Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Web Is Broken – Botnet Part 2

jan.wildeboer.net

Post reply on HN
Print view View original

131–140 of 301 posts

Re: The Web Is Broken – Botnet Part 2

#131

Post by bloppe »

ChrisMarshallNY wrote: post #9

> So if you as an app developer include such a 3rd party SDK in your app to make some money — you are part of the problem and I think you should be held responsible for delivering malware to your users, making them botnet members. I suspect that this goes for many different SDKs. Personally, I am really, really sick of hearing "That's a solved problem!", whenever I mention that I tend to "roll my own," as opposed to…

These are kind of separate issues. Apps using Infatica know that they're selling access to their users' bandwidth. It's intentional.

Re: The Web Is Broken – Botnet Part 2

#132

Post by wyck »

amiga-workbench wrote: post #7

What is the point of app stores holding up releases for review if they don't even catch obvious malware like this?

This isn't obvious, 99% of apps make multiple calls to multiple services, and these SDK's are embedded into the app. How can you tell whats legit outbound/inbound? Doing a fingerprint search for the worst culprits might help catch some, but it would likely be a game of cat and mouse.

Re: The Web Is Broken – Botnet Part 2

#133

Post by Timwi »

__MatrixMan__ wrote: post #93

The broken thing about the web is that in order for data to remain readable, a unique sysadmin somewhere has to keep a server running in the face of an increasingly hostile environment. If instead we had a content addressed model, we could drop the uniqueness constraint. Then these AI scrapers could be gossiping the data to one another (and incidentally serving it to the rest of us) without placing any burden on the…

Are there any systems like that, even if experimental?

Re: The Web Is Broken – Botnet Part 2

#134

Post by jevogel »

Timwi wrote: post #133
__MatrixMan__ wrote: post #93

The broken thing about the web is that in order for data to remain readable, a unique sysadmin somewhere has to keep a server running in the face of an increasingly hostile environment. If instead we had a content addressed model, we could drop the uniqueness constraint. Then these AI scrapers could be gossiping the data to one another (and incidentally serving it to the rest of us) without placing any burden on the…

Are there any systems like that, even if experimental?

IPFS

Re: The Web Is Broken – Botnet Part 2

#135

Post by alakra »

jevogel wrote: post #134
Timwi wrote: post #133

Earlier quoted context omitted.

Are there any systems like that, even if experimental?

IPFS

I had high hopes for IPFS, but even it has vectors for abuse.

See https://arxiv.org/abs/1905.11880 [Hydras and IPFS: A Decentralised Playground for Malware]

Re: The Web Is Broken – Botnet Part 2

#136

Post by Pesthuf »

klabb3 wrote: post #122
philippta wrote: post #79

Earlier quoted context omitted.

Apps should be required to ask for permission to access specific domains. Similar to the tracking protection, Apple introduced a while ago. Not sure how this could work for browsers, but the other 99% of apps I have on my phone should work fine with just a single permitted domain.

On the one hand, yes this could work for many cases. On the other hand, good bye p2p. Not every app is a passive client-server request-response. One needs to be really careful with designing permission systems. Apple has already killed many markets before they had a chance to even exist, such as companion apps for watches and other peripherals.

Maybe there could be a special entitlement that Apple's reviewers would only grant to applications that have a legitimate reason to require such connections. Then only applications granted that permission would be able to make requests to arbitrary domains / IP addresses.

That's how it works with other permissions most applications should not have access to, like accessing user locations. (And private entitlements third party applications can't have are one way Apple makes sure nobody can compete with their apps, but that's a separate issue.)

Re: The Web Is Broken – Botnet Part 2

#137

Post by zargon »

jshier wrote: post #118
aucisson_masque wrote: post #60

It's interesting but so far there is no definitive proof it's happening. People are jumping to conclusions a bit fast over here, yes technically it's possible but this kind of behavior would be relatively easy to spot because the app would have to make direct connections to the website it wants to scrap. Your calculator app for instance connecting to CNN.com ... iOS have app privacy report where one can check what co…

> iOS have app privacy report where one can check what connections are made by app, how often, last one, etc. Privacy reports do not include that information. They include broad areas of information the app claims to gather. There is zero connection between those claimed areas and what the app actually does unless app review notices something that doesn't match up. But none of that information is updated dynamically,…

I wasn't aware of this feature. But apparently it does include that information. I just enabled it and can see the domains that apps connect to. https://support.apple.com/en-us/102188

Re: The Web Is Broken – Botnet Part 2

#138

Post by realusername »

jeroenhd wrote: post #75
BlueTemplar wrote: post #42

Earlier quoted context omitted.

Yeah, also this means the death of archival efforts like the Internet Archive.

Welcome scrapers (IA, maybe Google and Bing) can publish their IP addresses and get whitelisted. Websites that want to prevent being on the Internet Archive can pretty much just ask for their website to be excluded (even retroactively). [Cloudflare]( https://developers.cloudflare.com/cache/troubleshooting/alwa... ) tags the internet archive as operating from 207.241.224.0/20 and 208.70.24.0/21 so disabling the bot-pr…

That's basically asking to close the market in favor of the current actors.

New actors have the right to emerge.

Re: The Web Is Broken – Botnet Part 2

#139

Post by SoftTalker »

ClumsyPilot wrote: post #52
ryandrake wrote: post #46

Earlier quoted context omitted.

I’m constantly amazed at how careless developers are with pulling 3rd party libraries into their code. Have you audited this code? Do you know everything it does? Do you know what security vulnerabilities exist in it? On what basis do you trust it to do what it says it is doing and nothing else? But nobody seems to do this diligence. It’s just “we are in a rush. we need X. dependency does X. let’s use X.” and that’s…

> Have you audited this code? Wrong question. “Are you paid to audit this code?” And “if you fail to audit this code, who’se problem is it?”

If a car manufacturer sources a part from a third party, and that part has a serious safety problem, who will the customer blame? And who will be responsible for the recall and the repairs?

Re: The Web Is Broken – Botnet Part 2

#140

Post by what »

klabb3 wrote: post #120
andelink wrote: post #108

Earlier quoted context omitted.

> Is that greed? Umm, yes? You are not owed anything in this life, certainly not income for your choice to spend your time on building a software product no one asked for. Not making money on it is a perfectly fine outcome. If you desperately need guaranteed money, don't build an app expecting it to sell; get a job.

> If you desperately need guaranteed money, don't build an app expecting it to sell; get a job. Technically true but a bit of perspective might help. The consumer market is distorted by free (as in beer) apps that does a bunch of shitty things that should in many cases be illegal or require much more informed consent than today, like tracking everything they can. Then you have VC funded ”free” as well, where the end…

>$800/year IAP

That’s got to be money laundering or something else illicit? No one is actually paying that for a timer app?

Post reply on HN