Samsung embeds IronSource spyware app on phones across WANA

Do you have sources for that? No problem if they're not in English.

If Putin didn't want bribery to go rampant he would set the example, and force other top leaders to do the same, but instead he flaunts his properties, yats, women that he enjoys; but it's probably a price too high for him to pay. I bet Xi Ping enjoys similar privileges but in much more private manner.

That's wishful thinking. Flying drones aren't the only threat, or the main threat, and there isn't such a thing as "counter-UAS tech", only counter-yesterday's-UAS tech. Radio jamming was "counter-UAS tech" until the mass production of fiber-optic-controlled FPV drones starting five months ago, for example. You can still find vendors marketing it as such.

30 milligrams of high explosive is enough to open your daughter's skull, or, more relevantly, your commanding officer's daughter's skull, and there are a thousand ways to deliver it to her if she can be tracked: in pager batteries, crawling, swimming, floating, waiting for ambush, hitchhiking on migratory birds, hitchhiking on car undercarriages, in her Amazon Prime deliveries, falling from a hydrogen balloon in the mesosphere, and so on. And if 30mg is too much, 2mg of ricin on a mechanical ovipositor will do just as well.

All of this is technically possible today without any new discoveries. At this point it's a straightforward systems development exercise. And you can be sure that there are bad people working for multiple different countries' spy agencies who know this; they don't need me to tell them.

This is the thing that has always concerned me about Cloudflare. The structure of their operation is "we do a MITM on most of the encryption on the internet". Even if that doesn't make you immediately suspicious that it was set up as a spying operation on purpose (compare "encryption added/removed here" Snowden slide), it makes them a massive state espionage target. Do they really have the ability to resist that level of persistent targeting from every country in the world?

Yes, this happens. Industrial espionage is popular.

From what I've seen with bribes, it doesn't even take life-changing amounts of money.

> 1. Low-level employees typically don't have access to sensitive information.

Snowden was a contract Sharepoint admin. He was on the absolute bottom of the org chart.

> 1. Low-level employees typically don't have access to sensitive information.

You would think, but when I was interning (well, it was a paid internship) for a company, I was fixing an excel spreadsheet with payroll information for an entire department of a few hundred people. Not the best piece of "opsec", but when you are in a hurry (pay was due in a couple of days) and most people are on vacations "hey the junior kid can probably fix it, he seems fine" is a way too common approach. And it is fine - sometimes for a long time. Until it isn't.

When a security analysis was done of Chinese parts of the Dutch mobile network, that was pretty much the conclusion: Chinese vendors deliver software and components full of vulnerabilities, but none of them seem to be intentional.

Since then there has been a movement to reduce Chinese vendors in general our if security concerns, as well as to improve the security posture of the mobile networks by doing things like "encrypting connections" and "switching away from telnet".

On the other hand, the Chinese managed to break into the US wiretapping system, so it's not like other networks aren't vulnerable either.

>I’ve yet to see a secure piece of software come out of China in my 30+ years of coding.

SW coming out of Korea's domestic industry giants isn't any better. Because they used to treat SW like a cost center or another item on the BoM.

IIRC, the only way to do online banking in Korea years ago, was you needed Internet explorer and some active-X plugin that supported encryption.

Some Korean giants do have good SW, but a lot of it is developed internationally by offices outside of Korea.

Better to swallow the poison that doesn't kill you(for now) than to swallow the one that is intended to kill you.

Yet in telco it is much easier and faster to get a bug fixed in Chinese equipment. IMO it is more likely you don't work with critical infrastructure than the problem being Chinese equipment.

Supermicro IPMI comes to mind. If it was compromised we would have known by now.

Brother you cannot be serious with this racist take

It's also a mistake to assume that a very capable country can't get into a network that uses US equipment/software... especially Cisco equipment with all the "forgotten" hardcoded logins. Iran is better off with Chinese equipment than American or Korean.

