Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

151–160 of 291 posts

Re: I decompiled the White House's new app

#151

Post by -retardando- »

yellow_lead wrote: post #4
colesantiago wrote: post #2

This is a pretty standard decomplation of an Android app. I am sure if you decompile other apps used by hundreds of thousands of people, you would find all sorts of tracking in there. Thanks for helping the White House improve their app security for free though.

Even in the apps I've worked on, you won't find us loading arbitrary JS from a random GitHub user's account.

> you won't find us loading arbitrary JS from a random GitHub user's account

You load arbitrary JS from a random GitHub user's NPM package. What's the difference?

Re: I decompiled the White House's new app

#152

Post by nazgul17 »

treykeown wrote: post #141
ddtaylor wrote: post #138

Earlier quoted context omitted.

I think you should make proper counter arguments instead of dismissing something because they used a specific tool. Ad-HomineLLM is a logical fallacy IMO and adds little value. I would hope eventually HN and other sites add this to the guidelines similar to other claims like vote manipulation etc.

Sorry, making up a word to try and frame distrust of LLM-generated content as a “logical fallacy” is a bad take. HN doesn’t have guidelines against anti-LLM rhetoric, but it does for LLM-generated comments. > Don't post generated comments or AI-edited comments. HN is for conversation between humans. https://news.ycombinator.com/newsguidelines.html#generated

GP was arguing against the OP, not a comment, and AI written posts are fair game.

Also, the comment you responded to was criticizing the attack to the substance of the post based on who/what wrote is. The comment neologism actually fits, IMO.

Re: I decompiled the White House's new app

#153

Post by Izkata »

fjdjshsh wrote: post #130
iancarroll wrote: post #23

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…

>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.

Perhaps the apparent hallucination they mentioned in their comment?

Re: I decompiled the White House's new app

#154

Post by jibal »

iancarroll wrote: post #23

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…

[flagged]

Re: I decompiled the White House's new app

#155

Post by fc417fc802 »

l2dy wrote: post #143
fc417fc802 wrote: post #137

Earlier quoted context omitted.

I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are present on many (most?) corporate networks. The point of the logs as I understand it is to surface events involving official CAs after the fact.

Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214 And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-tran...

So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they).

I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.

Re: I decompiled the White House's new app

#156

Post by direwolf20 »

goodmythical wrote: post #150
fjdjshsh wrote: post #130

Earlier quoted context omitted.

>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.

[flagged]

It's cool to dislike "disliking things "because AI""

Re: I decompiled the White House's new app

#160

Post by exogeny »

gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

[flagged]
Post reply on HN