Comment by tptacek | Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm not unbiased when it cames to Nate, who is one of my older friends, because he's dragooned me into being an advisor for SourceDNA. I've promised to donate all proceeds from his venture to charity, unless it returns enough to buy me a private jet, in which case I'm going to buy a private jet and then donate the rest to charity. I almost quit Matasano to join him; the day after I flew out to work out a role, we got the acquisition offer, and I had to stay.

Nate is way underselling himself. He's essentially not only acquired most of the contents of most of the app stores, and not only decompiled them, but has then built up a comparative analytics framework that can answer questions based on code similarity (as a first order of available facts) and behavior (as a sort of second-order thing).

I'm really curious to see what ideas other people would have for this kind of data set. If you could answer virtually any question about the behavior of any/every app in the app store, what would you do with that capability?

Also: people should ask him questions about how this stuff works. It's really neat.

To elaborate: he's got an up-to-the-minute view on library and technology choices made across the entire App Store. I figure this would basically be killer for e.g. sales teams at API companies, analysts following them, etc.

(Do a for loop over your customers and profile as many signals as you can. For example, I don't know, "adopted analytics solution X." Search store for firms who match the signals which correlate with adopting you but have not yet adopted your app. Call them to pitch.)

Yes, we are working on ways to provide predictive lead scoring to vendors, telling them which developers are most valuable and when.

We have some promising results we'll be talking about more in the near future.

This was the most surprising thing to me. Apart from the InfoWorld "Hot API of the week" columnist (who's writing for the CEO who mostly only cares about looking informed), I had a hard time imagining anyone would pay to know who uses what library. Cool that I'm wrong.

> library and technology choices made across the entire App Store. I figure this would basically be killer for e.g. sales teams at API companies, analysts following them

You nailed it, Patrick, and I wish I talked to you sooner. We were collecting this app data at MixRank for a while before it occurred to us to track every SDK and API integration. It turns out that knowing all the integrations an app has (ads, analytics, social, cloud services, tracking, libraries, etc) is really useful for predicting and understanding your customers!

> Do a for loop over your customers and profile as many signals as you can.

The most effective signal is the most obvious one: Did the app just integrate my competitor's SDK? This usually means the app is in a trial period and still deciding— you couldn't ask for better timing. Next best is: Did the app just uninstall my competitor's SDK? Then they're likely unhappy and searching for alternatives. (Source: we work with a bunch of sales teams that use us for exactly this)

Thanks, high praise indeed. I am super curious too what anyone would want to know if you could see inside any apps in the app stores?

I would be interested in pointing a (distributed, imprecise) symbolic executor at each app to gain a sense of the "state depth" of that app, and then correlating that with bugs discovered and rate of code churn in the app, and comparing the "state depth" across apps in a given 'vertical' and all apps globally.

Interesting, thanks. We've discussed providing some kind of code quality score. Also, we can definitely do something interesting by comparing how other apps have performed that share code features with yours. The ideal would be a predictor that makes recommended changes based on the insights we've learned from other code we've seen.

Identify malware and malware patterns of access.

We've actually resisted going after malware because every binary analysis technology seems to be pulled into its orbit eventually. It's like the Black Hole of Reversing. :)

What I do wonder is if there are more interesting questions to answer about the intent of code besides "pass/fail"?

Answering questions about information flow might be interesting in this regard. You could quantify what sources of information an application retrieves and how far through the application that information traverses.

Downsides are that it's very difficult to get a binary verdict out of something like that, even as a consumer of the information. You see a report that says "it takes video data and streams it out to the Internet!" and if the app purports to be a flashlight app that's bad, but if it's Skype then that's expected.

Maybe the additional insight into "where does my data go in this app" would be useful? Maybe people could start asking "why do you need to take my contacts and pass them to the network, why don't you just work with the data on my device?"

Thanks, this is a good avenue to consider.

As a novice mobile engineer I might go to stack overflow to see how to implement things like exception handling, caching, etc.

I'd like to know the best way to do these things, given your corpus of data. Decompile snippets of code from the most popular mobile apps and show me how they do all these things that everyone has to do.

Reply on news.ycombinator.com