Hacker News Reader

Comment by Zhenya | Hacker News Reader

US Government app on my personal device that's meant to move data?

No thanks.

Here are the permissions for the Android App (including location, storage access, and starting on boot)

  -Photos/Media/Files
   --read the contents of your USB storage
   --modify or delete the contents of your USB storage
   
  -Wi-Fi connection information
   --view Wi-Fi connections
  
  -Phone
   --read phone status and identity
   --Device ID & call information
   --read phone status and identity
  
  -Location
   --precise location (GPS and network-based)
   --approximate location (network-based)
  
  -Storage
   --read the contents of your USB storage
   --modify or delete the contents of your USB storage
  
  -Other
   --run at startup
   --full network access
   --prevent device from sleeping
   --view network connections

View on HN

Isn't that's what's required?

Read/modify USB storage = write bandwidth logs, read them later for graphing

View wifi connections = track bandwidth per network

Phone status identity = track phones with a unique id

Location = track location to help find the best/worst physical locations for network.

Full network access = send/receive packets

Prevent sleeping = accurate benchmark numbers

View network connections = track bandwidth per network.

Not an american, but I would not install a government application on my device unless it was opensourced (happened in my home country with our covid tracker).

And about the permissions:

1. There is plenty of internal sandbox space for logs (even on low end devices) unless no care is taken in trimming those logs, so don't see need for this.

2. Probably due to location detection, but could lead to some scary mass data analysis (Google has been working on mapping the insides of buildings using triangulation of wifi singals from Android devices; source: ADB podcast)

3. This shouldn't be done, and has been adviced against for years. The device should register for an id on a FCC controlled server.

4. Makes sense for what they are doing.

5. Comes out of the box on Android since a few years ago

6. Makes no sense. No need to keep the device from sleeping to do the analysis.

7. Detecting bandwidth usage and capabilities is what the app is supposed to do.

6: without this you can turn off the display and the app will either perform much worse or killed.

As an Android dev my self I assure you there is no need for that permission, unless they are doing real time processing all the time (rather than batched processing at scheduled intervals).

Which if they do, I sure hope they explain that to their users, as that will have a serious impact on their devices.

I honestly am wondering why this comment is being downvoted.

There are ample ways of performing background processing on the bandwidth data, and scheduling background tasks when the wifi information changes, that do not require the device to be permanently turned on (which would have a drastic effect on the battery life, and potentially screen burns).

Just downloaded the app. The reason for the "keep awake/do stuff in the background" permission is because the app has a "perform regular tests on a schedule" feature. In fact this app has a good few features that seem mildly unnnecessary just for collecting broadband speed data for the government. Seems they wanted to provide something that was useful to the user as well

So? Cancel the bandwidth test if the screen turns off.

There is no reason this app should NOT be opensourced. They should be defaulting to open per Play 13 of the US Digital Service handbook > https://playbook.cio.gov/#play13.

Run at startup?

Test your internet speed by seeing how fast you can download government malware and upload your personal data. It's so innovative!

My god, they’re disrupting disruption itself!

This is something I really don't understand...

You really trust private people over Government?

Why?

Moderately so, yes.

Why not? It seems obvious to me why a private entity is more trustworthy than a government with absolute monopoly on violence.

Private people can't put me in jail, man. That's good enough.

sure... people can only scam you, or beat you, or rape you, or kill you... or worse.

About the jail, it's not that we live in a "banana republic" or in a dictatorship. You have right to a fair trial.

I don't know where you live, but even though yes, such a right exists, it doesn't mean you shouldn't fear the government or its actions.

US is extremely bad about this, but most western countries have this problem - let's say that you get accused of something(unfairly). In most western countries(with some exceptions) media can immediately print "_ZeD_ has been arrested on suspicion of murder!". You are usually arrested and kept until trial if the accusation is strong enough. In the meantime, you lose your job. You lose your friends and family support, except for the select few who actually believe your innocence. Your neighbours immediately know they live next to a murderer(even though nothing has been proven yet). And yes, in some countries(US....) you can be waiting a year for trial. Then, the trial is meant to be "fair", but surprise, it's a jury trial - the very opposite of fair, it's basically 12 random people deciding whether you should go to prison or not. 12 people who have spent the last year watching the news explaining how guilty you are and how the local police department is certain they "have the right guy". But sure, you got your "fair trial".

