4 ms·

Which is impossible with any app of reasonable size that uses third party SDKs (which are often required for business reasons). Apple didn't catch it, how can w

by adevine 11y ago

Which is impossible with any app of reasonable size that uses third party SDKs (which are often required for business reasons). Apple didn't catch it, how can we expect hundreds of small developers to catch it?

mikeash 11y ago
Apple spends a few minutes reviewing any given app. The developers have much more time to examine this stuff.
- NateLawson 11y ago
  I disagree that developers can be expected to find this kind of thing on their own, say by digging in with a debugger. It's simply not a scalable solution. I think you need a appstore-wide view of the entire software world and the ability to query it for arbitrary behavior. But I'm biased since that's what we've spent years building. :-)
  - a3n 11y ago
    In the case of the SDK in question, how much due diligence on the developers' part would you say is appropriate? Not necessarily binary analysis, but more along the lines of knowing who you're getting your tools from, reputation, whatever, etc. Because as far as I, a user is concerned, that developer put that software on my phone. Maybe I as a user have a similar due diligence burden. One thing I might do is never download an app from the affected developers again. But that doesn't seem like a desired outcome. Nevertheless, I don't see how a user could do anything more fine-grained and nuanced than that.
    - NateLawson 11y ago
      Really great question. Certainly, there are "too good to be true" offers out there you might want to be concerned about, such as ad networks that pay crazy high CPMs. I'm biased, but I think developers should be using our service to track the code that they're putting in apps (including their own code) for security, quality, and app review problems. We watch third-party code for them, which is how we found this issue. I think it's unreasonable to expect developers to reverse-engineer every library they include. I agree users really can't do as much about this. We are considering ways to distribute the list of vulnerable apps/versions to help users find if they have them.
NateLawson 11y ago
Well, that's what we do for a living -- help thousands of small or large developers find these problems ahead of time. It's not an easy problem and not something you can do by hand. We've indexed the code in millions of apps and then learn patterns from it. For example, you can discover a new SDK being adopted by apps in one region purely from the co-occurrence of binary signatures. We're working hard to give developers this kind of insight, helping them detect problems in their apps before they are affected.

by adevine 11y ago

mikeash 11y ago

Apple spends a few minutes reviewing any given app. The developers have much more time to examine this stuff.

NateLawson 11y ago
I disagree that developers can be expected to find this kind of thing on their own, say by digging in with a debugger. It's simply not a scalable solution. I think you need a appstore-wide view of the entire software world and the ability to query it for arbitrary behavior. But I'm biased since that's what we've spent years building. :-)
- a3n 11y ago
  In the case of the SDK in question, how much due diligence on the developers' part would you say is appropriate? Not necessarily binary analysis, but more along the lines of knowing who you're getting your tools from, reputation, whatever, etc. Because as far as I, a user is concerned, that developer put that software on my phone. Maybe I as a user have a similar due diligence burden. One thing I might do is never download an app from the affected developers again. But that doesn't seem like a desired outcome. Nevertheless, I don't see how a user could do anything more fine-grained and nuanced than that.
  - NateLawson 11y ago
    Really great question. Certainly, there are "too good to be true" offers out there you might want to be concerned about, such as ad networks that pay crazy high CPMs. I'm biased, but I think developers should be using our service to track the code that they're putting in apps (including their own code) for security, quality, and app review problems. We watch third-party code for them, which is how we found this issue. I think it's unreasonable to expect developers to reverse-engineer every library they include. I agree users really can't do as much about this. We are considering ways to distribute the list of vulnerable apps/versions to help users find if they have them.

NateLawson 11y ago

Well, that's what we do for a living -- help thousands of small or large developers find these problems ahead of time. It's not an easy problem and not something you can do by hand. We've indexed the code in millions of apps and then learn patterns from it. For example, you can discover a new SDK being adopted by apps in one region purely from the co-occurrence of binary signatures. We're working hard to give developers this kind of insight, helping them detect problems in their apps before they are affected.