Some of the footage coming out of Iran of the aftermath of these assinations have shown specific rooms in buildings targeted, leaving the rest of the building in-tact. For a high value military target like chief of the armed forces, it seems unlikely that would be a warcrime as the civilian casualities would be low compared to the military advantage of the target.

[The nuclear scientists on the other hand are much more questionable because its pretty unclear if they are legal targets at all]

When there is no one willing to prosecute it, is it still a crime?

Yep, tomorrows forecast: raining fire

In my case I wanted a damn SD card slot. And more than 2 years of security updates.

Motorola has well priced excellent phones with minimal bloat.

From first hand experience, I can confirm that AppCloud is installed on certain carrier versions of S series phone as well.

No there are lots of Chinese phones with minimal bloatware, like the nothing phone cmf 1, sure they only come with 2 years of updates but what you gonna do at that price...

If you're in the middle east, I'm sure you'd rather be spied on by China.

Do you imagine that shit? You're a nuclear scientist, working on a program for generating electricity, your country is open to being audited and complies with the restrictions and has no weapon's program, one day you come home and then a fucking rocket comes right inside your appartment and kils you and your whole family.

Ain't that a bitch? I get Khamas was hiding there too... And since they have all that precise rockets that can take a single appartment down, why did they reduce Gaza to rubble?

The ramifications of this make me sick: evil not only wins but also writes history... And yeah the midwits here will unironically look you in the eye and explain how killing children is ok because of this of that... You being able to explain horrors doesn't make you smart or pragmatic, it makes you have no self respect and makes your personal boundaries weak, and the same mind that finds arguments to cope with the horror his tax money funds will find arguments to cope with a lot more until it's his turn on the grinder and by then it'll be too late.

Looking around, you can get an A series or unlocked iPhone 13 new from a prepaid mvno for $0.

A refurbished iPhone 13 is $300 on amazon, which is close to the cheapest M ($250). I can’t find new 13’s for sale except via budget carriers.

(Sent from my 12 mini which is better than all that followed it: $200-ish for excellent condition, refurbished.)

Wut? Besides that you can uninstall whatever you don't want or even replace the operating system with a bare android or whatever else you want, you're forgetting about Fairphone, Murena, and probably others. I had an apple phone for work once and it's not like it doesn't come with a lot of bloat preinstalled and tries to get your permission to snitch on where you are and what you do. It has toggles for some of the things but you can only do what apple lets you do. Also consider daily use, where you will install third party software to get stuff done: you're not better off with the necessarily commercial software from apple's store than with pretty much anything you can get on f-droid and other open source stores

Recommending Apple for privacy only makes sense for those who don't actually care and just want the feel-good premium brand

The trick is to define "bloatware". Is that known knowns (stuff that's visible), known unknowns (stuff that's added that's not visible), and/or unknown unknowns (stuff added we are pretty sure is there but can't prove)? Apple adds all kinds of carrier-specific crap on every phone, but it's not readily discoverable. Android mfgrs must also because of carrier contracts and country-specific regulatory approval requirements. There's likely little means of escaping this without a BYOD non-Android, non-overseas, non-Apple phone that may or may not exist. Surely there is an obvious, viable alternative somewhere I'm missing that I hope exists.

OnePlus has a phenomenal software experience

That's incorrect. Zenphone is a bliss.

I like the Samsung apps on my Galaxy.

Open an email from any email client and give it a try.

Every vendor waits a month before sending out security patches, including Google. I've never understood this (with Linux desktops as my context) but so if you have a risk profile where the OS needs more frequent updates but still want to use Android, you need to take extra hardening steps such as limiting what you expose the OS to (from the outside (firewall, turn off unnecessary connections like Bluetooth) and inside (potentially malicious apps))

GrapheneOS if you can live without Google Wallet and hardened Google Pixel (the only secure Android device family to date).

It's not being pedantic. Disabling the application does not give me the storage space back.

If people are paying for upgrades to storage space it's completely reasonable for them to be annoyed by bloatware

Only because it is mounted as one. It is like saying that you can't have your house in pink because it is green.