But let's say you win. You are cleared of all charges, and are free to go. The government will not automatically reimburse you for the time you spent in jail(or some very nominal amount), your old employer is not required to give you your job back, and there will forever be people around you who secretly think you are actually guilty and just managed to escape justice.

Or, you could just not trust the government and never ever put yourself in a situation which increases any chances of being accused of anything, fairly or not. The government has infinite amount of money and time to make your life miserable if someone is dedicated enough. They can make your life absolute hell or basically put you in a never ending loop of trials, which even if you keep winning, they can just bring more on, while your life is ruined.

A private corporation can also make your life hell, but the only difference here is that at the very least, they would have to have a financial reason to do so. The government doesn't need that reason, all you need is one career prosecutor who thinks they can get a nice reputation by making an example of you.

And the funny thing is, I generally trust our justice system(here in UK at least). I trust the police, I trust the court system. And yet I would never ever willingly give the government any information that is not absolutely 100% required by law for some essential function. Nuh uh. Nope.

The government does need an incentive to do something. It may still be financial… it may also be political. However, corporations are not immune from either of those incentives either.

It’s true that the consequences are different but it seems like different doesn’t necessarily mean worse.

Giving information out to anyone that doesn’t absolutely need it seems the best policy here. I see no reason to specifically target the/a government.

OTOH, broadband connectivity in the US is notoriously spotty and monopolized. Getting bandwidth data and visibility into this is the first step in potentially fixing the problem.

People can't beat me, rape me, or kill me by stealing my data. The gov can (and often will) jail me if the data it's stolen is stuff it doesn't like. Like if I happen to be buying shrooms from a friend who grew them. No thanks.

and if both are caught and two different trials are set - most juries, most judges, prosecutors are more likely to believe an operative of the state vs you.. as compared to random citizen vs same. In many cases, laws of qualified immunity takes care of it for them regardless of what 'truth' is discerned from he said she said.

It was only just recently they finally made it not-legal for NYPD to rape people they detain. I've got several saved articles showing many people who have suffered such treatment - you don't see that many with non-state folks.

similar with beating, killing etc.

I understand this varies a bit on which town or city you may be in across the states, however in most places the feds still help the men in blue take your cash at gun point with further threats of violence, loss of freedom and more.. and if you want your money back you can't get someone to arrest them and prosecute them - you have to hire counsel and go to court against state to try to prove your money innocent.

About the non-banana - fair trial - sure it's a right, and I am glad that we have it. However most people will not be able afford a fair trial in the US.

This is one reason so many cases are turned into plea-bargains. Many people can not afford to take days off work and pay for parking at the courthouse, much less a competent lawyer that would be affordable for a 'fair trial'.

Robert Kraft was able to afford the legal team for a truly 'fair trial' and was able to essentially put the state on trial for their actions, which got his handjob dismissed - but most people don't have that kind of money to spend and instead get railroaded by the state at all levels doj.

And if you are super rich you still have to contend with bad PR through the news when dealing with the state's people with guns - which can affect jobs, family, friends - even if you are innocent - even if you afford you days in court and get out of jail proven so.

fair trials are more fair for those people who are paid to be there opposed to those who are paying imho - ymmv.

Private orgs are merely greedy. The government is malevolent in dimensions you didn’t even know existed.

Absolutely. I'm in the UK and our government mandates all ISPs to store your browsing history for a year. Many government agencies(including.....food standards agency??) can access this data without a warrant.

So knowing this, I use a VPN to mask what I'm doing from my ISP. Yes, that means that now the VPN provider has my entire browsing history - this is still vastly preferable outcome to the government having free and warantless access to my browsing history.

What reason do I have to trust the government? They have a long history of spying, abusing human rights, corruption, and ignoring the populace.

When interacting with a rando, there is a pretty good chance they are a "good person". They are polite and not trying to harm me in any way.

When interacting with the government, there is a very high chance I am dealing with a "bad" person. The government is filled with corrupt, selfish people who have a long history of harming others.

