4 ms·
The core of the argument FTA: >>Wolfe did some digging into Footpath’s server logs, to see whether staff at Strava had been using Footpath. They had. “I disco
by docdeek 8y ago
The core of the argument FTA:
>>Wolfe did some digging into Footpath’s server logs, to see whether staff at Strava had been using Footpath. They had.
“I discovered multiple accounts and dozens of routing requests originating from Strava’s corporate IP address starting in November — literally hours after the Product Hunt tweet about Footpath,” Wolfe said. “Digging even further, a good percentage of the requests occurred over a six-hour period on December 12th and 13th. Strava’s December ‘hackathon’ where they purportedly conceived the idea? Also right around this time.”
Footpath’s Application Programming Interface (API) logs, seen by CyclingTips, do indeed show multiple instances of Footpath API access from Strava HQ between October and December 2018. Four requests were made in the day following Product Hunt founder Ryan Hoover’s tweet tagging Strava. Several clusters of requests followed through November before a flurry of activity in December.
Footpath’s API logs show nearly two and a half hours of activity from a user at Strava HQ on December 12, including the creation of 23 screenshots between 5:04pm and 7:25pm. The logs also show continued access between 10:45am and 8:40pm the following day. Four further API requests were made from Strava HQ through January.
- saturn_vk 8y agoSeems they reverse engineered it more than copy it.
- ctvo 8y agoWhat argument? That Strava's employees examined a competitor's app? A lot of apps are in trouble if this is considered bad behavior. Strava didn't steal any code. They copied a feature's presentation and UX, right? I'm sure Snapchat re: Instagram would be highly interested if there was a legal or even moral issue here, especially when there's no patent protection.
- bluetidepro 8y agoOff topic but "Strava’s corporate IP address" - How do people even figure that out? Maybe it's super obvious, but I'm not familiar? Can someone explain...
- phonon 8y agohttps://www.maxmind.com/en/geoip-demo https://www.maxmind.com/en/geoip-demo ?
- ericrwolfe 8y agoCreator of Footpath here. I didn't know this was possible either until I looked up the suspicious IP from the logs: https://www.ip2location.com/demo/12.131.20.242 https://www.ip2location.com/demo/12.131.20.242
- jeremy7600 8y agoI ask this sincerely: how much understanding of internet protocols did you have going into this project?
- ceejayoz 8y agowhois <ip address> will show you the owner of an IP. Sometimes it'll trace back just to an ISP, or to something like AWS, but larger companies will often own their own block of IPs directly.
- bluetidepro 8y agoAhhh, I guess that's why I got confused. Anytime I had run an IP check at previous/current jobs, I would always get back a generic ISP so you wouldn't see the company name. I hadn't ever been at a job that actually had their own block of IPs like that. That's what tripped me up. Makes more sense. So basically you can sometimes get to that info of who it is, and sometimes not.
- driverdan 8y ago> including the creation of 23 screenshots between 5:04pm and 7:25pm Tracking screenshots is really creepy.
- ericrwolfe 8y agoFull disclosure: Footpath does currently collect an analytics event when a screenshot gesture is invoked (absolutely no screenshot data) to decide whether to present a share prompt, and it had the unintended side effect of revealing suspicious account activity. I've already updated the code to remove the event in the next release. I'm happy to answer any questions about privacy and the data Footpath collects: https://footpathapp.com/privacy https://footpathapp.com/privacy
- kylec 8y agoYour privacy policy does not mention that you collect and store data on when users take screenshots
- strig 8y agoAnd publicly disclosing user screenshot counts and times is extra creepy.
- cannam 8y agoThis was the most surprising part of the article for me. I had no idea an app publisher could tell when I had taken a screenshot. (I don't use iOS myself; I assume if it's possible on iOS it's possible on Android as well?)