Except uninstallining the app does not equal removing it, as you claim. Removing it from list of apps to load is not removal. Not to mention it resets back to installed and you have to rerun the command.

You also have to enable developer options (tap the Android build number N times) and then enable USB debugging. You can disable USB debugging and the developer options afterwards (keeping USB debugging on is insecure).

The universal android debloater makes uninstalling packages easier, it has descriptions and categorizes packages by how safe they are to uninstall.

Thanks, my issue so far was with the 2nd step, as if my Linux did not recognize my device. I might have a go on Windows if Linux will not work again.

MENA - Middle East & North Africa

WANA - West Asia & North Africa

SMEX - "a non-profit that advocates for and advances human rights in digital spaces across West Asia and North Africa." (from their website)

"Arab countries"

Ah, I see. Trying to find a way to include Pakistani, Afghanistan, Somalia i.e non-Arab or Persian Muslim states in the vicinity.

The fact that they were struggling for revenue just made the massive spend seem even weirder to me, but I suppose it could make sense if they truly expected to somehow get >4.4 billion back from ad revenue eventually. They also bought Wētā FX for $1.6 billion around the same time and did basically nothing with it.[1]

[1] https://www.fxguide.com/quicktakes/unity-software-with-a-com...

no, unity was dying for low profitability and ads had higher margin

I argued against the acquisition at the time, including against accepting the framing that it was a "merger", and I think everything that's transpired since then has validated my views.

Sadly, I was outnumbered and “it is difficult to get a man to understand something, when his salary depends on his not understanding it” applied as it always does.

John Riccitiello was a terrible CEO

I think there's non-zero chance this company will go down in flames. I think its only hope at this point is a sufficiently motivated activist shareholder.

> Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not.

Not sure how to phase this legally, but please also add a provision against manufacturers making the "custom firmware" logo hideously ugly on purpose to discourage rooting - like e.g.Microsoft did for Surface tablets.

> 3. Users should have the ability to opt themselves into cryptographic protection, either on the original or modified firmware, for anti-theft reasons.

Full agreement here. I very much would like to keep the bootloader locked - just to my own keys, not the OEMs.

> Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not.

Another thought on that point: Why of all things is manufacturer approval so important? We know manufacturers often don't work for - or even work against - the interests of their end users. Manufacturer approval is not an indicator for security - as evidenced by the OP article.

If anything, we need independent third parties that can vet manufacturer and third party software and can attach their own cryptographic signatures as approval.

4. Apps with special security needs are allowed to detect whether a device is unlocked and can either disable themselves or go into a mode that shifts ALL related liability onto the user. It's not the bank's fault if the user disabled protections and some spyware logs the online banking password or something like that.

Repeal and outlaw drm. It was a mistake that violates everyone's constitutional rights.

DRM can still stick around and be popular. For example, consider an Apple TV. They make the hardware and software, so it can be locked down under the provided rules. Or a console. We might consider devices which are used for streaming or movies to not be general purpose computation devices. Which, historically, they haven't been.

Watching copyrighted stuff on general purpose computers is a very new phenomena, and it's still quite atypical IMO.

What there are is many people utterly convinced that this brings some security to end-users. See the other messages in this thread. DRM is only a fraction of the problem.

DRM is a barrier to legally protected purchasing digital media for me. I will buy an album from iTunes (no DRM), but I will not buy digital movies the same way.

It wouldn't forbid shipping the device with a virus scanner. It would only forbid refusing the user control over what software does and does not run.

There might be a couple messy edge cases if applied at the software level but I think it would work well.

Applied at the hardware level it would be very clear cut. It would simply outlaw technical measures taken to prevent the user from installing an arbitrary OS on the device.

Regarding warranties, what's so difficult about flashing a stock image to a device being serviced? At least in the US wasn't this already settled long ago by Magnuson-Moss? https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty...

> Won't this also forbid virus scanners that quarantine files?

Yes. If I really _want_ to execute malware on my device, I should be allowed to do so by disabling the antivirus or disregarding a warning.

