Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS scanning and following downloaded QR codes has been retracted

twitter.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: macOS scanning and following downloaded QR codes has been retracted

#71

Post by gw99 »

joeframbach wrote: post #67
gw99 wrote: post #18

Earlier quoted context omitted.

This stuff happens all the time. A few years back a company I was contracting for had one of their end users report a high severity security defect. Apparently he signed into the app and thought he had been hacked because a couple of large 6-figure transactions had been made. After several hours of inconclusive investigation where even identifying the user proved difficult, this turned out to be him seeing the market…

Was it Personal Capital? I always thought it was silly that the demo screenshots in the marketing were some absurd amount in the multi millions. Like, who do you think you are marketing to?

No wasn’t them. Similar concept though.

Re: macOS scanning and following downloaded QR codes has been retracted

#72

Post by powerapple »

codyb wrote: post #57
nomel wrote: post #52

Earlier quoted context omitted.

I know someone that doesn’t tell people they work at Apple. They say it’s a death blow to making new friends, always resulting in in the same “well, I don’t like Apple because” or “well I prefer Android because” conversations (or their inverse). I thought they were exaggerating until they proved it to me, by letting me witness the train wreck, at a social gathering.

People seem to have _really strong opinions_ about Apple. I’m in an IRC group and the people in there are great but then very tribal when anyone mentions Apple. It’s a little bizarre to me, the litany of things they can talk about. I’m pretty sure I spend just about 0% of my energy thinking about where people get their phones or which mobile operating system they use.

What's worse is that the brands they use have became the extension of their identity, or even their complete identify. I once mentioned online that FaceID has failed for me almost once a day, I got attacked online by fanboys.... very strange behaviour

Re: macOS scanning and following downloaded QR codes has been retracted

#73

Post by Liquid_Fire »

Tijdreiziger wrote: post #58
yjftsjthsd-h wrote: post #55

Earlier quoted context omitted.

> Well, because using any popular service or app is right out? > Just looking at my own phone, payments, banking, planning transit rides, ordering cabs, keeping in touch with (online and offline) friends, streaming videos and music, gaming, ordering groceries, ordering takeout, translating documents, getting breaking news, taking (good) photos, and reporting vandalism to the city are all proprietary apps. Most if not…

I know for certain that the services I depend on in at least half of those categories either don’t work in the browser, do work but don’t have full functionality, or are just the desktop version.

Maybe it's different where you live, but for me from of the things you listed, the only one that would absolutely depend on a proprietary OS is keeping in touch with friends - because many use services such as WhatsApp that depend on having a phone with Google Play Services. And games where you usually have no choice.

Of the others, many depend on proprietary services, but pretty much all are accessible via their respective websites and I rarely see missing functionality.

payments - just use your card. You could even stick it in your phone case so you always have it if you have your phone

banking - there are some "app-only" banks where I live, but for every one there are 5 normal ones with websites

planning transit rides - all the ones I've used work in the browser

ordering cabs - around here they all have websites... or even phone numbers. Even Uber works via the website.

streaming videos and music - Spotify, YouTube, Twitch etc all work fine in a browser (in fact, on mobile they work better in a browser as you can block the ads!). If you want to host your own, there is Plex and similar.

gaming - most games won't work, but there are web-based and OSS games; Steam Deck could be an alternative

ordering groceries - around here they all have websites

ordering takeout - as above

translating documents - this one is weaker but there are several services that let you do this via the website

getting breaking news - if you really need to see them ASAP, use a site that has an RSS feed - they still exist! Might not work for local news though

taking (good) photos - plenty of OSS camera apps; using an actual camera could be an alternative

reporting vandalism to the city - must be specific to where you live; here everything is via web forms, and if there is an app it just wraps the website

Re: macOS scanning and following downloaded QR codes has been retracted

#74

Post by Tijdreiziger »

Liquid_Fire wrote: post #73
Tijdreiziger wrote: post #58

Earlier quoted context omitted.

I know for certain that the services I depend on in at least half of those categories either don’t work in the browser, do work but don’t have full functionality, or are just the desktop version.

