I accidentally built a spying app

https://withblue.ink/2020/09/24/that-time-i-accidentally-built-a-spying-app.html

by akeck • 6 years ago

176 55 6 years ago

LeonB2• 6 years ago

Thinking “how can this technology be used by stalkers, harassers, abusive partners” and so forth is something I didn’t think about when I was young, but always consider now.

Having more diverse voices in your team and in your life is a big part of getting better at this stuff.

PradeetPatel• 6 years ago

What are some things a start up founder can do to foster a culture of diversity and inclusivety?

gibolt• 6 years ago

Hire outside your bubble. Hire someone from non-elite schools who have amazing/interesting projects or clear success in spite of struggles or poor odds.

fareesh• 6 years ago

Focus on diversity of perspective as opposed to superficial diversity. For example, a second generation Taiwanese American can bring a very different perspective from that of a Taiwanese immigrant. The latter is more likely to bring something unique to the table.

tomc1985• 6 years ago

Favor people that don't fit your mold. Hang out with people that aren't your usual group. Hang out in an underground community (not literally underground, more like subcultures)

ArnoVW• 6 years ago

In the last 25 years I've experienced the voyage from a staff count of 6 to a staff count of 100 three times in different companies (service provider, professional services, software editor).

Your first hires determine largely your culture. The people that end up creating teams, and that eventually hire and influence people themselves, make your culture.

TazeTSchnitzel• 6 years ago

Perhaps care less about “culture fit” in hiring? If you only hire people who think the way you do, the results are obviously not diverse.

Yetanfou• 6 years ago

Make sure to include diversity of opinion in your hiring criteria so as to avoid creating a bubble. This is true diversity as opposed to identity-based "diversity". Make sure to get people who themselves are open for true diversity as well, otherwise you risk creating factions inside your company.

drdeadringer• 6 years ago

So far it looks like "Don't Hire Who Drinks Your Kool-Aid".

Kool-Aid is good for some of your group.

The opposite is also good for your group.

terracatta• 6 years ago

One time a friend and I built an app for a weekend hackathon competition called Rails Rumble.

At the time (2010), link shortening services were all the rage, but they were being used to obfuscate malware links. To fight this, we wanted to create a link shortening service that couldn't be used for malware. Instead of redirecting to a webpage, it broke the page apart into its core elements so you could see what it was about before you visited it. If the site had photos, we even put them into a nice looking image gallery that you could peruse.

We finished the project in 72 hours and got an honorable mention for the competition, but we didn't win. A month later, our free server hosting we were given for the competition was about to expire. I logged in to spin the whole thing down.

Poking around the DB a bit, I realized our little weekend project had thousands of links shortened and the traffic for the site was actually exceeding the limits of the server. Looking at the URLs, I realized they all had one thing in common; they were all porn sites. The simple inclusion of the image gallery had inadvertently created a porn scraping service. It was like your browser's reader view, but perfect for adult sites!

It was so obvious in retrospect, but sometimes in your rush to build an idea, you can be completely blind to its true nature. This time it was amusing, but the next time it could be dangerous, and the lesson always stuck with me.

wolco2• 6 years ago

Did you ever open source the project? I can see it being useful in a more limited context.

Scoundreller2• 6 years ago

Reminds me of Firefox Send.

Found myself in a situation needing it a few weeks ago and was like, ugh, what do I do now.

giancarlostoro• 6 years ago

I swear Mozilla misses out on a ton of opportunities to make money and fund MDN / Firefox properly. They need to stop making free services, and charge money for services that will fund the open source projects in their foundation, that or finally donate it to a real org that will actually maintain the projects in question.

cbkeller• 6 years ago

There's still a working donation-supported command-line-focused version of it here [1] for anyone who doesn't know!

[1] https://github.com/timvisee/ffsend

Iv• 6 years ago

The year is 2020 and transferring files between devices is still hard.

I think a decade ago I started paying ~5$ a month for a server at OVH with a lot of storage. SSH/Filezilla, Nginx on an obfuscated URL, has solved a lot of my problems. I also use it as a server to test docker images, a VPN when I want a French IP, a pictures backup server and a professional presentation website.

