Google have declared Droidscript is malware • Hacker News Board

Re: Google have declared Droidscript is malware

#331

Post by ShroudedNight » Tue, Apr 27, 2021, 6:52 PM UTC

oneplane wrote: post #228

ShroudedNight wrote: post #164

Earlier quoted context omitted.

Your primary alternative already sounds materially better than the 'Current Scenario' you describe: 1 - I'm not sure I've encountered anybody that universally falls within the 90% 'ideal' coverage. The more hostile things are to outliers, the more difficult everyone's life becomes. 2 - As far as I can tell, the slack that allows the bottom and top vigesimile (? 1/20th) to survive is also what allows the flexibility t…

As for point 1: that depends; if your business operates on keeping the center of the bell curve happy, and you don't like to risk that, than implementing something that degrades that doesn't seem like a sound business decision. Keep in mind that this is from the 'producer' perspective. As for point 2: that should indeed be how it works, but the circumstances have changed, especially for large scale general purpose co…

> just 'run whatever code appears at the JMP', we might as well not have an internet.

I'm old enough to have used the internet with a computer running Windows 98SE. As far as I can tell, besides data throughput, only webmail, maps, and media streaming have gotten materially better since that time, and even those peaked in an era when people were still running Windows XP SP3.

Despite all this froth about how we need to lock stuff down within an inch of its life with manufacturer-specified code verification, (North American) banks still seem to mostly be using the same terrible authentication policies they were 10, even 20 years ago.

The hardware problem isn't new; phone taps have been easy to install for decades. The world didn't end, nor did we shut down the telephone network.

In re software, we could easily strengthen owner trust in systems without having manufacturers ensnare us in straitjackets. Trust on first use could allow an infrequently-updated chain loader to verify subsequent components without depriving the owner of using the system as they desire. Hardware tokens, or physical buttons with dedicated circuitry could prevent certain system functions from being configured / updated without direct user intervention. 'Trusted' execution environments could be used to run software of particular significance to the device owner. We have an enormous quantity of tools in our tool box to improve the security of systems without relinquishing ultimate control.

Ultimately, though, liberty will always have some irreducible risk. It's not obvious to me why we should be valuing status-quo business plans to its detriment.

Re: Google have declared Droidscript is malware

#332

Post by veeti » Tue, Apr 27, 2021, 6:52 PM UTC

szopa wrote: post #100

dtx1 wrote: post #39

Earlier quoted context omitted.

Banning it first is fine. banning it first, then not giving a reply to the concerns they have is not. Even if they have reasonable believe or proof that droidscript is indeed malware, it looks like at least a chunk of their userbase uses it for legitimate usecases and the devs, who likely invested at least a few hundred hours of work in it, deserve at least some communication.

I used to work at Google, and a friend reached out to me for help – his company's app was in a similar situation, with similar communication from Google. This was a good friend from high school, so I pressed the issue using internal channels. The person handling it on Google's side was very assertive about them violating a policy, and after some back and forth I received a _vague hint_ about what was the supposed vio…

> It's a safe assumption that the vast majority of people police deal with are criminals. And there's a lot of them. If they gave a detailed explanation of why they are under arrest it would mean a ton of additional work - which would create an unsustainable situation at this scale.

But it's all good, Google is a private company™ and can do whatever they want®.

Re: Google have declared Droidscript is malware

#333

Post by stjohnswarts » Tue, Apr 27, 2021, 6:53 PM UTC

criddell wrote: post #216

ncann wrote: post #161

Earlier quoted context omitted.

Even as a casual Android dev I've noticed it becoming more and more restrictive over the years, from restricting apps from reading storage, to restring apps from accessing clipboard, to restring apps from running in background, and a ton of other things all in the name of protecting customer. Every time I update to a new phone with a new Android version my hobby apps (which only I use, not published anywhere) are bro…

> at least give the power user some choices damn it At some point it just doesn't make economic sense to do that.

That's the way only bean counters should think, not developers, it should be a problem to solve since it helps keep us honest and not just a cog in the system.

Re: Google have declared Droidscript is malware

#334

Post by munk-a » Tue, Apr 27, 2021, 6:53 PM UTC

easton wrote: post #116

wzdd wrote: post #103

Earlier quoted context omitted.

> this is the kind of app that would never have been legal at all on any version of iOS. Pythonista is a complete Python programming environment which provides access to camera, music, contacts, the network, and so on, and has been available for iOS since 2016. What specifically distinguishes Droidscript from Pythonista such that you think Apple would reject Droidscript? https://apps.apple.com/us/app/pythonista-3/id1…

Droidscript has support for writing custom intents, which Pythonista (and Scriptable, a JavaScript version of the same thing) do not have. A malicious Droidscript application could access other applications on the device. https://symdstools.github.io/Docs/docs/app/SendIntent.htm

I know that this has but a fat chance of being taken seriously by Google but... Isn't this a good chunk of the reason why people here on HN and elsewhere have been arguing for much more granular intent management on Android like they had in the early days?

When we get permissions boiled down to one or two popups we end up with issues providing accurate privileges to applications (and might be forced to allow WhatsApp to trawl through our contact list if we ever want to send a picture in it).

Granular control shifts the power to the user and allows programs like this to have more fine tuned privileges.

Re: Google have declared Droidscript is malware

#335

Post by stjohnswarts » Tue, Apr 27, 2021, 6:54 PM UTC

horsawlarway wrote: post #122

FredFS456 wrote: post #105

Earlier quoted context omitted.

