6 ms·

I was wondering why PinDuoDuo were hiring for "Android Reverse Engineer". Screenshot of translated job page: https://github.com/jonatron/randomstuff/blob/main/S

I was wondering why PinDuoDuo were hiring for "Android Reverse Engineer". Screenshot of translated job page: https://github.com/jonatron/randomstuff/blob/main/Screenshot%20from%202023-03-28%2018-07-36.png https://github.com/jonatron/randomstuff/blob/main/Screenshot... Edit: Replaced imgur link

cubefox 4y ago
(Off topic, but does someone know a good alternative to imgur? The website currently autoplays unrelated videos, freezes my mobile browser for several seconds, and appears to hijack the back button. It feels like malware.)
- robgibbons 4y ago
  I just had to close the tab myself.
- Workaccount2 4y ago
  It's too much of a hassle with NoScript too. At least 12 domains trying to run js and allowing just imgur still doesn't load the image. Ridiculous that you even need js to view an image anyway.
  - nouryqt 4y ago
    On a laptop/PC you could give the rimgo[0] frontend a try for simple viewing, no uploading or interacting. It's by no means perfect but works really well in addition with the LibRedirect[1] browser extension. Rimgo is basically a frontend for imgur that you can selfhost (or use a public instance). The LibRedirect browser extension automatically replaces the imgur.com URL with the specified rimgo instance. So for example https://imgur.com/gallery/eMKxD6t https://imgur.com/gallery/eMKxD6t turns into https://rimgo.pussthecat.org/gallery/eMKxD6t https://rimgo.pussthecat.org/gallery/eMKxD6t. [0] https://codeberg.org/elttil/rimgo https://codeberg.org/elttil/rimgo [1] https://github.com/libredirect/libredirect https://github.com/libredirect/libredirect
    - Workaccount2 4y ago
      This is great, thanks!
- doodlesdev 4y ago
  If you are the one linking you can just grab the URL for the image file directly. If opening the website to do that is your problem... good luck I guess Lol
  - jonatron 4y ago
    I linked the image file url, but checking on my phone, it redirects to the bloated page instead of the image. Loaded just the image on my desktop though.
    - thatguy0900 4y ago
      On mobile they also default to serving resolutions that are completely unusable a lot of the time. I find myself going to desktop mode for anything with text on it.
      - cubefox 4y ago
        Ah yes, that's another major problem. I couldn't see anything on the screenshot. So far I always assumed the poster uploaded the wrong resolutionm.
      - mardifoufs 4y ago
        What you can do is change the URL parameters to get a workable resolution (though honestly using desktop mode might be easier, I didn't know that it gives you a higher resolution!). Here's a direct link that I got from a comment above that you should be able to get if you press on any imgur image and select "open image": https://i.imgur.io/4clqUdj_d.webp?maxwidth=640&shape=thumb&fidelity=medium https://i.imgur.io/4clqUdj_d.webp?maxwidth=640&shape=thumb&f... I just remove the shape parameter entirely, and add a 0 to the maxwidth (seems like it can take any number there, but it will just give you the highest available resolution). The fidelity arg I'm not sure about, but it might have to do with compression? I haven't seen a huge difference changing jt.
    - miyuru 4y ago
      You can link the image without the "i" subdomain and it will redirect to the direct image. eg: https://imgur.com/4clqUdj.jpg https://imgur.com/4clqUdj.jpg (picture of a cat) since the traffic appear to come from the main domain to them, it does to redirect back to the html page.
