[dkersten]

Software is data an operating system and processor interprets. He never specified apps.

Besides, how would inserting the string in his apps have any different affect than inserting it into the website? This is completely within the parameters that were set (because there weren't many).

[nickpsecurity]

I already explained my perspective on this here:

https://news.ycombinator.com/item?id=11696750

Suffice to say, the real point is whether people can compromise his apps with something that would harm their computer. So, let's rephrase your question, "What's the difference between convincing him to post a challenge string on his website and convincing him to arbitrarily modify code of apps he distributes to users?" Obviously, a huge difference unless he's a complete idiot.