Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook scans system libraries on Android and uploads them to their server

twitter.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Facebook scans system libraries on Android and uploads them to their server

#41

Post by wongarsu »

0x0 wrote: post #7

If the actual files are uploaded(?), doesn't this constitute reverse software piracy? Under what license are the uploaded files covered by? Can facebook require the end users to supply the source code for GPL-licensed library binaries uploaded through this system? What about proprietary oem blobs that are often covered by a no-redistribution license or EULA? What if I am an AOSP or vendor developer working on unrelea…

It's not really reverse software piracy, it's just software piracy. Facebook is pirating software off of users' phones.

Re: Facebook scans system libraries on Android and uploads them to their server

#42

Post by rocqua »

spunker540 wrote: post #36
rocqua wrote: post #12

Earlier quoted context omitted.

If I buy a book, I'm allowed to read that book, but I am not allowed to copy it.

You are allowed to copy it, you just can’t sell copies of it.

The first line of wikipedia: "Copyright is the exclusive right, given to the creator of a creative work, to reproduce the work"

You probably won't be in trouble until you start trying to distribute your copies, but the prohibited thing is copying. Hence the term copy-right.

Re: Facebook scans system libraries on Android and uploads them to their server

#43

Post by EarthMephit »

spunker540 wrote: post #36
rocqua wrote: post #12

Earlier quoted context omitted.

If I buy a book, I'm allowed to read that book, but I am not allowed to copy it.

You are allowed to copy it, you just can’t sell copies of it.

You are not allowed to copy it, or sell copies of it

Under fair-use laws (which vary country to country), you can usually copy a small portion of the work for non-profit educational use

https://en.wikipedia.org/wiki/Fair_use

Re: Facebook scans system libraries on Android and uploads them to their server

#44

Post by wongarsu »

spunker540 wrote: post #38
lugg wrote: post #28

Earlier quoted context omitted.

It's not an angle it's literally copyright infringement. Users aren't given the right to distribute their copies.

So are they allowed to make point in time backups / snapshots of their phone or is that also “copyright infringement”? Usually copyright infringement focuses on distribution for piracy and/or fraudulent sales — this is neither.

Backups are a special case exempted from copyright. What is happening here is clearly not a backup for personal use but redistribution to another party for commercial use.

Re: Facebook scans system libraries on Android and uploads them to their server

#45

Post by brador »

shawnz wrote: post #20
cstross wrote: post #2

How is this not utterly illegal in the EU, per GDPR? (Which was drafted to stop indiscriminate data acquisition on human subjects: I'm assuming that metadata about the core libraries on your phone, in conjunction with FB's user metadata, are trivially de-anonymizable.)

How does this provide any more data for fingerprinting than just checking the model of the phone?

Harder to spoof, less likely to be faked, plus additional meta information.

Re: Facebook scans system libraries on Android and uploads them to their server

#46

Post by wongarsu »

jaimex2 wrote: post #18
amelius wrote: post #10

Earlier quoted context omitted.

Nice angle but I guess the defense is that the user explicitly gave Facebook permission to read those files.

read, not copy. They upload the files up to their servers.

They read it and write an identical version somewhere else. That sounds like a copy to me.

Re: Facebook scans system libraries on Android and uploads them to their server

#47

Post by wongarsu »

heavenlyblue wrote: post #40
londons_explore wrote: post #30

Earlier quoted context omitted.

Frequently those static libraries provide device-specific functionality. For example, the Jpeg decompressor on my phone uses custom silicon, and is a systemwide shared library.

Is there any way to make memory pages executable, but not readable?

Kernel modules are executable, but not readable (by userspace processes). Or just have it in a different process and talk over IPC.

Re: Facebook scans system libraries on Android and uploads them to their server

#48

Post by wongarsu »

shawnz wrote: post #20
cstross wrote: post #2

How is this not utterly illegal in the EU, per GDPR? (Which was drafted to stop indiscriminate data acquisition on human subjects: I'm assuming that metadata about the core libraries on your phone, in conjunction with FB's user metadata, are trivially de-anonymizable.)

How does this provide any more data for fingerprinting than just checking the model of the phone?

My previous phone got an OS patch every few months. You would get most of this by reading the phone model and Android version, but there's probably a smidge more information in the library versions

Re: Facebook scans system libraries on Android and uploads them to their server

#49

Post by makomk »

cstross wrote: post #2

How is this not utterly illegal in the EU, per GDPR? (Which was drafted to stop indiscriminate data acquisition on human subjects: I'm assuming that metadata about the core libraries on your phone, in conjunction with FB's user metadata, are trivially de-anonymizable.)

In general, I don't think this is going to collect any more identifiable data than just logging the phone model and Android build ID would; under almost all circumstances every build should correspond to exactly one set of system libraries, and they could match across upgrades just as easily with just the build metadata. Generally, every phone of the same model sold by the same carrier in the same country will have the exact same Android build with the exact same system libraries.

The main benefit that Facebook likely get out of this is that it helps them debug crashes on devices they don't have themselves.

Re: Facebook scans system libraries on Android and uploads them to their server

#50

Post by jethro_tell »

londons_explore wrote: post #32
cstross wrote: post #11

Earlier quoted context omitted.

I'm pretty sure you can fingerprint a device by gathering data about the binaries (and versions thereof) installed on it. I'm pretty sure that Facebook also know whose instance of the FB app is running on the device in question. Ergo, the data can be deanonymized and gives them more insights into what their users are doing … including, oh, competing platforms and apps? The traditional model of computer security assum…

> I'm pretty sure you can fingerprint a device by gathering data about the binaries Actually, probably not. These libraries are the base system image, which is read-only, and typically will only identify which model of phone it is. It might identify you if you have a custom android build you've done yourself though.

Shit, there are dozens of us. Dozens
Post reply on HN