7 ms·

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location pe

A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a commonly invoked function.

dijksterhuis 6mo ago
what version are you on? from the iphone app store: version 47.0.1 - minor bug fixes - 34 minutes ago while the parent posted 18 minutes ago they may have patched the location stuff as part of the “minor bug fixes”?
- deleted 6mo ago
  [deleted]
- filoleg 6mo ago
  I have the iOS version from yesterday, haven't updated the app yet. No location permission request prompting encountered. In system settings, where each app requesting location data is listed, it isn't present either.
  - SV_BubbleTime 6mo ago
    Ah. So another way to say it doesn’t get your location every 4 seconds.
- croes 6mo ago
  Isn’t it useless to talk about the iOS version if the article is about the Android app?
frizlab 6mo ago
> it doesn't request location permissions anywhere, despite the claims in the article The article does not claim the app requests the location. It claims it can do it with a single JS call.
- dmitrygr 6mo ago
  > The article does not claim the app requests the location. It claims it can do it with a single JS call. so can ... any other code anywhere on a mobile device? That is how API work...
  - david_allison 6mo ago
    You need to state the permissions you *may* request/use in AndroidManifest.xml. This data can then be displayed to users pre-installation. From the (limited) article, it doesn't seem they do this: https://thereallo.dev/blog/decompiling-the-white-house-app#permissions https://thereallo.dev/blog/decompiling-the-white-house-app#p... ---- EDIT: I'm mistaken. From the Play Store[0] it has access to * approximate location (network-based) * precise location (GPS and network-based) [0] https://play.google.com/store/apps/details?id=gov.whitehouse.app&pli=1 https://play.google.com/store/apps/details?id=gov.whitehouse... This seems to disagree with: > The location permissions aren't declared in the AndroidManifest but requested at runtime *shrug*, someone should dig deeper. It looks like the article may not match reality.
    - Groxx 6mo ago
      What version do you see? 47.0.1 doesn't have that for me: https://news.ycombinator.com/item?id=47557033 https://news.ycombinator.com/item?id=47557033
      - david_allison 6mo ago
        Very unusual: 47.0.1 is showing these permissions when on my MacBook viewing the store entry. The Play Store doesn't show these permissions when viewed on my Pixel 9 Pro, and the APK doesn't have these permissions when downloaded/extracted.
- esprehn 6mo ago
  It can request with a JS call. It can't passively collect it without you approving first. The article is written like calling that JS function will turn on location tracking without consent.
Groxx 6mo ago
The permissions snippet they show also doesn't include location, and you can't request location at runtime at all without declaring it there. I'd verify all this stuff for myself, but Play won't install it in my phone so I can't really get the APK. Maybe because I use Graphene...? but I don't know all the ways they can restrict it, maybe it's something else (though for a pixel 9a it's rather strange if it's hardware based). --- EDIT --- To be specific / add what I can check, this is what my Play Store "about -> permissions" is showing: Version 47.0.1 may request access to Other: run at startup Google Play license check view network connections prevent phone from sleeping show notifications com.google.android.c2dm.permission.RECEIVE control vibration have full network access which appears fairly normal, and does not include location, and I think Play includes runtime location requests there. Maybe there's a version-rollout happening, or device-type targeting?
- crumpled 6mo ago
  If you use Aurora Store instead of the Play store, you can download APKs. They are a Google Play store proxy.
  - cuu508 6mo ago
    Or from APKPure https://apkpure.com/the-white-house/gov.whitehouse.app https://apkpure.com/the-white-house/gov.whitehouse.app
    - hiccuphippo 6mo ago
      Is there a way to conver that xapk format to apk other than installing their app?
      - bigbugbag 6mo ago
        yes, unzip it.
  - 2Gkashmiri 6mo ago
    I have many apps that refuse to work. They try to open play store app which does not have logged in account. The app doesn't work
liveoneggs 6mo ago
how do you know it didn't lie during the decompilation?
- BoorishBears 6mo ago
  It doesn't have to lie: unfortunately libraries that are essentially a full application themselves (complete with their own permissions) are not uncommon on mobile. So it could come across a manifest that includes location permissions and some code that would (if enabled) send location, but it might do a bad job properly tracing
fjdjshsh 6mo ago
>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.
- goodmythical 6mo ago
  [flagged]
  - direwolf20 6mo ago
    It's cool to dislike "disliking things "because AI""
  - lkjdsklf 6mo ago
    What? They listed a very specific complaint about the content.
  - trueno 6mo ago
    > Haven't you heard? It's cool to dislike things "because AI". There's no explicit rules against it, but I cannot stand this type of sarcastic im anti-everyone-else commentary. Super reddit-coded, and you could have made your point without it. There's a lot of discussion to have about that point actually, but I'm pretty sure we've all been collectively scrolling long enough to just kind of roll our eyes at this stuff. I read through it. I get some AI vibes. Probably a little bit of both.
    - VerifiedReports 6mo ago
      Look out: It's forbidden to compare HN to Reddit!
      - trueno 6mo ago
        frick
      - VerifiedReports 6mo ago
ddtaylor 6mo ago
I think you should make proper counter arguments instead of dismissing something because they used a specific tool. Ad-HomineLLM is a logical fallacy IMO and adds little value. I would hope eventually HN and other sites add this to the guidelines similar to other claims like vote manipulation etc.
- treykeown 6mo ago
  Sorry, making up a word to try and frame distrust of LLM-generated content as a “logical fallacy” is a bad take. HN doesn’t have guidelines against anti-LLM rhetoric, but it does for LLM-generated comments. > Don't post generated comments or AI-edited comments. HN is for conversation between humans. https://news.ycombinator.com/newsguidelines.html#generated https://news.ycombinator.com/newsguidelines.html#generated
  - nazgul17 6mo ago
    GP was arguing against the OP, not a comment, and AI written posts are fair game. Also, the comment you responded to was criticizing the attack to the substance of the post based on who/what wrote is. The comment neologism actually fits, IMO.
jibal 6mo ago
[flagged]
deleted 6mo ago
[deleted]

