Hacker News Reader

Comment by veidr | Hacker News Reader

The web puts the user in control; apps (on all significant platforms currently existing) put the company in control.

Yes, Google and (especially) Apple may force Reddit to comply with this or that, but Google and (especially) Apple also prevent the user from doing all sorts of things they can do with an open platform like the web.

Users can't block ads in an app. Users can't block telemetry. Users can't prevent tracking, at least without help from the platform vendor. Users can't easily save their favorite content from your app if the company doesn't want them to. Etc.

The web is fundamentally user-centric, and apps are roughly the opposite of that.

There are also legitimate user-benefiting advantages of apps, such as ability to use the accelerometer or other non-web features, but I can't really think of any that convincingly apply to Reddit's app. Maybe somewhat better push notifications, and "sign in with Apple" but... still seems like another own-goal from team Reddit if they are, in fact, doing this.

View on HN

Let's not forget that the in-app browser page can be injected with whatever javascript the owner of the app wants. FB/Instagram use this for tracking. There is a more comprehensive list of what apps do this somewhere; I do not remember where it is. But for FB/Meta, you can find the info here: https://krausefx.com/blog/ios-privacy-instagram-and-facebook...

Worth pointing out that not all in-app browsers are created equal, however. A huge number of apps, probably the majority, on iOS use SFSafariViewController for theirs, which is basically an isolated Safari tab that runs out of process and app developers have no access to. Furthermore, SFSafariViewController instances are unique per-app, each with their own separate set of cookies so apps can’t trick you into visiting a link to gain access to full Safari’s cookies.

IIRC Android has something similar that opens an isolated Chrome tab within apps but I have no idea how common usage of that is in Android apps.

You are correct; however, in the case of some of the biggest apps (Reddit's official app among them), they use the old WKWebView specifically for the ability to inject code. The more user-centric third-party apps that Twitter/Reddit have targeted lately used SFSafariViewController.

The question is, is there any way for the user to tell the difference just by looking? Or is that something you have to be able to examine the binary to be able to determine?

On Android, when you have the WebView open, go to the app switcher and the title will tell you which app provides the view: the original app, or your browser.

They look significantly different on both platforms, so it's easy to notice if you know how ewch one looks

Yes, the one that is “clean” has the open in Safari icon. However, as soon as that becomes common knowledge I’m guessing the malicious apps will be adding that icon

Can't always do that, though. Apple gets especially angy if you're injecting necessary stuff into the page, we found as a general rule they'll fail your app approval for anything like that (unless you're a big boi like FB I guess).

This, this and exactly this.

Their finance team probably made a projection that if they can get X% of current mobile web users onto the app, they’ll be able to extract Y% more total revenue. They have no idea that they should split users into contributors and lurkers and even if they had, they have absolutely no idea how to model their value, so they don’t, the board sees the numbers and tells them ‘ASAP’ and that’s how you kill social networks, because the financial model is based on false assumptions.

My former boss, someone I used to think had a brilliant business mind, at an e-commerce company, forced us to produce a shitty mobile app, and then to pour more resources into it, because of how the average spending of users in-app was higher. I mean, no sh*t, these are people who are such fans of your brand that they want to download a whole dedicated app for shopping at your site. Of course they’re buying more. I have an app for stores I frequent a LOT, but would not see myself installing one for like, stores that I visit maybe once a year. But the causality was in the other direction.

> They have no idea that they should split users into contributors and lurkers

Comments like this amaze me. People really think these giant corps are out here not doing things like this.

Big (and small) companies routinely make "data-driven decisions" based on obviously-faulty data collection, bad models, or misapplication of statistics. It rarely takes some crack scientific mind to spot it, either. But they want a decision now and doing it right might take a lot longer or cost more, or the correct model might be a lot fuzzier and that makes them uncomfortable, or they've got some notion in their heads already and they'll be damned if mere numbers are going to get in the way of that, so everyone in the room's just supposed to nod along when the blatantly-biased graphs come up on the Power Point suggesting (erroneously) that we do X.

The business world runs at least as much on bullshit as the most cynical among us might think, I'd say. It's not half as clever or competently-run as one might hope, certainly.

It's a cliche that front-line workers have a better understanding of customers and products than the c-suite and that this leads to predictable blunders, because that's often true.

