Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

231–240 of 291 posts

Re: I decompiled the White House's new app

#231

Post by lumpo »

nclin_ wrote: post #189
gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

Dead link

The onesignal domain is on the IPFire Domain Blocklist

Found 1 list exactly matching 'onesignal.com':

  - https://dbl.ipfire.org/lists/ads/domains.txt
    block list
    added:         2026-02-13 15:00:20
    last modified: 2026-02-13 15:00:20
    last updated:  2026-03-29 04:02:16 (126.625 domains)
    enabled, used in 1 group
    comment: "IPFire Advertising"
    matching entries:
    - onesignal.com

Re: I decompiled the White House's new app

#232

Post by windexh8er »

no-name-here wrote: post #173
windexh8er wrote: post #169

Earlier quoted context omitted.

Apparently just like OP, you didn't read the article either. Just because the app doesn't ask for permission in the manifest doesn't mean it can't be acquired at runtime. It's very publicly documented [0]. So, no. Not a "hallucination". [0] https://documentation.onesignal.com/docs/en/location-opt-in-...

How certain are you of that? That appears to be about providing a message to the user before requesting permissions. However, it appears even permissions you allow your app to request still need to be declared beforehand? https://developer.android.com/training/permissions/requestin... Regardless, people are reporting mixed info on whether the app declares location access: https://news.ycombinator.com/item?id=47557010

I checked all versions. Maybe, just maybe, the app was changed in response? Hmmm, I wonder...

https://imgur.com/a/SNJL4XO

Re: I decompiled the White House's new app

#233

Post by trimethylpurine »

array_key_first wrote: post #185
trimethylpurine wrote: post #117

Earlier quoted context omitted.

Microsoft? Okta? JetBrains? If these are amateurs, who is a professional developer? https://www.encryptionconsulting.com/top-10-supply-chain-att... Are you aware that common libraries like Bootstrap, FontAwesome, and HTMX walk developers through linking to their CDNs directly? In fact, FontAwesome recommends it for CDN performance. I think you're dangerously mistaken if you believe that it "literally never" happens.…

Linking to a CDN is for development only. Once the app is build you build your dependencies into the app. You don't fetch them at runtime and run them. Not only for security, but also for performance. There's also a difference between using a CDN for, say, React and a random github project hosted by some dude.

Yeah I agree. Tell Microsoft. But, meanwhile this is normally used wrong in a lot of apps. It's not newsworthy that this one is also.

Re: I decompiled the White House's new app

#234

Post by trimethylpurine »

habinero wrote: post #165
trimethylpurine wrote: post #120

Earlier quoted context omitted.

Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst... " rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZq…

They have not. CDNs are specifically meant for demo/non-critical usage, to make it easy for amateurs to try out the library. You don't do this in any non-trivial system.

According to FontAwesome you're wrong. Their instructions say that their CDN is the recommended way to use their kits.

So, it's nice that you don't do this. But there's nothing special about the White House app doing it. It's very common.

Re: I decompiled the White House's new app

#235

Post by trimethylpurine »

magackame wrote: post #202
trimethylpurine wrote: post #120

Earlier quoted context omitted.

Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst... " rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZq…

Huh? But there are integrity checks (none in htmx case, which is strange), to prevent exactly this attack.

I'm not sure I follow. How does an integrity check help when the source is compromised? The developer doesn't know that their repo is compromised. They continue posting legitimate hashes because the repo is legitimately compromised.

Re: I decompiled the White House's new app

#236

Post by [deleted] »

lukewarm707 wrote: post #229
rendx wrote: post #34

Earlier quoted context omitted.

I don't know if you're being serious or not, but in case you are: There is a difference between (re)using other people's open sourced code, hopefully reviewed, and giving anyone in control of the third party repository the ability to run arbitrary code on your user's devices. Even if the "random GitHub repo" doesn't contain any malicious code right now, it may well contain some tomorrow.

even open source is not that trustworthy. there are several corpo open source ai apps that have rce built in. to cut a long story short they pull their config from the developer's server on startup. that config has user level permissions giving rce. some have no rce but get remote executed exfiltration of all the prompts. the app pulls its posthog config on startup and can just take all the keyboard inputs. submit a…

[deleted]

Re: I decompiled the White House's new app

#237

Post by hiccuphippo »

cuu508 wrote: post #171
crumpled wrote: post #166

Earlier quoted context omitted.

If you use Aurora Store instead of the Play store, you can download APKs. They are a Google Play store proxy.

Or from APKPure https://apkpure.com/the-white-house/gov.whitehouse.app

Is there a way to conver that xapk format to apk other than installing their app?

Re: I decompiled the White House's new app

#238

Post by mikey_p »

drnick1 wrote: post #149

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls. I wouldn't run a non-free government app on my phone, but this seems a positive. It's basically what uBlock does.

Except the app isn't a browser, doesn't advertise this feature and hides it from it's users.

Re: I decompiled the White House's new app

#239

Post by xocnad »

trimethylpurine wrote: post #88
xocnad wrote: post #33

Earlier quoted context omitted.

All good for you to make those choices for yourself. Your response seems to be show ignorance of all the recent supply chain attacks that have occurred. You can imagine that given the situation with the shoe gifts that many high up members of the administration and cabinet members are running this app.

I'm critical of the author. I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website. "A common app is doing the…

> I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting.

It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/ifra.... You seem to be flippantly dismissing this as insignificant given the people who are probably running this app.

> HN isn't supposed to be an especially political website.

Yes but when technology and politics cross paths...

Re: I decompiled the White House's new app

#240

Post by dbbk »

robin_reala wrote: post #222
gdeglin wrote: post #159

OneSignal cofounder here. Posting since our service was mentioned in this article. For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

We do not sell user data. Period. You’ll sell it if you sell your company (as per your privacy policy).[1] We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction. If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your…

Yes that's the normal way of doing things? Why would someone buy a business with no user base?
Post reply on HN