Maybe it's different where you live, but for me from of the things you listed, the only one that would absolutely depend on a proprietary OS is keeping in touch with friends - because many use services such as WhatsApp that depend on having a phone with Google Play Services. And games where you usually have no choice. Of the others, many depend on proprietary services, but pretty much all are accessible via their res…

Yeah, so it’s as I said:

- some services don’t work (you already mentioned WhatsApp, there’s also others (Discord, FB Messenger) - maybe you can use them in the browser but it’s going to be a subpar experience)

- some have limited functionality (bank: works but you need to carry the physical 2FA device to log in instead of using your fingerprint; groceries: around here, the ones with websites have high order minimums and delivery fees; translating: camera translation (essential when travelling or living abroad) is only on the Google Translate app AFAIK; news: the national public broadcaster here doesn’t have a ‘breaking’ RSS feed, and apparently even the ‘all news’ feed is broken anyways)

- carrying around separate devices (camera etc.) brings us back to the original point: if you want to enjoy the niceties of modern devices, FOSS is going to be a compromise

Re: macOS scanning and following downloaded QR codes has been retracted

#75

Post by prmoustache »

regularespresso wrote: post #35

How embarrassing for this man of many titles and authorities, to have his reputation upended by a foolish and avoidable false accusation. A slice of humble pie sticks in the throat, so it is heard.

I am curious to know why someone would tweet something like that before trying it in a lab with a freshly installed VM.

Re: macOS scanning and following downloaded QR codes has been retracted

#76

Post by imwillofficial »

zimpenfish wrote: post #31
imwillofficial wrote: post #24

Earlier quoted context omitted.

I wouldn’t say that’s a fair characterization. Besides the ham fisted approach, the original vuln idea seemed reasonable. They were wrong, it happens to the best of us. I’d say the potential security risk was worth raising the flag over. Better be wrong and safe, having many of us learn something along the way, then overly cautious and leave a potential problem unaddressed.

> then overly cautious and leave a potential problem unaddressed. I don't think "do even the most cursory verification to check if the extraordinary thing I've just seen is actually happening" could be counted as "overly cautious".

As somebody in the security field tackling this stuff every day, I am happy with the tradeoffs made, and the resolution.

Re: macOS scanning and following downloaded QR codes has been retracted

#77

Post by Waterluvian »

gw99 wrote: post #65
Waterluvian wrote: post #37

Earlier quoted context omitted.

I’m quite curious to be a fly on the wall where the decision was made to accommodate the lowest common denominator. Why wouldn’t he just be dismissed rather than wasting hundreds or thousands of dollars of employee time? By chance could you illuminate the thought process?

When you are in a regulated industry it’s better to be sure than incur the wrath of the regulator.

Ah! That’s a good point.

Re: macOS scanning and following downloaded QR codes has been retracted

#78

Post by natch »

malshe wrote: post #59
JimDabell wrote: post #26

Earlier quoted context omitted.

You’re not kidding. From the earlier discussion: > this is the exact same technology Apple lets China use to hunt down their religious and political minorities > one thing is for certain; Apple doesn't treat privacy as a human right. If you can live with that, then more power to you. Something tells me people won’t use this as an excuse to accuse Firefox of human rights abuses though.

This potentially troll comment from the first thread: > That's It. I am done. Back to Debian Linux full time for me. Anyone want to buy a lightly used MacBook Air M1? I hope they didn't already sell their M1 MBA!

I hope they did sell it. It’s right for there to be consequences for not being a critical thinker.

Not that Debian Linux is bad. But selling a machine and setting up a new one is friction that I don’t mind seeing imposed as a cost of unthinkingly following cognitive bias.

Re: macOS scanning and following downloaded QR codes has been retracted

#79

Post by natch »

ignite wrote: post #45
TillE wrote: post #38

Earlier quoted context omitted.

Yeah and to be clear, that's not merely an HN thing, or an internet thing. People - even people who seem very clever - generally have no idea what they're talking about. It's sort of exhilarating to truly understand just how much of the world is built on absolute bullshit.

Just read through the comments on any popular hacker news post. So many divergent opinions, many conflicting. People are sure they are right.

Some of us are right ;-)

But at least I’ll admit that I’m not always right.

Re: macOS scanning and following downloaded QR codes has been retracted

#80

Post by natch »

zimpenfish wrote: post #13
derbOac wrote: post #11

Earlier quoted context omitted.

So... I think replication was needed and have a MacBook myself. However, the claim in question was tricky to verify because it was supposedly occuring over the course of days. I also think it says a lot about collective anxieties over not using an open OS. The scanning wasn't happening but it was plausible and there wasn't really much to do about it other than try to verify it. I think the episode says less about col…

> The scanning wasn't happening but it was plausible I didn't think it is plausible which is why I set up a whole bunch of replication scenarios to verify the extraordinary claim. > It doesn't say the scanning isn't happening, just that it's not MacOS. I think it's clear that the scanning isn't happening and that it was just Firefox refetching something? "I now believe the canary token was triggered [...] by Firefox’…

Unfortunately he doesn’t go the full distance and tell us unambiguously whether or not he clicked on said shortcut. Which would say nothing about the already settled macOS question but would say something about Firefox.
Post reply on HN