“Tencent QQ caught scraping all browser history on Windows”
twitter.com
twitter.com
> I just noticed that someone linked my previous tweet on HN. Sorry I have to delete it in case something come after me
https://twitter.com/CodeColorist/status/1350798973431283712?...
Edit: Internet Archive of tweet: https://web.archive.org/web/20210117115536/https://twitter.c...
https://i.imgur.com/rSOyTt7.jpg
It wants to know what you searched on e-commerce sites.
This is somewhat unsursprising, Tencent failed on e-commerce, it desperately needs these data to help with user profiling.
According to that post, they don't even upload the URLs that match, but just the fact that there was a match for one of three groups of keywords. Seems like a lot of effort for little information gain...
I immediately deleted it, who the hell does that? Even Google Drive asks for permission first. I guess that's what you trade for 1TB haha.
1. S.TAOBAO.COM/SEARCH?
2. LIST.TMALL.COM/SEARCH_PRODUCT.HTM?
3. (30, 0xDDA1029, 0x9E67F3BB, 0xB18ACC45, 0x597CF438): b'', # not yet decoded
4. SEARCH.JD.COM/SEARCH?
Keyword Group 1:
5. 古着 (kanji meaning old cloths)
6. VINTAGE
Keyword Group 2:
7. 融券 (margin trading-short)
8. 融资 (financing)
Keyword Group 3:
9. 炒股 (stock trading)
10. 股票 (stock)
[1]: https://archive.vn/c1ABO post id 229
`uland.taobao com/sem/tbsearch?`
Credit to lhprojects https://nbviewer.jupyter.org/github/lhprojects/blog/blob/mas...
I would be very careful.
So yes, if your antivirus allows you to deny QQ access to your browser history, it won't read your browser history. But most QQ users probably didn't do that, considering that it went undetected for so long.
these two statements are in no way equivalent.
"I just noticed that someone linked my previous tweet on HN. Sorry I have to delete it in case something come after me"
https://twitter.com/CodeColorist/status/1350798973431283712?...
Signed app distribution won't solve this problem.
Chrome hides this as legitimate value to users - when I type out an URL on my desktop, I will get auto complete for it and shared history on my phone and my laptop. It's a trade-off.
You can have signed apps and sandboxing without Apple being the sole arbiter of what you install. For example, Linux has multiple options available to solve this. Signed repos combined with SELinux, or flatpak, and snap all solve the same problem.
Just because something is a solution, it doesn't automatically make it good. I can _at the same time_say that it is problematic that people die in the traffic _and_ loathe banning cars altogether.
Letting Apple act as the internet court might help on some problems. But letting a commercial entity act as legislative, executive, and Judicial power in the software distribution realm is simply not a good solution.
It has nothing to do with signing.
Something like this doesn't happen, and would not be acceptable, on a desktop computer.
tracing and blocking QQ/TIM from reading browsing history.
Note: Valorant installs a kernel driver as part of the "anti-cheat" system; described by many as a rootkit: https://www.osnews.com/story/131665/riot-games-maker-of-leag...
Valorant's parent company is Tencent, the same company mentioned in this tweet.
This has been a major issue for decades across many countries, all of whom have been lobbying (for instance in the WTO) to crack down on Chinese IP theft, their use of non-Chinese citizens' data for censorship training purposes, etc
To be fair, some cool Chinese developers do have repos on GitHub. They’re not the majority though.
Edit: Hold on folks, I need to find source of this.
Edit2: I am pretty sure I was using Zhaodao.
Do you have a source for this? I tried signing up on Gitee (Chinese GitHub alternative), and it did not ask me to prove that I had WeChat or a phone number.
> some cool Chinese developers do have repos on GitHub
Mirroring their projects on GitHub might be fine, but given the current relationship between China and the US (where GitHub is hosted), Chinese developers would be better off hosting their main repo elsewhere.
Edit: I think I was most likely using Zhaodao.
That's not how the US Judiciary systems works. You can't ban dozen of apps based on "suspicious behaviour". You need to start an investigation , then you need to collect proofs , then based on those proofs prosecutor we'll be able to decide to sue or not , and ultimately a judge will decide to ban those apps or not.
It's why our western constitutional democracy are doomed to fail.