> I don't think it's reasonable to expect any manufacturer to uphold a warranty if making unlimited changes to the system is permitted

It is very reasonable and already the rule of law in "sane" jurisdictions, that manufacturer and mandated warranties are not touched by unrelated, reversable modifications to both hard- and software.

>virus scanners

You can (and should, imho) remove anti-virus software.

> A normal person does not have secret agents attempting to flash malicious images to his phone while he's in the shower.

No, but millions of women have controlling partners or friends who betray their trust and, for example, many people going through U.S. Customs are being asked to surrender control of their devices so they can be used without their knowledge. There’s a well-funded malware industry with a lot of customers now.

> AFAIK that's true for many vendors but for example [on] Pixels you can relock the bootloader with other keys

Oh that's pretty cool, wasn't aware.

> The crazy thing is that on all the devices I've had AVB is implemented on top of secureboot. Being able to set your own secureboot keys is bog standard on corporate laptops. The entire situation makes absolutely no sense.

Hold on, could you elaborate a bit on this? I thought it was an either/or type deal cause they do the same thing.

Verified Boot isn't merely to thwart Evil Maids, but by and large provide what's known as "Trusted Computing Base". And yes, given the proliferation of smartphones and the nature of sensitive applications built on top, most people, even if they don't realise it, need it.

> if I buy something then I own it.

That's the point: you can't buy it, only license.

> Having your vehicle serviced by someone other than the dealer could void your warranty and poses a safety risk

Good tongue in cheek post, but in the US Magnuson-Moss prohibits warranty claim denials merely on the basis of non-OEM parts and service. It also puts the burden on the manufacturer to demonstrate the defect or failure was the direct result of the non-OEM part. Other jurisdictions have similar laws on the books.

Right to repair already exists in certain aspects and needs to be expanded (and enforced. Tons of those ‘will void warranty’ stickers are lies and you have legal rights to poke around)

You make an interesting point here. While “rooting your phone can void your warranty and pose a security risk“ may be a factually true statement, we must also consider some entirely unrelated and possibly untrue statements that could be theoretically uttered in another reality.

We can get so bogged down with “things that are real” and “exist in this universe” that we completely fail to focus on the vital stuff like “Bigfoot is circumcised” and “Who did it?” and “Why?”

>For starters, in most places, warranty is a legal requirement and the manufacturer isn't allowed to void it for whatever reason they want.

This only makes the statement untrue if you use “can” and “will” interchangeably.

>More importantly, rooting is only a security risk in the sense that it increases the attack surface for exploits.

This is a good point. What even is “attack surface” anyway? Does anybody actually consider it when “evaluating security posture”? If I simply choose not to care about attack surface because I don’t want to, then doesn’t it simply become a factual nonissue? There are no answers to these questions

Malware van persist across reboots regardless of verified boot. What it can't do is persist through a factory reset.

But if you really want a thorough reset, simply re-lock the bootloader and flash stock firmware from there. Nothing can persist through that without an exploit in the verification chain and if you have that kind of exploit, you don't need the bootloader to be unlocked in the first place.

Also, there are devices out there that let you enroll your own keys, like the Google Pixel series.

Computer usage and consequently threat landscape went through a crazy change from 40/50 years ago. Desktops are a minority of devices. If you take personal devices even more so. Most people in the world with a computer have just a pocket one. Especially in WANA countries discussed

If you talk to regular non IT savvy people many of them don't bother and correctly assume that at some point it will "get a virus" or something. And it is fine for them because almost no one uses desktop for critical stuff like payment or finance. But majority do use phones for that. They jumped from cash straight to phones and now it's a lucrative attack vector.

Edit to reply because throttled by downvotes: yea I'm in your boat, we live in a bubble. It's hard to believe. But now I'm using a payment system that literally has "get app" on its site and no other way to manage money or even sign up. And apps like that can be the only way for many people to get some sort of plastic card to pay cashless

And I see how it happened. Many people have no personal desktop computers. Many payment vendors don't trust desktop computers because an ordinary person's windows machine is a malware breeder.

