Hacker News Reader

ge0rgon Google warns Android might not remain free because of EU decision

They do have the copyright to the code they wrote, but not to the code they took and changed (Apache Harmony, Linux kernel). They can relicense everything that originated from them, and provide it under a pure commercial license or dual-license it.

However, it might mean that they have to re-implement big parts of the Android runtime, or even do clean-room implementations by people not previously involved in those projects, to prevent legal attacks on the inevitably-similar code that results.

ge0rgon Google warns Android might not remain free because of EU decision

Okay then, but Google Search is what paid for Android development, so if you can't tie them together, Android needs to seek other sources of funding. The most obvious one is some sort of licensing fee.

A licensing fee would be a valid and reasonable outcome. It probably can even work without making Android closed-source, by choosing the licenses accordingly or maybe have some kind of early-access or migration-support agreements (IANAL).

The main point is that Google is using a monopoly in one market to retain a monopoly in another market, and this is illegal. As far as I'm reading the press release, Google is not barred from developing and offering Android for free, if they wish so - they are only disallowed to abuse their monopoly.

but it also forced browsers to find independent business models

It stopped Microsoft from preventing independent business models for browsers; it was just too late already for the commercial browser vendors of the time. And the current EU ruling will hopefully allow other mobile OS developers (or startups) to compete on more equal grounds.

Of course we still have the network effect of Google Play, featuring a market dominance over Android apps and Android users. I wouldn't be too surprised to see another future EU ruling requiring Google to unbundle Google Play from all but technical requirements, possibly allowing users to legally get access to Google Play on AOSP-based devices, or using alternative clients.

ge0rgon Google warns Android might not remain free because of EU decision

I don't think that replacing Linux under the hood of Android will change anything. Most of Android is licensed under the Apache license, probably due to the alternative Java runtime they took initially from the Apache Foundation.

They sheer developer power Google has at hand to throw at Android development, including out-of-tree-kernel patchsets, means that it is a very significant effort to just keep pace with them, and the AOSP "code drops" come late and require major integration work.

If they wanted to switch to a closed-source model, they could have adopted that for the runtime a long time ago, still keeping the closed-source blob on top of the Linux kernel.

Maybe the EU decision will change the benefit balance of Android "being open source", and Google will go on with forking off / replacing the whole middleware, but I think that with their speed of Android development most commercially viable OEMs only have a chance to follow by subscribing to Google contracts (and maybe getting early access to new releases) anyway.

ge0rgon Google warns Android might not remain free because of EU decision

The original post by Pichai is more carefully worded as "you can easily disable or delete them", so it's an inaccurate summary by theverge.

ge0rgon European Commission fines Google €4.34B in Android antitrust case

Maybe the problem with the Google deal is that it's exclusive: if you want to make one device that's Google approved and contains the "highly valued" services, you are disallowed by the compliance contract to make other Android devices that are not Google-approved.

ge0rgon Employers will do almost anything to find workers except pay them more

You might want to indicate that this is a quote from the web site, not a statement of yours. I'd suggest to edit it and to add asterisks around the text to make it render in italics.

ge0rgon Shutting Down the BGP Hijack Factory

How many hours / days / weeks do you need to give the announcer to produce all that evidence, before considering the action as malicious and undoing the announcement?

Proving a business relationship sounds like a multi-day endeavor, whereas you typically want to undo the damage ASAP.

ge0rgon Why Mastercard Doesn't Use OAuth 2.0

The problems are before and after the TLS tunnel.

I've seen a BigCorp load balancer / web firewall log the first 1KB of each HTTP POST body into a permanent archive. A typical login submission is much smaller than that. Also in some networks the TLS connection is terminated by a frontend server and backend communication is plaintext HTTP.

While these examples are obviously bad practice, having your requests signed and not leak user passwords would easily nullify their impact.

ge0rgon Polish charity gets huge phone bill thanks to stork

Don't forget that in some countries, the stork's ID card is required to activate the SIM card before use.

ge0rgon The Hidden Cost of Touchscreens

Voice control isn't friendly either. It often fails to understand what you say, requires significant focus from you to say the exact magic words, and works less well when it's loud outside.

