4 ms·

Hey Mike, we had to make a judgement call on this one. We know exactly which ones (there are about 3,000), but it's something you'd probably be sensitive about

Hey Mike, we had to make a judgement call on this one. We know exactly which ones (there are about 3,000), but it's something you'd probably be sensitive about if you're affected, right? These aren't bad or minor developers, since using the NDK is often a sign you care about performance of your app or are doing something interesting that's outside the norms of Java. Are you a user trying to figure out about apps you use or a developer wondering if your own apps have this issue?

mikeash 11y ago
I'm really just an observer. The presentation smells far too much of local TV news ads. "This common soda ingredient could kill you! But we won't tell you which one until after sports and the weather!" I don't really see the problem with letting people search without signing up. This isn't a security vulnerability, right? It's just "these apps will crash on the next OS version." Which anyone can find out for themselves if they get their hands on it and test the apps they're interested in.
- NateLawson 11y ago
  I hear you. We also track security flaws in apps and users can see all of their apps' issues. We don't yet have a way to separate which issues you can see. We're trying to figure out the right balance between allowing anybody to quickly look up an app but not becoming the hammer that end users take to bash developers. A few months ago, we found 25,000 iOS apps with an SSL flaw and allowed anybody to look up which ones. There were a lot of uninformed complaints to developers, even if the app only used the library to load images or some other non-sensitive use. Suggestions welcome on how to balance this, and we'll keep trying to find the right one.
  - mikeash 11y ago
    If it's mixed up with security issues then that is certainly troublesome. I think this is a question of context. My first exposure to your company was with this blog post, and with that it seems like you're trying to gather data to tell people if their apps crash. But really you're focused on security and this is a side benefit, if I understand it correctly. What about making available a big text file with the names or identifiers of apps affected by this problem? Or if you can whip up a quick search interface (I know, always sounds easier than it is) to just this list of apps, maybe provide that as an alternate. Your experience with that SSL flaw is interesting. I'm guessing/hoping it wouldn't apply here because the apps really will fail when you say they will, but I see where you'd want to be cautious. Anyway, thanks for explaining the context and providing this service.
    - NateLawson 11y ago
      Yeah, we'll see about making a one-off just for searching for this flaw. We add issues to our index constantly, and many are security-related but not this one. Thanks for the tips, and we'll try to do better next time.

mikeash 11y ago

I'm really just an observer. The presentation smells far too much of local TV news ads. "This common soda ingredient could kill you! But we won't tell you which one until after sports and the weather!" I don't really see the problem with letting people search without signing up. This isn't a security vulnerability, right? It's just "these apps will crash on the next OS version." Which anyone can find out for themselves if they get their hands on it and test the apps they're interested in.

NateLawson 11y ago
I hear you. We also track security flaws in apps and users can see all of their apps' issues. We don't yet have a way to separate which issues you can see. We're trying to figure out the right balance between allowing anybody to quickly look up an app but not becoming the hammer that end users take to bash developers. A few months ago, we found 25,000 iOS apps with an SSL flaw and allowed anybody to look up which ones. There were a lot of uninformed complaints to developers, even if the app only used the library to load images or some other non-sensitive use. Suggestions welcome on how to balance this, and we'll keep trying to find the right one.
- mikeash 11y ago
  If it's mixed up with security issues then that is certainly troublesome. I think this is a question of context. My first exposure to your company was with this blog post, and with that it seems like you're trying to gather data to tell people if their apps crash. But really you're focused on security and this is a side benefit, if I understand it correctly. What about making available a big text file with the names or identifiers of apps affected by this problem? Or if you can whip up a quick search interface (I know, always sounds easier than it is) to just this list of apps, maybe provide that as an alternate. Your experience with that SSL flaw is interesting. I'm guessing/hoping it wouldn't apply here because the apps really will fail when you say they will, but I see where you'd want to be cautious. Anyway, thanks for explaining the context and providing this service.
  - NateLawson 11y ago
    Yeah, we'll see about making a one-off just for searching for this flaw. We add issues to our index constantly, and many are security-related but not this one. Thanks for the tips, and we'll try to do better next time.