There's nothing wrong with the appliance business model - embedded devices that use microcontrollers are Turing complete and yet no one complains about those. It's only when devices are marketed as general-purpose (i.e. smartphones, PCs) but are locked down to prevent running arbitrary user-loaded code that it becomes a problem.

I disagree. I also mind when things like my tractor or my car are locked down to prevent my ability to use a 3rd party repair shop, repair it myself, or make changes so the item better suits me: The person who fucking owns that computer. I think there's a very real risk that the concept of "ownership" is going to die if we continue in this fashion. Do you own a thing if you're prohibited, intentionally - by the manuf…

I think as long as you're willing to give up your warranty on your tractor/car/whatever because you're hacking on it with 3rd party tools/firmware you should be able to do whatever you want with it. Just remember it's a two way street and everything has a price, you will have to give up something to get something.

Re: Google have declared Droidscript is malware

#336

Post by unexaminedlife » Tue, Apr 27, 2021, 6:56 PM UTC

I like most people don't like the idea of a few large groups controlling entire ecosystems. Especially in technology if these companies have a complete stranglehold on the entire system it's not good.

HOWEVER, I really don't think that's the case. I mean look at Hacker News! They built up their brand and product through grass roots efforts. Large ecosystems take notice and recognize, I think, reputation in smaller ecosystems.

When a group gets banned like this and feel it's their only hope, I'm skeptical.

My guess is either these guys are playing dumb or they don't understand why the best software engineers in the world think they're doing malicious stuff. Either way they don't appear to be ready for the "big time".

Re: Google have declared Droidscript is malware

#337

Post by veeti » Tue, Apr 27, 2021, 6:57 PM UTC

easton wrote: post #116

wzdd wrote: post #103

Earlier quoted context omitted.

> this is the kind of app that would never have been legal at all on any version of iOS. Pythonista is a complete Python programming environment which provides access to camera, music, contacts, the network, and so on, and has been available for iOS since 2016. What specifically distinguishes Droidscript from Pythonista such that you think Apple would reject Droidscript? https://apps.apple.com/us/app/pythonista-3/id1…

Droidscript has support for writing custom intents, which Pythonista (and Scriptable, a JavaScript version of the same thing) do not have. A malicious Droidscript application could access other applications on the device. https://symdstools.github.io/Docs/docs/app/SendIntent.htm

You can't access any random application just by sending intents. Available intents must be exposed to other apps if desired - for example, the camera app has a "show the camera for taking a photo" intent.

Re: Google have declared Droidscript is malware

#338

Post by stjohnswarts » Tue, Apr 27, 2021, 6:57 PM UTC

salawat wrote: post #169

kube-system wrote: post #137

Earlier quoted context omitted.

I still like my car to have an immobilizer, and locks on the ignition and doors. There is certainly some level of access controls that most people definitely want.

Those are still "yours" in a sense, so don't fall into the feature set the poster you are replying to is talking about. Though the immobilizer somewhat skirts the line. (Or at least from my personal view). Think John Deere implementing software lockouts in the tractor ECU. That is nothing more than forcing their business model onto the end user through digital logic.

Those are the sorts of things that need to be legislated. You should not be able to lockout people from ECU for example, but the person would have to be willing that a compromised ECU can blow up/damage their engine and they will have to accept that the warranty is invalid the second they mess with the ECU programming.

Re: Google have declared Droidscript is malware

#339

Post by robocat » Tue, Apr 27, 2021, 6:58 PM UTC

eptcyka wrote: post #64

ajross wrote: post #14

Earlier quoted context omitted.

Time for one of these again. So... having read through their marketing material, this is an on-device tool that opens up what appears to be most of the Android application API to at least the user of the device, and potentially to any Droidscript applications they grab from other sources, and... maybe to other apps on the device? It's not clear from a quick read how extensive the runtime control is. So just right out…

Chrome is closed source and has developer tools, and has damn near every permission Android provides. You can app your apps on it, as long as they are of the web variety. Should we not ban chrome too? If droidscript enables ad fraud, isn't it an issue with how the android sandboxing model is fundamentally broken? Given that there are far more people using phones than computers, and a lot of new smartphone users will…

Chrome does not provide raw access to the APIs from JavaScript. Instead everything is sandboxed to the hilt.

Also the product has a very heavy emphasis on security, the security team is superb quality and well funded, and Google know that the team is trustworthy.

Re: Google have declared Droidscript is malware

#340

Post by franga2000 » Tue, Apr 27, 2021, 6:59 PM UTC

simias wrote: post #23

blakesterz wrote: post #2

I had to go look to see what this was: "DroidScript is an easy to use, portable coding tool which simplifies mobile App development. It dramatically improves productivity by speeding up development by as much as 10x compared with using the standard development tools. It’s also an ideal tool for learning JavaScript, you can literally code anywhere with DroidScript, it’s not cloud based and doesn’t require an internet…

Was it used to publish malware? Given that it's a general purpose scripting tool I can imagine that some people would abuse it and use it as some sort of backdoor to get clueless users to run malware without having to publish it on the app store. If that's the argument I can sort of see Google's point here. The Play Store is supposed to be curated and the application should follow certain guidelines. This tool as I u…

> This tool as I understand it effectively provides a loophole that lets people run non-curated code without jailbreak.

Installing non-curated apps has always been supported on Android - no jailbreaking required. Just get an APK either straight from the developer or through any number of alternative app stores, open it, click the "yes, I'm sure" option in the security popup and you've got yourself an app.