I decompiled the White House's new app (thereallo.dev)

by amarcheschi 259 comments 668 points
Read article View on HN

259 comments

[−] SoftTalker 48d ago
Looks like what you might expect in a standard marketing app from a consultancy. They probably hired someone to develop it, that shop used their standard app architecure which includes location tracking code and the other stuff.
[−] iAMkenough 48d ago
If only the US Digital Service still existed as an agency to do this right. Too bad it's now been hollowed out to be DOGE, subject to multiple active lawsuits.

What are your taxes paying for?

https://en.wikipedia.org/wiki/United_States_Digital_Service

[−] thegreatpeter 45d ago
have you seen some of the websites they've developed? they're actually quite nice. maybe joe hasn't gotten to mobile yet

edit: oh wait, thats https://ndstudio.gov/

[−] a11yauditfailed 45d ago
"Accessibility Matters" they chortle between giant images of text https://ndstudio.gov/posts/accessibility-matters
[−] jclardy 48d ago
The location tracking code is within the OneSignal SDK - which is just a standard messaging platform for sending emails/push messages to users. It doesn't have some magical permissions bypass, the app itself has to request it.
[−] charcircuit 48d ago
And r8 which does tree shaking to remove dead code is not smart enough to understand react native so it won't strip it out without extra work from the developer.

Cross referencing these different things in the article to other apps that exist was my first thought as these seem pretty generic and probably reused from somewhere else.

[−] miki123211 48d ago
The Polish covid quarantine app was famously adapted from some app for store inspectors or something, as it already implemented most of the required functionalities, like asking for photos via push at random times, sending them along with a location etc.

They likely did a search-and-replace on the brand name, so you had strings like 'your invoices from Home Quarantine inc' in the code.

Not a bad thing per se, getting the app out the door asap was definitely a priority in that project for understandable reasons, but funny nonetheless.

[−] halJordan 48d ago
That's exactly what 45Press is. They won a 1.5mil contract to spit out this tripe (tbf the contract includes other wh.gov support).
[−] irishcoffee 45d ago
Shockingly, still better than baltimore: https://foxbaltimore.com/news/city-in-crisis/baltimores-webs...

I think its cost over $5mm at this point, and the website doesn't exist. Oh, the company that built the site is owned by, I think the spouse of a council member, or something of that ilk.

Edit: 2.2mm, initial bid of 300k.

[−] DonHopkins 48d ago
To be fair, Kristi Noem shot the horse they rented, so there were a lot of expenses.
[−] pseudohadamard 48d ago

  "Visit TrumpRx.gov"
Holy crap, the grift never ends! Is he even allowed to do that, use a .gov address to peddle dodgy meds?
[−] kdheiwns 48d ago
"He can't do that" means nothing when the law is never enforced.
[−] iAMkenough 48d ago
Hatch Act won't be enforced until the next administration and next DOJ.
[−] ImJamal 46d ago
Has the Hatch Act ever been enforced? Every administration in the last 20+ years have had people violate it but as far as I can tell nobody has been found guilty.
[−] extraduder_ire 48d ago
At least. I'm not hopeful.
[−] nielsbot 48d ago
[flagged]
[−] throwawayqqq11 48d ago
Thank god there are still republicans left.

But snark aside, the next elections will be decided around damage control. Yes, the old school dems are pretty spineless (corrupt) but i guess even they feel the temptation of revenge and taking out political opponents for good. I really hope the new generation of democrats succeeds and breaks the corruption ties.

[−] nielsbot 47d ago
Thank you for understanding. I'm pointing things like Obama "looking forward not backward" and not punishing Bush, Cheney, Ashcroft, Condi, etc for war crimes and illegal warmongering which leads directly to today's current illegal Iran invasion.

We will need actual punishments for everyone who illegally defunded (or funded) programs, got us into the Iran invasion, embezzled and lined their pockets with corruption etc etc etc.

[−] AbstractH24 47d ago

> Hatch Act won't be enforced until the next administration and next DOJ.

How did that last administration's dwelling on persecuting the one before it turn out?

While I don't like the current one and certainly agree that some of its actions are totally unethical, once it's over can we just move on and look forward, not back?