- nouryqt 4y ago
  I like https://catbox.moe https://catbox.moe. Works with ShareX and has a few tools like browser extension for right click upload context. https://catbox.moe/tools.php https://catbox.moe/tools.php
  - causality0 4y ago
    With the caveat that you should fully expect catbox.moe to be added to your organization's blacklist if it hasn't been already. It's kind of the premier service for sharing content that falls into the "legally grey but no big service will ever let you keep it on their site" content like mass shooting videos, etc. Just don't get used to relying on it at work is all I'm saying.
  - chatmasta 4y ago
    As a general rule of thumb, if I've seen a URL shared on 4chan, I assume it's either a honeypot or a service people will judge me for associating with. I also avoid clicking such a URL because it's the kind of place I'd expect to find a zero day WebKit exploit.
  - 2h 4y ago
    closed source: https://catbox.moe/faq.php https://catbox.moe/faq.php
- password4321 4y ago
  Drop your image into a comment on a GitHub issue, switch to preview and copy the link. Sort of like using Twitter as a URL shortener. Do not recommend abusing this.
- cubefox 4y ago
  I just remembered a good image upload service: https://abload.de/ https://abload.de/ It is online since 2006, does no obviously evil browser stuff, and the guy hosting it seems cool.
- 2h 4y ago
  http://0x0.st http://0x0.st open source: https://git.0x0.st/mia/0x0 https://git.0x0.st/mia/0x0
chatmasta 4y ago
To be fair, there are plenty of legitimate reasons to hire a reverse engineer. Maybe you're building a red team to your AppSec blue team, or you want to analyze the apps of your competitors, or any apps at the top of the App Store (you'd be shocked at the dark patterns you can uncover by looking at newly trending apps).
- tester457 4y ago
  Dark patterns like what?
  - chatmasta 4y ago
    I'm long gone out of the mobile industry, but circa 8-10 years ago, I was aware of multiple top ranking iOS apps which were abusing OAuth login by opening the identity provider login screen inside an in-app browser, which meant they had full control over the DOM, and could e.g. circumvent Facebook protections to silently invite all your friends to the app using "invite to game" functionality. You would never know it happened because you wouldn't get any notification unless someone reached out and asked you why you sent that invite. And FB conveniently sorts friends so that the first 50 are your close contacts, which these apps could skip sending the invite to, under the assumption that your random acquaintances wouldn't bother reaching out about yet another notification they got from you. I didn't see any of them grabbing the password, but they easily could have. I'm pretty sure Apple has since closed this loophole by enforcing that apps perform OAuth in a browser where they can't control the DOM, but I'm not sure - I got as far away from that scene as I could...
    - Vanilla_Salt 4y ago
      > I'm pretty sure Apple has since closed this loophole by enforcing that apps perform OAuth in a browser where they can't control the DOM, but I'm not sure Apple are not restricting OAuth in an embedded web view, at least not on a software level. I have worked on an application that injected JS into the OAuth window for non malicious style purposes. It is possible they're rejecting apps from the store for this behavior, but I wouldn't know.

