Sign in / up

back to article WhatsApp, Apple and a hidden source code F-bomb: THE TRUTH

Facebook-owned chat app WhatsApp says viral screenshots of rude messages to Apple buried deep within its mobile application's code are not real. A spokesperson told The Register on Friday afternoon that the screenshots posted to Reddit showing log strings with the phrase "Fuck Apple" spread throughout were not taken from its …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *

Page:

  1. Anonymous Coward
    Anonymous Coward

    All that debugging logging - more tracing than logging - code in a release version smells of lame developer. IMHO when a developer is so obsessed in tracking his own steps, it's because he doesn't trust his own code. Don't get me wrong. Well placed logs and trace code are good, people "printfing" every damned steps of their code should never leave high school.

    13 35 Reply
    1. Adam 52 Silver badge
      Reply Icon

      On the other hand I try to single-step every single line of my code before release. I'm not arrogant enough to think I write perfect code and I've found lots of subtle errors this way.

      This used to be a common tactic 15 years ago, when graphical IDEs made it easy, but seems to have fallen out of favour these days.

      There used to be a C library/preprocessor that logged every single line as it executed. You'd hate that but it was incredibly useful for finding bugs that couldn't be reproduced. I couldn't find it, so would love a link if anyone's got one.

      29 0 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Using a profiler to profile code (different type of profiling) is good. Identifying code that is never executed and write tests that exercise it is good. Writing tests to ensure code performs as designed is good.

        Littering the code with "log" calls is evil - especially if it writes to a single file because 1) it's slow 2) it needs locks to serialize 3) it may inadvertently leave around sensitive information 4) it makes code far less readable when you encounter a log call every line or so.

        I know I'll got downvotes because I know there are lots of "developers" out there who never learnt how to code truly, and need to leave breadcrumbs around to understand where they are and what they did, and they do in the most outdated way still around.

        Especially those who looks they can't understand how to use exceptions properly to gracefully handle and log what went wrong. Or those who refuses to use a proper IDE because "true programmers" don't.

        Anyway this just confirms my opinion WhatsApp is something cobbled together by lame developers who were just very lucky they got enough PR to become widely used.

        8 14 Reply
      2. Curious
        Reply Icon

        "There used to be a C library/preprocessor that logged every single line as it executed"

        rr for recording a program execution and gdb for replaying, with the ability to break at whatever point?

        0 0 Reply
    2. OliverJ
      Reply Icon

      So, coding for the Apple ecosystem was a little bit more demanding ....

      ... and the coder was a little bit stressed out? That doesn't exactly increases my confidence into the technical competence of WhatsApp. And I agree that this "debug log" has no place in shipped code.

      While I agree that Apple may not provide the ideal environment for dev's (which ecosystem does?), I think that this discovery is more revealing regarding WhatsApp, their QA, and the maturity of their staff.

      12 12 Reply
    3. Hans 1
      Reply Icon

      1. This is most likely the work of an undergrad.

      2. Pretty sure he wanted to work on the iOS team to get the latest shiny iPhone, however, since he was not good enough, was sent over to work on the Android port.

      As for the guyz complaining about dev environments, can Visual Studio not be used to create iOS apps, last time I checked, that was the case, I know, I know, Visual Studio sucks, but, you are NOT limited to Mac OS X POS, you can also use Play D'Oh OS. Then again, it might just be marketing on MS' part, like, you can write the code, yet, you need OS X to compile ... I dunno, have NOT tried, I do not care about iOS, PlayD'Oh OS, or VisualStudio.

      Now, don't get me wrong, I am NOT an Apple fanboy ... Apple is just mehhhhh

      4 25 Reply
      1. Warm Braw
        Reply Icon

        "can Visual Studio not be used to create iOS apps" [?]

        Provided that you wish to rely on Xamarin''s cross-platform middleware, you can write iOS applications using Visual Studio. However, you still need at minimum a Mac "build host" because you can't build an iOS application except on a Mac.

