Precisely. Who would have predicted that Twitter would have been used to organize people in a meaningful way during the Arab Spring?
The overthrow of tyrannical regimes is a noble cause that a startup would almost certainly never been able to focus on as a solution to a big picture problem.
From an interview of Nathan Myhrvold on Fareed Zakaria:
Zakaria: How worried are you that the United States is no longer going to be the place that invents the future?
Myhrvold: I'm very worried. Current course and speed --- we're very good at inventing, uh, but we're also undermining our ability to do that in lots of ways.
I'm not embedding account credentials for Flurry and UA in my app. I embedding app keys and while those don't allow someone to take over my account they could certainly wreak havoc with push notifications.
I think this happens all_the_time. Amazon has a solution for managing their access credentials that I admittedly wasn't using, but how many vendors do not?
If you're using a web services API from a 3rd party that requires developer authentication keys you may be storing those keys in the code because there's not a great alternative.
They clearly say that they've detected my access credentials in the app. There's no way to associate my credentials to my app without downloading the app first and inspecting it.
For instance Atmos doesn't have public buckets, DNS names for buckets, named keys implemented like S3, regions, etc.
But it does have features that S3 doesn't have like byte range updates, erasure coding, etc.