[thih9]

Did you contact the creator first with these findings? What was the creator's response, if any?

In any case I hope the creator was contacted, I'd say publishing active issues like this on a popular website would be arguably as bad as releasing insecure software.

[coal320]

Responsible disclosure was given. Developer doesn't seem keen on changing things.

[MrGilbert]

Might be worth adding that piece of information to the original article, maybe including a timeline of events.

[thih9]

The original article has now been updated:

> The developer has been given responsible disclosure and I have been informed that steps are being taken to address the security concerns.

There is still no timeline or other information about the events, which is unfortunate; I'd expect the author to document and report this in such a situation.

[MrGilbert]

In fact, the original article has been taken down and a timeline of events has been added.

The job offer the author received on the other hand is… something.

[coal320]

Trust me. I have no intention of accepting it!

[MrGilbert]

That is absolutely the right call. It screams "Tech Bro" all over it.^^

[handfuloflight]

Valid security issues buried under unnecessary smugness and basic 'techniques' like demonstrating the unzip command. The condescending tone undermines what could have been constructive disclosure. This reads like a high schooler dunking on a first grader, I'm just glad we all learned from the technical prowess of extracting an archive. The underlying problems with exposed API keys and unrestricted database access are serious, but your arrogant presentation does a disservice to responsible disclosure.

[rockemsockem]

I read it as an incredulous and increasingly pissed off person absolutely dunking on a smug person's attitude and success who has done so in a fashion they find completely unacceptable.

[ycombinatrix]

this app leaks the private data of hundreds of children, but GP's "smugness" is the problem? give me a break.

are you Christian Monfiston? that would explain a lot.

[ryandrake]

Both sides can be wrong. This isn't the first HN article investigating security issues where the researcher has this exact smug, exasperated, "oh, how can the dev be so stupid" attitude. I can say that in business communication, this kind of insufferable smugness never helps, even if the subject person really is stupid/incompetent.

[handfuloflight]

I never said the app's issues should be absolved, the security problems are obviously serious. But the author claims he did responsible disclosure and got no response, yet somehow skipped the obvious next step of contacting Apple directly. Instead he chose to publish a detailed technical writeup that essentially creates a how-to guide for exploiting these vulnerabilities.

Now because of this post, these children are arguably at greater risk than before, since anyone can follow his step-by-step instructions. If he actually cared about user safety over HN karma, he would have escalated to Apple's App Store channel rather than publishing exploitation details.

The smugness isn't the only problem, it's the irresponsible disclosure wrapped in performative outrage.

You can criticize terrible security practices without creating a ready to replay tutorial for bad actors.

[ycombinatrix]

>the author claims he did responsible disclosure and got no response

that's an easily verifiable lie. the author says the developer is not interested in fixing it just 3 comments above this one. why are you lying?

reporting this to Apple doesn't make sense either. Apple doesn't develop this app. Christian Monfiston develops this app.

[handfuloflight]

Are you really going to be pedantic now and accuse me of deception? OP said: "Developer doesn't seem keen on changing things." Which I can rightly interpret as the developer didn't respond meaningfully or at all. Knowing the nature of OP, he would have surely published the developer's responses if he did. And if he did respond, what I said is semantically valid in that OP did not receive the response he or we would expect: the developer actually doing something about these vulnerabilities.

Apple absolutely should be contacted here: they have App Store Review Guidelines that this app clearly violates. Apps in the kids category and apps intended for kids cannot include third-party advertising or analytics software and may not transmit data to third parties. This app is transmitting children's location data to third parties through unsecured APIs, which directly violates Apple's kids category guidelines.

But you're completely ignoring the main point: by publishing this detailed technical writeup instead of escalating to Apple, the author has now made these children MORE vulnerable.

[Wurdan]

I think you’re somewhat overestimating the chances of getting Apple to take action with a single person’s report.

[handfuloflight]

Perhaps, but let's not pretend his claim to responsible disclosure holds up when he skipped this obvious step. That being said, because the app violates their App Store guidelines with regards to data collection related to minors, it's a channel that should have absolutely been explored.

[bravetraveler]

Responsible disclosure for a meme-level mistake, lol.

I understand letting them know. I agree. Painting them as equally wrong, no. "Popular website"; you mean 'theirs', right? The person with a whole 27 GitHub followers right now.

[MrGilbert]

The article says: "Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open."

Meme-level mistake is one thing, but their wrong doesn’t grant the right to be irresponsible for the author.

[bravetraveler]

I don't believe this is irresponsible, they called for readers to report the app. We can all contact the host and go escalate if we want.

I wouldn't suggest anyone recreate this process just to sanitize what's sitting around.

There you go, new trolley problem.

[JanSt]

Pushing out an exact way to extract that data without giving the creator time to fix it may even be worse than using such code in production. The data may than be in the hands of malicious people who wouldn’t have found it otherwise

[bravetraveler]

Go talk to the abuse contact, I won't stop you