6 ms·

Android Studio’s “Code contains easter egg” inspection (2019)

141 points by mqus 4y ago

pabs3 4y ago
This reminds me a bit of the "Trojan Source" paper. https://trojansource.codes/ https://trojansource.codes/
deleted 4y ago
[deleted]
lupire 4y ago
Why would they use "Easter Egg" to describe "lightly obfuscated code"? They are two different things. Easter Eggs have no special need for obfuscation in source code, just in UI. Especially for Java, not JavaScript where source code is at least slightly relevant to the end user experience?
- muststopmyths 4y ago
  Because frequently Easter eggs are frowned upon at large companies and I suppose developers may still be trying to sneak them in by obfuscation. So this linter is trying to catch those cases
  - BoorishBears 4y ago
    Realistically this would be the best way to get your easter egg caught. Unicode escape characters in comments will draw most people's eyes immediately, it just doesn't look natural. Instead write the easter egg in completely plain sight attached to a boring change, make sure the PR is passing CI on the first try, and a reviewer will skim for exactly .5 seconds before replying "LGTM!".
    - JTbane 4y ago
      For better effect, put the easter egg in a file and directory starting with "z" so it appears last in the pull request.
      - marcosdumay 4y ago
        zlib-interface: contains functions for displaying the author's name.
      - BoorishBears 4y ago
        People usually scroll straight down, so their eyes will dwell on the last contents Just past the fold at the top, but out of view from the bottom, would be the ideal place
  - MereInterest 4y ago
    Historically, Easter eggs were implemented as a way of having a verifiable resume. To reduce employee bargaining power, companies didn't include developer names in software credits. So even if you worked on project X, even if you designed and wrote the entire program as was common at the time, the developer didn't have any proof they could use on their resume. But, if you sneak in an Easter Egg, especially one that displays your name, you could use that as proof. So, given the antagonistic relationship in which Easter Eggs originated, I'm not surprised that large companies would continue that antagonistic relationship. Source: https://en.wikipedia.org/wiki/Easter_egg_(media)#Origin https://en.wikipedia.org/wiki/Easter_egg_(media)#Origin
    - eesmith 4y ago
      Your source points out while the term "Easter egg" was coined to describe a circumstance you mentioned, the concept is older, and used for circumstances other than what you described.
      - jjeaff 4y ago
        And we all know that the first and original use of a word is the only correct use of the word.
    - bitwize 4y ago
      In Japan, game companies forbade programmers from putting their real names in their games. It was an anti-poaching move, the studios didn't want their programmers hired out from under them. So the game programmers put aliases in instead. Hence why you see such strange names in games like Yu2, Nakazoo, Faw, S.Miyahon (who is actually Shigeru Miyamoto), etc.
    - kabdib 4y ago
      I stuck difficult-to-find easter eggs in my game cartridges precisely because I wanted to prove that I'd written them. The eggs are not spectacular, nor do they subtract from the player experience. It was just signing my name, when I wasn't allowed to. https://kotaku.com/donkey-kong-easter-egg-discovered-26-years-later-5307375 https://kotaku.com/donkey-kong-easter-egg-discovered-26-year...
- Closi 4y ago
  Probably because it's not looking for lightly obfuscated code, it's looking for hidden code (hidden by a unicode escape sequence).
- djur 4y ago
  It seems like it could be a way to draw attention to potentially concealed code without making an inflammatory and possibly false accusation. Or it could just be that someone at JetBrains used this trick to hide an Easter Egg at some point.
lawgimenez 4y ago
It reminded me of isUserAGoat https://developer.android.com/reference/android/os/UserManager#isUserAGoat https://developer.android.com/reference/android/os/UserManag...()
- mysterydip 4y ago
  "Used to determine whether the user making this call is subject to teleportations." As a non-android developer, I am now more confused.
  - olibhel 4y ago
    As a chromium task manager, I count teleported goats.
  - hbn 4y ago
    I'm pretty sure it used to return true if the user had Goat Simulator installed. Never played the game but I'm assuming there's something to do with teleportation in it.
    - exikyut 4y ago
      Yeah, it did O.o 2249 public boolean isUserAGoat() { 2250 if (mContext.getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.R) { 2251 return false; 2252 } 2253 // Caution: This is NOT @UserHandleAware (because mContext is getApplicationContext and 2254 // can hold a different userId), but for R+ it returns false, so it doesn't matter anyway. 2255 return mContext.getPackageManager() 2256 .isPackageAvailable("com.coffeestainstudios.goatsimulator"); 2257 } https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/os/UserManager.java;l=2236-2257 https://cs.android.com/android/platform/superproject/+/maste...
  - ddulaney 4y ago
    It's a reference to a very old (and since removed, at least in my version) Chrome Easter egg where Chrome Task Manager had a hidden column called "Goats Teleported". See https://bugs.chromium.org/p/chromium/issues/detail?id=31482 https://bugs.chromium.org/p/chromium/issues/detail?id=31482
AshamedCaptain 4y ago
I do think that "Face Screaming in Fear" is indeed the only appropriate reaction to a compiler parsing escape sequences outside of character/string literals. Also, it seems strange to add a detector for this specific case instead of actually fixing the IDE's parser to match the language's correct syntax rules.
- kllrnohj 4y ago
  Maybe jetbrains didn't want to fix the IDE parser for some reason? Although there's still value to that lint warning as lint isn't coupled to the IDE. So you'd get value out of that warning regardless of if you're using Android Studio or not, as well as value in CI or similar.
  - origin_path 4y ago
    Android Studio is a fork of IntelliJ, Google don't seem to contribute much stuff upstream in general. It seems to be more like, JetBrains pull from them sometimes when it's possible.
- moffkalast 4y ago
  And is also the appropriate reaction to using Android Studio.
  - tadfisher 4y ago
    I see you didn't use the Eclipse plugin (with Ant scripts, yay!). Dang I'm old.
- usrusr 4y ago
  Fixing the parser as in properly switching back from comment coloring to code coloring? Won't tell you anything unless you look, and you might still miss it. The linter will ring alarm bells that someone is trying to hide code even if you never had the file in question on the screen. I feel tempted to bring up the counter argument "but someone should look at untrusted code thoroughly enough to not miss it anyways!", but that would be like abolishing safety belts and airbags because surely people would drive more safely.
hahahGetbent 4y ago
methyl 4y ago
Is this inspection an easter egg itself?
dontbenebby 4y ago

