Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

See what JavaScript commands get injected through an in-app browser

krausefx.com

Post reply on HN
Print view View original

51–60 of 330 posts

Re: See what JavaScript commands get injected through an in-app browser

#51

Post by pizzathyme »

mywacaday wrote: post #30
paxys wrote: post #21

Earlier quoted context omitted.

People are going to reply to you with the usual "we are better than them", "we are a democracy" etc., but reciprocity clauses are very common in areas like international trade, travel, disarmament treaties, emissions control and lots more. In fact China would never have been allowed into the WTO (which happened in 2001) had they not made sweeping changes to their economy and assured the world that they would compete…

Why is it unfair?

US companies like Meta, Google, are banned in China. Chinese companies are not banned in the US. US investors are barred from making controlling acquisitions of Chinese companies. Chinese investors are free to gain ownership in any US company they like.

The rest of the world is generally playing on a level globalist playing field of free trade and open competition. The theory for decades has been that if the world treats China like every other country and then over time they will become more open. But this theory has been disastrously wrong. China’s communist party is a mercantilist country where the government and private industry act together as one.

Re: See what JavaScript commands get injected through an in-app browser

#52

Post by 10u152 »

walls wrote: post #34
sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

What happened to free speech being the bastion of America and the only thing that can counter misinformation and propaganda? Suddenly doesn't seem to work so well when a Chinese app is granted that privilege.

How is stealing users credit card information and all keystrokes free speech again ?

Re: See what JavaScript commands get injected through an in-app browser

#53

Post by systemvoltage »

sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

It's amazing. Tiktok has been HN's darling for the longest.

Re: See what JavaScript commands get injected through an in-app browser

#54

Post by franklampard »

mensetmanusman wrote: post #27
sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

Because China is ruled by technocrats who are probably book-smarter than Western politicians. In the west you typically have to be rich to be a politician, in China you have to be smart, then you get rich(and ban the NYT when your corruption is uncovered).

Lololol techno what which one?

Re: See what JavaScript commands get injected through an in-app browser

#55

Post by quickthrower2 »

londons_explore wrote: post #2

Was anyone expecting otherwise? They'll use it to make their algorithm better, and they'll use it to better target ads. Both of those things are good for me the user, so I'm fine with it. And for those who don't like that, use a blocker, or don't use TikTok.

I walked into a shop. They place a bug on me, so they can listen to my conversations in the store, and the store next door if I leave and pop in there. Both conversations about products, and conversations about I am having with my therapist about personal problems. Everything is recorded.

They use it to make their algorithm better, and they'll use it to better target ads. Both of these things are good for me the shopper, so I'm fine with it. If they sell that data to other companies, have their employees LOL at my problems, or secretly pass it on to the police or spy agencies, that is totally cool. Nothing to hide here!

And for those who don't like it, don't shop at this particular store.

Re: See what JavaScript commands get injected through an in-app browser

#56

Post by YetAnotherNick »

ajross wrote: post #25
paxys wrote: post #21

Earlier quoted context omitted.

People are going to reply to you with the usual "we are better than them", "we are a democracy" etc., but reciprocity clauses are very common in areas like international trade, travel, disarmament treaties, emissions control and lots more. In fact China would never have been allowed into the WTO (which happened in 2001) had they not made sweeping changes to their economy and assured the world that they would compete…

> reciprocity clauses are very common in areas like [...] Distributing software for you to run on your own hardware is speech, though, and it's protected by the first amendment. You can license the distribution of your own software if you want, but you can't tell me I can't give you software if you want it. Basically: how do you think this would work, in a way that wouldn't also make Linux or gcc or whatever availabl…

This is a strawman argument. No one is telling to stop them from distributing software. Just remove the TikTok servers from operating.

Re: See what JavaScript commands get injected through an in-app browser

#58

Post by nopenopenopeno »

sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

The corporations that control our government depend on China’s cheap labor. It’s as simple as that.

Re: See what JavaScript commands get injected through an in-app browser

#59

Post by jabbany »

sva_ wrote: post #9

I just don't understand how we can allow a Chinese social media app in the west, while any non-chinese social media apps aren't allowed there? Same with housing, why can Chinese nationals buy housing here, while I can't do so there?

There is an interesting meta discussion here but the parent is over-simplifying things.

> How we can allow a Chinese social media app in the west, while any non-Chinese social media apps aren't allowed there?

Easy. The laws are different.

"Non-Chinese social media app"s are not banned in China, just that if you run one it need to be licensed (https://beian.miit.gov.cn/) first before you can start servicing. Licensing is difficult since there's requirements about keeping data domestic, having physical presence should legal enforcement be necessary (i.e. there are people to arrest if something goes wrong), and complying with takedown requests (both copyright and political). Western big tech companies (rightfully) do not want to comply, so they do not get licenses, and thus have no presence. Attempting to "just provide service" without a license will result in blacklisting via the GFW as enforcement.

"Allow a Chinese social media app in the west" -- this is also more complex. If TikTok or friends violate laws in the west they are also liable for any punishment. For example, TikTok and WeChat comply with the GDPR in Europe and keep EU data local to the EU. If they didn't they'd be looking at a potentially huge fine and possibly getting banned. Similarly they also comply with copyright stuff like DMCAs. If they didn't, the FBI can seize their domain and compel ISPs to not resolve it just like the GFW (this has precedent and has been done before).

So the meta question becomes: Are the current protections in the west sufficient? To which the answer is probably no.

But in any case, in the free world, whether a Chinese social media app's presence is allowed to be maintained should not be dictated by ideology, but rather through real demonstrated evidence of misbehavior and/or harm (which is why research like this is important).

Re: See what JavaScript commands get injected through an in-app browser

#60

Post by whatgoodisaroad »

TheAceOfHearts wrote: post #28

Can websites protect against this through the use of Content Security Policy (CSP) [0]? [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

CSP protects against an XSS threat model, but once the attacker has control of the browser itself, defeating CSP is trivial since you can just decorate scripts with the nonce string (or equivalent).
Post reply on HN