Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google have declared Droidscript is malware

groups.google.com

Post reply on HN
Print view View original

431–440 of 665 posts

Re: Google have declared Droidscript is malware

#431

Post by NateEag »

vaer-k wrote: post #399
sequoia wrote: post #301

> ...after taking into consideration the information that you have provided, we have confirmed that we are unable to reinstate your publisher account. I hate when using euphemism slides into flat out lying like this. They are not "unable" to reinstate the account, in fact they are the only party able to reinstate the account, that's why the account holder was contacting them instead of someone else. They are "unwilli…

As a cashier, I am certainly "able to" just hand you the goods and let you leave without paying, but in reality due to laws, regulations and good morals I am unable to do that.

No, you _will_ not do that, and made that decision so long ago it feels inviolable to you.

When someone points a gun at a cashier and says "this is a robbery and I'm gonna shoot you if you move a muscle," the cashier usually uses their ability to hold still out of concern for their safety.

The distinction matters.

Re: Google have declared Droidscript is malware

#432

Post by spinny »

franga2000 wrote: post #326
easton wrote: post #116

Earlier quoted context omitted.

Droidscript has support for writing custom intents, which Pythonista (and Scriptable, a JavaScript version of the same thing) do not have. A malicious Droidscript application could access other applications on the device. https://symdstools.github.io/Docs/docs/app/SendIntent.htm

I've done some, although not a lot of, native Android development and I'm not quite sure what's so bad about sending intents. "Could access other applications" sounds dangerous, but as far as I know that "access" is limited to things those apps have explicitly decided to allow external apps to access.

Probably it's not the capability to send custom intents. Everytime i buy a new device, i look for apps with unknown or curious names, check the manifest and use an app like Intent (https://play.google.com/store/apps/details?id=krow.dev.schem...) to poke around.

Re: Google have declared Droidscript is malware

#433

Post by random5634 »

akiselev wrote: post #367
fuyu wrote: post #361

Earlier quoted context omitted.

If I were to ask you if I could get a refund for an item out of warranty, what language would you use to refuse me? I'm struggling to come up with a response that doesn't use the terms "unable" or "can't" that wouldn't come across as fairly rude.

"We do not issue refunds for items with expired warranties" Notice that the policy is clearly stated in the rejection and there is no ambiguity.

You would be lying - and people will call you out on this, because they will find out that you have in fact issued refunds for products with expired warranties.

Re: Google have declared Droidscript is malware

#434

Post by 7OVO7 »

TheRealPomax wrote: post #382
zepto wrote: post #359

Earlier quoted context omitted.

Technically you are right. However the key here is exploiting the ambiguity. ‘We are unable to’ is a cowardly way of saying ‘we choose not to’, or ‘our policy dictates’.

If it's based on a real policy that can be verified by others, then there is no ambiguity here. "We reviewed your case, and based on our policy, we cannot reinstate your account. Because if we did, we'd be the ones violating our policy, and someone -including you- could then actually sue us for unfair business practices, rather than merely complaining about overly restrictive policies that are blindly enforced throug…

the first sensible and rational comment I see here (I hope more comment like this in this post).

Re: Google have declared Droidscript is malware

#435

Post by jedimastert »

unexaminedlife wrote: post #392

Here's a thought. One of the most frustrating things to me about this kind of thing is that Google (or any other major tech company) could just ignore me and just tell me "you're malware". I get it. Technology people cost a lot of money, so I would propose that companies who the public depend on MUST offer consulting out-of-band at an hourly (or daily?) rate. This way the real issues are squashed. Now I know that I c…

Except that ties access to these companies depend on to people who have the money to do so, which creates a huge imbalance

Re: Google have declared Droidscript is malware

#436

Post by IncRnd »

TheRealPomax wrote: post #382
zepto wrote: post #359

Earlier quoted context omitted.

Technically you are right. However the key here is exploiting the ambiguity. ‘We are unable to’ is a cowardly way of saying ‘we choose not to’, or ‘our policy dictates’.

