Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I decompiled the White House's new app

thereallo.dev

Post reply on HN
Print view View original

241–250 of 291 posts

Re: I decompiled the White House's new app

#241

Post by augusto-moura »

dbbk wrote: post #240
robin_reala wrote: post #222

Earlier quoted context omitted.

We do not sell user data. Period. You’ll sell it if you sell your company (as per your privacy policy).[1] We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction. If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your…

Yes that's the normal way of doing things? Why would someone buy a business with no user base?

I believe the problem is not doing this, but the text in the policy is misleading, since users would believe their data would never be shared with anyone outside of the company itself _unconditionally_, which is not true (if only by technicality), the data can be sold as part of the company.

Re: I decompiled the White House's new app

#242

Post by pdntspa »

ghywertelling wrote: post #172
Mathnerd314 wrote: post #167

Earlier quoted context omitted.

There's a specific writing style for globalized English that AI's use. And then this post also had none of the stylistic flourishes that a real author might add. And then simple things like constructing a table of 68 libraries or whatever organized by relatively subjective categories. That is something that nobody is going to do by hand.

There is a new term "load-bearing" which is used a lot in my usage of AI. Has anyone else encountered this term being used a lot in their conversations? Or is it a quirk of personalization?

Both you and parent are making a lot of load-bearing assumptions.

As someone who likes to use a lot of em dashes in writing -- the 'heuristics' that AI 'hunters' like to use need a lot of further refinement before I would trust them with anything. And yet there are legions of anti-AI crusaders out there wielding them like weapons.

These folks are reinforcing a bias against all kinds of people, particularly those who are not native English speakers and were very likely taught 'globalized' English in their language training.

Re: I decompiled the White House's new app

#244

Post by nielsbot »

throwawayqqq11 wrote: post #212
nielsbot wrote: post #187

Earlier quoted context omitted.

[flagged]

Thank god there are still republicans left. But snark aside, the next elections will be decided around damage control. Yes, the old school dems are pretty spineless (corrupt) but i guess even they feel the temptation of revenge and taking out political opponents for good. I really hope the new generation of democrats succeeds and breaks the corruption ties.

Thank you for understanding. I'm pointing things like Obama "looking forward not backward" and not punishing Bush, Cheney, Ashcroft, Condi, etc for war crimes and illegal warmongering which leads directly to today's current illegal Iran invasion.

We will need actual punishments for everyone who illegally defunded (or funded) programs, got us into the Iran invasion, embezzled and lined their pockets with corruption etc etc etc.

Re: I decompiled the White House's new app

#246

Post by malmeloo »

Gigachad wrote: post #183
malmeloo wrote: post #132

Earlier quoted context omitted.

Certificate transparency doesn't prevent misissuance, it only makes detection easier after the fact. Someone still needs to be monitoring CT and revoke the cert. I actually believe most HTTP stacks on Android don't even check cert revocations by default.

I'm not too sure what the detection process is like, but being found to sign fraudulent certificates results in your CA being untrusted and is the end of your business. So it's not going to be done lightly even if there isn't automated systems to catch it instantly (which there likely are at least for major websites)

The detection process basically boils down to 'server admins need to check CT themselves'. A CA also doesn't have to be malicious; a non-CA malicious actor could also exploit a vulnerability in the verification process of an honest CA. Depending on the severity of the situation that's unlikely to get them removed from the root stores.

Interesting example: last year Cloudflare found out that a CA had been (incorrectly) issuing certs for 1.1.1.1. They only found out 1.5 years after the first cert had been issued. The CA didn't do it with malicious intent, and as far as I know they're still in business. https://blog.cloudflare.com/unauthorized-issuance-of-certifi...

Re: I decompiled the White House's new app

#247

Post by trimethylpurine »

xocnad wrote: post #239
trimethylpurine wrote: post #88

Earlier quoted context omitted.

I'm critical of the author. I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. The supply chain attack articles are interesting exactly because this is so common. So what's special here other than it being loosely related to a disliked political figure? HN isn't supposed to be an especially political website. "A common app is doing the…

> I'm well aware of supply chain attacks. But this isn't a supply chain attack. If it were, the article would be way more interesting. It's an article that includes coverage of the exposure to supply chain attacks, mainly via directly linking in https://lonelycpp.github.io/react-native-youtube-iframe/ifra... . You seem to be flippantly dismissing this as insignificant given the people who are probably running this ap…

There's nothing you could exploit here. There's nothing special about this app. This article is about nothing. Not politics and not technology.

If you enjoy reading about how a guy smelled another guy's underpants and discovered that they smell like everyone else's, then rest assured, you can continue reading it over and over again if you like. I'm not able to down vote, so your enjoyment is safe from my opinion.

If he finds something interesting in there (I hope he does), and writes another article I might miss it, unfortunately, because I've written him off as a trash piece author.

EDIT: I went to use this as an example. Hilarious, this blog now has a bad SSL cert, just to put the icing on the cake.

Re: I decompiled the White House's new app

#248

Post by trimethylpurine »

torstenvl wrote: post #168
trimethylpurine wrote: post #120

Earlier quoted context omitted.

Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst... " rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZq…

I was being sarcastic. Although hot linking is not particularly common, it's common enough; and unpinned dependencies are just as much if not more of a supply chain attack risk. I'd bet something like 70+% of all JS apps are inadequately protected against the risk of a malicious actor gaining access to a dependency's repo. Pearlclutching over this while ignoring the lessons of `left-pad` and `colors` is biased motiva…

Awesome. Now that I know you were being sarcastic it's hilarious. It's amazing how difficult it is to tell from text.

Re: I decompiled the White House's new app

#249

Post by trimethylpurine »

gitaarik wrote: post #184
trimethylpurine wrote: post #13

I don't see what the fuss is about. This all looks pretty standard. I use random people's stuff all the time. Isn't that the point of open source? Did you find something malicious in the random GitHub repo? If so, you should write an article about that instead.

For an Android game downloaded from the Play store I wouldn't find these findings surprising at all. But from an official app from the White House? Well ok, from THIS White House - you're completely right to expect that.

Lol, this is a really funny take. I'm imagining Joe Biden or George Bush asking, "did you check it for supply chain vulnerabilities?"

The DoD has been hacked countless times, by children even. I wouldn't doubt if we decompiled most government apps we'd find this same vector in many of them.

It seems like this vector is only recently a hot topic. And decades of doing things wrong won't be patched and habits broken in short time. It will take a few years to get the majority of it, and decades after that to get the next majority, and so on.

Re: I decompiled the White House's new app

#250

Post by quesera »

rerdavies wrote: post #207
ceejayoz wrote: post #97

Earlier quoted context omitted.

But that's not true; it could easily fallback to other forms of geolocation like using the current IP.

That would allow you to see the local network IP (not actually sure you even get that, tbh). To get more detailed information about IP configuration, you need Location permission. Been there, done that. Most Android network information calls provide degraded information if you have not been granted Location permissions.

If an app can make an HTTP request, the app can know the user's public IP address and the geolocation derived from that.

This data has well-known limitations, but I think it is the fallback people are talking about here.

Post reply on HN