Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Web Is Broken – Botnet Part 2

jan.wildeboer.net

Post reply on HN
Print view View original

121–130 of 301 posts

Re: The Web Is Broken – Botnet Part 2

#121

Post by tzury »

philippta wrote: post #79
Pesthuf wrote: post #51

We need a list of apps that include these libraries and any malware scanner - including Windows Defender, Play Protect and whatever Apple calls theirs - need to put infected applications into quarantine immediately. Just because it's not directly causing damage to the device running the malware is running on, that doesn't mean it's not malware.

Apps should be required to ask for permission to access specific domains. Similar to the tracking protection, Apple introduced a while ago. Not sure how this could work for browsers, but the other 99% of apps I have on my phone should work fine with just a single permitted domain.

Vast majority of revenues in the mobile apps ecosystem are ads, which by design pulled from 3rd parties (and are part of the broader problem discussed in this post).

I am waiting for Apple to enable /etc/hosts or something similar on iOS devices.

Re: The Web Is Broken – Botnet Part 2

#122

Post by klabb3 »

philippta wrote: post #79
Pesthuf wrote: post #51

We need a list of apps that include these libraries and any malware scanner - including Windows Defender, Play Protect and whatever Apple calls theirs - need to put infected applications into quarantine immediately. Just because it's not directly causing damage to the device running the malware is running on, that doesn't mean it's not malware.

Apps should be required to ask for permission to access specific domains. Similar to the tracking protection, Apple introduced a while ago. Not sure how this could work for browsers, but the other 99% of apps I have on my phone should work fine with just a single permitted domain.

On the one hand, yes this could work for many cases. On the other hand, good bye p2p. Not every app is a passive client-server request-response. One needs to be really careful with designing permission systems. Apple has already killed many markets before they had a chance to even exist, such as companion apps for watches and other peripherals.

Re: The Web Is Broken – Botnet Part 2

#123

Post by klabb3 »

_Algernon_ wrote: post #37
amiga-workbench wrote: post #7

What is the point of app stores holding up releases for review if they don't even catch obvious malware like this?

They pretend to do a review to justify their 30% cartel tax.

Oh no, they review thoroughly, to make sure you don’t try to avoid the tax.

Re: The Web Is Broken – Botnet Part 2

#124

Post by trinsic2 »

jeroenhd wrote: post #75
BlueTemplar wrote: post #42

Earlier quoted context omitted.

Yeah, also this means the death of archival efforts like the Internet Archive.

Welcome scrapers (IA, maybe Google and Bing) can publish their IP addresses and get whitelisted. Websites that want to prevent being on the Internet Archive can pretty much just ask for their website to be excluded (even retroactively). [Cloudflare]( https://developers.cloudflare.com/cache/troubleshooting/alwa... ) tags the internet archive as operating from 207.241.224.0/20 and 208.70.24.0/21 so disabling the bot-pr…

This sounds like it would be a good idea. Create a whitelist of IPs and block the rest.

Re: The Web Is Broken – Botnet Part 2

#125

Post by klabb3 »

fc417fc802 wrote: post #80
Retr0id wrote: post #30

Earlier quoted context omitted.

iiuc, they do actually ask the user for permission

Which is ironic considering that I strongly disagree with one of the primary walled garden justifications, used particularly in the case of Apple, which amounts to "the end user is too stupid to decide on his own". Unfortunately, even if I disagree with it as a guiding principle sometimes that statement proves true.

It’s not about stupidity, but practicality. People can’t give informed consent for 100 ToS for different companies, and keep those up to date. That’s why there are laws.

Re: The Web Is Broken – Botnet Part 2

#126

Post by econ »

andelink wrote: post #108
II2II wrote: post #82

Earlier quoted context omitted.

You're a developer who devoted time to develop a piece of software. You discover that you are not generating any income from it: few people can even find it in the sea of similar apps, few of those are willing to pay for it, and those who are willing to pay for it are not willing to pay much. To make matters worse, you're going to lose a cut of what is paid to the middlemen who facilitate the transaction. Is that gre…

> Is that greed? Umm, yes? You are not owed anything in this life, certainly not income for your choice to spend your time on building a software product no one asked for. Not making money on it is a perfectly fine outcome. If you desperately need guaranteed money, don't build an app expecting it to sell; get a job.

I prefer to focus on the technical shortcomings.

We could have people ask for software in a more convenient way.

Not making money could be an indication the software isn't useful, but what if it is? What can the collective do in that zone?

I imagine one could ask and pay for unwritten software then get a refund if it doesn't materialize before your deadline.

Why is discovery (of many creation) willingly handed over to a hand full of mega corps?? They seem to think I want to watch and read about Trump and Elon every day.

Promoting something because it is good is a great example of a good thing that shouldn't pay.

Re: The Web Is Broken – Botnet Part 2

#127

Post by kmeisthax »

klabb3 wrote: post #122
philippta wrote: post #79

Earlier quoted context omitted.

Apps should be required to ask for permission to access specific domains. Similar to the tracking protection, Apple introduced a while ago. Not sure how this could work for browsers, but the other 99% of apps I have on my phone should work fine with just a single permitted domain.

On the one hand, yes this could work for many cases. On the other hand, good bye p2p. Not every app is a passive client-server request-response. One needs to be really careful with designing permission systems. Apple has already killed many markets before they had a chance to even exist, such as companion apps for watches and other peripherals.

P2P was practically dead on iPhone even back in 2010. The whole "don't burn the user's battery" thing precludes mobile phones doing anything with P2P other than leeching off of it. The only exceptions are things like AirDrop; i.e. locally peer-to-peer things that are only active when in use and don't try to form an overlay or mesh network that would require the phone to become a router.

And, AFAIK, you already need special permission for anything other than HTTPS to specific domains on the public Internet. That's why apps ping you about permissions to access "local devices".

Re: The Web Is Broken – Botnet Part 2

#128

Post by squeaky-clean »

layer8 wrote: post #107
squeaky-clean wrote: post #99

Earlier quoted context omitted.

> whose value (the dependency) will be set by the dependency injection framework I agree with your definition except for this part, you don't need any framework to do dependency injection. It's simply the idea that instead of having an abstract base class CriticalErrorLogger, with the concrete implementations of StdOutCriticalErrorLogger, FileCriticalErrorLogger, AwsCloudwatchCriticalErrorLogger which bake their depe…

The pattern you are describing is what I know as the Strategy pattern [0]. See the example there with the Car class that takes a BrakeBehavior as a constructor parameter [1]. I have no issue with that and use it regularly. The Strategy pattern precedes the notion of dependency injection by around ten years. The term Dependency Injection was coined by Martin Fowler with this article: https://martinfowler.com/articles/…

They're not really exclusive ideas. The Constructor Injection section in Fowler's article is exactly the same as the Strategy pattern. But no one talks about the Strategy pattern anymore, it's all wrapped into the idea of DI and that's what caught on.

Re: The Web Is Broken – Botnet Part 2

#129

Post by ClumsyPilot »

ryandrake wrote: post #102
baumy wrote: post #61

Earlier quoted context omitted.

Your expectations do not match the employment market as I have ever experienced it. Have you ever worked anywhere that said "go ahead and slow down on delivering product features that drive business value so you can audit the code of your dependencies, that's fine, we'll wait"? I haven't.

Yea, and that’s the problem. If such absolute rock bottom minimal expectations (know what the code does) are seen as too slow and onerous, the industry is cooked!

Yeah, about that, businesses are pushing and introducing code written by AI/LLM now, so now you won't even know what your own code does.
Post reply on HN