Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

181–190 of 291 posts

Re: I decompiled the White House's new app

#181

Post by Gigachad »

fc417fc802 wrote: post #155
l2dy wrote: post #143

Earlier quoted context omitted.

Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214 And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-tran...

So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they). I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.

Corporate managed machines can control the software running on the computer to do anything. I'm not sure the details, but chrome certainly can support corporate MITM. There's likely some setting you have to configure first.

The default should be to reject certificates which aren't being logged, and if you as a user or corporation have a reason to use private certificates, you just configure your computer to do that. Which fully protects against the risk of normal CAs signing fraudulent certificates.

Re: I decompiled the White House's new app

#182

Post by gitaarik »

Arainach wrote: post #3

"An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls." In their defense, this is the first thing the Trump admin has done that's unambiguously positive for ordinary people.

Yeah it's great, we can actually let go of these silly open source projects like uBlock Origin, and just rely on the government for protecting us against the dangerous web!

Re: I decompiled the White House's new app

#183

Post by Gigachad »

malmeloo wrote: post #132
Gigachad wrote: post #119

Earlier quoted context omitted.

This is stopped by certificate transparency logs. Your software should refuse to accept a certificate which hasn’t been logged in the transparency logs, and if a rogue CA issues a fraudulent certificate, it will be detected.

Certificate transparency doesn't prevent misissuance, it only makes detection easier after the fact. Someone still needs to be monitoring CT and revoke the cert. I actually believe most HTTP stacks on Android don't even check cert revocations by default.

I'm not too sure what the detection process is like, but being found to sign fraudulent certificates results in your CA being untrusted and is the end of your business. So it's not going to be done lightly even if there isn't automated systems to catch it instantly (which there likely are at least for major websites)

Re: I decompiled the White House's new app

#184

Post by gitaarik »

trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

For an Android game downloaded from the Play store I wouldn't find these findings surprising at all. But from an official app from the White House? Well ok, from THIS White House - you're completely right to expect that.

Re: I decompiled the White House's new app

#185

Post by array_key_first »

trimethylpurine wrote: post #117
array_key_first wrote: post #113

Earlier quoted context omitted.

It's definitely a rant worthy mistake because this would literally never happen in any professional app anywhere. This is a supply chain risk.

Microsoft? Okta? JetBrains? If these are amateurs, who is a professional developer? https://www.encryptionconsulting.com/top-10-supply-chain-att... Are you aware that common libraries like Bootstrap, FontAwesome, and HTMX walk developers through linking to their CDNs directly? In fact, FontAwesome recommends it for CDN performance. I think you're dangerously mistaken if you believe that it "literally never" happens.…

Linking to a CDN is for development only. Once the app is build you build your dependencies into the app. You don't fetch them at runtime and run them. Not only for security, but also for performance.

There's also a difference between using a CDN for, say, React and a random github project hosted by some dude.

Re: I decompiled the White House's new app

#186

Post by array_key_first »

vdqtp3 wrote: post #144
array_key_first wrote: post #111

Earlier quoted context omitted.

I would imagine it would be useful in 100% of English-speaking workplaces because all workplaces have the expectation of English communication, which pronouns are essential for. If I'm writing an email or a chat message, I will typically have to use a pronoun. Inferring pronouns has always been dumb and annoying. Many names don't have obvious pronouns, for example, the name "Taylor". Is that he or she? And clicking t…

> If I'm writing an email or a chat message, I will typically have to use a pronoun. It's not that hard to just avoid it. I send emails to a lot of people I haven't spoken to and don't know their gender, so I write gender-neutral emails.

Sure, but why would I go out of my way to use gender neutral pronouns like "they" when they can just tell me their preferred pronouns?

Re: I decompiled the White House's new app

#188

Post by defrost »

array_key_first wrote: post #186
vdqtp3 wrote: post #144

Earlier quoted context omitted.

> If I'm writing an email or a chat message, I will typically have to use a pronoun. It's not that hard to just avoid it. I send emails to a lot of people I haven't spoken to and don't know their gender, so I write gender-neutral emails.

Sure, but why would I go out of my way to use gender neutral pronouns like "they" when they can just tell me their preferred pronouns?

It's only "out of your way" if you never learned to write gender neutral from the ground up.

In the 1970s and 1980s it was the default in many Commonwealth locales to not assume that (say) Rob Owens writing mathematics and engineering papers was male (as it turns out, she isn't, the Rob is short for Robyn).

So much correspondence was with people who had Initial Surname or abstract handles that didn't broadcast gender.

Re: I decompiled the White House's new app

#189

Post by nclin_ »

gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

Dead link

Re: I decompiled the White House's new app

#190

Post by array_key_first »

defrost wrote: post #188
array_key_first wrote: post #186

Earlier quoted context omitted.

Sure, but why would I go out of my way to use gender neutral pronouns like "they" when they can just tell me their preferred pronouns?

It's only "out of your way" if you never learned to write gender neutral from the ground up. In the 1970s and 1980s it was the default in many Commonwealth locales to not assume that (say) Rob Owens writing mathematics and engineering papers was male (as it turns out, she isn't, the Rob is short for Robyn). So much correspondence was with people who had Initial Surname or abstract handles that didn't broadcast gender…

But if someone has the ability to broadcast their preferred pronouns and we built that in, and it costs nothing, then what's the problem?

I guess I'm just not really understanding people getting upset at what I perceive to be completely made up problems. We have technology, we no longer have to assume gender neutral pronouns for everyone. They can just tell us the pronouns they want.

Post reply on HN