31–40 of 68 posts
How is this not utterly illegal in the EU, per GDPR? (Which was drafted to stop indiscriminate data acquisition on human subjects: I'm assuming that metadata about the core libraries on your phone, in conjunction with FB's user metadata, are trivially de-anonymizable.)
Earlier quoted context omitted.
It's not metadata, is IS the binaries.
I'm pretty sure you can fingerprint a device by gathering data about the binaries (and versions thereof) installed on it. I'm pretty sure that Facebook also know whose instance of the FB app is running on the device in question. Ergo, the data can be deanonymized and gives them more insights into what their users are doing … including, oh, competing platforms and apps? The traditional model of computer security assum…
Actually, probably not. These libraries are the base system image, which is read-only, and typically will only identify which model of phone it is. It might identify you if you have a custom android build you've done yourself though.
As someone who’s built my company’s mobile crash reporting solution, I have a guess why they might do this. It’s is extremely difficult to diagnose Android native code crashes. Unlike iOS where it is both straightforward to unwind on the phone, and where Apple makes the iOS system symbols available for symbolizing system frames in a stack trace, neither of these things are true on Android. My first approach for my co…
Okay what is the purpose of this even? Sure, everyone is going to talk about fingerprinting, but let's face it, there are way easier and more reliable methods of doing that than system libraries that mostly match between same devices. Must be for some sort of debugging? Still seems insane...
Facebook wants their app to work on all of them, but cant track down all of those physical devices.
Instead, I bet they load all the libraries into a big test bench and check all features of the app work with all possible hardware.
It wouldn't be perfect, since I bet many of those libraries rely on custom system services, kernel interfaces, etc, but I bet it helps them track down a bunch of issues before they impact real users.
How does this pass through their legal team?
I suspect they don't run anything through their legal team, only ask them to help after they've fucked up. This has the advantage of getting away with things the legal team would advise against, which I think they do a lot.
Earlier quoted context omitted.
Nice angle but I guess the defense is that the user explicitly gave Facebook permission to read those files.
If I buy a book, I'm allowed to read that book, but I am not allowed to copy it.
Earlier quoted context omitted.
It likely constitutes copyright infringement, carrying a $100K or so civil payment without need to show any damages, if FB is subject to the law. If you hold the copyright to a library deployed on android, you might want to talk to a lawyer.
Not that many people do... This only includes system libraries which a phone OEM shipped. It doesn't include libraries which are bundled with an app.
Earlier quoted context omitted.
Nice angle but I guess the defense is that the user explicitly gave Facebook permission to read those files.
It's not an angle it's literally copyright infringement. Users aren't given the right to distribute their copies.
Apps should be statically linked and the kernel should not allow any access to the hdd or fs. Where you have to opt in to what folders the app is able to read or write to. Same for network access and any other hardware, camera, mic, etc.
Frequently those static libraries provide device-specific functionality. For example, the Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.