On my Android Auto, the voice-activated voice control also tends to trigger inadvertently when playing podcasts.

ge0rgon Breaking LTE on Layer Two

A VPN will not protect you from fingerprinting of your traffic patterns. VPNs just add a fixed overhead to all packets and maybe a bit of fragmentation. A well-positioned attacker with a large database of traffic fingerprints is probably easily able to re-calculate the traffic fingerprints for the common VPN protocols.

ge0rgon Breaking LTE on Layer Two

The attack is a combination of multiple "vulnerabilities":

1. the data link layer is not protected, so an attacker can perform a relay attack (forward the encrypted radio packets between the phone and the actual cell tower).

2. from watching the encrypted traffic patterns, it is possible to guess which websites the user is surfing by comparing the traffic fingerprints.

3. the packets are not integrity-protected, so it's possible to change bits of data, if you can guess which packet you have and how it's constructed. This is used to manipulate DNS requests to redirect traffic.

I'm not sure about the significance of #1 and #2. A passive attacker might be able to obtain the same information simply by monitoring the physical layer traffic patterns emitted by the phone. Additionally, mobile operators are typically monitoring their frequencies for abuse, so an active attack might not stay under the radar for long.

Regarding #3, this is a complicated way to achieve what you can do with a fake WiFi hotspot, and gives you control over unencrypted communications, which hopefully is only a very small subset of todays traffic thanks to omnipresent HTTPS.

ge0rgon Interpol rolls out international voice identification database

The very serious data protection issues aside, today's state-of-the-art biometrics are hardly suitable for authentication purposes (does sample X belong to given person Y?). Using them for large-scale identification (find the most probable person from a huge database, given a sample X), especially with low-quality data sources, is a lottery game.

Unfortunately, the article doesn't state the false-positive and false-negative rates of the technologies used, so it's impossible to calculate the actual risks of being accused of something, once your sample is in the database.

ge0rgon MS Windows Once Caused Second Life To Break An Inkjet Printer

This is also true for running arbitrary non-code.

ge0rgon IRC.com Bought by London Trust Media, Pledges an IRC Revival

DCC has been broken in practice for decades due to NAT. If you use a bouncer and have workarounds for the NAT problem in place, your files will still end up on the wrong machine, and then there is the multi client distribution problem. That's a bunch of problems you need to solve beyond just showing an image "inline".

ge0rgon IRC.com Bought by London Trust Media, Pledges an IRC Revival

Everything in this post except the personal sentiment could be about any semi-anonymous text based communication medium, be it mailing lists, web forums or any other chat system with group chats / channels.

As somebody who has been on irc for over 20 years now, and shares most of the sentiment, I still wouldn't invest into the tech. As others have written, the protocol simply isn't adequate for today's usage scenarios.

This is a problem that people have been fighting with some success on xmpp, which is far more flexible and is a superset of what irc provides, and there are the obvious web stack based solutions like Slack, Matrix and Mattermost.

Still, people rather use Facebook groups today, and we won't convert them by making irc better.

ge0rgon Android Studio 3.2 Beta

I wish they would focus on backward compatibility of their IDE instead, every time I upgrade I need to spend several days on SO to figure out how to work around the newest breakage. This is from a part-time developer who doesn't have the time to keep up with the CATD[0] development model of Android's APIs and UIs.

[0] https://www.jwz.org/doc/cadt.html

ge0rgon Blockers to IPv6 Adoption

It is really sad to see that essentially all security issues of IPv4 were inherited, at least on the LAN level. However, besides of the "firewall protection" provided by NAT, which is largely mirrored as "outgoing connections only" in ipv6 deployments, I fail to see how it actually makes security worse. Do you have examples for what you had in mind?

ge0rgon GDPR, China and data sovereignty are ultimately wins for Amazon and Google

It's really cynical that before I can even read this article about the GDPR, TC makes me painfully aware that they

- violate my GDPR rights by requiring opt-out from their tracking, instead of opt-in

- are going to sell my data to hundreds of "partners"

https://gdprhallofshame.com/5-techcrunch-engadget-and-oath-c...