[−] nebulous2026 46d ago
The only possible way this country has a future is if crime is actually punished. If the members of this current administration who committed criminal acts do not actually suffer the consequences then what is to stop the next one?
[−] Jedd 47d ago
This sounds like something criminals would say / want.
[−] AbstractH24 47d ago
How do we move forward?
[−] Jedd 46d ago
"Justice must be seen to be done."

Without consequences for illegal behaviour, there's no incentive for bad actors to not continue acting bad. This, in no small part, explains why we are where we are today - a misplaced attempt to 'move forward' by ignoring illegal actions.

[−] RankingMember 45d ago
Without holding those who do wrong to account, positive movement will always be dogged or straight-up negated by those who do wrong without facing justice.
[−] NewJazz 47d ago
Prosecuting criminals.
[−] ceejayoz 46d ago
That'll only work here if there are reforms to the pardon power while we're at it. Any convictions a Democratic administration manages to obtain will be pardoned the next time a Republican gets in.
[−] RankingMember 45d ago
That Jan 6th participants were almost uniformly let off the hook is a stain that will continue to haunt us until pardon power is finally reigned in.
[−] AbstractH24 44d ago
Agreed

More than prosecution we need politicians elected who are willing to reform. Even if those reforms reduce their power as well

[−] ceejayoz 44d ago
Both is fine.

Prosecute, and get rid of the loopholes that made it necessary to do so.

[−] ceejayoz 46d ago

> How did that last administration's dwelling on persecuting the one before it turn out?

They were way too slow about it.

I hope the next one is faster.

[−] ImJamal 46d ago
What do you mean by dodgy meds? These are just the normal meds you can get at any pharmacy. They also aren't even peddling them. They just link to pharmacies or provide discount codes.
[−] thegreatpeter 45d ago
what are the dodgy meds? it provides a discount at the pharmacy if you pay cash and skip insurance. are you from here?
[−] gdeglin 48d ago
OneSignal cofounder here. Posting since our service was mentioned in this article.

For those concerned or curious about location data collection, we wrote an explanation of how it works: https://onesignal.com/blog/youre-in-control-how-location-act...

[−] robin_reala 48d ago
We do not sell user data. Period.

You’ll sell it if you sell your company (as per your privacy policy).[1]

We may disclose or transfer your personal information in connection with, or during negotiations of, any acquisition of our business, financing or similar transaction.

If you wouldn’t sell it, period, then I’d suggest amending your privacy policy to include irrevocable deletion of customer data at the point your company is sold to a buyer.

[1] https://onesignal.com/privacy_policy

[−] SecretDreams 48d ago
I would love to see a response to this comment from the OP.
[−] giwook 47d ago
Same. OP will likely ignore it though.
[−] AbstractH24 47d ago
Same
[−] dbbk 47d ago
Yes that's the normal way of doing things? Why would someone buy a business with no user base?
[−] s3p 47d ago
Great question, however the important point here is that the company makes the claim they will not sell user data. "Period." So the company implies that if they are sold they will be sold with no user data
[−] dbbk 46d ago
I think that's a silly read of what they're saying
[−] augusto-moura 47d ago
I believe the problem is not doing this, but the text in the policy is misleading, since users would believe their data would never be shared with anyone outside of the company itself _unconditionally_, which is not true (if only by technicality), the data can be sold as part of the company.
[−] kibibu 45d ago
Not just as part of the sale, but as part of the negotiation.
[−] nclin_ 48d ago
Dead link
[−] lumpo 47d ago
The onesignal domain is on the IPFire Domain Blocklist

Found 1 list exactly matching 'onesignal.com':

  - https://dbl.ipfire.org/lists/ads/domains.txt
    block list
    added:         2026-02-13 15:00:20
    last modified: 2026-02-13 15:00:20
    last updated:  2026-03-29 04:02:16 (126.625 domains)
    enabled, used in 1 group
    comment: "IPFire Advertising"
    matching entries:
    - onesignal.com
[−] Anonasty 48d ago
Works for me.
[−] nclin_ 48d ago
weird, still dead here (entire rest of the internet is fine) :shrug:
[−] dtj1123 48d ago
VPN
[−] rerdavies 48d ago
Bump this please. This should be the #1 comment.
[−] exogeny 48d ago
[flagged]
[−] somehnguy 48d ago
Interesting. The site is nearly unusable to me unfortunately. '19 MBP w/ Chrome - scrolling stutters really bad
[−] tredre3 48d ago
Scrolling is extremely poorly behaved on that page for me too, Firefox 149 Windows 10. Which is quite ironic coming from an article that mainly criticizes the web dev aspects of the app!
[−] Aerolfos 48d ago
Scrolling on my firefox is smooth... with javascript blocked.
[−] imalerba 48d ago
Scrolling is so laggy it's annoying to follow on mobile (FF 151.0a1)
[−] catlikesshrimp 48d ago
Not what you meant, but works fine on

