DJI pulls drone app plugins that swiped too much user data
It's part of DJI's broader effort to make security a priority.
DJI's efforts to improve drone security go well beyond offering bug bounties and requiring updates. The company has rolled out updates to its Go and Go 4 mobile apps in order to pull add-ons that collect too much of your data. The main culprit is JPush, a third-party extension DJI implemented to send notifications when you finish uploading videos to the SkyPixel sharing service. It's supposed to help you move on to other tasks while your video goes to the cloud, but DJI has learned that it's collecting unnecessary info without asking, including the list of apps installed on Android devices. The company says it doesn't approve of this practice any more than you do, and it's creating its own status system as a replacement.
The company is also pulling two other plugins, jsPatch and Tinker, that let DJI deliver small updates without replacing an entire app. While DJI doesn't mention any instances of these add-ons swiping more data than necessary, the firm is yanking both to make sure that all app updates get a "thorough screening" before they hit your Android or iOS device. The drone maker is looking at other plugins in its Go apps, too, and promises to be cautious before incorporating more.
It's unusual for a company to announce that it's removing features, if temporarily in some cases. However, DJI has a strong incentive to scale things back. Questions over the security of its drones have led to lost business. What good would it do to keep the plugins if DJI didn't have the trust of its customers? Between this and the other security initiatives announced today, DJI has undoubtedly decided that it's worth a little short term pain to earn your long term respect.
