r/neoliberal • u/jobautomator Kitara Ravache • Mar 29 '26

Discussion Thread Discussion Thread

The discussion thread is for casual and off-topic conversation that doesn't merit its own submission. If you've got a good meme, article, or question, please post it outside the DT. Meta discussion is allowed, but if you want to get the attention of the mods, make a post in /r/metaNL

Links

Ping Groups | Ping History | Mastodon | CNL Chapters | CNL Event Calendar

New Groups

Upcoming Events

0 Upvotes

48% Upvoted

6.3k comments sorted by

View all comments

24

u/RaisinSecure George Soros Mar 29 '26

https://blog.thereallo.dev/blog/decompiling-the-white-house-app

The official White House Android app:

1) Injects JavaScript into every website you open through its in-app browser to hide cookie consent dialogs, GDPR banners, login walls, signup walls, upsell prompts, and paywalls.

2) Has a full GPS tracking pipeline compiled in that polls every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing lat/lng/accuracy/timestamp to OneSignal's servers.

3) Loads JavaScript from a random person's GitHub Pages site (lonelycpp.github.io) for YouTube embeds. If that account is compromised, arbitrary code runs in the app's WebView.

4) Loads third-party JavaScript from Elfsight (elfsightcdn.com/platform.js) for social media widgets, with no sandboxing.

5) Sends email addresses to Mailchimp, images are served from Uploadcare, and a Truth Social embed is hardcoded with static CDN URLs. None of this is government infrastructure.

6) Has no certificate pinning. Standard Android trust management.

7) Ships with dev artifacts in production. A localhost URL, a developer IP (10.4.4.109), the Expo dev client, and an exported Compose PreviewActivity.

8) Profiles users extensively through OneSignal - tags, SMS numbers, cross-device aliases, outcome tracking, notification interaction logging, in-app message click tracking, and full user state observation.

Is any of this illegal? Probably not. Is it what you'd expect from an official government app? Probably not either.

5

u/brucejoel99 Theresa May Mar 29 '26

Wtf? This is just spyware! Ig the gut reaction's surprise but some people probably assume that all government tech already has spyware installed (& why would they download the White House app?)