(I'm also not sure I'd call Reddit a "giant corp", but that's beside the point [EDIT] and anyway, to be fair, this particular discussion isn't just concerned with Reddit)

Often the decision is already made. The numbers game is how you sell the decision internally.

Reddit is far from giant in terms of employees or revenue, and you'd be surprised at how many dumb decisions and how much money is wasted by startups that have raised hundreds of millions of dollars. You really shouldn't assume competence in situations like these, especially when Reddit has recently been making a bunch of terrible long term decisions to try and juice their numbers in the short term for IPO

I think the problem is that people read the analyses that companies share publicly (e.g., in a press release or earnings call), and they assume that that's all they did.

You should assume that any numbers shared publicly are just the tip of a giant-ass iceberg and that there were probably 10x more analyses going on internally that weren't shared.

The thing that ultimately gets shared publicly is whatever avoids using advanced stats or internal jargon; They want a single soundbite, not a scientific paper with a full methods section.

Story time: Worked at a large multinational, and 6-7 years ago they decided they had to ape into the whole “data science” gold rush. They spent millions of dollars on hardware, software, salaries, and consulting.

After a year with not much to show for it, the VP for the silo starts to put out kudos for the team for break-even revenue impact. However, behind the scenes, the insight they were taking credit for was a common sense idea that had already been in the e-commerce team’s backlog.

Nothing surprises me when a company says that they’ve run the numbers.

i think that many business get lured into doing data-science because they think that math/stats powers grant borderline-mystical powers and that they can be used to peer into a data warehouse and create ideas/business strategies that no mere mortal (i.e., people with domain expertise in business) could have dreamt up.

But... most businesses aren't that complex, and people can usually come up with really good common sense ideas for how to make improvements.

Data-science is often most effective when it serves less as a visionary idea-maker and more as translator that helps common-sense ideas become real (optimizing values, figuring out the best roll-out strategies, building forecasts).

Me too. Reddit almost certainly ran those numbers.

They might have chosen to ignore them. They might have fed biased assumptions into their calculations. Project management might have messed up and deprioritized the features meant to placate that section of the userbase. Institutional churn might have resulted in the corporation forgetting that they ever did run those numbers or why they are now heading down this path.

Having worked at some quite large companies: yes, it happens for real that they do not do stuff like that. It is likely that some team obviously has ran the numbers but that does not mean they made it to the people who made the decision.

People really think a giant corp acts a monolithic entity with perfect distribution of knowledge and ability and the stupid actions of dumb individuals will always be stamped out rather than amplified.

And yes comments like this amaze me too.

It’s less about extracting that revenue and more about extracting that sweet IPO capital with a story about being replacement-TikTok.

The IPO capital you can raise is a function of your revenue prospectus.

If you have NNN million users, and you have full location tracking, purchase history, device ID, contacts, search history, list of other apps installed, usage data, Wifi SSIDs, Bluetooth beacons, etc. etc. etc. that's going to look like a huge payday compared to those same users running a mobile adblocker.

And if you're not currently collecting location tracking data, and you've got half a decade of meteoric growth, well, turn it on. Forecast that graph up and to the right, and just flip the switch to the "get money" position.

Due to the winner's curse, you only have to convince a few investors. Even if a significant fraction don't trust your prospectus and imagine that some users might be turned off by a post-IPO monetization scheme, you merely have to convince a small group that your numbers are accurate and you're TikTok 2.0.

The key point in that is that many IPO buyers are willing to believe in imaginary revenue that will never be extracted. Extracting revenue as a goal in and of itself uses a different playbook than IPOing.

Yeah, IPO (or VC) capital at this point is a Pavlov's dog trained to expect riches from every additional bit of private information in the data feed.

> They have no idea that they should split users into contributors and lurkers […]

They probably did do the maths and conclude that the contributors who'll stick around are driving a significant part of the desired engagement. Dumb memes and culture war potshots and disinformation sure, but engagement.

> Users can't block ads in an app.

Yeah, they can. By which I mean, they can do it right away, for the official Reddit app:

– https://revanced.app/patches?pkg=com.reddit.frontpage

– https://revanced.app/download

Or, for even less work, you can just use a pre-patched APK with the ads removed: https://github.com/revanced-apks/build-apps/releases

No need for root access nor flimsy DNS solutions.

any recommended links to learn more about revanced? the best I can find from their website is that they're a continuation of the "vanced" project but it doesn't say what that was and I haven't had luck on google. It's clear that they have something to do with providing patched apps, but is revanced a framework? is it a library? is it a person or group that does the patching?

