Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obtainium: Get Android App Updates Directly from the Source

obtainium.imranr.dev

Post reply on HN
Print view View original

91–97 of 97 posts

Re: Obtainium: Get Android App Updates Directly from the Source

#91

Post by trehalose »

furyofantares wrote: post #69
shakna wrote: post #66

Earlier quoted context omitted.

You knowing someone personally is different from the objective millions of infections [0] that we've seen in the real world. [0] https://www.tomsguide.com/news/these-35-malicious-android-ap...

Nevermind that being downloaded a million times doesn't mean by a million people, as scammers download their own app to boost numbers -- a million is what, 1 in a few thousand smartphone users? I'd love it to be zero but the amount of vigilance warranted has gotta be a lot less than it was in the past unless there's some argument that magnitude of harm has gone up by a massive amount while probability has gone down b…

> Nevermind that being downloaded a million times doesn't mean by a million people, as scammers download their own app to boost numbers -- a million is what, 1 in a few thousand smartphone users?

Isn't this cause for people to be more vigilant? You can't even trust apps that are vouched for by large numbers of users (with these large numbers being not mere claims on a shady website, but statistics officially certified by the authority of the app store).

Re: Obtainium: Get Android App Updates Directly from the Source

#92

Post by g-b-r »

porridgeraisin wrote: post #78
g-b-r wrote: post #62

Earlier quoted context omitted.

They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case, there's for sure no GitHub certificate added to the APKs

NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.

I saw, nice

It seems to not check it automatically, though?

Re: Obtainium: Get Android App Updates Directly from the Source

#94

Post by porridgeraisin »

g-b-r wrote: post #92
porridgeraisin wrote: post #78

Earlier quoted context omitted.

NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.

I saw, nice It seems to not check it automatically, though?

Yeah, you have to set provenance flag to true.

  - uses: JS-DevTools/npm-publish@v2
  with:
      token: ${{ secrets.NPM_TOKEN }}
      access: public
      provenance: true
For example

Re: Obtainium: Get Android App Updates Directly from the Source

#96

Post by furyofantares »

trehalose wrote: post #91
furyofantares wrote: post #69

Earlier quoted context omitted.

Nevermind that being downloaded a million times doesn't mean by a million people, as scammers download their own app to boost numbers -- a million is what, 1 in a few thousand smartphone users? I'd love it to be zero but the amount of vigilance warranted has gotta be a lot less than it was in the past unless there's some argument that magnitude of harm has gone up by a massive amount while probability has gone down b…

> Nevermind that being downloaded a million times doesn't mean by a million people, as scammers download their own app to boost numbers -- a million is what, 1 in a few thousand smartphone users? Isn't this cause for people to be more vigilant? You can't even trust apps that are vouched for by large numbers of users (with these large numbers being not mere claims on a shady website, but statistics officially certifie…

Sure, it means you can't trust download count.

But 2 million downloads among 35 apps is nothing when it comes to evaluating your personal risk. There's like 50,000 times that many apps downloaded every year. The point is the odds of you installing this app are very low. And if those numbers are half fraudulent then the odds are half of that already very small number.

Re: Obtainium: Get Android App Updates Directly from the Source

#97

Post by shakna »

furyofantares wrote: post #96
trehalose wrote: post #91

Earlier quoted context omitted.

> Nevermind that being downloaded a million times doesn't mean by a million people, as scammers download their own app to boost numbers -- a million is what, 1 in a few thousand smartphone users? Isn't this cause for people to be more vigilant? You can't even trust apps that are vouched for by large numbers of users (with these large numbers being not mere claims on a shady website, but statistics officially certifie…

Sure, it means you can't trust download count. But 2 million downloads among 35 apps is nothing when it comes to evaluating your personal risk. There's like 50,000 times that many apps downloaded every year. The point is the odds of you installing this app are very low. And if those numbers are half fraudulent then the odds are half of that already very small number.

That's one incident among many. Don't judge the situation by a singular incident. Google's move to realtime scanning of apps upon install is not because there is no risk.
Post reply on HN