141 points by mqus 4y ago

pabs3 4y ago

This reminds me a bit of the "Trojan Source" paper. https://trojansource.codes/ https://trojansource.codes/

deleted 4y ago

[deleted]

lupire 4y ago

Why would they use "Easter Egg" to describe "lightly obfuscated code"? They are two different things. Easter Eggs have no special need for obfuscation in source code, just in UI. Especially for Java, not JavaScript where source code is at least slightly relevant to the end user experience?

muststopmyths 4y ago
Because frequently Easter eggs are frowned upon at large companies and I suppose developers may still be trying to sneak them in by obfuscation. So this linter is trying to catch those cases
- BoorishBears 4y ago
  Realistically this would be the best way to get your easter egg caught. Unicode escape characters in comments will draw most people's eyes immediately, it just doesn't look natural. Instead write the easter egg in completely plain sight attached to a boring change, make sure the PR is passing CI on the first try, and a reviewer will skim for exactly .5 seconds before replying "LGTM!".
  - JTbane 4y ago
    For better effect, put the easter egg in a file and directory starting with "z" so it appears last in the pull request.
    - marcosdumay 4y ago
      zlib-interface: contains functions for displaying the author's name.
    - BoorishBears 4y ago
      People usually scroll straight down, so their eyes will dwell on the last contents Just past the fold at the top, but out of view from the bottom, would be the ideal place
- MereInterest 4y ago
  Historically, Easter eggs were implemented as a way of having a verifiable resume. To reduce employee bargaining power, companies didn't include developer names in software credits. So even if you worked on project X, even if you designed and wrote the entire program as was common at the time, the developer didn't have any proof they could use on their resume. But, if you sneak in an Easter Egg, especially one that displays your name, you could use that as proof. So, given the antagonistic relationship in which Easter Eggs originated, I'm not surprised that large companies would continue that antagonistic relationship. Source: https://en.wikipedia.org/wiki/Easter_egg_(media)#Origin https://en.wikipedia.org/wiki/Easter_egg_(media)#Origin
  - eesmith 4y ago
    Your source points out while the term "Easter egg" was coined to describe a circumstance you mentioned, the concept is older, and used for circumstances other than what you described.
    - jjeaff 4y ago
      And we all know that the first and original use of a word is the only correct use of the word.
  - bitwize 4y ago
    In Japan, game companies forbade programmers from putting their real names in their games. It was an anti-poaching move, the studios didn't want their programmers hired out from under them. So the game programmers put aliases in instead. Hence why you see such strange names in games like Yu2, Nakazoo, Faw, S.Miyahon (who is actually Shigeru Miyamoto), etc.
  - kabdib 4y ago
    I stuck difficult-to-find easter eggs in my game cartridges precisely because I wanted to prove that I'd written them. The eggs are not spectacular, nor do they subtract from the player experience. It was just signing my name, when I wasn't allowed to. https://kotaku.com/donkey-kong-easter-egg-discovered-26-years-later-5307375 https://kotaku.com/donkey-kong-easter-egg-discovered-26-year...
Closi 4y ago
Probably because it's not looking for lightly obfuscated code, it's looking for hidden code (hidden by a unicode escape sequence).
djur 4y ago
It seems like it could be a way to draw attention to potentially concealed code without making an inflammatory and possibly false accusation. Or it could just be that someone at JetBrains used this trick to hide an Easter Egg at some point.

