Hacker News Reader

Comment by stonekyx | Hacker News Reader

> Apparently Apple is doing the same.

Just curious, where did you find this?

Everyone operates an AGPS service these days. Without it, you'd have to wait at least 12.5 minutes from a fully cold start (and likely, if you missed a data packet, double or triple that) until the GPS receiver has all the almanac data [1].

[1] https://en.wikipedia.org/wiki/GPS_signals#Almanac

In my old Nokia N95, the AGPS data was downloaded when starting the GPS app.

No need to require a constant background download.

this.

I may actually use gps once or twice a week only, disable geolocalisation when it is possible on all apps I am using.

There is no justifiable reason to say gps is not possible without this. Besides you should be able to decide you don't mind waiting 15 minutes to get full gps service.

Also there's not really any good justification for the amount of data sent with the AGPS request. It can be a super plain HTTPS request with nothing else, instead of sending basically all of the tracking data from the device, including from what I can tell the IMEI which google doesn't even let app developers access anymore.

There is no private data in the request. The request is HTTP and authors could have analyzed them and discovered there is nothing in them. Instead, they published a list of things that Qualcomm privacy policy could include.

Do you have an actual copy of a example request (with all headers) from an manufacturer's ROM? There's a lot of discussion but no-one has actually posted the full HTTP request, but there is a lot of stuff which indicates there might be a lot more information in the request on official ROMs (especially those using qualcomm's daemon). I know grapheneOS keeps it to the bare minimum required.

The response post I was reading (and got posted here) didn't include any details. I can't tell if they actually looked at the response or were depending on someone else. But that is better than the original article that didn't even look.

Why would you expect any private data to be sent when requesting static file? That would slow down both the client and server.

I don't know why they would do it, apart from the obvious that it allows some tracking. Here's some more detail I managed to find on it (from /e/OS development): https://gitlab.e.foundation/e/backlog/-/issues/5765 . At least it seems the IMEI is not included (at least in this specific example), but a serial number and a bunch of other information about the phone is.

I might be wrong; it was merely speculated in the article due to the fact that Qualcomm chips are used also in Apple smartphones. An audit would be needed.

> Qualcomm chips are used also in Apple smartphones

The main SoC definitely isn’t, Apple design their own SoCs, are you talking about some other chip?

5G modem.

I thought it might be something like that, but in this case isn’t it the main SOC doing it?

The article authors continuously conflate the SoC with the OS distro.

it’s almost certainly part of the distro since they claim you can block it. If it was the chipset, you wouldn’t be able to.

iPhone involves a lot of telemetry which Apple sends it to itself. We don’t know what kind of contract Apple has with Qualcomm but if it involves Apple anonymising and sending the data to Qualcomm for using its chips then it’s likely going to be the same just in a different form. I’m pretty sure Qualcomm would like some kind of telemetry from its partners it sells chips to.

That's actually not likely at all. There's no reason for Apple to trash its reputation by doing something stupid like this for Qualcomm's benefit.

Telemetry is something like : this is the history of modem signals etc. Something Qualcomm might have in its contract.

The iPhone has plenty of it's own telemetry like OCSP and Find My. No need to play cats vs dogs here.

Reply on news.ycombinator.com