3 ms·

HTML requests are just text, how would you even go about scanning for that?

• judge2020 5y ago
  As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy). 0: https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d80db653289c9447ef7a/TMessagesProj/src/main/java/org/telegram/ui/Components/TranslateAlert.java#L1066 https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d...
  • fao_ 5y ago
    Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable. Anyway, regardless of that it sounds like it would be easily defeated with the following C format string: "%s-%s: %s/%s (%s) %s/%s %s/%s" with argument list: "User", "Agent", "Mozilla", "5.0", "X11; Ubuntu; Linux x86_64", "Gecko", "2010000", "Firefox", "90.0" For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.