dijksterhuis 6mo ago

what version are you on? from the iphone app store: version 47.0.1 - minor bug fixes - 34 minutes ago while the parent posted 18 minutes ago they may have patched the location stuff as part of the “minor bug fixes”?

deleted 6mo ago
[deleted]
filoleg 6mo ago
I have the iOS version from yesterday, haven't updated the app yet. No location permission request prompting encountered. In system settings, where each app requesting location data is listed, it isn't present either.
- SV_BubbleTime 6mo ago
  Ah. So another way to say it doesn’t get your location every 4 seconds.
croes 6mo ago
Isn’t it useless to talk about the iOS version if the article is about the Android app?

frizlab 6mo ago

> it doesn't request location permissions anywhere, despite the claims in the article The article does not claim the app requests the location. It claims it can do it with a single JS call.

dmitrygr 6mo ago
> The article does not claim the app requests the location. It claims it can do it with a single JS call. so can ... any other code anywhere on a mobile device? That is how API work...
- david_allison 6mo ago
  You need to state the permissions you *may* request/use in AndroidManifest.xml. This data can then be displayed to users pre-installation. From the (limited) article, it doesn't seem they do this: https://thereallo.dev/blog/decompiling-the-white-house-app#permissions https://thereallo.dev/blog/decompiling-the-white-house-app#p... ---- EDIT: I'm mistaken. From the Play Store[0] it has access to * approximate location (network-based) * precise location (GPS and network-based) [0] https://play.google.com/store/apps/details?id=gov.whitehouse.app&pli=1 https://play.google.com/store/apps/details?id=gov.whitehouse... This seems to disagree with: > The location permissions aren't declared in the AndroidManifest but requested at runtime *shrug*, someone should dig deeper. It looks like the article may not match reality.
  - Groxx 6mo ago
    What version do you see? 47.0.1 doesn't have that for me: https://news.ycombinator.com/item?id=47557033 https://news.ycombinator.com/item?id=47557033
    - david_allison 6mo ago
      Very unusual: 47.0.1 is showing these permissions when on my MacBook viewing the store entry. The Play Store doesn't show these permissions when viewed on my Pixel 9 Pro, and the APK doesn't have these permissions when downloaded/extracted.
esprehn 6mo ago
It can request with a JS call. It can't passively collect it without you approving first. The article is written like calling that JS function will turn on location tracking without consent.