My free email account I am using since the 90s is now telling me it is almost full so I am considering to switch it.

Really, storage is cheap but is not free. Save yourself a lot of hassle: pay it yourself, take back control.

buu700• 6 years ago

Reminds me of https://news.ycombinator.com/item?id=24119024

l-p• 6 years ago

We just wanted to build a gif-making app for a hackathon.

You could search for and browse movies by clicking on directors, actors and other staff, download a movie with one click, preview it to select what you want to clip, and make a gif out of it.

Turns out it was a very convenient interface to discover, download, and view movies. All we had to do was front-end to TMDb, a torrent search scrapper, and a layer between the Transmission CLI and the front-end.

We inadvertently built a popcorn-time clone in a day.

RcouF1uZ4gsC2• 6 years ago

This is almost like "think of the children" in regards to enabling users to do stuff with their own phone.

Yes, if you know how to jailbreak an iPhone and are able to have the other person use the phone, you can spy on them. You are already "on the other side of the airtight hatch". I don't think there are technical solutions to having physical control of a person and their phone.

Many times tech people want to imaging a perfect tech solution to a problem, but many times you need legal and social solutions.

jakelazaroff3• 6 years ago

I don't see how this is "think of the children"? The point is that we need to be cognizant of how the things we build can be (ab)used.

RcouF1uZ4gsC2• 6 years ago

It’s this thinking about how things can be abused that is behind calls to ban encryption or for ISPs to be filtered, or for Torrents to be banned.

Every powerful tool can be abused. In fact, the more powerful it is, the more it can be abused. The abuse of the tool is the responsibility of the person abusing it.

We don’t require baseball bat or hammer manufacturers to think about how their product can be abused, even though baseball bats and hammers have been used to murder people before.

ufmace• 6 years ago

I'm not so sure I like where the rest of this argument is going, but I do want to support the idea that there are probably a zillion ways to spy on and otherwise abuse somebody if you can get them to use an iphone that you jailbroke and installed some off-app-store software on.

Maybe it's better to come up with some lesser way to discourage people from using this kind of software on somebody else's phone without their knowledge than shutting down the whole service entirely.

m463• 6 years ago

and to this day you can't export your imessages in any official way.

imperfect_blue2• 6 years ago

You can run people over with cars, electrocute them with electricity. This doesn't mean we should never have built cars or generators.

The more powerful and impactful something is, the greater the potential for abuse. You don't even need that something to be abused - bad people benefited from electricity just as much as good people. This doesn't mean we should stop building powerful and impactful things, or think of ways to restrict them such that only the "good guys" can benefit.

Sebguer2• 6 years ago

You absolutely should think about the ways the things you create can be used to harm other people, and take steps to mitigate that.

sneak• 6 years ago

I would prefer my knives have sharp points on them, despite the fact that they can be used to stab. I do not want general purpose tools "mitigated" because some people could use them to harm other people.

I want my tools to be sharp, pointy, and effective.

Blunt your own tools, but don't tell me what I can do with mine, please.

h_anna_h3• 6 years ago

I agree, the authors of cron and wget/curl should have taken steps to protect people from having their privacy invaded by others who use these tools.

tehjoker• 6 years ago

Electricity is definitely good, but cars certainly have alternatives with various tradeoffs.

Electricity is also especially amusing in the US because we picked the frequency of AC current that requires the least juice to stop your heart. Other countries picked slightly different frequencies....

peterkelly• 6 years ago

Both cars and electrical infrastructure have a ton of safety mechanisms built in to them to reduce the potential for harm, many required by law.

For cars we have seatbelts, airbags, traffic lights, speed limits, guard rails on mountain roads, and you have to undergo training or certification before you're allowed to get a license. All cars have numberplates for tracking, and identifying these in CCTV and dashcam footage can be useful in identifying those who have caused accidents or other damage. Vehicle manufactures have a lot of regulations that they have to comply with.

