Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

161–170 of 188 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#162

How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?

I am reminded of a quote from Mad Men: "How do you sleep at night?" "On a bed made of money."

That was from The Simpsons way before Mad Men:

https://www.youtube.com/watch?v=GO0JaecRWy0

Re: Facebook scans system libraries on Android and uploads them to their server

#164

How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?

Because it happens in small steps. (I'm talking extreme end here, btw). Someone doesn't turn to high crimes overnight nor are they (usually) born that way. You start of making smaller immoral decisions which then become normal. You essentially move the bar a little more and more. People sleep at night frankly because they no longer think that these things are immoral. That's why there's plenty of sayings along the li…

> Because it happens in small steps.

Nah Zuckerberg is a high functioning psychopath with no morals at all.

Re: Facebook scans system libraries on Android and uploads them to their server

#165
post #78

Earlier quoted context omitted.

>This wouldn't be possible in Linux, right? If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. As does android. Good luck using dylibs without it, anyways. Since the android market is so fragmented and customized, this probably saves them from having to buy lots of phones when diagnosing crashes. The knee-jerk reaction is to feel uncomfortable but these a…

> If you have read access, then yes. Conventional desktop and server linux distributions would allow this behavior. The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop, but mobile OSes provide the sense that software is isolated. In Android, that's mostly an illusion.

> The difference is in people's expectations of mobile vs. desktop apps. You'd never install untrusted software on your desktop

I knew many Linux desktop users who had installed the Slack client back in the days we used Slack at work. Myself I have installed Skype. Not that I find Skype particularly good, but sometimes I need to communicate with people who have no clue about software freedom.

So, yes the number of "untrusted apps" is significantly lower on a (Linux) desktop, but "you'd never install" is an incorrect characterization.

Re: Facebook scans system libraries on Android and uploads them to their server

#166
It's not my business, as I don't use the FB app --and I won't. But even if the original intent was to help the debugging process, this is not acceptable. This is, to put it plainly, copying files from a user's device, without the user's consent.

FB has the means (resources) to route around this and find the ways to properly debug apps.

I hope this would find its way to Google Play blocking the app and a class action lawsuit. It's the only fair outcome.

Re: Facebook scans system libraries on Android and uploads them to their server

#167

Earlier quoted context omitted.

I'm not making a moral judgement (FB is a big yikes), just technical. They'd have to: - build lists of every phone, including carrier variant and internal revisions (pretty common!), to make sure they could be sure they had a complete library - rely on the manufacturer to publicly post the ROM (cheaper mfg wont do this) (or somehow retrieve the URL from the update mechanism, said URL not easily accessible from usersp…

At the very least, the privacy-respecting solution would be to upload hashes and only upload libraries once some critical mass of users had reported the hash along with a bug. Even then, you would only upload the files themselves from some capped number of users.

That makes no difference from a privacy point of view but would be more respectful of people’s bandwidth limits.

Re: Facebook scans system libraries on Android and uploads them to their server

#168

Earlier quoted context omitted.

Stupid idea: --X the pages for the library.

Does hardware allow that?

Not really.

Whereas the execute flag on a page allows one to only load data from there but not jump there is nothing that allows one to execute code while preventing mov.

Re: Facebook scans system libraries on Android and uploads them to their server

#169
post #146

Isn’t this potentially a copyright violation? Especially on Qualcomm devices (such as the Jolla phone) Qualcomm explicitly forbids you from distributing their OpenGL drivers. So if facebook copies libGLESv2.so off from the device they are potentially performing straight piracy at that point. If I recall the damages demanded by RIAA it was several hundred k per infringement.

The exact details would depend on what they do with the uploads and the specific countries they're uploaded to/from. I'd presume they do this for security and debugging purposes, not to 'steal' the libraries. Like a virus company uploading samples of 'suspicious' .dlls for analysis, this looks like a fair use exception.

This is a good point. And in EU interoperability is explicit reason for not just this but full fledged reverse-engineering.

Re: Facebook scans system libraries on Android and uploads them to their server

#170
post #58

How does the internal culture at FB come to grips with the world's vision of them as creepy and amoral and still do stuff like this anyway?

Seems like people assume FB employees are 'gifted' they are technically capable, and emotionally and philosophically infantile.

In a way that's what you want for the stereotypical "startup culture".

Nobody in their fourties who has the life experience of being married with kids is going to work lots of overtime and put up with their boss acting like a child and treating them like they are nobody. I guess that's why they like hiring college grads (that and they don't know their value so can be paid much less).

Post reply on HN