        I dunno, have NOT tried, I do not care

        An excellent basis for posting, then.

        23 0 Reply
        1. Hans 1
          Reply Icon
          Angel

          Re: "can Visual Studio not be used to create iOS apps" [?]

          Indeed, I hereby apologize, been mislead by MS marketing ... should have looked closer and at least tried it.

          The other part of my post, however, could be true ... I mean, this guy must have some reason to hate Apple which I cannot make sense of - remember, he writes the Android port, so Apple should not bother him ... EXCEPT, maybe, if he is jealous.

          0 2 Reply
          1. Simon Taylor 1
            Reply Icon

            Re: "can Visual Studio not be used to create iOS apps" [?]

            Or, like many, many people, Apple just pisses him off?

            0 0 Reply
      2. James 47
        Reply Icon

        Visual Studio sucks

        Actually, VS is one of the best IDEs out there, the best Linux can offer is QTCreator which is now non-free for commercial use.

        10 2 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Re: Visual Studio sucks

          "the best Linux can offer is QTCreator"

          ... and yet somehow the Linux kernel devs manage to scrape by on a project that is rather large and complex:

          $ find /usr/src/linux/ -name "*.[ch]" | nl finds 44,444 files

          $ find /usr/src/linux/ -name "*.[ch]" -exec cat {} \; | nl spits out 17,032,797 lines

          Not very scientific ...

          0 0 Reply
          1. sabroni Silver badge
            Reply Icon

            Re: Not very scientific ...

            And doesn't mention which IDE they use. I asked about this recently on another thread and got very poor responses, none of which suggested a better IDE. So gerdesj, any idea what IDE they use and how it's better than VS?

            0 0 Reply
    4. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Are you saying you go through your code and remove all of the debug logging from your code instead of just having a config flag to switch it on or off at run time?

      Your comment makes you sound like you're not actually supporting any live software, hint, the option to switch debug logging on in a live system can be a life saver, it's not like you can attach a debugger and step through, and not everything is repeatable in different environments. Setting DEBUG=true in a config file and asking the user to retrace their steps can be enough to tell you exactly what is going on.

      51 3 Reply
      1. OliverJ
        Reply Icon

        The facility used is log.d. Hence my quotes. 'nuff said. And how "FUCK APPLE: Fail to add new user" is supposed to help debugging live code one or two years in the future, or when the dev has left the team, will remain your secret. I had to dig into code from someone who left the company based on such helpful "debug logs" more than once.

        2 1 Reply
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        The 70s and 80s are over, if you still need that kind of "debugging" believe me you're need to update your programming and debugging skills. Also, any application that has a "debug" switch somewhere you can easily turn on just risks to dump a lot of sensitive information. I've seen some happily writing passwords and so on to files.... which nobody then deleted.

        Anyway, remember there is a difference between "tracing" and "logging". And even with a live system you can use separate debug symbols and remote debugging to attach a running application and see what is doing and where it breaks - with far better inspection capabilities than a text log. Or analyze exception or crash dumps. Yes, it's a little more complex than opening a log with a text editor, but it usually points you at an issue much more quickly, once you learnt how to use the proper tools. But keep on with printf(), if it makes you feel better...

        2 23 Reply
        1. Dan 55 Silver badge
          Reply Icon

          Yes, you don't log passwords in the same way as you don't log "FUCK APPLE". Both are not good ways of logging. I think most people would agree with that.

          Now back to debugging, I bet you work at RBS if you compile a release build with debug symbols set and think having a live system or a thread in it grind to a halt while you step through it is in any way acceptable.

          You might claim you can get all possible errors all sorted out by the QA stage. When this doesn't happen because you can't set everything up to perfectly match the live system (e.g. scale), logging helps.

          5 3 Reply
          1. Anonymous Coward
            Reply Icon
            Anonymous Coward

            When you start "logging" that way, you will end to log also sensitive information. I already seen it.