Firefox 148.0.2 (Build #2016148295), 15542f265e9eb232f80e52c0966300225d0b1cb7 GV: 148.0.2-20260309125808 AS: 148.0.1 OS: Android 14

[−] KomoD 48d ago
Does it for me too, chrome on a thinkpad
[−] beAbU 48d ago

> chrome on a thinkpad

This is akin to saying "browser on a computer". Need to be more specific.

[−] amarcheschi 48d ago
I agree, the website of the original article is kinda terrible
[−] bigbugbag 47d ago
no problem here using librewolf on arch linux on a 2012 thinkpad.
[−] r4indeer 48d ago
The argument regarding no certificate pinning seems to miss that just because I might be on a network that MITM's TLS traffic doesn't mean my device trusts the random CA used by the proxy. I'd just get a TLS error, right?
[−] subscribed 48d ago
Not if someone can issue the certificate signed by the CA your phone trust.

Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe.

Or imagine living in the country where almost all of the cabinet is literally (officially) being paid by the propaganda/lobbying body of such country.

Or living int he country where lawful surveillance can happen without the jury signoff, but at a while of any police officer.

Maybe its not common but frequent enough.

[−] layer8 48d ago

> Imagine being in a cafe nearby, say, embassy of the certain north African country known for pervasive and wide espionage actions, which decides to hijack traffic in this cafe.

How would they get your phone to trust their CA? Connecting to a Wi-Fi network doesn’t change which CAs a device trusts.

[−] Galanwe 48d ago
Because there is a quadrillion trusted CAs in every device you might use. A good chunk of these CAs have been compromised at one point or another, and rogue certificates are sold in the dark market. Also any goverment can coerce a domiciled CA to issue certs for their needs.
[−] hvb2 48d ago
That is a wild claim. I can't imagine that being correct given how that's been abused in the past

https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

[−] ceejayoz 48d ago
It's a pretty huge list.

https://support.apple.com/en-us/126047

The chances of zero of these CAs having been compromised by state-level actors seems… slim.

Do you trust "Hongkong Post Root CA 3" not to fuck with things?

Your link's from 2011; the US government was still in the trusted list until 2018. https://www.idmanagement.gov/implement/announcements/04_appl...

[−] nucleardog 48d ago
All modern browsers require certificates to be published in the certificate transparency logs in order to be considered valid.

These are monitored, things do get noticed[0], and things like this can and have lead to CAs being distrusted.

It's not foolproof, and it's reactive rather than proactive... but in general, this is unlikely to be happening on major sites or at any significant scale.

I'd wholeheartedly recommend people taking some time and reading through the CA Compliance issues on Bugzilla. The entire CA program there, in my opinion, does a fantastic and largely thankless job of keeping this whole thing on the rails. It's one of the few things I can say I had _more_ trust in the more I looked into it.

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1934361

[−] ceejayoz 47d ago

> It's not foolproof, and it's reactive rather than proactive…

This just means you keep your powder dry until it's needed.

[−] cookiengineer 48d ago

> That is a wild claim

China telecom regularly has BGP announcements that conflict with level3's ASNs.

Just as a hint in case you want to dig more into the topic, RIR data is publicly available, so you can verify yourself who the offenders are.

Also check out the Geedge leaked source code, which also implements TLS overrides and inspection on a country scale. A lot of countries are customers of Geedge's tech stack, especially in the Middle East.

Just sayin' it's more common than you're willing to acknowledge.

[−] technion 48d ago
If you go down this path you argue desktop browsing https is broken, which i dont think is a serious argument.
[−] fc417fc802 48d ago
Well yes, CAs and the ICANN model of DNS are intertwined and fundamentally broken in multiple ways. However the system as a whole is largely "good enough" as can be seen from its broad success under highly adversarial conditions in the real world.
[−] quesera 48d ago
No one is trying to go that far down the path.

https (specifically the CA chain of trust) is imperfect, and can be compromised by well-placed parties.

