Airbnb on Android just send a “Test, Test dev" push notification message

As another commenter mentioned, it's at least a good marketing campaign, causing me to open the app for the first time in months. Or it might be to gather a baseline of how many people react to their notifications, regardless of their contents? (Perhaps to immediately go to the notifications settings to disable them)

Edit: if the notification is sent by an attacker, does the attacker get access to firebase metrics as well? (Guessing they at least contain info about how many people opened the app)

What phone do you have? 1 day 23 hours, I'm jealous of your battery life!

Interesting, but why would an attacker push a notification like this to so many people?

Or did not many people get it? Could I be targeted, along with the others in this thread?

If the attacker really intended to send the notification to everyone (or even 10%), wouldn't that very likely get the attention of Airbnb, and then they'd know about the issue and be able to mitigate it?

Edit: assuming everyone got it, this seemed much more likely to be a mistake, to me. For example, someone working at Airbnb was testing something and accidentally did it in prod instead of dev. Otherwise, why not camouflage this as something more innocent, like an ad for Airbnb, saying something generic like "Check out our listings near you"?

No, the process failed. They should NOT have access to prod API keys.. It actually shows how ABnB treats security of prod secrets.

Maybe. But given the culture at most of these places I'd expect the junior to be explained that it's ok, everybody makes mistakes. Some engineering manager is probably sweating bigger buckets over their failure to properly secure casual human access to prod stuff, which is definitely not ok. Meanwhile the both of them are really really relieved that the notification contents were completely innocuous and not some sick inside joke that would have been massively offensive out of context.

I get a paywall. Can a subscriber share the content here? Airbnb charges to read their own official publications?

How big is their dev team? Does their app change much? Could they have contracted it out and now only have one or two people who still push updates to it?

Its the process, not the dev. A Dev should never have access to prod secrets, it show flaws in ABnB security model and tells me a fair bit around how the work with dev/deployment.

Did you have developer mode enabled on your device?

Haha I considered this as a possibility for why it was sent... I don't ever open their app otherwise, I only ever installed it to receive messages from a host on a trip.

At the very least they might have wanted to understand a baseline for how many people will open a notification just to dig into the app and try to disable future notifications, regardless of how annoying the text in the notification was.

That would actually be sad

Press F to pay respects

High up yes, not the dev who did this.