For electrical distribution networks and equipment there are also many safety mechanisms in place, such as insulation, circuit breakers, surge protectors, and lots of regulations covering the installation of electrical wiring in buildings. While growing up, everyone learns of the potential dangers of electricity, e.g. don't stick a fork in a socket and keep that hairdryer away from the bath tub. Similarly everyone knows the damage and trauma that can result from car accidents.

The same is not currently true of social media. I don't know what the right answer is regarding regulation - I'm wary of unforseen negative consequences it may have and the potential for it to be poorly thought out. But I think education on how to use social media responsibly is important. Things like be careful about how much information you share about yourself, don't believe everything you read (check to see if the source of news is reliable), learn how to identify fake news and propaganda, and even how to decide whether to opt out of using certain services altogether.

I agree with your main argument, but it's overly simplistic - we should think about how to achieve the benefits of new technologies while minimising the costs.

imperfect_blue2• 6 years ago

All of these safety measures are developed through trials and iterative improvements, not something that was foreseen by the inventors. That's because its difficult if not impossible to accurately predict the impact of a revolutionary product at the onset. Its hard enough predicting whether something will be revolutionary, much less its impact.

This iterative process is working fine for social media. The platforms are changing, how the users use them is changing, it just needs more time to mature.

swirepe• 6 years ago

You can run people over with cars, electrocute them with electricity. This doesn't mean we should never have built cars or generators.

You should still think about how a car or a generator could hurt someone when you're building one, right? That's how we got crosswalks and fuses.

vinniejames• 6 years ago

At least you got in early on those PLTR stock options

DoctorNick• 6 years ago

well, stop doing that.

ignoramous• 6 years ago

I implemented a new feature: the ability to upload texts automatically, in background, without user intervention.
I had, unknowingly and unwillingly, built a spying tool, and a really convenient and efficient one.
Thanks to background uploads, people could install the YouArchive.It app on another person’s iPhone, set it up, maybe even hide it (something possible on a jailbroken iPhone), and then watch as the text messages come in, almost real-time. Jealous partners, stalkers and the likes could install this tool on an unknowing victim’s phone with relative ease.

...

This hit home: (The absolutely otherwise fantastic) NextDNS (and anything that's similar to it) comes pretty close to a spying app, too (300,000 DNS requests per month conveniently stored for a long time, for free). I know a handful people who I introduced NextDNS to as a privacy enhancing service ended up using it to encroach upon privacy by configuring it on unsuspecting user's Android and iPhones (doesn't even require jailbreak or root and runs forever in the "background").

bzb6• 6 years ago

You could’ve made the same point in a post 1/10 the length.

Olreich• 6 years ago

Facebook can tune the algorithm to stop polarizing viewpoints. YouTube can better vet the video content that gets posted, (they find porn with eerie accuracy, but can’t identify anything else that might not be good to spread?). Instagram can promote positivity about all parts of life instead of idolization of beauty and riches. Twitter can ban someone who constantly breaks the terms of service, instead of making them a specific loophole.

None of these platforms are going to improve though. The money that they make is now closely entwined with what started out as unintended consequences and those consequences are well known. And that just makes them intended consequences.

The author shut their service down when they realized the harm it was doing. They could have solved it other ways as well. Social media and other companies could fix their unintended consequences too, but aren’t likely to so long as money and engagement are the primary metrics of success of a business.

amelius• 6 years ago

Academic studies in this area would help. I'm curious why we don't see more of them.

dakial1• 6 years ago

There is an interesting ethics discussion here, because FB could, for example, tune their algorithms to avoid polarization by presenting users with extreme views content that wouldn't validade those views, but show them a more moderate view and bring them to a more moderate, fact based, scientifically sound and politically correct view. But would it be ethical? Who would be the one to choose what "the correct view" is? Right now FB is doing harm because it is being somewhat fair by showing people what "they want to see", so their behaviors are telling the algorithms want they want, not a third party, even if what they want is wrong/toxic.

I accidentally built a spying app

Related Stories