Yikes. Does Facebook even try to not be creepy?!?
Facebook scans system libraries on Android and uploads them to their server
91–100 of 188 posts
Re: Facebook scans system libraries on Android and uploads them to their server
#92Earlier quoted context omitted.
...system libraries contain identifying information? Is this some alternate usage of the word "system library" I wasn't previously aware of? I'm assuming, and haven't read anything to the contrary, that these are just dynamically linked code libraries what have been a pretty big part of how OSs work for decades. Therefore, I can only conclude that the identifying information is which precises system libraries are ins…
> I'm assuming, and haven't read anything to the contrary, that these are just dynamically linked code libraries what have been a pretty big part of how OSs work for decades. Yes, we're talking about the same thing. > Therefore, I can only conclude that the identifying information is which precises system libraries are installed on any given machine. Specifically, it provides very detailed information about your hard…
Ok, so let's say you've solved this problem tomorrow. You've just made it impossible for an application to know which OS version, security patch level, and hardware revision it is running on, meaning it can't do anything like dynamically adjust itself depending on features (or bugs) it will know are available or not. It also can't submit any of this in crash reports, so fixing bugs that occur in rare combinations of hardware and software is now much more problematic.
All to prevent... what? If you log into Facebook, which is presumably why you have the application, then it already knows who you are. Not to mention the hundreds of other ways to fingerprint you.
Re: Facebook scans system libraries on Android and uploads them to their server
#93Earlier quoted context omitted.
>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…
> If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop, but mobile OSes provide the sense that software is isolated. In Android, that's mostly an illusion.
I feel like users install untrusted software on the desktop all the time and it's called closed source software.
It's not like Facebook is some small, unknown malware peddler so that its software should be considered "untrusted". If anything, it's untrusted because it's coming from a scummy company and opaque (due to being closed source).
Re: Facebook scans system libraries on Android and uploads them to their server
#94Earlier quoted context omitted.
im thinking about how we get to non traditional sandboxing
Here's a stupid idea I had elsewhere in the comments: https://news.ycombinator.com/item?id=20840466
i think one of the biggest nuts to crack is that end user is in app space and cant black list apps [such as FB] from system procs and resources. If we could sniff and/or hook for requests to read the entire library all at once, or for such a request from a particular app, and ~pihole it or give it a honeypot to suck on for data.
Re: Facebook scans system libraries on Android and uploads them to their server
#95I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…
Looks like it's only uploading the name and a hash.
Read down the twitter thread, looks like they can/are uploading the contents of the files too.
Re: Facebook scans system libraries on Android and uploads them to their server
#96Earlier quoted context omitted.
That culture has been built up over years. And probably most of the people they hire don't have the life experiences that would give them pause and allow them to consider or even recognize if what they're tasked to do is creepy or not.
That, or they don't care. Or they don't care enough.
If you do care, you get filtered out.
Re: Facebook scans system libraries on Android and uploads them to their server
#97I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…
> copying and uploading the libraries is actually illegal Is it through? If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?
I seem to remember a case where files were being uploaded to a server where they were only retained in memory and that qualified as a copyright violation, but I'm having trouble actually finding it.
Re: Facebook scans system libraries on Android and uploads them to their server
#98I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…
> copying and uploading the libraries is actually illegal Is it through? If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?
In the US there is a legal doctrine called fair use, which limits the extent of copyright. There are a number of factors but one of the most relevant here is the purpose and character of the use. If you're using the work to create an analysis of it, that's often covered under fair use as it is not a simple reproduction of the original. (not legal advice).
Re: Facebook scans system libraries on Android and uploads them to their server
#99How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?
Because it happens in small steps.
(I'm talking extreme end here, btw). Someone doesn't turn to high crimes overnight nor are they (usually) born that way. You start of making smaller immoral decisions which then become normal. You essentially move the bar a little more and more. People sleep at night frankly because they no longer think that these things are immoral. That's why there's plenty of sayings along the lines of "the path to heaven is long and narrow and the path to hell is short and wide".
Obviously morals are flexible and need to be to survive in this world. But the thing is when people are put into environments that encourage this bar to be pushed too far (by what society determines is too far).
Btw, if you like podcasts Hidden Brain did an episode on this concept that went through how an athlete went from taking no sports enhancing drugs to being a major dealer. And they decompose each step and how reasonable they seem in the context.
Tldr: it's no longer immoral for them, so the real question is "what keeps them up at night?"
Re: Facebook scans system libraries on Android and uploads them to their server
#100Earlier quoted context omitted.
Are they closed source? I.e. does facebook not have a license to make copies of them?
source avail != anyone can make copies of the binary
Sure, by closed source I meant "not licensed under a typical open source license that gives you that right" rather than "I literally can't find the source via google".