Hacker News Reader

Comment by foobaw | Hacker News Reader

I've been in the OEM industry for years and can't believe this happened in production.

For something like texting/RCS, there are thousands of phones being tested thousands of time by thousands of people with multiple additional checkpoints (ODM, Google, Carriers). It's a core functionality so it's extremely tightly verified.

RCS was first implemented about three years ago for phones so it's shocking that this kind of bug happened now. I also worked on the initial infrastructure for this so I can't imagine how this bug was even introduced. My bet goes to it being a server-side issue, especially since it's carrier-specific, and not a software bug.

View on HN

This is the first time I'm hearing about RCS at all. I know SMS is ancient, but I had no idea it had been superceded like this. (Probably because I've never had a smartphone - they're a bit beyond my budget.)

I (very vaguely) know that SMS works on top of SS7. I just checked out https://en.wikipedia.org/wiki/Rich_Communication_Services, which was interesting but doesn't have that many technical details.

I'm very curious to understand how RCS works technically. I get the impression it can work over IP as well as carrier-integrated data transfer?

GSM's official specification document is what we used when we implemented everything. "Advanced Messaging" and "IP-based messaging" were some other ways we referenced the feature like you said. Carriers definitely have to support this themselves and set transfer limits, provide the web-view, etc...

What do you do? There are (were) wonderfully fast windows phones for for $20

Appreciate it hugely. It's actually the data costs that are prohibitive - I've only just started looking around, but my first quote is $39 for 2GB and 500 free minutes ($1/min after that) from Telstra, Australia's juggernaut.

I did recently think I critically needed to stay in touch (this is why I have the numbers above), but that requirement seems to have settled a little, which is why I'm less motivated to get on the merry-go-round of plan-hunting now. Chances are prepaid is probably what I'll end up doing ("yeah this is my number this week", here we come, lol).

What I _really_ want is an IoT/M2M contract, but I have no idea how to look for those :D

Oh - as for what I do, currently working on kickstarting that :) this sums up the difficulty FWIW: https://news.ycombinator.com/item?id=15004608#15005811 (I'm working on it, it's fine)

If it's possible to be a server side issue, then no phones are ever secure.

SMS and phone calls were never secure.

SMS and phone calls should never let the server see every file on your device, or every image

>SMS and phone calls should never let the server see every file on your device,

That may be the case but the bug could still be on the server side:

  Carol the Client: Hi Steve, will you send this photo to 111-1111?

  Steve the Server: Hi Carol, I've sent your photo to 555-5555

Unless you encrypt the data to your recipient's client-side held key, the opportunity for the server to err and data leak, persists.

That doesn't explain the case where all photos on the phone were silently sent to a contact.

Reply on news.ycombinator.com