            You can strip debug symbols for executables, and use them only when needed. You don't also need to step manually through code but in extreme conditions - and usually means your tests were utterly inefficient. But you can get error traces - and only error traces - with enough information to tell you what is happening without any need to log every other line. If you don't know how to implement more modern error tracing techniques than old "printf()", you will take ages to resolve issues on a live, critical system.

            0 4 Reply
            1. HmmmYes
              Reply Icon

              OK, A problem has occurred. Ive replaced the production executable with a debug version - all debug remain unstripped.

              I run the system up and - wow! - no problem.

              so why does the production version not work but the debug does?

              Again, a very naive and limited version on what can go wrong.

              No imagine we talking about a system running many 100s or 1000s of binaries. NOw you'll see why application logging becomes essential.

              2 0 Reply
              1. Displacement Activity
                Reply Icon

                > I run the system up and - wow! - no problem.

                > so why does the production version not work but the debug does?

                If the logging version works, and the production one doesn't, the answer is almost certainly that you have an issue with uninitialised data, or memory over-writes. You can (and should) find and fix all these on your dev system with Valgrind/Purify/etc. before it gets anywhere near production.

                0 0 Reply
            2. d3vy
              Reply Icon

              "When you start "logging" that way, you will end to log also sensitive information. I already seen it."

              Maybe YOU would... Some of us have more sense.

              3 0 Reply

          2. This post has been deleted by its author

        2. HmmmYes
          Reply Icon

          No. Not in this case. Not in a lot of cases.

          This application needs to run on a number of similar but not identical platforms.

          At a guess, its also working its way through a FSM against some sort of remote entity which may or may implement a protocol. Maybe that protocol has been 'optimised' by a 3rd party.

          There's a world of difference writing a single application that runs on one or two platforms, to writing a very large - think telecom switch - that has to interface to a large number of 3rd parties which may or may not implement a protocol correctly. Then there's different version of protocols.

          Large system live and die by their logging. Tools like Dtrace give you some help for free.

          7 0 Reply
          1. Anonymous Coward
            Reply Icon
            Anonymous Coward

            DTrace is exactly one of those dynamic tools you can use to debug code on a production system. It does work by "instrumenting" (patching) code at run-time by identifying and replacing some well known code sequences (you can also use static "probes", but DTrace can work without) in the kernel, user space libraries and application code.

            It will not depend on logs data defined at compile time, it will let you inspect exactly what you need at runtime.

            Anyway, user logging is not developer tracing. For example, a network admin will need logs only with information useful for his monitoring and troubleshooting of the systems. Bury them into a lot of data useless to him, and you'll have an unhappy admin.

            1 0 Reply
            1. Anonymous Coward
              Reply Icon
              Anonymous Coward

              "Bury them into a lot of data useless to him, and you'll have an unhappy admin."

              You mean like most Java stack dumps???

              5 0 Reply
        3. Anonymous Coward
          Reply Icon
          Anonymous Coward

          "with a live system you can use separate debug symbols and remote debugging to attach a running application"

          Well that clinches it.

          No fucking idea what your doing. If you have access to your live environment to do ANYTHING (Never mind attach a remote debugger) then your doing it wrong.

          Never mind the fact that the live system that you are debugging is potentially multi user and you dont want 1500 people all sitting waiting for you to read a line of code and press F10 because your remote debugger has paused execution of a thread on a live server.

          "'ve seen some happily writing passwords and so on to files.... which nobody then deleted."

          To be fair, thats not an issue with logging, thats people putting too much infotmation in the logs that they are writing. You should not write sensitive information out to a log, this does not mean that you should not write the log in the first place.

          Going back to the remote debugger - would you care to enlighten me as to how the whatsapp developers could remote debug the app on an end users phone?

          I'd probably report bugs and send logs, I'd certainly not let a third party access my phone to attach a debugger to it.