Groxx 6mo ago

The permissions snippet they show also doesn't include location, and you can't request location at runtime at all without declaring it there. I'd verify all this stuff for myself, but Play won't install it in my phone so I can't really get the APK. Maybe because I use Graphene...? but I don't know all the ways they can restrict it, maybe it's something else (though for a pixel 9a it's rather strange if it's hardware based). --- EDIT --- To be specific / add what I can check, this is what my Play Store "about -> permissions" is showing: Version 47.0.1 may request access to Other: run at startup Google Play license check view network connections prevent phone from sleeping show notifications com.google.android.c2dm.permission.RECEIVE control vibration have full network access which appears fairly normal, and does not include location, and I think Play includes runtime location requests there. Maybe there's a version-rollout happening, or device-type targeting?

crumpled 6mo ago
If you use Aurora Store instead of the Play store, you can download APKs. They are a Google Play store proxy.
- cuu508 6mo ago
  Or from APKPure https://apkpure.com/the-white-house/gov.whitehouse.app https://apkpure.com/the-white-house/gov.whitehouse.app
  - hiccuphippo 6mo ago
    Is there a way to conver that xapk format to apk other than installing their app?
    - bigbugbag 6mo ago
      yes, unzip it.
- 2Gkashmiri 6mo ago
  I have many apps that refuse to work. They try to open play store app which does not have logged in account. The app doesn't work

liveoneggs 6mo ago

how do you know it didn't lie during the decompilation?

BoorishBears 6mo ago
It doesn't have to lie: unfortunately libraries that are essentially a full application themselves (complete with their own permissions) are not uncommon on mobile. So it could come across a manifest that includes location permissions and some code that would (if enabled) send location, but it might do a bad job properly tracing

fjdjshsh 6mo ago

>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.

goodmythical 6mo ago
[flagged]
- direwolf20 6mo ago
  It's cool to dislike "disliking things "because AI""
- lkjdsklf 6mo ago
  What? They listed a very specific complaint about the content.
- trueno 6mo ago
  > Haven't you heard? It's cool to dislike things "because AI". There's no explicit rules against it, but I cannot stand this type of sarcastic im anti-everyone-else commentary. Super reddit-coded, and you could have made your point without it. There's a lot of discussion to have about that point actually, but I'm pretty sure we've all been collectively scrolling long enough to just kind of roll our eyes at this stuff. I read through it. I get some AI vibes. Probably a little bit of both.
  - VerifiedReports 6mo ago
    Look out: It's forbidden to compare HN to Reddit!
    - trueno 6mo ago
      frick
    - VerifiedReports 6mo ago

ddtaylor 6mo ago

I think you should make proper counter arguments instead of dismissing something because they used a specific tool. Ad-HomineLLM is a logical fallacy IMO and adds little value. I would hope eventually HN and other sites add this to the guidelines similar to other claims like vote manipulation etc.

treykeown 6mo ago
Sorry, making up a word to try and frame distrust of LLM-generated content as a “logical fallacy” is a bad take. HN doesn’t have guidelines against anti-LLM rhetoric, but it does for LLM-generated comments. > Don't post generated comments or AI-edited comments. HN is for conversation between humans. https://news.ycombinator.com/newsguidelines.html#generated https://news.ycombinator.com/newsguidelines.html#generated
- nazgul17 6mo ago
  GP was arguing against the OP, not a comment, and AI written posts are fair game. Also, the comment you responded to was criticizing the attack to the substance of the post based on who/what wrote is. The comment neologism actually fits, IMO.

jibal 6mo ago

[flagged]

deleted 6mo ago

[deleted]