NateLawson

9 ms·

31.
Sequence the code in millions of apps at SourceDNA (YC S15)(sourcedna.com)
1 points by NateLawson 11y ago
32.
SourceDNA (YC S15) is looking for customer advocates to help mobile developers(sourcedna.com)
1 points by NateLawson 11y ago
33.
Help developers track the code in their apps at SourceDNA (YC S15)(sourcedna.com)
1 points by NateLawson 11y ago
34.
by NateLawson 11y ago
We both download apps and scan apps developers upload to us.
35.
by NateLawson 11y ago
Many do require this, but there are current sandbox limitations that make this harder to change quickly.
36.
by NateLawson 11y ago
Exactly right. What we expect to happen next is runtime generation of an XPC identifier to call the underlying service, replicating the behavior of the private API with none of its code. We're moving ahead with detecting this too as it
37.
by NateLawson 11y ago
Really great question. Certainly, there are "too good to be true" offers out there you might want to be concerned about, such as ad networks that pay crazy high CPMs. I'm biased, but I think developers should be using our ser
38.
by NateLawson 11y ago
Right. Any runtime behavior can be altered by observed state from outside the phone. There's even a paper on intentionally inserting security flaws into your code and then exploiting them from your own server to change execution patter
39.
by NateLawson 11y ago
You're exactly right. You can go even further in gathering environmental data from syscalls and using it to construct strings at runtime. At some point, you have to include dynamic analysis in addition to static analysis. The iRiS pape
40.
by NateLawson 11y ago
We don't know why these apps got through in particular. However, I do think we have a unique vantage point by being outside any particular app store. We scan code on both iOS and Android, identifying libraries and patterns of behavior.
41.
by NateLawson 11y ago
I agree that enforcement is the best way to go here. Hopefully they will improve the granularity of sandbox control to make detecting private APIs purely a compatibility issue.
42.
by NateLawson 11y ago
Hey all, I'm the founder of SourceDNA and happy to answer any questions about how we found this or about binary code search in general. We take a different approach to understanding code than the traditional antivirus world. Rather tha
43.
by NateLawson 11y ago
I disagree that developers can be expected to find this kind of thing on their own, say by digging in with a debugger. It's simply not a scalable solution. I think you need a appstore-wide view of the entire software world and the abil
44.
by NateLawson 11y ago
Well, that's what we do for a living -- help thousands of small or large developers find these problems ahead of time. It's not an easy problem and not something you can do by hand. We've indexed the code in millions of apps
45.
by NateLawson 11y ago
You're both right. It's the kernel's job to ultimately enforce this policy, and calling private APIs should only be a compatibility problem, not a security risk. I believe the current sandbox design makes it more complex to p
46.
by NateLawson 11y ago
They do deny access, and they usually seem to try to do it in a backwards-compatible way. For example, if you try to get the list of installed apps by brute-forcing URL schemas, they return "no more entries" after 50 calls now. Th
47.
by NateLawson 11y ago
Some of these APIs are protected, and Apple keeps adding more to this list over time. For example, reading the UDID (hardware serial number) was blocked in iOS 8 and you need an entitlement to call this API. Since the list of entitlements i
48.
by NateLawson 11y ago
Nice, thanks for pointing that out. Note that it may be skewed a bit since apps can get created but not published on the app stores (personal experiment, in-house app for a company). This does roughly align with our data on iOS though.
49.
by NateLawson 11y ago
Sure, just look at our public view of the data. It's limited to the top 500 free apps in the US. Choose category "cross-platform" and then compare iOS vs. Android. List of apps and the SDKs in each is at the bottom. https:&#
50.
by NateLawson 11y ago
Correct, the banner shows it was last updated in 2011. http://allseeing-i.com/ASIHTTPRequest/ Given the problems we found with SSL domain verification in another networking library, you definitely don't want to be
51.
by NateLawson 11y ago
Xamarin on iOS works in a similar way to Unity. They both use the Mono AOT compiler (ahead of time translation) to convert C# to native ARM code. It's not a JIT environment, like on Android. Miguel de Icaza is one of the founders of Xa
52.
by NateLawson 11y ago
The top iOS app with Realm in it is Target, and they're ranked 450 today. So his analysis of the top 100 just missed it.
53.
by NateLawson 11y ago
There are many non-native apps in the top 100. Cordova is popular for business apps (Amazon and Walgreens both use it, for example). Unity (C#) is extremely popular for games because they built an awesome dev environment and it compiles to
54.
by NateLawson 11y ago
I agree that both Realm and Fabric have done an excellent job reaching out to developers. Fabric went to another level in providing a slick interface to make it easy to drop in and update their SDKs. I'd be excited to see that more gen
55.
by NateLawson 11y ago
The approach Ryan used was to look at ObjC classes, but you're right that many SDKs and tools don't show up there. We actually scan millions of apps from the app stores. Here's a public view of the top 500 in US, and if you c
56.
by NateLawson 11y ago
Developer behavior is pretty varied along a number of angles. Since even indie apps can hit the top ranks (especially in games), it's a little less useful to talk about apps by rank and instead more by company background. Swift is grow
57.
by NateLawson 11y ago
Yep, there are tons of SDKs being used that aren't actively maintained like ASIHTTPRequest on iOS, for example. There are two reasons we've found: 1. App was written a while ago and is only in maintenance mode 2. Developer got sta
58.
by NateLawson 11y ago
Correct, the completely gone case does not allow you to download the app any more. This can be due to copyright issues etc.
59.
by NateLawson 11y ago
I agree re: checksumming. Regarding Android's flexibility, I've written an obfuscator (on another Java-based platform) that took a DSL and generated half the code in Java and half in C, intertwining the computation between the two
60.
by NateLawson 11y ago
Great point. Why check what might later change when you can enforce it now and going forward?

More ›