Live data from Hacker News

Apple Is Sending URLs to Tencent?

twitter.com

141–150 of 154 posts

Re: Apple Is Sending URLs to Tencent?

#141

I'm curious if, as @thefalken brought up [0], this is illegal under the GDPR, given that it's a hidden opt out and should apply to EU citizenry with browser language set to Chinese. [0] https://mobile.twitter.com/thefalken/status/1183445477645312...

The code is checking the region part of the locale, which is CN for china. The language code for chinese is zh.

Didn't realize this, thank you for clarification!

Re: Apple Is Sending URLs to Tencent?

#142
post #57

Earlier quoted context omitted.

Downvoters who think that might be too much data don't know about Bloom filters.

Bloom filters are likely useless in this situation - following facts for phishing only: 1. Phishing sites have a lifecycle of about 15 hours. 2. Most malicious links are hidden within benign domains. 3. About 400,000 phishing sites are created each month. From: https://www.itgovernance.co.uk/blog/4-eye-opening-facts-abou... I haven't run the numbers, but I am guessing that a clientside solution would have a lot of ba…

Google's safe browsing API is probabilistic too. The idea is that you do so many rounds of checking to get closer and closer to the mark. You start with a fairly high false positive probability, high-privacy check, then if you get a positive, you try a lower false positive rate check that also loses you some privacy, and the trade-off is that you don't have to have the full malicious site DB with you at all times (and keep it up to date).

Why did you assume I'd not know about false positives?

Re: Apple Is Sending URLs to Tencent?

#143

Earlier quoted context omitted.

This is incorrect. en_GB doesn't mean you're in or from Great Britain. It means you want the device to show English as it is used in Great Britain, with extraneous "u"s and rearranged month and day. A user in the US can request that locale instead of en_US if that is the language they prefer. Locale is for localization of the interface, not for telling where you are from. See the Australian English example in https:/…

What should they do?

They should send to Tencent based on network location. If you're inside the Great Firewall, Google's safe browsing service will be unreachable. If you're outside the Great Firewall, you really don't want to use services through it if possible. https://arstechnica.com/information-technology/2015/04/ddos-...

Re: Apple Is Sending URLs to Tencent?

#144
post #134

Earlier quoted context omitted.

This is incorrect. en_GB doesn't mean you're in or from Great Britain. It means you want the device to show English as it is used in Great Britain, with extraneous "u"s and rearranged month and day. A user in the US can request that locale instead of en_US if that is the language they prefer. Locale is for localization of the interface, not for telling where you are from. See the Australian English example in https:/…

> This is incorrect. en_GB doesn't mean you're in or from Great Britain. You misinterpreted. "Region" is a setting in iOS. But iOS "Region" has nothing to do with the "region" part of a locale. Setting your iOS "Region" to "Great Britain" and setting your "Locale" to "English (Great Britain)" are separate things. "Region" is just what iOS happens to call a completely distinct thing. If you like, to lessen your confus…

> You wouldn't want your phone to start sending data to Tencent as soon as you cross the border into China, right?

You most likely would. Google's service will be unreachable from within China. If it didn't switch providers, you would have no Safe Browsing protection. The key thing is to obtain consent from the user the first time this happens.

Re: Apple Is Sending URLs to Tencent?

#145

Took a quick look, and this appears to be enabled if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: char ____ZN7Backend6Google12SSBUtilities24shouldConsultWithTencentEv_block_invoke_2(void * _block) { rax = [NSLocale currentLocale]; rax = [rax retain]; r14 = [[rax countryCode] retain]; [rax release]; rbx = [r14 isEqualToString:@"CN"] != 0x0 ? 0x1 : 0x0; [r14 release]; rax = rbx; return rax; } Update: the…

> if [NSLocale.currentLocale.countryCode isEqualToString:@"CN"]: So even for US and EU based users the data is send to Tencent just because they enabled Chinese language support? Who programmed that?

CN is the country code, not the language code. zh-CN is simplified chinese localized to mainland China. If you want simplified chinese try something like zh-HK or zh-SG.

But there is valid criticism to be had that Apple should be signposting more visibly the differences between its settings for CN and outside CN.

Re: Apple Is Sending URLs to Tencent?

#146
post #89

Earlier quoted context omitted.

URL to same code search on Sourcegraph (which works): https://sourcegraph.com/search?q=repo%3Awebkit%2Fwebkit+malw... (Disclaimer: I am the Sourcegraph CEO.)

It shows Search timed out Try narrowing your query, or specifying a longer "timeout:" in your query. right now.

Sorry about that. There must’ve been a brief blip during a moment of intense load or a redeploy. Is it working for you now?

Re: Apple Is Sending URLs to Tencent?

#147
post #88

Earlier quoted context omitted.

The code is checking the region part of the locale, which is CN for china. The language code for chinese is zh.

“en_US” is “American English”, not “English on a Phone in america”. The alternative “zh-*” codes are SG, TW, or HK. It’s checking if the user has their region set to “Mainland Chinese”, not That their phone is “Chinese on a phone in China”.

Actually, american english is "en-US", "en_US" means english with the region set to the US, at least on iOS. But yes, it is checking that their region is set to mainland china.

https://developer.apple.com/library/archive/documentation/Ma...

Re: Apple Is Sending URLs to Tencent?

#148
post #137
post #82

Earlier quoted context omitted.

iOS has separate region and language settings. Quick look at Apple docs suggests that this is the former.

No, it's the latter. In NSLocale, "region" is a subtype of language, as in a regional dialect, not an independent dimension. https://developer.apple.com/documentation/foundation/nslocal... https://developer.apple.com/library/archive/documentation/Ma...

Nope, [[NSLocale currentLocale] countryCode] returns Region country code from settings. The same code is also used for language region, so you can end up with something like zh_US.

Re: Apple Is Sending URLs to Tencent?

#149

Earlier quoted context omitted.

That is exactly my experience too. My parents just kept calling me when they were using Android phones. I bought them iPhone to get my free time back.

There is not much difference there. iPhone might be more confusing for people who are used to android.

On an Android device, there are lots of relatively simple to follow guides to be able to download 'free games'.

Rooting your phone is all well and good if you know what you're doing. It's not so good when you don't, and I'm your tech support phone call.

Re: Apple Is Sending URLs to Tencent?

#150
post #12

Earlier quoted context omitted.

Firefox downloads a big blob of unsafe URLs and checks against that, last I saw.

No, Firefox uses the exactly same Safe Browsing protocol. In fact, the protocol was co-developed by Google and Mozilla.

Interesting. I do remember people complaining about a large file in Firefox profiles, in the context of multi-user host admins wanting to be able to have it in a centrally managed location rather than replicated to every profile. I recall it being a sizable sqlite DB for Safe Browsing. I wonder what that was about, then.
Post reply on HN