So many people in the world depend on mobile security (especially underprivileged people). Anyone who wants them all to get fucked for own libertarian ideal of "hardware ownership" is basically a psychopath to me. Especially considering that he is literally free to root his device and not make it a problem for others.

By following the principle of least privilege. Like with apps the user should only have privileges for what they are allowed to control and nothing more. So if the user should have privilege to disable apps, then the settings app could expose a way for the user to do so.

Yes, this is kind of approach of coming up with a design to security instead of going with the easy route of everything being allowed is harder to do and takes more time, but it leads to better security.

By having a "maintenance mode" that can be entered and left.

Having root access implies that you can do all sorts of things: change files, install new software, new kernel modules, etc. Locking this down makes the attack surface for malicious parties much smaller. Many exploits start in user-space and then obtain root access to install rootkits.

Of course you lose freedom, but that is exactly what is needed, because some people just cannot help themselves from exploiting that freedom.

Unless someone figures out a way where we can safely share computing power and connections to real-life services (e.g. banking, having an identity, communication in general), I think there is no real alternative.

Perhaps having separate internets for various purposes would be an option. Ond where we can socialize anonymously, but not trust each other, and one where it's pretty boring, but where you can safely buy goods using your paycheck.

But we have GDPR here in UK too.

Who is the email sender?

Yes, by incorporating end-to-end encryption in their services.

What difference does that make to the outcome? If anything, being automatically subject to that without any option is worse.

Going from a phone with a Snapdragon SoC to a Pixel with the Tensor SoC was a big downgrade for me. It gets hotter quicker when doing more demanding tasks, battery drains faster if network conditions are not perfect, etc.

We've been having some warm weather (~30ºC) around here and the other day my Pixel 8 Pro started warning me about the phone being too hot when I tried to record a video.

I like Google's Android skin and their long support periods, but Tensor holds these newer Pixels back.

Pixel phones are available in very few regions, Samsung is available virtually anywhere.

Pixel phones have been awful hardware since the 5. So there is that. The tensor chip is a dud and can't be fixed. I'm done with Samsung for good after my current phone which I bought a few months ago. I'll probably replace it with an Oppo or something again, never going back to Samsung.

No SD slot is a showstopper for many.

I'm still using a V20 as my main phone. The recent app icons at the extra top section of the screen really make juggling active apps fast. I don't think any phone has had this feature since.

I was an LG G3 user a long time ago. With the exception of the overheating issue, it was a lovely phone. LG really did have some unique devices

All the nothing phones are too big. Give me something the size of the s25.

On the other side Apple dealt with the BatteryGate of 2017 and Google paid back all remaining users of the Pixel 4a.

Each of these is also unique and unseen ever before for a phone.

Why does this become a competition where we're looking for a winner ?

If it's mostly marketing, why was Facebook so up in arms about forced opt-in for tracking in iOS?

All marketing? None of it is real? Citation?

From the fire into....

I disagree; I think all we can really say about China in this regard is that they have more control over the press.

> Was situation in Tibet really good before China came?

Well I imagine there was a lot less persecution by the Chinese government at that time.

> media are not interested in enlightening people

You're right, the media in China are mostly or exclusively mouthpieces for the state.

>Oh you like phones? Well our phone companies require us to directly or indirectly create proxy wars in this region in order to acquire the raw materials necessary.

I think that is the will of the masses.

I've got this fairphone in my pocket that has a replaceable cobalt-free battery and a replaceable OS for a reasonable price. But people by-and-large don't want fairphones, they want iphones.

The third worlders fighting over cobalt don't want peace, they want wealth for themselves.

People don't want niche third parties and alternative stuff, they want to be part of a larger cultural group.

Captialism is based on individual voluntarism, and the problems you describe are not caused by manufactured sentiment but a lack thereof. The problems are caused by the distributed actions of a silent majority, as opposed to some greater rational plan.