Hacker News Reader

Comment by creato | Hacker News Reader

I don't doubt at all that TikTok is super shady, but

> I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now.

Just sounds like "my dog at my homework".

View on HN

Could also be that they never expected this to blow up. If they were just doing it for fun, why bother taking backups? It seemed like when this first started making the rounds a few weeks ago, they were just talking about it in passing, but people kept asking questions and it became A Thing(tm)...but that may not have been the plan at the start.

Because the assertions being made are rather more serious?

In this case it’s even more important to double check the findings.

It’s easy to misremember something, use shortcuts or assume too much when doing a hobby research project.

This is now more important than a random side project and it should be treated accordingly.

Just to make it clear, I’m not accusing anyone and I don’t suspect bad intentions; I’d just like to see as many details as possible.

> If they were just doing it for fun

They claim they weren't:

> tl;dr; I'm a nerd who figures out how apps work for a job.

Which makes the claims that he "lost the data" difficult to believe.

How does being a reverse engineer correlate with making backups of a hobby project which seemed to had outliven it's usefullness?

especially after claiming "There's also a few snippets of code on the Android version that allows for the downloading of a remote zip file, unzipping it, and executing said binary."

I checked quickly tiktok apk, but couldn't find the relevant part.

Most possibly, he is mixing some bridging functions which are mapping functions or resources from dex files. (such as https://github.com/alibaba/ARouter, which I suspect tiktok uses)

such as:

@Route(path = "/test/activity") public class YourActivity extend Activity { ... }

Doesn't android block you from running executables on your home directory now?

https://github.com/termux/termux-packages/wiki/Termux-and-An...

This speculation has as much weight as me putting forward the idea that the motherboard failure was an attack by CCP; possible but no evidence.

My 2013 MacBook Pro Retina recently died too, but anything worth keeping or working on was stored in free-tier Dropbox, which has multi version history too.

And I'm just a dumb boiler-maker / welder.

It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.

To be honest - I know I should - but I don't either.

Lots of people with technical clue's are also lazy as fuck about doing uninteresting work like setting up proper backups. Also somewhat paranoid about putting backups on other peoples infrastructure like dropbox (especially unencrypted).

Then use cryptomator. https://cryptomator.org/

Overconfidence. We somehow cling to this absurd notion that we're capable enough to perform an emergency recovery if necessary. Never mind that we've already experienced the difficulty of losing data one way or another, the delusion yet persists.

I just wish affordable tape drives never disappeared.

Can confirm. I have a server in my basement with 10TB+ of storage, sitting mostly empty, and I still don't have backups configured. Screwing with servers is fun and interesting, but configuring backups isn't.

It's not that I don't want to be good at backing up my files, it's that the ADHD makes it very difficult. Thinking about backing up my files is so incredibly boring that I end up getting about 2% through it before I inevitably find something more stimulating to do.

I have BackBlaze running continuously. You can do similar with Tarsnap.

I just don't understand this POV at all, I mean it's like two seconds of work with systems like crash plan and other automation tools. You keep everything in one master folder called /myprojects, then point the automated back up system at the directory and done. I have everything in there from blender projects, to code, to sheet music transcriptions.

Just order a pizza or a call-bride; you must have something else except a _single computer_ to do. Read a book; switch over to either of the other 16 computers and or screens; it's just a suggestion. Everyone needs backups; two copies are none; three copies are one. doesn't matter what 'diagnosis' you have; it's still the same truth.

Setting up proper backups for my systems has been on my list for like 25 years at this point... A few months ago I found the backup I had set up hadn't run in 18 months (luckily, before it was needed).

I don't bother with backups of anything except a clean, freshly installed OS and my laptop immediately after purchase (I only bother with these mainly because Microsoft expired my MSDNAA keys, preventing reactivations when I was still in college, and I don't trust them not to do it again). Anything important is stored in cloud storage accounts, yes, but to me, mp3 rips of my CD music connection aren't important; neither are saved games, data from class assignments 10 years ago (I have printouts and final CD presentation), etc. If my computer died, I'd be out quite a bit of data I, personally, simply don't care about--including signing keys for several software repositories, multiple versions of compiled software used for creating delta updates, and other things that people other than myself might care about. I would have a ton of work to do to regain most of this data (ripping CDs, redownloading data, cloning and building software) but most of this data simply takes up too much space to keep backed up.

I will say this: box.net's webdav support is quite useful if you want cloud storage without a client like Dropbox, OneDrive, etc. I have having a background process constantly running just so I can keep up to date files that never change, and that I either don't need locally (backups) or are too large to want multiple copies of (CD images), or get locked/constantly modified (browser profile).

The default on a Mac is to back up most of your home folder stuff in iCloud though.

I use a free dropbox for things I think are worth keeping too, but that doesn't include random code and explorations. Those usually go into a local folder and get upgraded to a git repo if appropriate.

Most of the stuff I produce is random garbage that isn't worth keeping. There's a good chance that this guy didn't think he had anything particularly interesting or worth keeping. Once you feel you understand how the app works, you don't really need the work you put into figuring it out anymore.