          5 1 Reply
      3. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "Are you saying you go through your code and remove all of the debug logging "

        No. I don't use that kind of outdated techniques dating back to an era when debugger, profilers and exceptions didn't exits at all. Yes, I did it too in BASIC many years ago, 150 PRINT "I'm here!!!". No need to do it today in production code.

        First, my code is written following a "defensive programming" approach to identify anomalous situations early - and raise proper exceptions when it happens, never log and go on, executing code in unsafe states that often can lead to exploitable vulnerabilities. Oh, and never catch an exception, log it, and then clear it without properly and wholly handling it.

        I'm much more confident thereby in the code I write, especially I also write tests to check it works as designed.

        Then I use exceptions properly to handle errors - creating for example dumps with stack traces, system state, etc. etc. Much more useful to reconstruct quickly what lead to an error than a text log with too few information. And you get a centralized way to report issues without littering the code with log calls and hardcoded strings (a good help to reverse engineers, believe me).

        Profilers will tell me what I need to inspect further.

        I use logs for what they are designed to - tell the end users their system is working as they configured it for, and report errors if they happen. Also, I use the system log facilities for that, because in a live system you'll be using monitoring systems which need to be able to spot errors in logs, and warn those in charge.

        6 8 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          pah....

          "On Error Resume Next"

          Compile

          Job's a good'un; it's Friday, pub o'clock after all ;-)

          3 0 Reply
        2. Doctor_Wibble
          Reply Icon
          Trollface

          > Yes, I did it too in BASIC many years ago, 150 PRINT "I'm here!!!"

          I really hope you didn't actually do such a shockingly amateurish thing, and that it's just shorthand for 'got here 1', 'got here 2'... like proper professionals do.

          Especially when trying to figure out why that 3000 line mega-program from C&VG we just slavishly typed in isn't working, before the grand revelation that the semicolon was actually a comma with a speck of dirt and 'thwack' 'ow' 'just run it' 'I told you it would be rubbish' etc.

          0 0 Reply
        3. Anonymous Coward
          Reply Icon
          Anonymous Coward

          @Anon

          "No. I don't use that kind of outdated techniques dating back to an era when debugger, profilers and exceptions didn't exits at all. Yes, I did it too in BASIC many years ago, 150 PRINT "I'm here!!!". No need to do it today in production code."

          You might as well have said "I just write my code without bugs to start with" that way we could have all skipped reading the rest and got the laughing at you over with that little bit sooner.

          "I use logs for what they are designed to - tell the end users their system is working as they configured it for, and report errors if they happen. Also, I use the system log facilities for that, because in a live system you'll be using monitoring systems which need to be able to spot errors in logs, and warn those in charge."

          I think that you have misunderstood what logging we are talking about here, this isnt a message that the user will see unless they go looking for it, its a file burred away somewhere ready to be sent to/inspected by the developers in the event of an error.

          Its all well and good saying that you write robust software and its all unit tested and goes through QA etc... NONE of that has any impact on the fact that logging what your application is doing at any given time is immensely useful, you might want to be able to go back and see what the app was doing at a given time last tuesday - maybe there were no errors, maybe you just want to know if user X was in there and called function Y (This isnt a great example, but you get the idea)

          4 0 Reply
      4. Wensleydale Cheese
        Reply Icon
        Thumb Up

        "Setting DEBUG=true in a config file and asking the user to retrace their steps can be enough to tell you exactly what is going on."

        Many years ago I discovered a similar debug mechanism lurking in the code I was given to fix as my first task in a new job.

        Whoosh! I managed to identify some bad data on file in less than an hour on a system I'd never seen before.

        This can be a seriously productive means of identifying problems.

        2 0 Reply
    5. Dan 55 Silver badge
      Reply Icon

      If there isn't logging your code up to a user-configurable level, you're probably in high school anyway.

      If a live system is going wrong there's no other way to do it apart from logs. No, you can't attach a debugger, it's a live system.

      9 2 Reply
    6. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: All that debugging logging

      Yeah I much prefer to go to customer site and install development tools and debug there. Getting some trace via email is for idiots.