[−] Gigachad 48d ago
This is stopped by certificate transparency logs. Your software should refuse to accept a certificate which hasn’t been logged in the transparency logs, and if a rogue CA issues a fraudulent certificate, it will be detected.
[−] kevin_thibedeau 48d ago
Israel is not in Africa.
[−] thegagne 48d ago
Not if you are part of an org that uses MDM and pushes their own CA to devices.
[−] greenchair 48d ago
that argument also misses because it is based on old best practices which are no longer relevant.
[−] iancarroll 48d ago
A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article.

I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a commonly invoked function.

[−] reactordev 48d ago
Violating the law is what the White House is all about these days.
[−] julianlam 48d ago
This site makes my browser choke.

Reader mode was the only thing that made it readable.

[−] sitzkrieg 48d ago
i assumed it was malware out the gate. yep
[−] nine_k 48d ago

>

An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

So at least it does something actually beneficial for the user! I wish it could go even further, the way Reader Mode in a browser would go.

[−] 1e1a 48d ago
This website is quite GPU intensive when scrolling.
[−] wnevets 48d ago

> That's a personal GitHub Pages site. If the lonelycpp GitHub account gets compromised, whoever controls it can serve arbitrary HTML and JavaScript to every user of this app, executing inside the WebView context.

I was promised a meritocracy and non stop winning. When do those begin?

[−] vineyardmike 48d ago

> The official White House Android app has a cookie/paywall bypass injector, tracks your GPS every 4.5 minutes (9.5m when in background), and loads JavaScript from some guy's GitHub Pages (“lonelycpp” is acct, loads iframe viewer page).

Doesn’t seem too crazy for a generic react native app but of course coming from the official US government, it’s pretty wide open to supply chain attacks. Oh and no one should be continually giving the government their location. Pretty crazy that the official government is injecting JavaScript into web views to override the cookie banners and consent forms - it is often part of providing legal consent to the website TOS. But legal consent is not their strong suit I guess.

[−] AnonyMD 48d ago
If this is true, it would be a symbolic event marking the disappearance of freedom, a source of pride for the United States.
[−] oefrha 48d ago

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

Giving people a taste of web with Ublock Origin annoyance filters applied, refreshing. Can’t believe orange man regime is doing one thing right.

[−] jcmartinezdev 48d ago
Even though those pop ups and paywalls are annoying, you shouldn’t be injecting custom CSS and JS like that. It’s just wrong.

And the location… well, if one day they need you, they’ll sure be glad they know your each steps and current location .

It’s not a bug, it’s a feature.

[−] ChicagoDave 48d ago
I prefer my state-sponsored propaganda raw without tracking me.
[−] post-it 48d ago

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

Rare Trump administration W. I'm assuming there's one particular website they open in the app that shows a cookie popup, and this was a dev's heavy-handed way of making that go away.

[−] drnick1 48d ago

> An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls.

I wouldn't run a non-free government app on my phone, but this seems a positive. It's basically what uBlock does.

[−] Arainach 48d ago
"An official United States government app is injecting CSS and JavaScript into third-party websites to strip away their cookie consent dialogs, GDPR banners, login gates, and paywalls."

In their defense, this is the first thing the Trump admin has done that's unambiguously positive for ordinary people.

[−] somebudyelse 48d ago
The only permissions on the play store are notifications. On data privacy, it only shows optional email or phone number. Respectfully, I call BS.
[−] orthogonalinfo 48d ago
[flagged]
[−] ssyhape 48d ago
[flagged]
[−] pugchat 48d ago
[dead]
[−] iam_circuit 48d ago
[dead]
[−] krisakma 44d ago
[dead]
[−] alcor-z 48d ago
[dead]
[−] kaluga 45d ago
[dead]
[−] nguyendinhdoan 48d ago
[dead]
[−] crimshawz 48d ago
[flagged]
[−] enigmaTest 48d ago
[flagged]
[−] analog31 48d ago
[flagged]
[−] Factomega 46d ago
[flagged]
[−] razkaplan 48d ago
[flagged]
[−] longislandguido 48d ago
[flagged]
[−] periodjet 48d ago
[flagged]