3 ms·

"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to mak

"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.

hamburglar 7y ago
Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.
- bigiain 7y ago
  Pretty sure at least some of those are “helpful” in the sense of “this is one of the ways we make money, by installing someone else’s sdk in our game and getting paid for it, while not looking too carefully at what it’s doing to our users”. And I’d be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven’t done this in the past even if they’re not doing it now. Surveillance capitalists gonna surveil...
  - ryandrake 7y ago
    This comes up all the time on HN and I’m always shocked[1] at how controversial an idea it is that the developer is responsible for knowing what they are shipping in their dependencies. “Oh, woe, how can you audit all of your dependencies and their dependencies and know what’s in them?? Oh it’s impossible! There is no way to solve this!” Too few devs are really careful about their dependencies and do good due diligence when evaluating them for suitability. Everyone else is just “Hey our problem is solved by this one. YOLO! Link it and ship it LOL!” I’ve seen projects that link and ship binary dependencies without even being able to inspect the source. This is, to me, totally insane. But standard practice in a lot of places! 1: https://news.ycombinator.com/item?id=21439953 https://news.ycombinator.com/item?id=21439953
    - bigiain 7y ago
      While I totally agree with what you say here, I think it goes deeper. Some devs/shops are complicit in this, knowingly adding dependencies for shady reasons.
wool_gather 7y ago
I think you got my point backwards. I wasn't justifying including bad code. > ...we included just because... Bob from marketing is the one who asked for the integration. > We should talk to Bob from marketing to make sure... Bob has no clue about this stuff. We're not asking Bob what the SDK is doing, we're telling him. And any other decision makers in the vicinity. Then we see whether the decision about the SDK changes. If not, we have to make our own personal ethical decision about what to work on.

"We shipped a trojan and code-signed it, but it's okay, it is some blob from a vendor that we included just because. We should talk to Bob from marketing to make sure it's not doing bad things." No.

hamburglar 7y ago

Ok, well, say "No" all you want but this totally happens, only the perpetrators are not nearly so clue-ful as to realize they've shipped a trojan. There are "helpful" SDKs out there whose ulterior purpose is to collect user data without the app author's knowledge. This is one reason I'm very wary about what apps I'll install... it's not enough to trust the app author if they include 3rd party code.

bigiain 7y ago
Pretty sure at least some of those are “helpful” in the sense of “this is one of the ways we make money, by installing someone else’s sdk in our game and getting paid for it, while not looking too carefully at what it’s doing to our users”. And I’d be astounded if various Facebook/Google/Twitter SDKs (including things like Fabric/Crashlytics and Google Analytics) haven’t done this in the past even if they’re not doing it now. Surveillance capitalists gonna surveil...
- ryandrake 7y ago
  This comes up all the time on HN and I’m always shocked[1] at how controversial an idea it is that the developer is responsible for knowing what they are shipping in their dependencies. “Oh, woe, how can you audit all of your dependencies and their dependencies and know what’s in them?? Oh it’s impossible! There is no way to solve this!” Too few devs are really careful about their dependencies and do good due diligence when evaluating them for suitability. Everyone else is just “Hey our problem is solved by this one. YOLO! Link it and ship it LOL!” I’ve seen projects that link and ship binary dependencies without even being able to inspect the source. This is, to me, totally insane. But standard practice in a lot of places! 1: https://news.ycombinator.com/item?id=21439953 https://news.ycombinator.com/item?id=21439953
  - bigiain 7y ago
    While I totally agree with what you say here, I think it goes deeper. Some devs/shops are complicit in this, knowingly adding dependencies for shady reasons.

wool_gather 7y ago

I think you got my point backwards. I wasn't justifying including bad code. > ...we included just because... Bob from marketing is the one who asked for the integration. > We should talk to Bob from marketing to make sure... Bob has no clue about this stuff. We're not asking Bob what the SDK is doing, we're telling him. And any other decision makers in the vicinity. Then we see whether the decision about the SDK changes. If not, we have to make our own personal ethical decision about what to work on.