Slashdot Mirror

← Back to Stories (view on slashdot.org)

Popular Android Apps Full of Bugs: Researchers Blame Recycling of Code

Posted by timothy on from the little-of-this-little-of-that dept.

New submitter Brett W (3715683) writes The security researchers that first published the 'Heartbleed' vulnerabilities in OpenSSL have spent the last few months auditing the Top 50 downloaded Android apps for vulnerabilities and have found issues with at least half of them. Many send user data to ad networks without consent, potentially without the publisher or even the app developer being aware of it. Quite a few also send private data across the network in plain text. The full study is due out later this week.

6 of 150 comments (clear)

  1. Laziness by Anonymous Coward · · Score: 4, Insightful

    Code recycling is one thing, but not understanding what that code does when you put it into a production app or not following best practices is another. As Android gains popularity as a platform to develop for, we're going to lose quality as the new folks jumping onto the band wagon don't care how their apps work or look beyond the end goal. This mentality is already popping up with Android Wear developers who cram as much information as they can on the screen and claim that design guidelines are "just recommendations."

    1. Re:Laziness by AuMatar · · Score: 5, Insightful

      Design guidelines are just recommendations. Frequently bad ones. A developer should design the best UI he can, not follow what Google says regardless of whether it fits. And most developer guidelines, Google and Apple both, are crap.

      The problem is that the whole app movement has brought in a whole slew of crappy developers who's idea of coding is to search stack overflow or git for stuff to copy paste. They don't read it, don't understand how to use it right, and expect it to magically work. Worse half of the people writing that code fall into the same category, so its the blind reading the blind. If you pick a library off of github and assume it will work, you deserve what you get. Unfortunately your users don't.

      These people have been around for a while (they used to be "web developers" and program by copy pasting big chunks of javascript). The problem is that on a phone they can do more damage. In a world where the number of quality programmers is fixed and far less than the demand for programmers, how do you fix it? Making it easier to program actually hurts, you end up with those crappy coders trying to do even more. Maybe its time to raise the barriers to entry for a while.

      --
      I still have more fans than freaks. WTF is wrong with you people?
  2. All software is full of bugs by Tony+Isaac · · Score: 4, Insightful

    It doesn't matter if it is Windows, Mac, iOS, Android, or Linux, all software is full of bugs.

    For that matter, all of everything constructed by human beings...is full of defects, or potential defects, or security vulnerabilities. Your house, for example. You have a lock on your front door, but it takes a thief just a few seconds to kick the door in. Or your car...a thief can break into it in seconds, even if you have electronic theft protection. I'd call those "security vulnerabilities."

    It's the nature of all human creations, software or hardware, electronic or mechanical.

    So what do we do? We improve security until it becomes "just secure enough" that we can live with the risks, and move on.

  3. Re:What alternative could be built? by Anonymous Coward · · Score: 4, Insightful

    Fine grained permissions. Try denying an app access to your contacts in Android. Good luck.

  4. Code Academies by Fnord666 · · Score: 5, Insightful

    This is the sort of thing that you can expect when you put developers through a whirlwind coding course. They learn to use library after library without understanding the ramifications of their use. Need an ad network? Slap in a library. Need geolocation? Slap in a library. What you end up with are flashlight applications that want permission to read the low level system log. Then again, that's coding in the instant gratification world that we live and develop in today.

    --
    'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
  5. Load of ignorant crap by janoc · · Score: 5, Insightful

    The entire article is harping on 3rd-party ad network libraries stealing personal data and phoning tracking info home. As these are libraries and developers are re-using open source libraries, then it follows that "Open source is no free lunch" and is stealing your data. What a majestic leap in logic!

    They conflate open source libraries with various ad-network code stealing personal data, basically trying to portrait open source code as being responsible for it. Never mind that the ad-network code is almost never open source.

    Granted, OSS is certainly not bug-free, but the spyware has little to do with it.

    What a load of ...