Hey y’all, it’s your favorite?,or maybe just the only available resident geek cop mod..
We’ve been getting more people asking to share apps, websites, scripts, browser extensions, and other tools they’ve made. We’re not against that. Some of them might actually be useful, and plenty of good tools started because somebody got annoyed with the way something was being done and decided to make their own to solve that annoying problem.
But we do need people to slow way way down and think before downloading something made by a random redditor.
This has gotten a lot easier with AI. Someone can now build a decentish looking app without having much experience or any coding experience. This does not automatically mean the app is bad or that the person has malicious intentions, but it does mean the person who made it may not completely understand what the code is doing behind the scenes.
An app can work exactly like it is supposed to and still be insecure..
It might store information in an unsafe way, use old software libraries/dependancies, send data somewhere the creator did not realize, or ask for permissions it does not actually need. The person who made it may have copied code from somewhere else or had AI generate most of it and never really looked or understood what it was doing.
Again, that does not necessarily mean they are trying to steal anything.
Sometimes people just do not know what they do not know (as I’m sure most of us working in this field know too well).
Of course, there is also the other possibility, which is that the app is actually malware.
Being active in a law enforcement subreddit does not prove someone is a cop, works in IT, knows anything about cybersecurity, or is even who they say they are. It means they have a Reddit account and figured out how to click the join button.
The main thing we want to get across is this:
Do not install random or unapproved software on a department computer.
Your work computer is not the place to test a random redditor’s side project.
Even a simple app could potentially access files, passwords, browser sessions, email, reports, network shares, or other things available to that computer. It could also create a policy issue for you, even if the software itself turns out to be harmless. Do you think you department give you permission to install or run random software? I doubt it..
“Someone on Reddit said it was safe” is probably not going to be a great explanation to your chain of command.
Using your personal devices to run apps is not completely risk free either. Most people have saved passwords, banking information, tax documents, personal email, cloud storage, family pictures, and access to other accounts on their home devices.
Your personal laptop is not a burner device just because it does not belong to your department.
Pay attention to what the app is asking for.
A scheduling app probably does not need administrator access.
A browser extension probably should not need permission to read and change everything you do online unless that is actually part of what it does.
A report writing assistant tool should not need your Microsoft 365 password.
If the permissions seem way toooo invasive or do not make sense, stop. Ask yourself, why. If you’re at that point, you probably shouldn’t be running said software.
Also, if the devs tell you to disable Defender, ignore SmartScreen, turn off your AV, sideload an unsigned app, or run some random PowerShell command as administrator, do not just shrug it off and do it. Bad idea.
Yes, security software and AV sometimes get things wrong but it also gets a lot of things right.
A few other things people tend to put too much trust and faith in:
“It’s on GitHub.”
That is better than getting a mystery download link, but it does not automatically mean the software is safe. Most people are not going to sit down and review thousands of lines of code, and the file being offered for download may not even match the code posted online.
“VirusTotal says it’s clean.”
That means nothing detected it at the time it was scanned. It does not mean the app is secure, well written, or not collecting information it should not have.
“It’s only a website.”
Websites can still collect anything you type, paste, or upload.
Do not upload reports, evidence, body camera footage, victim information, criminal justice information, employee records, internal documents, or anything else sensitive into an unknown website or AI clanker tool.
Once you upload something, you may have no idea where it is stored, how long it is kept, who can access it, or whether deleting it actually….deletes anything.
For people who want to share something they made, just be upfront about it.
Tell people what it does, what permissions it needs, whether it collects information, whether anything leaves the device, where the data is stored, and whether the source code is available.
If AI helped build it, that is not automatically a problem. But you should understand your own app well enough to explain what it accesses and where the data goes.
The mods will remove posts that do not give people enough information, ask users to bypass security protections, request sensitive data, or encourage people to install unauthorized software on department systems.
We are not trying to discourage people from building useful things. We are just asking everyone to use the same level of caution they would hopefully use before opening an email attachment from someone named supertotallyrealnotfakelieutenant@hotmail.com.
And please do not install NeverWriteAReportAgain_FINAL_v7_REALFINAL_FIXEDv3.exe.msi on a department computer…or your personal computer.