"YouTube Vanced" was meant an "Advanced" YouTube client, minus the "Ad"s.

They offered a version of the YouTube client which they patched to remove display ads and video ads, plus add background play, SponsorBlock support, and more.

They became fairly popular before Google shut them down for distributing modified versions of their proprietary code.

ReVanced was one of the teams that popped up in the aftermath, a spiritual successor. They reasoned that they could achieve the same basic functionality legally if they only distributed patches (instructions) rather than a pre-patched binary.

So they wrote an app (ReVanced Manager) that takes a stock copy of the YouTube app, unpacks it, applies patches, then repacks & re-signs it. (They don't have Google's signing keys, so typically users need to install the new version under a new name. Users with root can choose to override the built-in version instead.)

Once ReVanced Manager could do that, they expanded into patching other apps as well.

So ReVanced is a team that maintains:

  * A list of useful patches
  * An engine to apply them
  * A Java CLI frontend to the patcher
  * An Android app frontend to the patcher

(I've skipped over a lot of the history details but this should give the basic idea.)

It's a community-driven collection of patches[0] for popular Android apps, supported by a patching framework which includes patch management software (ReVanced Manager[1]).

The documentation[2] is very sparse right now.

[0] https://github.com/revanced/revanced-patches

[1] https://github.com/revanced/revanced-manager

[2] https://github.com/revanced/revanced-documentation

Not only that, they now have a perfect way of tracking the association between multiple accounts, which is very helpful for selling a person's ahem real browsing history.

> apps are roughly the opposite of that

Although I broadly agree with this assessment, I'd just like to add a slight nuance that, at least in my view, it's specifically _app store apps_ that are roughly the opposite. You can still, for example, install random APKs (on Android, I doubt Apple has anything similar) if you're so inclined, so they can be as user-centric as you want. It's just that the major manufacturers optimize for the roughly-anti-user-centric flow.

I would still say that even FOSS apps off F-Droid are less user-centric than the web. They're more likely to respect the user, for sure, than even most web apps. And a user who is comfortable with code can always fork them and customize them. But the barrier to entry for a custom experience is much higher on an app than it is on the web. Browser extensions are highly accessible to many people and can allow tweaking the experience beyond what the developer natively enabled.

As a simple example: Dark Reader has 5 million installs on Chrome. That's 5 million people who can view a web app in dark mode even if the developers didn't think to provide a native way to do so.

My thoughts exactly. I do lots of "tinkering" with my web experience and have a few open source apps that I build and install, and the barrier of entry on apps is way higher than for websites. Even for an app that is open and friendly, it's still a major undertaking to get a dev env setup and debug/tinker. And once you do, auditing the app to see what it does is further difficult. With the web you don't even need a dev env, and an extension like uMatrix makes it pretty easy to audit the site and see what it's doing/loading.

I'm to the point where I boycott apps. I will only use an app if there's a real benefit to me for doing so, such as podcasts and music and offline functionality or those that use hardware features.

That depends on the implementation, but its just a fundamental technology difference. On the web, the default way to do things is to use a bunch of HTML elements and whatnot, which are user-agent-introspectable, even if they are modified using a blob of code.

With apps, you kind of by definition only have a blob of code. As an user and with a sufficiently advanced operating system, you can block some outside-world interactions like internet connections, but the app only has to give you a render target whose pixels can be drawn to arbitrarily. Some apps even use integrity verification features from the OS vendor to check if they haven't been tampered with, that is much harder to do on the web.

Which is incidentally why there is so much interest in high performance web programming and being able to draw arbitrary pixels to a render target (hello canvas/webgl/webgpu). Expect content blockers to become way less effective in the coming years (even ignoring the big obvious attacks like Chrome's Manifest v3).

> Expect content blockers to become way less effective in the coming years

That's s very sad and probably very accurate analysis!

Wonder if the arms-race will give rise to other kinds of add blockers that use image recognition to identify ads. But that still requires rendering the ads (even if only in the background), removing much of the benefit of ad-blockers.

