logoalt Hacker News

periodjetyesterday at 8:18 PM5 repliesview on HN

> Is it what you'd expect from an official government app? Probably not either.

Since when is the government a slick and efficiently run outfit that produces secure and well-done software products? Does no one remember the original Obamacare launch?

It’s hard to imagine a smug article like this dissecting a product of some other administration. There’s something very weird and off about stuff like this.


Replies

rootusrootustoday at 1:57 AM

> Since when is the government a slick and efficiently run outfit that produces secure and well-done software products? Does no one remember the original Obamacare launch?

Wasn't that written by a private company? Canadian, IIRC.

mmastracyesterday at 8:22 PM

You omitted these items immediately above that line:

Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls.

Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers.

Loads JavaScript from a random person's GitHub Pages site (lonelycpp.github.io) for YouTube embeds. If that account is compromised, arbitrary code runs in the app's WebView.

Loads third-party JavaScript from Elfsight (elfsightcdn.com/platform.js) for social media widgets, with no sandboxing.

Sends email addresses to Mailchimp, images are served from Uploadcare, and a Truth Social embed is hardcoded with static CDN URLs. None of this is government infrastructure.

Has no certificate pinning. Standard Android trust management.

Ships with dev artifacts in production. A localhost URL, a developer IP (10.4.4.109), the Expo dev client, and an exported Compose PreviewActivity.

Profiles users extensively through OneSignal - tags, SMS numbers, cross-device aliases, outcome tracking, notification interaction logging, in-app message click tracking, and full user state observation.

show 1 reply
felipellrochayesterday at 9:40 PM

You think this administration is trustworthy?

jibaltoday at 3:21 AM

> It’s hard to imagine a[n informative] article like this dissecting a product of some other administration.

A baseless ideological claim.

array_key_firstyesterday at 9:38 PM

> It’s hard to imagine a smug article like this dissecting a product of some other administration.

Yes, that's because this administration is uniquely awful. Basically every single thing this administration does is bad. Often so bad that it's legitimately impressive just how incompetent our leaders our.

Obviously previous administrations were not perfect, but to sit here and pretend that they are on the same level is delusion.

show 1 reply