Like it was mentioned here [1]: nobody cares.
Trusting clients is probably a security flaw
21–30 of 150 posts
Re: Trusting clients is probably a security flaw
#22Ick. That turned my stomach. Sure it's bad for end users that corporate mobile app development is a swamp. In this case it only affects the vendor who lost out on users and reputation. But cavalier, reckless engineering equally causes harm to the client device or end user - if only in wasted time. Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk.…
> People need to be able to say "I studied what you asked me to make, and refuse to work on this illegal, insecure, depressing cruft, and if you fire me for having professional ethics my lawyers will empty your company bank account." This only works if everyone or the vast majority join unions. Otherwise, those who join will get penalised with lower offers or no offers at all.
> This only works if everyone or the vast majority join unions.
This is a common objection but I think it's wrong. Putting aside the huge differences between US (at will) and global employment law, the idea of a fluid, frictionless workforce is quite the myth. Keeping wages down and conditions poor very much relies on the propagation of that myth that ethics will work against you. so please be careful not to do yourself a disservice (if indeed you are a developer).
In reality quite small minorities have a disproportionate impact on change. Some accounts claim it's as low as three percent. I'm sceptical of that, but the fact remains; if only a handful of people object but with severe consequences by the force of law, employers will play it safe. I find it unlikely that any employers would survive long if it transpired they were disfavouring members of IEEE, ACM, IET or whatever.
Re: Trusting clients is probably a security flaw
#23Ick. That turned my stomach. Sure it's bad for end users that corporate mobile app development is a swamp. In this case it only affects the vendor who lost out on users and reputation. But cavalier, reckless engineering equally causes harm to the client device or end user - if only in wasted time. Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk.…
Why would you want to continue working at such a place as a developer? It's not like it's hard to find another job as developer...
The job market since 2022 says otherwise
Re: Trusting clients is probably a security flaw
#24Earlier quoted context omitted.
Why would you want to continue working at such a place as a developer? It's not like it's hard to find another job as developer...
> It's not like it's hard to find another job as developer... In 2025? Haven't you noticed the massive layoffs by the big companies. Check r/cscareerquestions and read the posts from seniors unable to find a job
Worth mentioning that the IT jobs crisis is mostly an US thing.
It's still relatively easy to find a dev job in Poland or many other EU countries. It's worse than before, as in bootcamps are no longer enough, but as a mid+ it's still very easy.
Re: Trusting clients is probably a security flaw
#25This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…
You could try getting them to give you a physical security key, they used to supply them and I think still will if you can't use the app (just say it doesn't work on your phone). I have one and the website still works with it.
Re: Trusting clients is probably a security flaw
#26[flagged]
Re: Trusting clients is probably a security flaw
#27Earlier quoted context omitted.
This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…
You could try getting them to give you a physical security key, they used to supply them and I think still will if you can't use the app (just say it doesn't work on your phone). I have one and the website still works with it.
Thanks, I was thinking of phoning and asking, but good to know there is some point in waiting in the queue to talk to someone!
Re: Trusting clients is probably a security flaw
#28This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…
> I find it disturbing that any app can examine your device in this much detail.
When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I was in a "dev mode" somehow, but that was very surprising.
Re: Trusting clients is probably a security flaw
#29[flagged]
Re: Trusting clients is probably a security flaw
#30Ick. That turned my stomach. Sure it's bad for end users that corporate mobile app development is a swamp. In this case it only affects the vendor who lost out on users and reputation. But cavalier, reckless engineering equally causes harm to the client device or end user - if only in wasted time. Given the audience here, I hope many would agree it's pitiful that developers are wasting their time building this junk.…
> professional body membership is becoming more important for programmers. People need to be able to say "I studied what you asked me to make, and refuse to work on this illegal, insecure, depressing cruft, and if you fire me for having professional ethics my lawyers will empty your company bank account."
I think this might be an interesting one to consider, other than the "depressing" bit of course. The problem is, I think, if you have the accreditation and you develop an insecure application, do you lose the accreditation? What's the tradeoff?