AAD Professional Ethics & Standards 3 — Questions and Answers
Question 1: You discover a critical security vulnerability in a popular third-party Android library your app depends on. What is the ethical course of action?
- Exploit the vulnerability to gain competitive advantage
- Ignore it since it is the library author's responsibility to find it
- Privately disclose the vulnerability to the maintainer and allow reasonable time to patch before any public disclosure (Correct answer)
- Immediately post full vulnerability details on social media to warn the community
Correct answer: Privately disclose the vulnerability to the maintainer and allow reasonable time to patch before any public disclosure
Responsible disclosure gives maintainers time to patch the issue before attackers can exploit public knowledge of the vulnerability.
Question 2: Your Android app bundles an open-source library licensed under GPL v2. What legal and ethical obligation does this create?
- No obligations; open-source code can be used freely in any commercial app
- You must pay a licensing fee to the original authors
- You may be required to release your app's source code under a GPL-compatible license (Correct answer)
- You must credit the authors only in your Play Store listing
Correct answer: You may be required to release your app's source code under a GPL-compatible license
The GPL is a copyleft license that typically requires derivative works to also be distributed under the GPL.
Question 3: Which open-source license allows you to include a library in a closed-source commercial Android app without sharing your source code?
- GPL v3
- AGPL v3
- MIT License (Correct answer)
- GPL v2
Correct answer: MIT License
The MIT License is a permissive license that imposes no requirement to open-source your own code, making it compatible with proprietary apps.
Question 4: A security researcher contacts you to report a vulnerability in your published Android app. What is the industry-standard ethical response?
- Threaten legal action for unauthorized testing of your app
- Acknowledge the report, fix the issue promptly, and credit the researcher with their consent (Correct answer)
- Ignore the report unless the researcher can prove active exploitation
- Demand full proof-of-concept code before you will engage
Correct answer: Acknowledge the report, fix the issue promptly, and credit the researcher with their consent
A professional bug bounty culture encourages researchers to report responsibly, which improves security for all users.
Question 5: When storing sensitive authentication tokens in an Android app, which approach is most secure and ethical?
- Store in SharedPreferences with MODE_PRIVATE
- Store in a plaintext file on external storage for easy debugging
- Use the Android Keystore System to protect cryptographic keys (Correct answer)
- Encode credentials in Base64 and hardcode them in the app's source
Correct answer: Use the Android Keystore System to protect cryptographic keys
The Android Keystore System stores keys in secure hardware, preventing extraction even if the device is compromised.
Question 6: What does 'responsible disclosure' mean in the context of a discovered Android platform vulnerability?
- Publishing full exploit details immediately to maximize pressure on Google to fix it
- Keeping the vulnerability secret to use as a zero-day for profit
- Privately notifying the vendor and allowing a standard window (e.g., 90 days) to patch before going public (Correct answer)
- Reporting only to government agencies and never to the public
Correct answer: Privately notifying the vendor and allowing a standard window (e.g., 90 days) to patch before going public
Responsible disclosure balances the public's right to know with the vendor's need for time to develop and deploy a fix.
Question 7: Which action constitutes a violation of open-source licensing ethics when distributing an Android app?
- Including MIT-licensed libraries without modification
- Listing open-source dependencies in the app's About screen
- Stripping copyright notices from Apache 2.0-licensed source code before bundling it (Correct answer)
- Using open-source libraries in a free, non-commercial educational app
Correct answer: Stripping copyright notices from Apache 2.0-licensed source code before bundling it
Apache 2.0 requires preservation of copyright notices and attribution; removing them is both unethical and a license violation.
AAD Professional Ethics & Standards 3
You discover a critical security vulnerability in a popular third-party Android library your app depends on.
What is the ethical course of action?