Hacker News Reader

Comment by NateLawson | Hacker News Reader

Thanks, high praise indeed. I am super curious too what anyone would want to know if you could see inside any apps in the app stores?

View on HN

I would be interested in pointing a (distributed, imprecise) symbolic executor at each app to gain a sense of the "state depth" of that app, and then correlating that with bugs discovered and rate of code churn in the app, and comparing the "state depth" across apps in a given 'vertical' and all apps globally.

Interesting, thanks. We've discussed providing some kind of code quality score. Also, we can definitely do something interesting by comparing how other apps have performed that share code features with yours. The ideal would be a predictor that makes recommended changes based on the insights we've learned from other code we've seen.

As a novice mobile engineer I might go to stack overflow to see how to implement things like exception handling, caching, etc.

I'd like to know the best way to do these things, given your corpus of data. Decompile snippets of code from the most popular mobile apps and show me how they do all these things that everyone has to do.

Identify malware and malware patterns of access.

We've actually resisted going after malware because every binary analysis technology seems to be pulled into its orbit eventually. It's like the Black Hole of Reversing. :)

What I do wonder is if there are more interesting questions to answer about the intent of code besides "pass/fail"?

Answering questions about information flow might be interesting in this regard. You could quantify what sources of information an application retrieves and how far through the application that information traverses.

Downsides are that it's very difficult to get a binary verdict out of something like that, even as a consumer of the information. You see a report that says "it takes video data and streams it out to the Internet!" and if the app purports to be a flashlight app that's bad, but if it's Skype then that's expected.

Maybe the additional insight into "where does my data go in this app" would be useful? Maybe people could start asking "why do you need to take my contacts and pass them to the network, why don't you just work with the data on my device?"

Thanks, this is a good avenue to consider.

Reply on news.ycombinator.com