Its a simple risk calculation. I'm going to minimize my exposure to an entity that can jail, kill, steal from, or otherwise harm me with impunity.

>They have a long history of spying, abusing human rights, corruption, and ignoring the populace.

All of these things are even more true of private firms.

>When interacting with the government, there is a very high chance I am dealing with a "bad" person. The government is filled with corrupt, selfish people who have a long history of harming others.

You're buying into conservative propaganda. Government is made up of people in exactly the same way a private firm is. The main difference is that I don't get to vote on what Zuckerberg does with my information.

If I don't trust a private organisation, I can use another one, set up my own, or supply them with pseudo-true information and rotate between providers periodically. I can select private VPN providers on the basis of say, independent audits and the history of communicating well-received patches into open source code. I can pick and choose what I want and, because most of the time the item in question is electronic in nature, change it without difficulty. I know that the company in question will be making a profit out of me --- the question is "how much" and "can I afford them to".

It's much harder to do any of those things with the government. I'm an academic, and I've just been appointed as an associate professor in Denmark. I've noticed that almost all Danes trust their government to do the right thing, and look out for them. As a Brit, this is complete anathema to the way I think --- I wouldn't trust the local council to organise a car park, let alone anything actually complicated.

I have a deep-seated and innate distrust of the intelligence services, a skepticism of the police (I was beaten up repeatedly by someone who is now a policeman for being a nerd while at school!), and dislike having a government gateway ID in the UK for tax reasons. There is no way in hell I am downloading a government-produced app in the UK onto my actual phone without a sandbox or some sort of randomising, GPS-blocked VM. Literally none. If I can't change what they do, and I use another method of communication -- like letters, in the post -- and join the hoards of people who don't. Like many other HN posters, I've used a VPN since before the Snooper's Charter came into force, and it positively has improved my life.

Were I in America, I wouldn't download this app with these permissions.

> If I don't trust a private organisation, I can use another one, set up my own, or supply them with pseudo-true information and rotate between providers periodically.

This is not really an answer to the question since in this situation you can do that here too, this app from the govt is t the only solution, there are many Speedtest options out there. Your argument seems to be about govt monopolies on services which is I guess a straw man?

Consequences.

The consequences for being a bad-actor are generally worse for a private individual or private organization.

Organizations have reputation concerns, individuals have legal and personal concerns.

The gov't? Not so much. The NSA, institutionalized spying, slow transition to a police-state... I don't get the feeling that these are much cause for reputational concern at the federal level.

> The consequences for being a bad-actor are generally worse for a private individual or private organization.

I don't think it's this simple — for example, what consequences have Comcast, Verizon, Facebook, etc. had for stifling competition or reselling customer data? It seems to come back to how well the political process works in all of those cases.

Comcast seems like a good counter example here. They don’t have a great reputation and get away with quite a bit historically.

I don't trust either but at least in situations like this, the incentives for me and the private person/company are aligned. I want a quality product, they want me to be happy with the product so I will tell other people about it and they will sell more products or get more downloads. A government organization doesn't have those incentives, their 'success' is not reliant on a quality product. They don't really care is anyone downloads this app. Someone at the FCC is already taking credit for this app being available even if no one uses it.

The only incentives government organizations have is to spend money. In fact if a government organization is bad at its job and spends all of its money, it can usually go to Congress and get more money. The sole exercise of most employees in the upper levels of government organizations is to increase their budgets for next year.

If you really want to try to understand this way of thinking, I recommend "Anatomy of the State" by Murray Rothbard. You can get a free eBook here: https://mises.org/library/anatomy-state

Everyone here cries about shitty ISPs in America. This is obviously a tool to police shitty American ISPs isn't it? You need data first.

It's why 3rd party speed tests and people saying "internet is too slow" doesn't cut it.

https://www.fcc.gov/general/measuring-mobile-broadband-metho...

Some of those permissions don’t exist on the iOS version (and some aren’t even permissions available on the platform?) which may indicate that Android perms are misconfigured.

GPS is a required permission for android in recent versions to check APs and do Wi-Fi network scanning

Pretty gnarly. I'm going to ask the FCC about this.

Reply on news.ycombinator.com