least and probably pretty similar we would see a lot of scapegoating in submitted rca which was frowned upon. It is failure of process that allowed an employee to do something undetected so identify action, and how it went undetected and your action plan should cover both. Don't rush into spamming them until you are confident in your plan. How is the cert stored on NAS / machine and what access controls on that machine and data loss prevention strategy for your cert. what monitoring to usage of cert do you have/submissions to app store sent to email all have access to or to company lead?
I am very sorry for your loss and the harm it is causing you.
Unfortunately, this is one of the risks of handing control over your future to the tyrants who run walled gardens.
While you can't undo the past, the silver lining of this experience is that it has clarified to you that Apple is an abusive, unfair, and unreasonable corporation that you should avoid doing business with.
As an immediate action, I'm sure it's not what you want to hear, but HTML5 and WASM have come a long way, and mobile web applications are increasingly converging on the capabilities of native mobile applications. While a rewrite will not be cheap or easy, ensuring you can offer service to your users without having to ask an abusive tyrant for permission ensures you are at less risk of this kind of tyranny and the disruption and harm it inflicts upon you and your users in the future.
I am sympathetic to the victims of Apple's tyranny (as well as Google's, Microsoft's, and others), and I know I can't solve the problem by myself, but I would like to help in a more material way - do you have a Bitcoin address I can send a donation to?
Unfortunately, this is one of the risks of handing control over your future to the tyrants who run walled gardens.
While you can't undo the past, the silver lining of this experience is that it has clarified to you that Apple is an abusive, unfair, and unreasonable corporation that you should avoid doing business with.
As an immediate action, I'm sure it's not what you want to hear, but HTML5 and WASM have come a long way, and mobile web applications are increasingly converging on the capabilities of native mobile applications. While a rewrite will not be cheap or easy, ensuring you can offer service to your users without having to ask an abusive tyrant for permission ensures you are at less risk of this kind of tyranny and the disruption and harm it inflicts upon you and your users in the future.
I am sympathetic to the victims of Apple's tyranny (as well as Google's, Microsoft's, and others), and I know I can't solve the problem by myself, but I would like to help in a more material way - do you have a Bitcoin address I can send a donation to?
we just need a human to read our appeal
Unfortunately you probably need to think abou this from the point of view of an anti-fraud/abuse team. How would you differentiate between a business that had an employee go rogue and a business deliberately trying to cause harm and get away with it?
Claiming you fired the party responsible isn’t very convincing, honestly, especially if it’s hard to verify: was it an alias? did the employee only exist on paper? are they still around just not “employeed”, were they a designated patsy? Nor are claims that you revamped your security, which doesn’t address the root problem of whether it was intentional behaviour or not. And what’s worse, the natural urgency and appeals to emotion that you include in your story are unfortunately widely used tactics by scammers to try to get a human to bend rules to their benefit, and reviewers are trained to treat them as such. You need hard evidence.
How can you demonstrate that you didn’t know what the employee was doing? Have you reported the employee to the police? Is there a criminal case you can point to? Simply having a bad process before could very easily have been an intentional way to avoid knowledge of wrong doing, another common tactic used by criminal orgs.
Best of luck.
Claiming you fired the party responsible isn’t very convincing, honestly, especially if it’s hard to verify: was it an alias? did the employee only exist on paper? are they still around just not “employeed”, were they a designated patsy? Nor are claims that you revamped your security, which doesn’t address the root problem of whether it was intentional behaviour or not. And what’s worse, the natural urgency and appeals to emotion that you include in your story are unfortunately widely used tactics by scammers to try to get a human to bend rules to their benefit, and reviewers are trained to treat them as such. You need hard evidence.
How can you demonstrate that you didn’t know what the employee was doing? Have you reported the employee to the police? Is there a criminal case you can point to? Simply having a bad process before could very easily have been an intentional way to avoid knowledge of wrong doing, another common tactic used by criminal orgs.
Best of luck.
we sent supporting paperwork to apple, and a simple search from their end will confirm things
I hope you get this sorted !
If we're going feudal, it would be a good idea to provide justice to the commoners like feudal lords were obliged to do.
I.e. all these "tech companies" that want people to have accounts (and be heavily invested and/or dependent on them) should not be able to cancel those accounts without due process. This should be a legal requirement for them to operate at all.
I.e. all these "tech companies" that want people to have accounts (and be heavily invested and/or dependent on them) should not be able to cancel those accounts without due process. This should be a legal requirement for them to operate at all.
thanks
How about your android version?
How hard it will be to rewrite it for the web?
If it's react native or flutter probably not that hard, you can go back online with some struggle, but it's at least a way.
How hard it will be to rewrite it for the web?
If it's react native or flutter probably not that hard, you can go back online with some struggle, but it's at least a way.
The lack of empathy in the comments is appalling. This could happen to anyone, and the inability to reach a human to fix it is extremely poor customer service.
What did the employee do?
What is their second chance policy for incidents of misuse, generally?
I mean, you're straight up saying your team violated the Dev Terms of Service. That's kinda game over.
Honestly, HN is a great customer support forum considering so many posts actually get treated better than just using the standard customer support (many startups and other companies paying attention to it helps a bunch). It has to have more merit some of the time (this is not to say it is an assessment of what you are saying at all.
I love this thread full of people asking "what did the employee do?" and not "why do Apple and Google have the right to control distribution of all mobile software with no recourse?". It honestly does not matter, in any way, what the employee did. Apple should not be the final arbiter of who is allowed to develop mobile software.
> Apple should not be the final arbiter of who is allowed to develop mobile software.
That is the big picture here. Details aside, one company should not have the power to dictate how developers write software for their customers, just because those happened to purchase hardware from the big company.
If you think of this in terms of how the world existed prior to mobile, it would've been insane for any general purpose compute device (Apple ][, C64, IBM PC, etc).
That is the big picture here. Details aside, one company should not have the power to dictate how developers write software for their customers, just because those happened to purchase hardware from the big company.
If you think of this in terms of how the world existed prior to mobile, it would've been insane for any general purpose compute device (Apple ][, C64, IBM PC, etc).
Isn't that what the web is for?
we suspect leaked certs
We are a small software company in Africa. For over two years, we've built and maintained an app. It has become a vital economic engine for our local community, employing a whole fleet of delivery agents and serving as a lifeline for local stores and restaurants.
Recently, we discovered that a single employee used a shared company machine to engage in unauthorized activities that violated Apple's Developer Terms of Service.
We took immediate action: we fired the employee on the spot and completely overhauled our security. We revoked all individual access and implemented mandatory, peer-reviewed, supervised sessions for any Apple Developer portal access.
The problem is the collateral damage. Apple terminated our entire organization's account. We submitted an appeal through App Store Connect, but we feel completely stuck behind automated walls. We have also emailed Apple executives, but are waiting in the dark.
Because of this one employee's actions, our app is facing total removal, and families in our community are quite literally losing their daily income. We aren't asking for special treatment, just a chance for a real human at App Review to look at the security steps we've taken and consider a second chance.
If anyone here has been through this, has advice, or knows how to get a human at Apple to actually read our appeal, our entire community would be forever grateful. Thank you so much for your time.
(For reference if any Apple folks are reading: our Apple Team ID is T35TM9SW45)