If it's based on a real policy that can be verified by others, then there is no ambiguity here. "We reviewed your case, and based on our policy, we cannot reinstate your account. Because if we did, we'd be the ones violating our policy, and someone -including you- could then actually sue us for unfair business practices, rather than merely complaining about overly restrictive policies that are blindly enforced throug…

> If it's based on a real policy that can be verified by others, then there is no ambiguity here.

In this particular case, the ambiguity is exactly that - Google didn't say what what real policy was broken or how.

Re: Google have declared Droidscript is malware

#437

Post by joshuaissac »

twobitshifter wrote: post #38
eplanit wrote: post #25

It's seriously time to re-embrace the idea of ownership and control of our devices, and reject Android and iOS altogether. Developing for those platforms has become worse and more restrictive over the years, and this kind of crap is now just everyday news. How good are Pinephones[1]? Are there better alternatives? [1] https://www.pine64.org/pinephone/

I’d be hesitant to jump on another platform unless it has a way of locking down app permissions similar to iOS. I think it’s been shown that the app review process is a farce, but the permissions system like the new app tracking feature is great for privacy and security. If this droid script equivalent were going to start reading my emails watching me through the camera, reading my clipboard, or tracking my real worl…

> If this droid script equivalent were going to start reading my emails watching me through the camera, reading my clipboard, or tracking my real world location, I’d definitely want something that alerted me to that before it happened.

Android has supported permissions since at least Froyo (2010), and these permission requests were made on-demand/runtime rather than pre-install with Marshmallow (2015). So Droidscript would be unable to do any of those things (except reading the clipboard) until you explicitly granted those permissions to the app.

Re: Google have declared Droidscript is malware

#438

Post by jldl805 »

veeti wrote: post #332
szopa wrote: post #100

Earlier quoted context omitted.

I used to work at Google, and a friend reached out to me for help – his company's app was in a similar situation, with similar communication from Google. This was a good friend from high school, so I pressed the issue using internal channels. The person handling it on Google's side was very assertive about them violating a policy, and after some back and forth I received a _vague hint_ about what was the supposed vio…

> It's a safe assumption that the vast majority of people police deal with are criminals. And there's a lot of them. If they gave a detailed explanation of why they are under arrest it would mean a ton of additional work - which would create an unsustainable situation at this scale. But it's all good, Google is a private company™ and can do whatever they want®.

Actually Google is a public corporation, not a private company.

Re: Google have declared Droidscript is malware

#439

Post by Dylan16807 »

sofixa wrote: post #310
dtx1 wrote: post #22

Earlier quoted context omitted.

I think your thoughts on this are plausible, if not likely. However, the usual complete lack of communication by google is the actual problem. Perhaps droidscripts could mitigate googles concerns, if they had the decency to explain them.

But if they do, a malicious actor can use that information to circumvent their restrictions, and its their walled garden, so they have very little incentive to tell everyone exactly what they don't like.

Okay, but this developer isn't "everyone", and there seems to be no reason not to explain in this case.

Re: Google have declared Droidscript is malware

#440

Post by easton »

franga2000 wrote: post #326
easton wrote: post #116

Earlier quoted context omitted.

Droidscript has support for writing custom intents, which Pythonista (and Scriptable, a JavaScript version of the same thing) do not have. A malicious Droidscript application could access other applications on the device. https://symdstools.github.io/Docs/docs/app/SendIntent.htm

I've done some, although not a lot of, native Android development and I'm not quite sure what's so bad about sending intents. "Could access other applications" sounds dangerous, but as far as I know that "access" is limited to things those apps have explicitly decided to allow external apps to access.

Applications could be exposing intents they assume will be used by trustworthy applications (i.e. apps in the Play Store). A user could download a Droidscript (which as I understand doesn't trigger the unknown sources policy) which then tries to use intents it shouldn't need without asking the user for permission.

If Droidscript required unknown sources to do anything (not just APK exports), then other apps could check the unknown sources policy on the device and disable certain intents (which they may do anyway at the moment, since that would mean that the applications installed may be untrustworthy). But this way there isn't any way to tell.

Post reply on HN