lawgimenez 4y ago

It reminded me of isUserAGoat https://developer.android.com/reference/android/os/UserManager#isUserAGoat https://developer.android.com/reference/android/os/UserManag...()

mysterydip 4y ago
"Used to determine whether the user making this call is subject to teleportations." As a non-android developer, I am now more confused.
- olibhel 4y ago
  As a chromium task manager, I count teleported goats.
- hbn 4y ago
  I'm pretty sure it used to return true if the user had Goat Simulator installed. Never played the game but I'm assuming there's something to do with teleportation in it.
  - exikyut 4y ago
    Yeah, it did O.o 2249 public boolean isUserAGoat() { 2250 if (mContext.getApplicationInfo().targetSdkVersion >= Build.VERSION_CODES.R) { 2251 return false; 2252 } 2253 // Caution: This is NOT @UserHandleAware (because mContext is getApplicationContext and 2254 // can hold a different userId), but for R+ it returns false, so it doesn't matter anyway. 2255 return mContext.getPackageManager() 2256 .isPackageAvailable("com.coffeestainstudios.goatsimulator"); 2257 } https://cs.android.com/android/platform/superproject/+/master:frameworks/base/core/java/android/os/UserManager.java;l=2236-2257 https://cs.android.com/android/platform/superproject/+/maste...
- ddulaney 4y ago
  It's a reference to a very old (and since removed, at least in my version) Chrome Easter egg where Chrome Task Manager had a hidden column called "Goats Teleported". See https://bugs.chromium.org/p/chromium/issues/detail?id=31482 https://bugs.chromium.org/p/chromium/issues/detail?id=31482

AshamedCaptain 4y ago

I do think that "Face Screaming in Fear" is indeed the only appropriate reaction to a compiler parsing escape sequences outside of character/string literals. Also, it seems strange to add a detector for this specific case instead of actually fixing the IDE's parser to match the language's correct syntax rules.

kllrnohj 4y ago
Maybe jetbrains didn't want to fix the IDE parser for some reason? Although there's still value to that lint warning as lint isn't coupled to the IDE. So you'd get value out of that warning regardless of if you're using Android Studio or not, as well as value in CI or similar.
- origin_path 4y ago
  Android Studio is a fork of IntelliJ, Google don't seem to contribute much stuff upstream in general. It seems to be more like, JetBrains pull from them sometimes when it's possible.
moffkalast 4y ago
And is also the appropriate reaction to using Android Studio.
- tadfisher 4y ago
  I see you didn't use the Eclipse plugin (with Ant scripts, yay!). Dang I'm old.
usrusr 4y ago
Fixing the parser as in properly switching back from comment coloring to code coloring? Won't tell you anything unless you look, and you might still miss it. The linter will ring alarm bells that someone is trying to hide code even if you never had the file in question on the screen. I feel tempted to bring up the counter argument "but someone should look at untrusted code thoroughly enough to not miss it anyways!", but that would be like abolishing safety belts and airbags because surely people would drive more safely.

hahahGetbent 4y ago

methyl 4y ago

Is this inspection an easter egg itself?

dontbenebby 4y ago