This is pretty bad.
Facebook scans system libraries on Android and uploads them to their server
21–30 of 68 posts
Re: Facebook scans system libraries on Android and uploads them to their server
#22If the actual files are uploaded(?), doesn't this constitute reverse software piracy? Under what license are the uploaded files covered by? Can facebook require the end users to supply the source code for GPL-licensed library binaries uploaded through this system? What about proprietary oem blobs that are often covered by a no-redistribution license or EULA? What if I am an AOSP or vendor developer working on unrelea…
It likely constitutes copyright infringement, carrying a $100K or so civil payment without need to show any damages, if FB is subject to the law.
If you hold the copyright to a library deployed on android, you might want to talk to a lawyer.
Re: Facebook scans system libraries on Android and uploads them to their server
#23Another reason I'm glad I quit
Both. No point using an operating system that is a malware and privacy nightmare, just so I can fiddle with it more. It's not a computer, it's just a phone.
And no point using Facebook, really. Still with Whatsapp (and passively Instagram) as my friends are massively on those.
Re: Facebook scans system libraries on Android and uploads them to their server
#24Okay what is the purpose of this even?
Sure, everyone is going to talk about fingerprinting, but let's face it, there are way easier and more reliable methods of doing that than system libraries that mostly match between same devices.
Must be for some sort of debugging? Still seems insane...
Re: Facebook scans system libraries on Android and uploads them to their server
#25As someone who’s built my company’s mobile crash reporting solution, I have a guess why they might do this.
It’s is extremely difficult to diagnose Android native code crashes. Unlike iOS where it is both straightforward to unwind on the phone, and where Apple makes the iOS system symbols available for symbolizing system frames in a stack trace, neither of these things are true on Android.
My first approach for my company’s Android crash manager SDK was to use Google Breakpad. This works by capturing a snapshot of stack memory at the time of the crash. Unwinding then occurs on a backend server. But to unwind successfully, absent a frame pointer register, you need unwind info to provide to the unwinder. This simply isn’t available except for Nexus devices for which you can download the system images from Google. And even on devices where the code was compiled with a frame pointer, you still need symbols so you know what each frame’s function was.
Another approach is to unwind on the device. In my experience, using libunwind, this is successful about 50% of the time. It also risks hanging the app, which looks even worse to the user than just crashing.
Years ago, I briefly considered having our crash SDK, optionally and with user consent, extract the symbols and unwind data from the libraries on the device and upload them to our backend. I dismissed it as too expensive to do on a user’s phone.
Instead, we crowd source as much as we can from our employee phones.
Android native code crashes remain a bear to diagnose. Especially annoying since Android itself collects a ton of diagnostic data about your app when it crashes - it just doesn’t make it easily, or in some cases at all, accessible to the app itself.
Re: Facebook scans system libraries on Android and uploads them to their server
#26Earlier quoted context omitted.
It's not metadata, is IS the binaries.
I'm pretty sure you can fingerprint a device by gathering data about the binaries (and versions thereof) installed on it. I'm pretty sure that Facebook also know whose instance of the FB app is running on the device in question. Ergo, the data can be deanonymized and gives them more insights into what their users are doing … including, oh, competing platforms and apps? The traditional model of computer security assum…
No I meant they're outright uploading binaries, not just metadata.
Re: Facebook scans system libraries on Android and uploads them to their server
#27How does this pass through their legal team?
I suspect they don't run anything through their legal team, only ask them to help after they've fucked up.
This has the advantage of getting away with things the legal team would advise against, which I think they do a lot.
Re: Facebook scans system libraries on Android and uploads them to their server
#28If the actual files are uploaded(?), doesn't this constitute reverse software piracy? Under what license are the uploaded files covered by? Can facebook require the end users to supply the source code for GPL-licensed library binaries uploaded through this system? What about proprietary oem blobs that are often covered by a no-redistribution license or EULA? What if I am an AOSP or vendor developer working on unrelea…
Nice angle but I guess the defense is that the user explicitly gave Facebook permission to read those files.
It's not an angle it's literally copyright infringement.
Users aren't given the right to distribute their copies.
Re: Facebook scans system libraries on Android and uploads them to their server
#29If the actual files are uploaded(?), doesn't this constitute reverse software piracy? Under what license are the uploaded files covered by? Can facebook require the end users to supply the source code for GPL-licensed library binaries uploaded through this system? What about proprietary oem blobs that are often covered by a no-redistribution license or EULA? What if I am an AOSP or vendor developer working on unrelea…
It likely constitutes copyright infringement, carrying a $100K or so civil payment without need to show any damages, if FB is subject to the law. If you hold the copyright to a library deployed on android, you might want to talk to a lawyer.
Not that many people do...
This only includes system libraries which a phone OEM shipped. It doesn't include libraries which are bundled with an app.
Re: Facebook scans system libraries on Android and uploads them to their server
#30Apps should be statically linked and the kernel should not allow any access to the hdd or fs. Where you have to opt in to what folders the app is able to read or write to. Same for network access and any other hardware, camera, mic, etc.
Frequently those static libraries provide device-specific functionality. For example, the
Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.