Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

111–120 of 291 posts

Re: I decompiled the White House's new app

#111

Post by array_key_first »

wincy wrote: post #75
analog31 wrote: post #59

[flagged]

Every default setup on every website and app for the last five or so years has been encouraging users to add pronouns, making it difficult to avoid it, even my iPhone asks me to add each person’s pronouns when I add a new contact. I don’t know why Siri needs to know that, but it’s there. There’s one website I use that won’t let you sign up as a contributor without “completing your profile”, which includes mandatory p…

I would imagine it would be useful in 100% of English-speaking workplaces because all workplaces have the expectation of English communication, which pronouns are essential for. If I'm writing an email or a chat message, I will typically have to use a pronoun.

Inferring pronouns has always been dumb and annoying. Many names don't have obvious pronouns, for example, the name "Taylor". Is that he or she? And clicking the little profile icon and squinting to see if someone is a man or a woman is also a waste of time. It's a lot easier for everyone if it just tells you the pronoun.

Re: I decompiled the White House's new app

#112

Post by mattdeboard »

logifail wrote: post #62
mattdeboard wrote: post #55

Earlier quoted context omitted.

He explicitly says he can't determine it, but that the location tracking as configured will turn on once the user grants consent. All true statements. How would you have written it differently

"If the user chooses to opt-in and grants location-tracking permission, the app is then, and only then, able to track the user's location?"

You would be lying if you wrote that because you do not know if that is true.

Re: I decompiled the White House's new app

#113

Post by array_key_first »

trimethylpurine wrote: post #84
kevinsync wrote: post #35

Earlier quoted context omitted.

Using somebody's stuff is different than hot-linking directly to a hosted version of it, even just from the perspective that dude could delete it at any time and break the whole app.

That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.

It's definitely a rant worthy mistake because this would literally never happen in any professional app anywhere. This is a supply chain risk.

Re: I decompiled the White House's new app

#114

Post by dinkumthinkum »

array_key_first wrote: post #108
periodjet wrote: post #83

[flagged]

> It’s hard to imagine a smug article like this dissecting a product of some other administration. Yes, that's because this administration is uniquely awful. Basically every single thing this administration does is bad. Often so bad that it's legitimately impressive just how incompetent our leaders our. Obviously previous administrations were not perfect, but to sit here and pretend that they are on the same level is…

[flagged]

Re: I decompiled the White House's new app

#115

Post by [deleted] »

dinkumthinkum wrote: post #114
array_key_first wrote: post #108

Earlier quoted context omitted.

> It’s hard to imagine a smug article like this dissecting a product of some other administration. Yes, that's because this administration is uniquely awful. Basically every single thing this administration does is bad. Often so bad that it's legitimately impressive just how incompetent our leaders our. Obviously previous administrations were not perfect, but to sit here and pretend that they are on the same level is…

[flagged]

[deleted]

Re: I decompiled the White House's new app

#116

Post by david_allison »

Groxx wrote: post #78
david_allison wrote: post #49

Earlier quoted context omitted.

You need to state the permissions you *may* request/use in AndroidManifest.xml. This data can then be displayed to users pre-installation. From the (limited) article, it doesn't seem they do this: https://thereallo.dev/blog/decompiling-the-white-house-app#p... ---- EDIT: I'm mistaken. From the Play Store[0] it has access to * approximate location (network-based) * precise location (GPS and network-based) [0] https://…

What version do you see? 47.0.1 doesn't have that for me: https://news.ycombinator.com/item?id=47557033

Very unusual: 47.0.1 is showing these permissions when on my MacBook viewing the store entry.

The Play Store doesn't show these permissions when viewed on my Pixel 9 Pro, and the APK doesn't have these permissions when downloaded/extracted.

Re: I decompiled the White House's new app

#117

Post by trimethylpurine »

array_key_first wrote: post #113
trimethylpurine wrote: post #84

Earlier quoted context omitted.

That's fair. I download and embed, personally. Still, it's not a rant worthy mistake, honestly. Suggest a better approach, sure.

It's definitely a rant worthy mistake because this would literally never happen in any professional app anywhere. This is a supply chain risk.

Microsoft? Okta? JetBrains? If these are amateurs, who is a professional developer?

https://www.encryptionconsulting.com/top-10-supply-chain-att...

Are you aware that common libraries like Bootstrap, FontAwesome, and HTMX walk developers through linking to their CDNs directly? In fact, FontAwesome recommends it for CDN performance.

I think you're dangerously mistaken if you believe that it "literally never" happens. It literally does happen all the damned time. And, for your own safety and others', you should assume that when you use any app for which you don't have the source code.

Re: I decompiled the White House's new app

#118

Post by technion »

Galanwe wrote: post #79
layer8 wrote: post #67

Earlier quoted context omitted.

> Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. How would they get your phone to trust their CA? Connecting to a Wi-Fi network doesn’t change which CAs a device trusts.

Because there is a quadrillion trusted CAs in every device you might use. A good chunk of these CAs have been compromised at one point or another, and rogue certificates are sold in the dark market. Also any goverment can coerce a domiciled CA to issue certs for their needs.

If you go down this path you argue desktop browsing https is broken, which i dont think is a serious argument.

Re: I decompiled the White House's new app

#119

Post by Gigachad »

subscribed wrote: post #63
r4indeer wrote: post #14

The argument regarding no certificate pinning seems to miss that just because I might be on a network that MITM's TLS traffic doesn't mean my device trusts the random CA used by the proxy. I'd just get a TLS error, right?

Not if someone can issue the certificate signed by the CA your phone trust. Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe. Or imagine living in the country where almost all of the cabinet is literally (officially) being paid by the propaganda/lobbying body of such country. Or living int he…

This is stopped by certificate transparency logs. Your software should refuse to accept a certificate which hasn’t been logged in the transparency logs, and if a rogue CA issues a fraudulent certificate, it will be detected.

Re: I decompiled the White House's new app

#120

Post by trimethylpurine »

torstenvl wrote: post #71
rendx wrote: post #34

Earlier quoted context omitted.

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?

Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers.

Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst..." rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous">

https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/..." integrity="sha384-I7E8VVD/ismYTF4hNIPjVp/Zjvgyol6VFvRkX/vR+Vc4jQkC+hVqc2pM8ODewa9r" crossorigin="anonymous"> https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstr..." integrity="sha... ```

Pay close attention, they are inviting the new developer to link not just to Bootstrap, but to Popper!

HTMX (code snippet from their quick start guide): ``` Click Me ```

Fontawesome: A video quick start guide and instructions that recommends using the direct link to the kits via CDN for performance!

Look, I certainly don't think they should be used this way. But, to say that it's unique to the White House app? I definitely wouldn't say that. In fact, I think you've dangerously overestimated the status quo.

Post reply on HN