      3 0 Reply
  2. Anonymous Coward
    Anonymous Coward

    Debug logging

    Just a thought, but does the Log.d method actually do anything in the released version?

    In a .NET application (and I appreciate this is different but am assuming the runtime environment is capable of JIT compilation), if Log.d doesn't actually do anything (e.g. if the code in that method is surrounded by a preprocessor if block), the compiler should optimise out all the calls. Much more efficient from a time perspective than adding and removing debug log lines as you need them, and to some extent they serve to document the code as well...?

    5 1 Reply
    1. deftelf
      Reply Icon

      Re: Debug logging

      Log.d() doesn't do any logging on a release build, but the code isn't stripped out of the package that is distributed. That's what happened here (despite all the comments on here by non-Android devs that don't know what they're talking about), the code has been decompiled to expose these calls but they don't actually write anywhere in the released package.

      3 0 Reply
      1. Wilseus
        Reply Icon

        Re: Debug logging

        In C, something like this has always been my approach:

        #if DEBUG==true

        # define DB printf

        #else

        # define DB

        #endif

        The use of which generates no code at all unless DEBUG is turned on. It's not rocket science.

        0 0 Reply
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Debug logging

        Is this code ever executed? It looks it has several issues. Just look at the first useless if(), the unconditional continue statement, the use of the i variables to access the array, the infinite loop in the catch, the second method that does nothing but logging despite its parameters...

        Looks like something forgotten there. No coverage tests?

        1 0 Reply
  3. saif

    Evidence of scrutiny is good

    The best thing about this is that someone else actually checked the code. Sort of validates the idea that source visibility can be used by third parties to find errors, vulnerabilities, and even entertainment.

    3 1 Reply
  4. Anonymous Coward
    Anonymous Coward

    The best thing about this is that someone else actually checked the code.

    Yes, but it would be a lot better if that person worked for WhatsApp, because this seems to suggest either a lack of code audit, or a worryingly juvenile attitude to something that is supposed to keep communication safe (well, not anymore, Facebook bought it :) ).

    1 0 Reply
  5. Anonymous Coward
    Anonymous Coward

    "I see Apple try to actively fuck with standard ways of doing things all the fucking time, like they want to see the world burn and cause headaches for companies/devs everywhere, like the lamest fucking Bond villain ever," writes user CanadianBadass.

    LOL. Integration iOS with a Linux backend is exactly easy because Apple are pretty good standards compliant with anything that has to communicate with others outside their own eco system.

    "Let alone the inability to compile code except on their machines, which greatly limits my ability to do CI, automation or anything else efficient except on their overpriced POS hardware."

    If you can't be bothered to buy a machine for the platform you're developing for (you know, to just test that things actually work as emulators are never perfect) than maybe you should not be developing for that platform.

    "As someone who has had to upload an app to the app store, I completely understand," writes user xantxant. "If their store process is indication, Apple hates developers and wants us to die, so 'Fuck Apple' is a completely rational response."

    I have some sympathy with that, especially if you want to go international or in different languages there is a learning curve involved, also because Apple tend to test and enforce their rules far more rigorously than Google. It is, however, not that much of a chore if you write following the guidelines instead of trying to force the code into compliance afterwards. I reckon WhatsApp must have been thrown back quite a few times because of their desire to access so much customer data (which has now turned out quite an accurate objection)..

    That said, collecting hate messages on anything and anyone is rather easy on the Web..

    3 6 Reply
    1. The Indomitable Gall
      Reply Icon

      " "Let alone the inability to compile code except on their machines, which greatly limits my ability to do CI, automation or anything else efficient except on their overpriced POS hardware."

      If you can't be bothered to buy a machine for the platform you're developing for (you know, to just test that things actually work as emulators are never perfect) than maybe you should not be developing for that platform. "

      The problem is you have to buy a Mac to develop for iOS. OS X is not iOS, a Mac is not an iOS device. The Mac has the best iOS emulator, but as you said, "emulators are never perfect".

