I thought the closed-garden app stores were supposed to protect us from this sort of thing?
[deleted]
The Web Is Broken – Botnet Part 2
71–80 of 301 posts
Re: The Web Is Broken – Botnet Part 2
#72What is the point of app stores holding up releases for review if they don't even catch obvious malware like this?
[deleted]
Re: The Web Is Broken – Botnet Part 2
#73Earlier quoted context omitted.
> Have you audited this code? Wrong question. “Are you paid to audit this code?” And “if you fail to audit this code, who’se problem is it?”
I think developers are paid to competently deliver software to their employer, and part of that competence is properly vetting the code you are delivering. If I wrote code that ended up having serious bugs like crashing, I’d expect to have at least a minimum consequence, like root causing it and/or writing a postmortem to help avoid it in the future. Same as I’d expect if I pulled in a bad dependency.
[deleted]
Re: The Web Is Broken – Botnet Part 2
#74Earlier quoted context omitted.
At least here in the US most residential ISPs have long leases and change infrequently, weeks or months. Trying to understand your product, where is it intended to sit in a network? Is it a standalone tool that you use to identify these IPs and feed into something else for blockage or is it intended to be integrated into your existing site or is it supposed to proxy all your web traffic? The reason I ask is it has fa…
Indeed, if it's a real user from a residential IP address, in most cases it will be the same network. However, if it's a proxy from residential IPs, there could be 10 requests from one network, the 11th request from a second network, and the 12th request back from the same network. This is a red flag. Thank you for your question. tirreno is a standalone app that needs to receive API events from your main web applicat…
My phone will be on the home network until I walk out of the house and then it will change networks. This should not be a red flag.
Re: The Web Is Broken – Botnet Part 2
#75> I am now of the opinion that every form of web-scraping should be considered abusive behaviour and web servers should block all of them. If you think your web-scraping is acceptable behaviour, you can thank these shady companies and the “AI” hype for moving you to the bad corner. I imagine that e.g. Youtube would be happy to agree with this. Not that it would turn them against AI generally.
Yeah, also this means the death of archival efforts like the Internet Archive.
Welcome scrapers (IA, maybe Google and Bing) can publish their IP addresses and get whitelisted. Websites that want to prevent being on the Internet Archive can pretty much just ask for their website to be excluded (even retroactively).
[Cloudflare](https://developers.cloudflare.com/cache/troubleshooting/alwa...) tags the internet archive as operating from 207.241.224.0/20 and 208.70.24.0/21 so disabling the bot-prevention framework on connections from there should be enough.
Re: The Web Is Broken – Botnet Part 2
#76it's funny, i've never heard of or thought about the possibility of this happening but actually in hindsight it seems almost too obvious to not be a thing.
Re: The Web Is Broken – Botnet Part 2
#77> So there is a (IMHO) shady market out there that gives app developers on iOS, Android, MacOS and Windows money for including a library into their apps that sells users network bandwidth
AKA "why do Cloudflare and Google make me fill out these CAPTCHAs all day"
I don't know why Play Protect/MS Defender/whatever Apple has for antivirus don't classify apps that embed such malware as such. It's ridiculous that this is allowed to go on when detection is so easy. I don't know a more obvious example of a trojan than an SDK library making a user's device part of a botnet.
Re: The Web Is Broken – Botnet Part 2
#78Re: The Web Is Broken – Botnet Part 2
#79We need a list of apps that include these libraries and any malware scanner - including Windows Defender, Play Protect and whatever Apple calls theirs - need to put infected applications into quarantine immediately. Just because it's not directly causing damage to the device running the malware is running on, that doesn't mean it's not malware.
Apps should be required to ask for permission to access specific domains. Similar to the tracking protection, Apple introduced a while ago.
Not sure how this could work for browsers, but the other 99% of apps I have on my phone should work fine with just a single permitted domain.
Re: The Web Is Broken – Botnet Part 2
#80How is this not just illegal? Surely there’s something in GDPR that makes this not allowed.
iiuc, they do actually ask the user for permission
Which is ironic considering that I strongly disagree with one of the primary walled garden justifications, used particularly in the case of Apple, which amounts to "the end user is too stupid to decide on his own". Unfortunately, even if I disagree with it as a guiding principle sometimes that statement proves true.