Hacker News Reader

Comment by willstrafach | Hacker News Reader

I have checked. Facebook does not do this.

> does not do this

Do you have the hashes to prove that what you tested matches what is actually installed elsewhere?

No, I'm not actually claiming there actually are different versions in the wild. I just find it strange that anybody can make broad claims about what widespread software may or may not be doing. Widespread use of "A/B testing" and forced remote updates should make everyone question the nature of every binary, even when they have the same name (including version number).

Fb's well known for large scale A/B testing though. Isn't it more than possible that the binaries/versions/etc that you tested simply weren't part of the test?

You can't A/B test iOS app binaries though.

You could A/B test different app behaviour with the same binary by branching on some pseudorandom (quasi-) constant like IMEI or phone number.

Sure. But once you know that everyone has the same binary, you can reverse engineer the binary you know everyone has.

The nice thing is that you can reverse engineer it and sniff traffic to find out what the A/B tests are and what they do.

Couldn't you test 2 different behaviors in the same binary thought?

how have you checked (what do you have access to). if you work for Googe on Android would be a good answer for example :)

From his bio:

> information security research. ceo @ sudo security group (https://verify.ly).

> previously: founder of "Chronic Dev Team" responsible for many years of iOS jailbreaking solutions (24kPwn, absinthe, corona, greenpois0n, etc).

I still think "how have you checked" is a fair question.

My company collects/analyzes apps from the App Store to test their security, so I have pretty easy access to the machine code for apps.

Certainly a fair question.

On the Android side, it's not terribly difficult to send a copy of the app to a computer and decompile it. Then you can simply search for any code that invokes the Android function for mic access.

Reply on news.ycombinator.com