Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Localhost tracking" explained. It could cost Meta €32B

zeropartydata.es

Post reply on HN
Print view View original

161–170 of 286 posts

Re: "Localhost tracking" explained. It could cost Meta €32B

#161

Post by aduwah »

globalise83 wrote: post #124

This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.

Yeah and let's take away the income from the PMs and Engineers and leave the people who actually call the shots unharmed.

Once I worked at a place that actually made a calculation of how much an outage costed to the company and gave it to the engineers who resolved the issue to "think" about how bad they were.

What you propose is equally confused and wrong

Re: "Localhost tracking" explained. It could cost Meta €32B

#162

Post by fifilura »

BlarfMcFlarf wrote: post #157
fifilura wrote: post #122

If this fine is collected. Will I get the money? Serious question. I don't generally mind paying taxes and all that. But in this case I feel I am the person offended and I should get some kind of compensation. I'd say €1-2000 would make me feel somewhat compensated.

Theoretically, fines replace tax revenue, so you get compensated by lower taxes. (Practically, spending and income are decoupled and taxes are mostly just an inflation management strategy.)

I can understand it of course. But in this case I feel personally offended. I would like to see the money handed to me.

Re: "Localhost tracking" explained. It could cost Meta €32B

#163

Post by hoppp »

globalise83 wrote: post #124

This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.

Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge.

Its better to blame the management and higher ups or zuck himself directly. Blame the people who finance it and profit from it, not the people who coded it. Follow the money

Re: "Localhost tracking" explained. It could cost Meta €32B

#164

Post by hooverd »

haliskerbas wrote: post #148
globalise83 wrote: post #124

This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.

[deleted]

do what engineers in other fields do

Re: "Localhost tracking" explained. It could cost Meta €32B

#165

Post by const_cast »

aorth wrote: post #92

Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twit... Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook…

Web apps have been sabotaged so severely for years now, and it really peeves me. Half the time they bombard the UI with "use the app!!1" popups and the other half of the time they just don't work.

The worst part is that a lot of native apps these days are just web views. You can't even be bother to use the native UI toolkit and you expect me to download your app? If this is just safari with extra steps then let me use safari!

Re: "Localhost tracking" explained. It could cost Meta €32B

#166

Post by const_cast »

alchemist1e9 wrote: post #109
throwawayffffas wrote: post #76

Earlier quoted context omitted.

> I've recently been experimenting with running the browser (on my desktop) in a network namespace precisely because of these reasons. Let me introduce you to https://www.qubes-os.org/ .

For the ultra paranoid is there anything that can do this on a smartphone?

I believe GrapheneOS has true sandboxing.

Re: "Localhost tracking" explained. It could cost Meta €32B

#167

Post by hoppp »

dvngnt_ wrote: post #118
bobthepanda wrote: post #80

Earlier quoted context omitted.

Companies have been trying to make AR/VR the next platform shift but I'm not super convinced that people actually want or desire this outside of a few niche games. To me it feels like it has about as much staying power as 3D glasses in movies.

For gaming and media consumption, VR is here to stay. The meta raybans have also been successful. As far as replacing your smartphone with AR glasses that remains to be seen

I think the world is progressing away from headsets or screens.

We will just have an AI that will do everything, we just ask. "Book a flight, order a pizza and reply to my emails" boom, done.

Re: "Localhost tracking" explained. It could cost Meta €32B

#168

Post by hoppp »

gpderetta wrote: post #111
Miraste wrote: post #103

Earlier quoted context omitted.

Simpler than that: AI co-opted the hype machine and the buzzword gurus, and therefore the investor money.

wait for AI generated virtual worlds. On a blockchain.

I cant wait for the rug pull

Re: "Localhost tracking" explained. It could cost Meta €32B

#169

Post by const_cast »

riddley wrote: post #140

I'm guessing I'll get down-voted for this, but what's to stop any browser/executable from trolling through /proc on Linux and knowing about what every process running as you is doing?

Nothing really. Desktop operating systems are basically grandfathered into the modern world. They have the old timey approach to application security. That being, applications can access everything on your computer, and there's no fine-grained permission systems.

But, for OS that we've developed later, we kind of decided that's a problem, and applications are a vector for malware, and "trust" just isn't enough. So Android and iOS did the whole permissions thing.

Now, we've gone back and added some stuff onto desktop operating systems. Of course Linux has containers these days on desktop. Like, I'm running Firefox right now - but Firefox can only access it's runtime folders and ~/Downloads. So, if there's a zero day sandbox breach, I won't get data stolen. There's also SELinux and Apparmor and stuff and you can really jump into the deep end with this.

But, we largely view it as unnecessary because we're running open-source software from trusted repositories. We probably shouldn't view it that way.

Re: "Localhost tracking" explained. It could cost Meta €32B

#170

Post by david_allison »

throwawayffffas wrote: post #14

So I am seeing two issues here. 1. Android allows apps to open ports without permissions. And apps to communicate with each other without permissions. 2. The browsers allow random domains to access services on the localhost. Without notifying the user. We have seen vulnerabilities in the past accessing dev services running on localhost. Something should be done there.

> Android allows apps to open ports without permissions.

Just to clarify: you need `android.permission.INTERNET`. This is a default permission (granted by default at install time with no user interaction).

GrapheneOS allows this permission to be disabled.

As far as I'm aware, you can't lock this down to 'allow only intra-app communications via localhost', please let me know if I'm mistaken.

Post reply on HN