Our democracies move and react slower than authoritarian regime like China , Russia plus we have many economic interest with them. It's unlikely any politician would ban those apps .
Trump tried with Tik Tok, a judge blocked the order[0], and I agree with the justice. You can't block an app because you don't like it. You need some solid evidence to prosecute and stop a private a entity.
[0]https://www.wsj.com/articles/tiktok-download-ban-is-blocked-...
Quite a hyberbolic leap from not being able to arbitrarily ban foreign software to “democratic countries are doomed”. Weird
Well, in this case, Google would leave billions of dollars in revenue and hundreds of millions of users on the table. Not only would it hurt their bottomline, it would also hurt their products as they train on user data, which has quite strong network effects.
This is really a different scale than a local business. If you have that with a single owner, she/he might be content with what she has and choose not to expand further. Google, on the other hand, has multiple of layers of management which need to report to thousands of owners, quite a few of which expect constant growth. This is really not one person who can be content with the size; it's multiple people who get their salaries based on growth and report to thousands of investors, which, for the most part, care about increasing their shares value. Leaving so much money on the table just for the sake of it is a hard sell in this structure.
> This is not aimed personally at you
No offence taken :)
Twist it like that: China exported $125B worth of mobile phones. Cutting Google Play Store off would seriously harm Google's ability to sell anywhere
Remember, the world does not end with US, and Western Europe
Facebook does some shady shit too. Like stealing all your phone contacts list, without your permission. This is also a terrible invasion of your privacy.
By your logic, since Facebook is an American company, then by extension, this shitty behavior is reflective of all of America.
Besides, who uses QQ on their computers anymore?
Without informed consent maybe, but without permission? I doubt it. Please enlighten me on how the facebook app is able to bypass the android/ios sandbox.
>By your logic, since Facebook is an American company, then by extension, this shitty behavior is reflective of all of America.
If facebook has a mandatory CCP err- DNC/RNC member on its board, I'd be inclined to agree with that.
There's no private Chinese companies, only CCP subsidiaries. Comparisons with e.g. Facebook are moot.
At this point, comments like this are plain disingenuous, or purposefully misleading.
Apparently, your company and your industry, must be important enough that the government will send you a Top Secret document, forcing you to comply, and also forcing you to maintain the secrecy of its existence, and to even deceive your customers of ever enacting its mandates.
This sounds to me like the exact same thing as your argument here. That there are no private American companies, only American subsidiaries.
And if you’re just a small private company that runs a noodle restaurant, then I highly doubt that the CCP really gives a damn about your company. What are they going to monitor? What magic ingredients you put into your soup?
A case by case basis, limited in reach, for only a small subset of companies, and overseen by the Justice Department.
In no way comparable to the Chinese law, which mandates every bit of every company to be surrendered to the state, on demand, without questions.
And the recent Ma/Ali affair should tell you the vast difference in state reach.
That there are no private American companies, only American subsidiaries.
Again, absurd comparison because the above.
And if you’re just a small private company that runs a noodle restaurant, then I highly doubt that the CCP really gives a damn about your company. What are they going to monitor? What magic ingredients you put into your soup?
It doesn't matter. See above.
They are not trying to eliminate the system, when they are the elite of the system.
Their funding perpetuates the American government itself.
Don’t you get it?
yeah. that's going to be more-and-more commonplace, too.
I don't know why it's suddenly fashionable/allowable to touch ring 0 as installed software, but here we are.
the irony of the whole thing is that while game-devs rootkit clients in order to pull in more marketing data/telemetry/whatever else the ToS allows them to steal, the real game cheaters out there are using extremely cheap CotS parts to create artificial man-in-the-middle clients that they can manipulate instead, with the host PC totally oblivious that the computer that's plugged into it as a HID is the one cheating.
I've said this thousands of times, I'll use this opportunity to say it again : the only method available to routinely and reliably find game-cheaters is through constant statistical analysis of the players performance/inventory/score versus the environment they're in.
The days of tuning such a system will be filled with false-positives, but it's the only way to accomplish anything near comprehensive anti-cheat.
Need to get a few bucks for the project? Call that statistical analysis machine learning and say that you're going to provide it as a service. Sit back and watch the money flow in.