Your are right, prior to this method the IPK was downloaded. Now, it all happens on the device, it’s actually not a really big threat. Lets hope Palm will let us have this little workaround until they fix the submission process or get rid of the geo-filtering once and for all. There’s actually a reason for this post and my tool *hint*

So, I couldn’t agree more on your priority list for Palm. Until then, check back on the above link soon.

But this also explains why Palm had to react. The IPK fetcher tool did pose a much greater threat, allowing you to localy save apps on your computer, reinstall them even if they are no longer officially available via the app catalog or just unpack the IPK and have a look at the source of any app which, considering it’s all HTML, CSS and JS tends to be quite readable, etc. Palm obviously had to take care of this.

As for the method I describe in my blog post, it really just allows you to bypass regional filtering and that only for free apps. It’s still Palm’s App Catalog app, that does the actual downloading to the encrypted file system, so there’s no (simple) way locally backup these apps or directly access the IPKs / source code within them.

That said, I really hope that Palm decides to leave this “backdoor” open for a while, at least until they straighten out their app submission process and stuff to get the rest of the world on par with the US app catalog. I realize that based on the functionality of an app, copyright restrictions, etc. there are reasons why some apps should be limited to a certain region, but in the current state of the App Catalog, the main reason for an app to be US only is Palm’s complicated app submission form combined with the laziness of programmers with respect to filling out forms and the lack of appeal coming from Palm to encourage programmers to go that extra mile.

Palm’s priority should be 1) fix the app submission process and imparity between regional app catalogs 2) close the loopholes, not the other way round.

And above all, there are way bigger holes in Palm’s security measures to protect (to be) downloaded apps than the one I mentioned.

this method has been known for a while now, that’s why I have rewritten my tool IPK Fetcher a couple of weeks ago. I’m going to upload it very soon.

But just a warning: last time Palm reacted very quickly (with the release of IPK Fetcher).. we shouldn’t be too loud about this. I don’t think Palm has a reason to break this method because only the official App Catalog is downloading the real applications, but you have been warned..

http://www.nexave.de/forum/38588-ipk-fetcher-der-ipk-downloader.html (new version not uploaded YET)