Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BBC offices in India raided by tax officials amid Modi documentary fallout

theguardian.com

Post reply on HN
Print view View original

281–290 of 425 posts

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#281

Post by fsflover »

chongli wrote: post #257
eclipxe wrote: post #243

Earlier quoted context omitted.

Because playing them on the screen involves demuxing audio and video, decoding audio and video, usually using two different but complex codecs, some which have extensive capabilities and features (think multilingual subtitles, interactive menus, etc etc). Oh surely your video player should allow you to pause and play with a remote control, right? More code surface. We probably need an ability to check for updates. An…

All of that stuff should be handled through standard APIs. Applications shouldn’t be updating themselves at all; that’s the job of the operating system’s package manager. Really, a video player should be a dumb bit of glue code that wires together file open APIs with video playback APIs, and a few bits and bobs for saving preferences (API) and allowing remote control (another API). There’s no reason whatsoever for a…

With Qubes OS I don't have to care what a video player does, since it's isolated in a hardware-virtualized VM.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#282

Post by vel0city »

chongli wrote: post #249
pessimizer wrote: post #245

Earlier quoted context omitted.

overflows

No, what I’m asking is: why does the operating system allow the video player to do anything other than what it needs to do to play videos? If the video player suddenly starts trying to access files on its own (anything not explicitly chosen by the user through system file dialog) or trying to access the internet then the user should be prompted to give permission. We have this kind of API permission (capability) syst…

Many times these kinds of attacks are buffer overflows, tricking the hardware/OS to execute code it wasn't intending. Its not just that the media player starts to behave strangely, often the attack corrupts code outside the media player. See the Android Mediaserver vulnerabilities, or many of the buffer overflow vulnerabilities in ffmpeg.

If an attack corrupts how the OS checks permissions, it doesn't matter if you've got some API framework for calls, it broke out of it.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#283

Post by [deleted] »

pessimizer wrote: post #247
wavefunction wrote: post #216

Earlier quoted context omitted.

This is a terrible analogy. RT.com is a reliable purveyor of conspiracy theories and incendiary lies. The BBC's examination of Narendra Modi's well-documented behavior leading up to, during and after the Gujarat riots is well-supported by other media and academic sources.

[flagged]

[deleted]

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#284

Post by MobiusHorizons »

chongli wrote: post #249
pessimizer wrote: post #245

Earlier quoted context omitted.

overflows

No, what I’m asking is: why does the operating system allow the video player to do anything other than what it needs to do to play videos? If the video player suddenly starts trying to access files on its own (anything not explicitly chosen by the user through system file dialog) or trying to access the internet then the user should be prompted to give permission. We have this kind of API permission (capability) syst…

The ux you are describing is a lot worse than what people get with vlc or mplayer. For example, you can open videos from the cli, which means there is no file chooser involved. Also if you have a subtitle file (.srt) with the same name as the video you opened, the subtitles will automatically be added. Both of these are things people want as part of a versatile video player.

The level of lockdown you were describing is what we have on mobile platforms (which incidentally still have lots of malware). Generally speaking, people want more flexibility out of general purpose computers.

On the other hand something like pledge would be useful here, since the attack vector is untrusted files, not untrusted applications. With pledge, the application could open any files, then relinquish the ability to open new files before parsing the contents.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#286

Post by bobdvb »

chongli wrote: post #249
pessimizer wrote: post #245

Earlier quoted context omitted.

overflows

No, what I’m asking is: why does the operating system allow the video player to do anything other than what it needs to do to play videos? If the video player suddenly starts trying to access files on its own (anything not explicitly chosen by the user through system file dialog) or trying to access the internet then the user should be prompted to give permission. We have this kind of API permission (capability) syst…

Decoding the video involves hardware acceleration, so data is not just processed at the application layer, it's passed much deeper. In very specific and rare attacks, it's been possible to bypass application and even OS level protections by crafting media files. So that when they're processed there's an overflow which dumps some payload into unprotected memory and allows some intrusion into the viewers system. This has been done with photos, general images and videos.

It's not reliable unless you happen to know the specific, unpatched exploit on the target system. There aren't general purpose vulnerabilities for such things.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#287

Post by Regnore »

pessimizer wrote: post #266
Regnore wrote: post #229

Earlier quoted context omitted.

> The West has resources and well-oiled propaganda machinery in place to control the dissent Can you elaborate on this? Resources I agree with - but that boils down to controlling dissent by just removing a source of it which is not the same as controlling dissent by cracking down

> controlling dissent by just removing a source of it which is not the same as controlling dissent by cracking down You will have to elaborate on how these two phrasings mean different things i.e. what's the difference between "cracking down" on the sources of dissent and "removing" the sources of dissent, and why you support one and condemn the other (if you do.)

My bad for being vague with my definitions:

Cracking down - the government suppresses dissent by force.

Removing the source of dissent - this means solving the underlying issue that would otherwise cause the dissent. This would be government/society providing for the needs and desires of it’s population.

I think most would agree that the first is much worse than the second.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#289

Post by lappet »

mrtksn wrote: post #103

Do India has the issue of "strict laws which are enforced selectively"? Because this reminds me of the traffic light in Grozny, Chechnya that is always red, the people from the regime just ignore it but if someone undesirable doesn't obey the red light(they have no choice, the light is always red) they will face the wrath of the strict traffic code of Chechnya: https://twitter.com/kamilkazani/status/15954560406775562…

Yeah, income tax raids are a standard play in India. They are usually sent to target rich folks who have fallen out of favor.

Re: BBC offices in India raided by tax officials amid Modi documentary fallout

#290

Post by KingOfCoders »

MichaelZuo wrote: post #264
KingOfCoders wrote: post #256

Earlier quoted context omitted.

I don't know about a lot of countries, it doesn't work this way in Germany for sure.

So then who is liable if some dangerous substance is discovered within a company's office in Germany? Or if someone gets hurt by a normal object placed in a peculiar position? Assuming the perpetrator is unknown.

There is an investigation (for that we have the police) on how it got there and who is responsible and if something illegal (determined first by the prosecution office and then determined by a court) was going on.
Post reply on HN