4 ms·

I wouldn't be surprised if the apps themselves were not directly responsible here -- that is, the code that's written directly by the app developers. Instead,

I wouldn't be surprised if the apps themselves were not directly responsible here -- that is, the code that's written directly by the app developers. Instead, it may very well be be some analytics/marketing SDK that has been included in the app because of a business request. These have no privilege separation: they run their code in the same context as the code that the app developers wrote. (Consider the example of games with no text UI; unless they're truly spying on their users, what would they get from doing this?) I've said before, this SDK privacy hole is something we need to be very aware of as engineers and push our product/marketing folks to recognize as well. I would love to see Apple address it too. (On the other I have no idea how they would.)

izacus 7y ago
A few years ago, Pasteboard was a popular way of how advertising SDKs communicated between their own instances in different apps on iOS. It allowed those SDKs to determine which apps were installed on the phone and combine/mine user profile data across apps. Meaning: if you entered a social login in one app, others immediately got your demographic data. I assumed Apple plugged this hole by now :/
- cortesoft 7y ago
  Would that mess up things users actually copied?
  - saagarjha 7y ago
    You can read the pasteboard without messing it up, and then replace the contents back to what they used to be.
    - cortesoft 7y ago
      But don't you have to update the paste contents, and then wait for the other process to read them and update the paste contents to tell the original process that the message was received?
stefan_ 7y ago
"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.
- hamburglar 7y ago
  Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.
  - bigiain 7y ago
    Pretty sure at least some of those are “helpful” in the sense of “this is one of the ways we make money, by installing someone else’s sdk in our game and getting paid for it, while not looking too carefully at what it’s doing to our users”. And I’d be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven’t done this in the past even if they’re not doing it now. Surveillance capitalists gonna surveil...
    - ryandrake 7y ago
      This comes up all the time on HN and I’m always shocked[1] at how controversial an idea it is that the developer is responsible for knowing what they are shipping in their dependencies. “Oh, woe, how can you audit all of your dependencies and their dependencies and know what’s in them?? Oh it’s impossible! There is no way to solve this!” Too few devs are really careful about their dependencies and do good due diligence when evaluating them for suitability. Everyone else is just “Hey our problem is solved by this one. YOLO! Link it and ship it LOL!” I’ve seen projects that link and ship binary dependencies without even being able to inspect the source. This is, to me, totally insane. But standard practice in a lot of places! 1: https://news.ycombinator.com/item?id=21439953 https://news.ycombinator.com/item?id=21439953
frankus 7y ago
This is one of the few ways SDKs can enable e.g. diagnostic modes without extra integration work by the app developer, but as is often the case there's a fine line between "convenient hack" and "gaping security hole". Obviously this sort of thing needs super-explicit user opt-in and needs to be secured sufficiently that it can't leak private data, and it's possible/likely that a lot of SDKs aren't great about this.
hjnilsson 7y ago
I have personally seen apps that used the pasteboard to trigger debug ui / extra logging etc. For example, if the clipboard contained “FPS” when started, an FPS counter would be shown in game. Note: this was a long time ago, there are better methods now.

izacus 7y ago

A few years ago, Pasteboard was a popular way of how advertising SDKs communicated between their own instances in different apps on iOS. It allowed those SDKs to determine which apps were installed on the phone and combine/mine user profile data across apps. Meaning: if you entered a social login in one app, others immediately got your demographic data. I assumed Apple plugged this hole by now :/

cortesoft 7y ago
Would that mess up things users actually copied?
- saagarjha 7y ago
  You can read the pasteboard without messing it up, and then replace the contents back to what they used to be.
  - cortesoft 7y ago
    But don't you have to update the paste contents, and then wait for the other process to read them and update the paste contents to tell the original process that the message was received?

stefan_ 7y ago

"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.

hamburglar 7y ago
Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.
- bigiain 7y ago
  Pretty sure at least some of those are “helpful” in the sense of “this is one of the ways we make money, by installing someone else’s sdk in our game and getting paid for it, while not looking too carefully at what it’s doing to our users”. And I’d be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven’t done this in the past even if they’re not doing it now. Surveillance capitalists gonna surveil...
  - ryandrake 7y ago
    This comes up all the time on HN and I’m always shocked[1] at how controversial an idea it is that the developer is responsible for knowing what they are shipping in their dependencies. “Oh, woe, how can you audit all of your dependencies and their dependencies and know what’s in them?? Oh it’s impossible! There is no way to solve this!” Too few devs are really careful about their dependencies and do good due diligence when evaluating them for suitability. Everyone else is just “Hey our problem is solved by this one. YOLO! Link it and ship it LOL!” I’ve seen projects that link and ship binary dependencies without even being able to inspect the source. This is, to me, totally insane. But standard practice in a lot of places! 1: https://news.ycombinator.com/item?id=21439953 https://news.ycombinator.com/item?id=21439953

frankus 7y ago

This is one of the few ways SDKs can enable e.g. diagnostic modes without extra integration work by the app developer, but as is often the case there's a fine line between "convenient hack" and "gaping security hole". Obviously this sort of thing needs super-explicit user opt-in and needs to be secured sufficiently that it can't leak private data, and it's possible/likely that a lot of SDKs aren't great about this.

hjnilsson 7y ago

I have personally seen apps that used the pasteboard to trigger debug ui / extra logging etc. For example, if the clipboard contained “FPS” when started, an FPS counter would be shown in game. Note: this was a long time ago, there are better methods now.