Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

81–90 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#81

Post by saagarjha »

AnIdiotOnTheNet wrote: post #80
saagarjha wrote: post #25

Earlier quoted context omitted.

I'm not sure if Android allows for multiple mappings of the same page, but I could see something where global variables that are internal to the library are accessible only through a mapping that is known only to the binary itself (possibly by hardcoding it into instructions inside .text?) API needs to be exposed, of course, but ideally that would be the same across different implementations of a library.

What problem are you actually trying to solve though? System libraries are not secrets, there really isn't any good reason we should go through these hoops to prevent reading them.

They contain identifying information.

Re: Facebook scans system libraries on Android and uploads them to their server

#82

Post by gpm »

dmitrygr wrote: post #47
javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?

Are they closed source? I.e. does facebook not have a license to make copies of them?

Re: Facebook scans system libraries on Android and uploads them to their server

#83

Post by thermonot »

javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

> copying and uploading the libraries is actually illegal

Is it through?

If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?

Re: Facebook scans system libraries on Android and uploads them to their server

#85

Post by nerdponx »

JustSomeNobody wrote: post #54
annadane wrote: post #39

How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?

That culture has been built up over years. And probably most of the people they hire don't have the life experiences that would give them pause and allow them to consider or even recognize if what they're tasked to do is creepy or not.

That, or they don't care. Or they don't care enough.

Re: Facebook scans system libraries on Android and uploads them to their server

#86

Post by AnIdiotOnTheNet »

saagarjha wrote: post #81
AnIdiotOnTheNet wrote: post #80

Earlier quoted context omitted.

What problem are you actually trying to solve though? System libraries are not secrets, there really isn't any good reason we should go through these hoops to prevent reading them.

They contain identifying information.

...system libraries contain identifying information? Is this some alternate usage of the word "system library" I wasn't previously aware of? I'm assuming, and haven't read anything to the contrary, that these are just dynamically linked code libraries what have been a pretty big part of how OSs work for decades.

Therefore, I can only conclude that the identifying information is which precises system libraries are installed on any given machine. Any solution to this problem other than "have fewer system libraries and don't change them as often" is adding far more complexity to computing than it will ever be worth, and computing already has enough of such "for the security gods!" solutions.

Re: Facebook scans system libraries on Android and uploads them to their server

#87

Post by nerdponx »

javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

Looks like it's only uploading the name and a hash.

Re: Facebook scans system libraries on Android and uploads them to their server

#88

Post by saagarjha »

AnIdiotOnTheNet wrote: post #86
saagarjha wrote: post #81

Earlier quoted context omitted.

They contain identifying information.

...system libraries contain identifying information? Is this some alternate usage of the word "system library" I wasn't previously aware of? I'm assuming, and haven't read anything to the contrary, that these are just dynamically linked code libraries what have been a pretty big part of how OSs work for decades. Therefore, I can only conclude that the identifying information is which precises system libraries are ins…

> I'm assuming, and haven't read anything to the contrary, that these are just dynamically linked code libraries what have been a pretty big part of how OSs work for decades.

Yes, we're talking about the same thing.

> Therefore, I can only conclude that the identifying information is which precises system libraries are installed on any given machine.

Specifically, it provides very detailed information about your hardware revision, OS version, security patch level, which is generally something that forms part of most fingerprinting suites. Now, I'm not saying that we can solve this problem easily–but I do think it's important to recognize the privacy implications that uploading them can entail.

Re: Facebook scans system libraries on Android and uploads them to their server

#89

Post by [deleted] »

javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

[deleted]

Re: Facebook scans system libraries on Android and uploads them to their server

#90

Post by dmitrygr »

gpm wrote: post #82
dmitrygr wrote: post #47

Earlier quoted context omitted.

Some older android devices running newer lineage/AICP/etc builds include a few libraries I wrote (in their entirety) for compatibility of old vendor prebuilts with new android versions - libdgv1 & libdmitry. Maybe I should C&D FB for laughs?

Are they closed source? I.e. does facebook not have a license to make copies of them?

source avail != anyone can make copies of the binary
Post reply on HN