cubefox 4y ago

(Off topic, but does someone know a good alternative to imgur? The website currently autoplays unrelated videos, freezes my mobile browser for several seconds, and appears to hijack the back button. It feels like malware.)

robgibbons 4y ago
I just had to close the tab myself.
Workaccount2 4y ago
It's too much of a hassle with NoScript too. At least 12 domains trying to run js and allowing just imgur still doesn't load the image. Ridiculous that you even need js to view an image anyway.
- nouryqt 4y ago
  On a laptop/PC you could give the rimgo[0] frontend a try for simple viewing, no uploading or interacting. It's by no means perfect but works really well in addition with the LibRedirect[1] browser extension. Rimgo is basically a frontend for imgur that you can selfhost (or use a public instance). The LibRedirect browser extension automatically replaces the imgur.com URL with the specified rimgo instance. So for example https://imgur.com/gallery/eMKxD6t https://imgur.com/gallery/eMKxD6t turns into https://rimgo.pussthecat.org/gallery/eMKxD6t https://rimgo.pussthecat.org/gallery/eMKxD6t. [0] https://codeberg.org/elttil/rimgo https://codeberg.org/elttil/rimgo [1] https://github.com/libredirect/libredirect https://github.com/libredirect/libredirect
  - Workaccount2 4y ago
    This is great, thanks!
doodlesdev 4y ago
If you are the one linking you can just grab the URL for the image file directly. If opening the website to do that is your problem... good luck I guess Lol
- jonatron 4y ago
  I linked the image file url, but checking on my phone, it redirects to the bloated page instead of the image. Loaded just the image on my desktop though.
  - thatguy0900 4y ago
    On mobile they also default to serving resolutions that are completely unusable a lot of the time. I find myself going to desktop mode for anything with text on it.
    - cubefox 4y ago
      Ah yes, that's another major problem. I couldn't see anything on the screenshot. So far I always assumed the poster uploaded the wrong resolutionm.
    - mardifoufs 4y ago
      What you can do is change the URL parameters to get a workable resolution (though honestly using desktop mode might be easier, I didn't know that it gives you a higher resolution!). Here's a direct link that I got from a comment above that you should be able to get if you press on any imgur image and select "open image": https://i.imgur.io/4clqUdj_d.webp?maxwidth=640&shape=thumb&fidelity=medium https://i.imgur.io/4clqUdj_d.webp?maxwidth=640&shape=thumb&f... I just remove the shape parameter entirely, and add a 0 to the maxwidth (seems like it can take any number there, but it will just give you the highest available resolution). The fidelity arg I'm not sure about, but it might have to do with compression? I haven't seen a huge difference changing jt.
  - miyuru 4y ago
    You can link the image without the "i" subdomain and it will redirect to the direct image. eg: https://imgur.com/4clqUdj.jpg https://imgur.com/4clqUdj.jpg (picture of a cat) since the traffic appear to come from the main domain to them, it does to redirect back to the html page.
nouryqt 4y ago
I like https://catbox.moe https://catbox.moe. Works with ShareX and has a few tools like browser extension for right click upload context. https://catbox.moe/tools.php https://catbox.moe/tools.php
- causality0 4y ago
  With the caveat that you should fully expect catbox.moe to be added to your organization's blacklist if it hasn't been already. It's kind of the premier service for sharing content that falls into the "legally grey but no big service will ever let you keep it on their site" content like mass shooting videos, etc. Just don't get used to relying on it at work is all I'm saying.
- chatmasta 4y ago
  As a general rule of thumb, if I've seen a URL shared on 4chan, I assume it's either a honeypot or a service people will judge me for associating with. I also avoid clicking such a URL because it's the kind of place I'd expect to find a zero day WebKit exploit.
- 2h 4y ago
  closed source: https://catbox.moe/faq.php https://catbox.moe/faq.php
password4321 4y ago
Drop your image into a comment on a GitHub issue, switch to preview and copy the link. Sort of like using Twitter as a URL shortener. Do not recommend abusing this.
cubefox 4y ago
I just remembered a good image upload service: https://abload.de/ https://abload.de/ It is online since 2006, does no obviously evil browser stuff, and the guy hosting it seems cool.
2h 4y ago
http://0x0.st http://0x0.st open source: https://git.0x0.st/mia/0x0 https://git.0x0.st/mia/0x0

chatmasta 4y ago

To be fair, there are plenty of legitimate reasons to hire a reverse engineer. Maybe you're building a red team to your AppSec blue team, or you want to analyze the apps of your competitors, or any apps at the top of the App Store (you'd be shocked at the dark patterns you can uncover by looking at newly trending apps).

tester457 4y ago
Dark patterns like what?
- chatmasta 4y ago
  I'm long gone out of the mobile industry, but circa 8-10 years ago, I was aware of multiple top ranking iOS apps which were abusing OAuth login by opening the identity provider login screen inside an in-app browser, which meant they had full control over the DOM, and could e.g. circumvent Facebook protections to silently invite all your friends to the app using "invite to game" functionality. You would never know it happened because you wouldn't get any notification unless someone reached out and asked you why you sent that invite. And FB conveniently sorts friends so that the first 50 are your close contacts, which these apps could skip sending the invite to, under the assumption that your random acquaintances wouldn't bother reaching out about yet another notification they got from you. I didn't see any of them grabbing the password, but they easily could have. I'm pretty sure Apple has since closed this loophole by enforcing that apps perform OAuth in a browser where they can't control the DOM, but I'm not sure - I got as far away from that scene as I could...
  - Vanilla_Salt 4y ago
    > I'm pretty sure Apple has since closed this loophole by enforcing that apps perform OAuth in a browser where they can't control the DOM, but I'm not sure Apple are not restricting OAuth in an embedded web view, at least not on a software level. I have worked on an application that injected JS into the OAuth window for non malicious style purposes. It is possible they're rejecting apps from the store for this behavior, but I wouldn't know.