>My 2013 MacBook Pro Retina recently died too, but anything worth keeping or working on was stored in free-tier Dropbox, which has multi version history too.

Except Dropbox has stopped supporting encrypted linux filesystems, and Box doesn't support Linux.

>It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.

For most technical people I know, having data on an unencrypted disk is unacceptable. They wouldn't accept a scenario where a thief steals their laptop and simply has access to all their files. They wouldn't accept that risk just because a convenient "backup" service suddenly stopped support. They'll simply back data up another way.

I don't know what the lay of the land is for Mac/Windows users.

As I say, these services are as useful as the services they replaced 15 years ago from my perspective.

Since when is MacOS using encrypted linux filesystems?

>Since when is MacOS using encrypted linux filesystems?

I fail to see where in my comment was anything related to "MacOS using encrypted linux filesystems" which, as of itself as a sentence, is confusing.

My comment's parent was explaining that anything worth keeping was worth backing up, and how easy it was to set up back-up even for someone with the commenter's skill level, using services like Dropbox.

My comment was explaining that certain users who have encrypted filesystems on Linux cannot use Dropbox, for Dropbox stopped supporting them around November 2018, which makes Dropbox unusable for these users who have to come up with back-up schemes excluding Dropbox or Box.

You quote [..]My 2013 MacBook Pro Retina recently died[..] on which you answer something with Linux. The TikTok-Guy was using a Macbook too. So what relation have dead Macbooks with whatever state has dropbox under linux? Nobody here talked about linux except you. Your comment is just very random.

BTW Dropbox works fine under linux, just not in all setups.

It happens all the time. There’s a reason data recovery companies exist.

I'm a software engineer, my work is done on work VMs, all my personal projects (coding and music) are done locally and not backed up. I occasionally copy my entire SSD over to a large HDD, but haven't done it for a couple of years. It's entirely plausible.

You're a software engineer that doesn't use github or even bitbucket to store your personal project code? Not even a googledrive, dropbox, box.net sync services?

I'm a bit at a loss for words to be honest.

Larry Wall said one of the virtues of a programmer was laziness, a really great lazy programmer would set up all the backups needed to make sure they would never have to do all the agonizing work if something went wrong, but just a middling virtuous programmer might be too lazy to set up all those failsafes especially if they were just doing a project for personal reasons, then if things go wrong they can just decide not to do the work needed to recoup things afterwards - because of laziness.

> anything worth keeping or working on was stored in free-tier Dropbox

That's great that you have 5GB (or less) of backup-worthy data.

For anyone else like you, that's the simple and happy solution that solves the problem well enough, and you're done.

What about if you have more than 5GB? What about if you have privacy concerns? What if your offsite backup is an offline backup and you can't access it due to a pandemic restricting access and travel?

All of the above impacted me and my ability to keep my backups going, and I've had to think about how to rebuild my backup strategy, as I've lost access to the remote site where my offline backup disks are stored.

Doing small backups is easy if you just want another copy somewhere else.

Doing bigger backups on a long term sustainable basis for large amounts of data with privacy requirements is less easy.

Anyway, you deserve a cookie for having done a backup at all. You're doing better than many.

Definitely get what you're saying, but knowing things unfortunately doesn't mean putting that knowledge into use.

I don't know if the guy whose dog ate his homework actually did the homework.

But I know that as a system administrator/security analyst I've had to push back HARD against some really stupid the things the development team wanted to do. And I'm sure the development team thought I was stupid for requiring things like auditable artifacts, limited permissions for developers, and daily backups. They wanted to push out code as quickly and easily as possible.

Knowing tech doesn't necessarily mean adhering to the platonic ideal of 'computer best practices.' This is actually the root cause of most security breaches.

...plus, the family pictures you had on your personal laptop are probably worth a lot more than a lot of the code out there that isn't being backed up. ;)

it's a problem if it is true

Yeah it really does

Source: dude trust me

It's a smoking gun, and there's a lot of people that have the ability to replicate the "study" and present their findings. That's the scientific method; don't trust the findings? Do your own investigation.

It is not "smoking gun", it is not scientific, it is not even "study". This is more likely screaming "fire!" in theatre.

Also what you suggested is not symmetric, let me explain:

- There is a claim tiktok is downloading some zip file, extracting and executing.

making this claim is almost free, for me to claim otherwise, requires to reverse engineer all the app, then check 100s of possibilities to execute code in android app.

For example I took a quick look, and couldn't find anything related to this claim.

Also I checked reports from some "security" companies, there is nothing concrete there too. Mostly they talk about some SDK from appsflyer, which is used by a lot of apps, getting a lot of data, including IMSI etc (which is a US company btw)

But if you still ask me if it is running downloaded code, I cannot say 100% certain "no".

I believe claims should need proof, not the other way around.

Erg.... he write this and sounds a very stupid lie, but I wish that be true. TikTok is so annoying, having motivation to people use it less is better.

Doesn't even matter if it's a lie or not. It's 2020, if you fail to back up your stuff and it gets deleted, then it never existed and you're a liar if you say it did.

Reply on news.ycombinator.com