I suspect some might be able to rise up by injecting themselves at framework level, since it's very likely that the programs will still keep some sort of in-memory representation. Though I don't think that injecting code into other WebAssembly blobs is possible with the security models we have today.

The surefire way would be an external application that uses OS APIs to fiddle with memory directly (bye bye mobile content blockers).

But whatever form it takes, it would have to be programmed to operate on every framework available, so it's way less universal than writing a CSS selector or URL regex.

On Android, you even have f-droid, an entire alternative app store that only accepts open-source, user centric apps!

> Users can't block ads in an app. Users can't block telemetry. Users can't prevent tracking, at least without help from the platform vendor.

Adguard does a pretty good job of blocking these things inside of apps.

Adguard blocking inside apps is exclusive to DNS methods, these methods are extremely easy to circumvent by app providers. Reddit (as an example since topic of thread) already gets around these DNS blocking methods because content and ads are served from the same location.

Adguard costs money and non-tech savy userbase has no idea it even exists, even less how to use it. And that is the userbase they wanna keep, I feel like they are purposely alienating their power-user base.

Awareness is certainly an issue, but I've enabled adguard's DNS on my mobile device and it does indeed block almost all ads and doesn't cost me any money.

Admittedly, I'd prefer not to depend on third party DNS as a solution, but it's trading one entity having access to my requests for another. I used to be able to do this with a simple hosts file/blacklist solution, but I finally succumbed to the various user-hostile policies of "ability to elevate to superuser is OK on a laptop, but not on a phone" and have not enabled su on my current device (needed to manage hosts file).

You can block ads in apps. In android 11, you can have it use OpenDNS's adblocking server.

I suspect only a small subset of people who generally run an adblocker also block ads on apps as it requires a lot more specialized knowledge.

Settings -> Network & Internet -> Private DNS -> dns.adguard.com

Now you've blocked a large percentage of ads on android.

Not always, though. For instance it won't work on YouTube ads. I'd call it a hack at best.

I'm sure you're already aware of this, but for other HN users on Android, ads on YouTube are blocked when using Firefox Android + uBlock Origin + m.youtube.com -- the experience isn't as nice as the app but still totally worth it IMHO.

Use Youtube ReVanced if you want the full app experience.

Does DNS based blocking work on mobile?

Surely there is a way of checking api calls made by an app and blocking those?

I have never looked into this mind

HTTPS means the network connections between the app and the backend are opaque to third parties including the user.

Certificate pinning means you cannot insert yourself as the backend and/or MITM the requests. The app will only communicate directly with the owner of the private key it was pinned to.

Depending on the app and OS, it may be more or less easy to change the app to remove/crack the pinning. In general, if you are not in full control of the device (root), it's not possible.

> HTTPS means the network connections between the app and the backend are opaque to third parties including the user.

It means the payload is. HTTPS alone doesn't have any special considerations for hiding the domain, which I think is visible so the request can be routed correctly. And since a lot of ad-blocking is based on domain, that ought to work.

You're not wrong, but ads are already moving to a different model with either first-party URLs or random ones that are difficult or impossible to enumerate to get around ad blocking. With Apple's new thing that's going to bring the reckoning even sooner (sigh). This technique is much harder and won't last very long I'm afraid.

for android you pull down the apk using adb, patch maybe 1 byte in it and push it back

very very easy, no root required

I wouldn't call patching a binary very easy, especially since our point of reference was installing an ad blocker extension in the browser. Also, it takes more than one byte if the binary is obfuscated and full of various ways to check that it hasn't been tampered with.

> I wouldn't call patching a binary very easy

it's even easier than that as all apps (except native ones) will be using the java TrustManager interface

> Also, it takes more than one byte if the binary is obfuscated

but they can't hide the calls into TrustManager

a small utility could automatically take in the APK, patch out the calls and return the fixed APK for you

(would probably work for 99% of apps out of the box)

> it's even easier than that as all apps (except native ones) will be using the java TrustManager interface

Is this required? i.e. do all apps have to use the TrustManager interface to accomplish cert pinning, or is that merely the official way?

> Is this required?

well, Java is Turing complete, so you could completely re-implement TLS yourself instead of using the API that comes with the platform

in practice no-one is going to do that

I'd love to read a tutorial or watch a video going over the patch process -- can you share any links?

Shout this from the rooftops.

Phone apps delenda est

Reply on news.ycombinator.com