3 ms·
I disagree that developers can be expected to find this kind of thing on their own, say by digging in with a debugger. It's simply not a scalable solution. I t
by NateLawson 11y ago
I disagree that developers can be expected to find this kind of thing on their own, say by digging in with a debugger. It's simply not a scalable solution.
I think you need a appstore-wide view of the entire software world and the ability to query it for arbitrary behavior. But I'm biased since that's what we've spent years building. :-)
- a3n 11y agoIn the case of the SDK in question, how much due diligence on the developers' part would you say is appropriate? Not necessarily binary analysis, but more along the lines of knowing who you're getting your tools from, reputation, whatever, etc. Because as far as I, a user is concerned, that developer put that software on my phone. Maybe I as a user have a similar due diligence burden. One thing I might do is never download an app from the affected developers again. But that doesn't seem like a desired outcome. Nevertheless, I don't see how a user could do anything more fine-grained and nuanced than that.
- NateLawson 11y agoReally great question. Certainly, there are "too good to be true" offers out there you might want to be concerned about, such as ad networks that pay crazy high CPMs. I'm biased, but I think developers should be using our service to track the code that they're putting in apps (including their own code) for security, quality, and app review problems. We watch third-party code for them, which is how we found this issue. I think it's unreasonable to expect developers to reverse-engineer every library they include. I agree users really can't do as much about this. We are considering ways to distribute the list of vulnerable apps/versions to help users find if they have them.