Even if I would bother enough to do this dance from my mobile device, which I don't, there is no way the article can convince me that it's unbiased journalism.

ge0rgon FBI tells router users to reboot now to kill malware infecting 500k devices

You are right. The not-quite-RC4 implementation is mentioned in the Talos post, and it is originating from BlackEnergy. Talos is referencing a US-CERT report of APT28/29[0], which links an F-Secure whitepaper on APTs using "crimeware"[1]:

BlackEnergy is a toolkit that has been used for years by various criminal outfits. In the summer of 2014, we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting. These samples were identified as being the work of one group, referred to in this document as “Quedagh”, which has a history of targeting political organizations.

The only way I see how anybody could conclude from "APT uses a black market toolkit" to "Anybody using this toolkit is that APT" is: clickbait.

[0] https://www.us-cert.gov/sites/default/files/publications/AR-...

[1] https://www.f-secure.com/documents/996508/1030745/blackenerg...

ge0rgon FBI tells router users to reboot now to kill malware infecting 500k devices

Feds take aim at potent VPNFilter malware allegedly unleashed by Russia.

[..] to counter Russian-engineered malware that has infected hundreds of thousands devices.

I'm interested in the evidence for this attribution. Both ars and dailybeast [0] are pointing to Russia, but the only specific hints are that it's targeting Ukraine (which might also have to do with the prevalence of vulnerable devices there, we don't know that), and that it shares code with the BlackEnergy bot builder toolkit[1], which apparently can be bought on the black market for a decade already.

Neither of the original articles [2,3] mention Russia or any of the Russian APTs, so I'm genuinly interested in better attribution data.

[0] https://amp.thedailybeast.com/exclusive-fbi-seizes-control-o...

[1] https://community.rsa.com/thread/186012

[2] https://blog.talosintelligence.com/2018/05/VPNFilter.html

[3] https://www.symantec.com/blogs/threat-intelligence/vpnfilter...

ge0rgon FBI tells router users to reboot now to kill malware infecting 500k devices

The security levels of most electronics products connected to the Internet, be it IoT or routers, can only be described as criminal negligence. There is no financial incentive for the manufacturers to invest into proper security, and they typically just add some junk to the firmware they get from the SoC vendor and ship.

I'm not sure I agree that making the vendors liable in case of vulnerabilities is the right way. It should probably suffice to require vendors to define a guaranteed product support period, where they are obliged to provide security patches, and then hold them liable if they fail that.

ge0rgon Remote zero-click JavaScript code execution on Signal desktop

It's time to admit that we can't fix web security anymore, and that we should just start anew. XSS, SQLi, cross origin flaws, etc. There are just too many vectors for a human developer to make a correct implementation.

ge0rgon Gitea: Open source, self-hosted GitHub alternative

Have a look at reposurgeon for your old-repository-to-git needs.

ge0rgon AT&T updates firmware to block access to 1.1.1.1

"Mom, we need to move downtown, where there are two competing shady ISPs and not just the one we've got here, so we can buy different packages from both to get 95% of the Internet we need."

ge0rgon C Is Not a Low-Level Language

I also had the initial impression that the article is misleading, but later on the author made the point that the C compiler is doing significant work to reorder / parallelize / optimize the code. I agree that x86/x64 is not a low-level language either, but even if it was, with the description the author provided, I'd agree with his point of C not being low-level.

Regarding cutting off backwards compatibility to improve the design, Intel's Itanium (affectionately called "Itanic") was a very progressive approach to shift the optimization work from the CPU (and the compiler) to just the compiler. I'm not sure what the reasons for its failing were, though.

ge0rgon Briar: Peer-to-peer encrypted messaging and forums

Last discussion of Briar on HN (9 months ago): https://news.ycombinator.com/item?id=14825019

ge0rgon Now Is the Perfect Time for an RSS Renaissance

RSS feeds that provide a paragraph (or less) and a "more..." link make me unsubscribe immediately. I'm most often reading my feeds when offline or on the go, and not having the full article makes it worthless.

ge0rgon Google's Project Zero exposes unpatched Windows 10 lockdown bypass

Don't forget that these 90 days are also 90 more days where this vulnerability can be exploited by attackers.

Microsoft has set up a patch delivery infrastructure that's pretty effective and comparably fast by industry standards, if not deactivated by the people who got offended by the forced Windows 10 upgrade and feature creep.