71–80 of 188 posts
I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…
Earlier quoted context omitted.
Taking the hash of the library doesn't help you when a user updates their device, though.
How would uploading the library help with that?
Earlier quoted context omitted.
Taking the hash of the library doesn't help you when a user updates their device, though.
Even ignoring the ethical questions it is a massive waste of bandwidth. They could hash the libraries, and if they get a cache miss, upload that one from one person (or perhaps a few people, since everything is in parallel). They then know what system libraries their users have installed without wasting a ton of bandwidth. Next step to reduce creepiness is to only upload info on system libraries that actually affect…
Earlier quoted context omitted.
How would uploading the library help with that?
It's almost infinitely easier to track a library update if you have the actual libraries on hand to compare, rather than two hashes.
Earlier quoted context omitted.
They could download the stock roms from the major manufacturers, only ship the hashes, and match up library versions that way.
I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from usersp…
2. I have doubts that you need copies of all kinds of system libraries to debug that crash. They won't help you debug a crash dump (assuming they don't have debug symbols left in for some reason). They generally won't help you reproduce the crash unless you actually know reproduction steps - it wouldn't surprise me if they tracked every user action, but I doubt they do - so it takes many of those crashes to even start debugging. At that point you probably know precisely which library you need and can obtain it legally.
That said, I agree that uploading the files themselves is not necessary to fingerprint users (the hashes would totally suffice). Unless they do the uploading as a cover-up story, which doesn't make much sense either.
How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?
"How do you sleep at night?"
"On a bed made of money."
How the bloody hell is it permitted for apps to be uploading system files? This wouldn't be possible in Linux, right? Basically, this is malware. Edit: Thanks, all. So OK, I get that it's possible, because apps have read and execute permissions for all libraries that they use. But it's not common for apps to upload system files, right?
>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…
The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop, but mobile OSes provide the sense that software is isolated. In Android, that's mostly an illusion.
Earlier quoted context omitted.
It's almost infinitely easier to track a library update if you have the actual libraries on hand to compare, rather than two hashes.
But that presumes a human engineer is going through and looking at the libraries in order to maintain fingerprints. I suppose it's possible that's what Facebook is doing, but it strikes me as a massive waste of time, particularly in comparison to all of the other metrics at their disposal.
Earlier quoted context omitted.
That would only work for the .text section. Other sections like .data, .rodata, and .bss need read access because they contain data required for the library to function (global variables, vtables, constants, etc.).
I'm not sure if Android allows for multiple mappings of the same page, but I could see something where global variables that are internal to the library are accessible only through a mapping that is known only to the binary itself (possibly by hardcoding it into instructions inside .text?) API needs to be exposed, of course, but ideally that would be the same across different implementations of a library.