Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android may soon restrict on-device ADB

kitsumed.github.io

Post reply on HN
Print view View original

381–390 of 536 posts

Re: Android may soon restrict on-device ADB

#381

Post by NopIdoN »

chii wrote: post #218
hypendev wrote: post #83

Android had a tradeoff - less vertical integration and more annoyances, a bit worse software quality, for a more open, customisable and utility-like experience. I loved that. Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse. Doesn't make sense anymore. They can now do 99%…

> send a photo to your mac/PC is "upload to google photos and hope it decides to sync". and conveniently, google now has access to your photo, the meta data, and potentially able to scan it for advertising purposes.

and hopefully the other scans won't trip a false positive that leads to your inconvenience/death

Re: Android may soon restrict on-device ADB

#382

Post by Grombobulous »

ffsm8 wrote: post #374
Grombobulous wrote: post #338

Earlier quoted context omitted.

Or the tariffing party just continues buying very nearly the same amount of things at higher prices in many categories because those items don’t have perfectly elastic supply and demand.

Technically true but highly misleading. The amount of good like that are few, less then 30% of the EU -> US trade.

That’s actually kind of like not a good statistic though.

For 30% of transactions with the EU it’s just the US shooting itself in the foot and passing on higher costs to average Americans.

Imagine enacting a tax where 30% of the money collected was a net negative. I can’t think of many taxes that are that poorly constructed.

For the 70% of transactions where US companies and individuals decide to buy less or use alternative sources, doesn’t that at some point harm US businesses? At the very least you’re now artificially lowering competition, which tends to drive overall prices up and quality down.

Re: Android may soon restrict on-device ADB

#384

Post by hnlmorg »

zaptheimpaler wrote: post #325
microtonal wrote: post #30

I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing. The other proposed change (to restrict access to certain interfaces o…

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

Re: Android may soon restrict on-device ADB

#385

Post by hnlmorg »

petre wrote: post #369
asveikau wrote: post #352

Earlier quoted context omitted.

In the post iPhone era, a lot of what gets sold as security features is actually just removing functionality from the device. In early days of this, I honestly think it was rooted in the famous Steve Jobs paranoia, the one that shipped without an app store and told users to use Safari, the same Steve Jobs that was said to not want certain medical devices during cancer treatment to touch him because they weren't beaut…

It's a security theater but you should at least respect that the guy was willing to die for beautifully designed devices and rid us of Adobe Flash.

> you should at least respect that the guy was willing to die for beautifully designed devices

I don’t think that kind of stupidity warrants respect.

Re: Android may soon restrict on-device ADB

#386

Post by KerrAvon »

hnlmorg wrote: post #384
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

"Better things aren't possible" is a terrible outlook. There have been real improvements in this space, such as passkeys, and recognition that some of this stuff, like frequent password changes, is counterproductive.

Re: Android may soon restrict on-device ADB

#388

Post by grishka »

jiffygist wrote: post #245
peheje wrote: post #42

We need Linux on phones. Bank apps not needed as long as I can use browser. But do need some things like wireless cards, popular apps like Sonos and Spotify working.

We need unlockable bootloaders on ALL phones. Then many more OSes will come

Pixels do have unlockable bootloaders, but they also have a non-unlockable hypervisor that would snitch on you and make some apps refuse to work.

Re: Android may soon restrict on-device ADB

#389

Post by a-dub »

use encryption and keys for all socket connections to adb, listen on 0.0.0.0 and unify the wifi thing with the socket thing, add an app level permission that allows apps to access an ephemeral system key via the binder to enable libadb style usecases?

Re: Android may soon restrict on-device ADB

#390

Post by TeMPOraL »

AnthonyMouse wrote: post #368
zaptheimpaler wrote: post #325

Earlier quoted context omitted.

"Security" is just a scourge on software at this point. It means 2FA on every trivial site, being logged out every few hours for no good reason, having to fuck with settings and type "disable sandbox" to run an agent in YOLO mode which still won't work over mobile, being unable to install an unsigned extension at all in firefox (not behind a setting, literally impossible - you have to get Firefox Developer Edition),…

There is a simple and highly accurate heuristic to tell if a security measure is reasonable: Is it an open standard that anyone can permissionlessly implement? When the answer is yes, there is a high probability that it's something reasonable, e.g. TOTP. When the answer is no, what you will find behind the curtain is either a fool or a crook.

This heuristic is not covering the dimensions of interest here, because it fails to address the key security questions (that the industry usually wants people to not even think about):

Who is doing the securing, whose interests are being secured, and against who/what?

Security isn't an unqualified good thing to have. It's just an instrument of control. Who wields it and how are the paramount questions. You can have an "open standard that anyone can permissionlessly implement", aimed at protecting interest of third parties, by securing the device from its actual owner. In fact, that describes many, if not most, security measures introduced in computing over the past 20 years, especially on the web and mobile devices.

Post reply on HN