      It's a massive frustration for a lot of would-be app developers that even experimenting with iOS development has initial costs in the region of a grand. (Well, there's the Mac Mini as the "cheap" option, but most folk skip that and go for one of the portables.)

      4 1 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        "It's a massive frustration for a lot of would-be app developers that even experimenting with iOS development has initial costs in the region of a grand. (Well, there's the Mac Mini as the "cheap" option, but most folk skip that and go for one of the portables.)"

        So, you've never heard of eBay then?

        2 0 Reply
  6. Natalie Gritpants

    So many dicks in this comment section

    All of them convinced they will never have to debug their code because they write it "correctly".

    13 0 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: So many dicks in this comment section

      "debugging code" != "printf() everywhere" - for any kind of "printf()".

      And there are ways to write sounder code than others. For example, look in the code the catch which logs the exception but let code continue as if nothing happened...

      1 3 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: So many dicks in this comment section

        Picking holes in other peoples code is generally a piece of piss. It doesn't prove anything without context but it does show a lack of maturity in the person picking holes.

        9 2 Reply
  7. sabroni Silver badge
    Unhappy

    What's with all the ACs going on about how cool they are

    Why hide your identity if you're so confident of your abilities?

    AC is for business sensitive posting. It's not really appropriate if all you have to say is "I code better than you" or "you're old fashioned".....

    Put a name to your posts or fuck off.

    14 2 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: What's with all the ACs going on about how cool they are

      Because I also do code reviews for a living and I don't want to offend anybody who could understand who I am and think their code is referenced in my comments.... like it looks you got offended by them.

      1 7 Reply
      1. d3vy
        Reply Icon

        Re: What's with all the ACs going on about how cool they are

        "Because I also do code reviews for a living"

        I have no words to adequately express how ridiculous this statement is in light of your previous comments.

        3 0 Reply
    2. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: What's with all the ACs going on about how cool they are

      AC is for business sensitive posting.

      According to whom? Maybe for you, but you cannot speak for all El Reg members.

      I always post as AC because I am not invested in maintaining an online persona/posting history, badges, and generally prefer anonymity.

      1 0 Reply
    3. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: What's with all the ACs going on about how cool they are

      Why hide your identity if you're so confident of your abilities?

      Because that way I can offer an opinion without distractions such as name - as a matter of fact, it will force you to better look at the argument, not at the person. Secondly, I am not hiding my identity, I am protecting it. Slight, but rather important difference. If you knew who I was you would understand, but that would create a somewhat circular problem :). Besides, having a name is no guarantee either as some change it almost every day..

      AC is for business sensitive posting.

      Really? Who put you in charge? AC is simply a decision of the poster not to pollute the debate with track record, badge or who they work for - whatever the reason is, it's their decision to post AC rather than with a handle, not yours. You don't get to vote on that. It's IMHO also more honest than pretending, for instance, you're Linus Torvalds when offering an opinion about kernel programming - AC's will at least not use a false magical cloak to amplify their argument.

      It's not really appropriate if all you have to say is "I code better than you" or "you're old fashioned".....

      Oh, it is. And I do. And you are. Joking aside, I'm actually with you on a "I'm better than you" post that lacks substantive arguments to back up such an assertion. I like facts, and the facts I like best are the ones that brook independent validation - side effect of the work I do. Work, I must add, which pretty much compels me to post AC :).

      Put a name to your posts or fuck off.

      No, and no. Annoying, isn't it?

      2 3 Reply
  8. Anonymous Coward
    Anonymous Coward

    Hehehehehe

    I once worked for a company selling cheap Chinese made Android media centres which had a nice boot screen showing the name of the build machine.... forget having to look in the source code, this thing booted up calling everyone a 'c**tbox'.

    So this is quite mild by comparison.

    Anon to protect the innocent...

    4 0 Reply

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like