Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

141–150 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#141

Post by Wowfunhappy »

Godel_unicode wrote: post #117
Wowfunhappy wrote: post #74

Earlier quoted context omitted.

But that presumes a human engineer is going through and looking at the libraries in order to maintain fingerprints. I suppose it's possible that's what Facebook is doing, but it strikes me as a massive waste of time, particularly in comparison to all of the other metrics at their disposal.

There are a lot of techniques to compare binary similarity that don't require human intervention. Edit: see for instance https://www.usenix.org/conference/usenixsecurity17/technical...

But you could do that on the device too, you don't need to upload the library.

I don't know, you could be right—maybe Facebook really wants their analysis to only run on their own servers. It just seems like a stretch to me.

Re: Facebook scans system libraries on Android and uploads them to their server

#142

Post by fnord77 »

mdavidn wrote: post #115
fnord77 wrote: post #102

how was she able to capture / sniff those HTTP posts? Any kind of sniffer would just get encrypted SSL data...

The major HTTP proxy debuggers all support MitM of TLS traffic using a locally-generated CA trusted by the device.

thanks. I was imagining using wireshark and just getting garble

Re: Facebook scans system libraries on Android and uploads them to their server

#143

Post by Groxx »

saagarjha wrote: post #5

I'd expect that they're doing this because they'd like to diagnose crashes or bugs on systems that they don't have the hardware for. It's still somewhat creepy and possibly a fingerprinting mechanism.

Yeah, when I was working on an SMS app, I briefly considered doing something similar. The variety of ways companies break these shared services is astounding[1], and there's no way to reproduce without having the actual phone on-hand, and/or decompiling the framework and seeing what nonsense they wrote. I never did ship it tho.

There are definitely some non-shady useful reasons to do this, but Facebook has sorta lost my default assumption of not-evil, yea.

[1]: https://news.ycombinator.com/item?id=20672783

Re: Facebook scans system libraries on Android and uploads them to their server

#144

Post by godelski »

funkymike wrote: post #139
JustSomeNobody wrote: post #54

Earlier quoted context omitted.

That culture has been built up over years. And probably most of the people they hire don't have the life experiences that would give them pause and allow them to consider or even recognize if what they're tasked to do is creepy or not.

Not at FB but just doing enterprise software development I've had to explain to other developers that capturing and storing user info just because we can is in the "not okay" category. There are plenty of people who don't even consider ethics at work. They get a feature request, so they deliver it, with no second thoughts. These aren't bad people per se, it just doesn't occur to them to question the reasons for a req…

I think this is because people don't see the value of data. I've also heard a lot of justification about people saying "well my individual data isn't worth anything" but also being freaked out by ads they get. I'm always confused by this juxtaposition. But I guess there's similar stances in a lot of places in our culture right now.

Re: Facebook scans system libraries on Android and uploads them to their server

#146

Post by JaRail »

sharpneli wrote: post #2

Isn’t this potentially a copyright violation? Especially on Qualcomm devices (such as the Jolla phone) Qualcomm explicitly forbids you from distributing their OpenGL drivers. So if facebook copies libGLESv2.so off from the device they are potentially performing straight piracy at that point. If I recall the damages demanded by RIAA it was several hundred k per infringement.

The exact details would depend on what they do with the uploads and the specific countries they're uploaded to/from. I'd presume they do this for security and debugging purposes, not to 'steal' the libraries. Like a virus company uploading samples of 'suspicious' .dlls for analysis, this looks like a fair use exception.

Re: Facebook scans system libraries on Android and uploads them to their server

#147

Post by dredmorbius »

cjhveal wrote: post #98
thermonot wrote: post #83

Earlier quoted context omitted.

> copying and uploading the libraries is actually illegal Is it through? If I'm uploading a library to virustotal to check if it's a known piece of malware, am I breaking the law if it was clean?

In the US there is a legal doctrine called fair use, which limits the extent of copyright. There are a number of factors but one of the most relevant here is the purpose and character of the use. If you're using the work to create an analysis of it, that's often covered under fair use as it is not a simple reproduction of the original. (not legal advice).

There are numerous exceptions to the exclusive right to copy works of authorship, of which Fair Use is only one case, actually an "affirmative defence" (that is: not a preclusion to civil or criminal proceedings, but a defence which may be presented), based on a four-part test.

There are additional excemptions, including copying which is required in the normal use of software, and possibly other information, on electronic systems. Whether copying to a malware-scanning service may or may not be included in that, though it would seem a fair argument that it should be (transformative, doesn't impact market, does affect the whole work, purpose is constructive and not otherwise served, context is specific to the nature of the work).

Re: Facebook scans system libraries on Android and uploads them to their server

#148

Post by dredmorbius »

Wowfunhappy wrote: post #48
javagram wrote: post #43

I was going to say this isn’t a big deal but copying and uploading the libraries is actually illegal (copyright violation) and users likely can’t even consent to this even if it is in the Facebook ToS as many android phones contain proprietary libraries not licensed for redistribution. The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. I doubt an…

> The creators of those various libraries should have a valid legal case against Facebook here, if they want to exercise it. Perhaps, but sadly, I don't actually foresee vendors wanting to exercise that right. From a business perspective, why bother?

The owner of a specific library might or might not.

They could potentially have ... friends ... who would have an interest in seeing a case brought, though.

(And since Bollea, barratry seems acceptable.)

Re: Facebook scans system libraries on Android and uploads them to their server

#150

Post by bubble_talk »

We should create a "privacy hall of shame" (I was tempted to call it the "privacy offender registry") and list the names of all the employees who work on these features, along with an easy-to-read blurb which explains how the feature could be misused. Bonus points for linking to their social profile. If you cannot find the actual person, go up the org chart and list the person closest on the hierarchy.

Not that it is going to matter, any more than you can dissuade members of a cult by telling them they should forego their membership. It just seems to bring the cult closer together.

Post reply on HN