Welcome to Friendica.Eskimo.Com

Home of Censorship Free Hosting

 Eskimo North Linux Shells, E-mail, Virtual Machines, Web Hosting.

E-mail, Web Hosting, Linux Shell Accounts terminal or full remote desktops.

Sign Up For A Free Trial Here

Please tell your friends about federated social media site that speaks several fediverse protocols thus serving as a hub uniting them, hubzilla.eskimo.com, also check out friendica.eskimo.com, federated macroblogging social media site, mastodon.eskimo.com a federated microblogging site, and yacy.eskimo.com an uncensored federated search engine. All Free!

wordpress - Link to source

What Can Android Learn From Symbian's Security Model?


shkspr.mobi/blog/2013/04/what-…

More bad news for Android owners. A huge Russian malware operation is infecting Android apps in the the Google Play Store. The malware - hopefully now removed - hijacks your personal details, and sends premium rate text messages to drive profits for its owners.

Nasty.

This is the price we pay for Android's open access policy. iPhone users can smirk all they want - but I like being able to run anything I desire on my phone, rather than be restricted to the puritanical walled garden of Apple's App Store.

The late lamented Symbian OS did many things wrong - but it had an interesting approach to keeping users secure from malicious apps.

The first time an app wanted to access a feature - like Internet, SMS, phonebook - the phone would prompt the user to grant the app permission.

Symbian Internet PermissionSymbian Internet Permission 2Symbian Secure Connection prompt

Now, the Symbian model wasn't without flaws. It would often forget that you'd granted an app permission or repeatedly ask annoying questions.

Is this what is needed for Android? the first time an app tries to access, say, the dialer - should Android say "Are you sure you want Angry Birds to make a phone call?"

Or, should Android take a leaf out of BlackBerry 10? When installing the app, the user can choose whether to grant certain permissions.

Finally, what about personal responsibility? The Android permission model is quite opaque to most users, it's true, but there are some basic precautions users can take.

I was recently hit by a "drive by installation". A malicious website automatically downloaded an app to my Android phone. When I clicked on it to install, this is what I got:

Legit App Permissions

If you think a Battery app needs all those permissions... I'm not sure encasing you in bubble-wrap is enough to keep you safe from yourself!

The price of freedom is eternal vigilance. Android needs to do more to allow users to enjoy their freedom.

Going down the Symbian path of insisting every app be signed by a third party and repetitively interrupting the user is probably not the right way to do things. What is clear from the current crop of malware is that simply telling the user of the permissions an app is requesting at installation time is insufficient.

Until Google makes things better for its users, it's worth installing an app like Permissions Denied which will allow you to see which apps have more access than they need - and restrict them if necessary.

#android #mobile #security #symbian

The Bearer of BadNews | The Official Lookout Blog

Overview Lookout has discovered BadNews, a new malware family, in 32 apps across four different developer accounts in Google Play. According to Google Play
web.archive.org
This entry was edited (4 months ago)

wordpress - Link to source

Is it possible to allow sideloading *and* keep users safe?


shkspr.mobi/blog/2025/08/is-it…

In which I attempt to be pragmatic.

Are you allowed to run whatever computer program you want on the hardware you own? This is a question where freedom, practicality, and reality all collide into a mess.

Google has recently announced that Android users will only be able to install apps which have been digitally signed by developers who have registered their name and other legal details with Google. To many people, this signals the death of "sideloading" - the ability to install apps which don't originate on the official store0.

I'm a fully paid-up member of the Cory Doctorow fanclub. Back in 2011, he gave a speech called "The Coming War on General Computation". In it, he rails against the idea that our computers could become traitorous; serving the needs of someone other than their owner. Do we want to live in a future where our computers refuse to obey our commands? No! Neither law nor technology should conspire to reduce our freedom to compute.

There are, I think, two small cracks in that argument.

The first is that a user has no right to run anyone else's code, if the code owner doesn't want to make it available to them. Consider a bank which has an app. When customers are scammed, the bank is often liable. The bank wants to reduce its liability so it says "you can't run our app on a rooted phone".

Is that fair? Probably not. Rooting allows a user to fully control and customise their device. But rooting also allows malware to intercept communications, send commands, and perform unwanted actions. I think the bank has the right to say "your machine is too risky - we don't want our code to run on it."

The same is true of video games with strong "anti-cheat" protection. It is disruptive to other players - and to the business model - if untrustworthy clients can disrupt the game. Again, it probably isn't fair to ban users who run on permissive software, but it is a rational choice by the manufacturer. And, yet again, I think software authors probably should be able to restrict things which cause them harm.

So, from their point of view it is pragmatic to insist that their software can only be loaded from a trustworthy location.

But that's not the only thing Google is proposing. Let's look at their announcement:

We’ve seen how malicious actors hide behind anonymity to harm users by impersonating developers and using their brand image to create convincing fake apps. The scale of this threat is significant: our recent analysis found over 50 times more malware from internet-sideloaded sources than on apps available through Google Play.


Back in the early days of Android, you could just install any app and it would run, no questions asked. That was a touchingly naïve approach to security - extremely easy to use but left users vulnerable.

A few years later, Android changed to show user the permissions an app was requesting. Here's a genuine screenshot from an app which I tried to sideload in 2013:

A terrifying list of permissions.

No rational user would install a purported battery app with that scary list of permissions, right? Wrong!

We know that users don't read and they especially don't read security warnings.

There is no UI tweak you can do to prevent users bypassing these scary warnings. There is no amount of education you can provide to reliably make people stop and think.

Here's the story of a bank literally telling a man he was being scammed and he still proceeded to transfer funds to a fraudster.

It emerged that, in this case, Lloyds had done a really good job of not only spotting the potential fraud but alerting James to it. The bank blocked a number of transactions, it spoke to James on the phone to warn him and even called him into a branch to speak to him face-to-face.


Here's another one where a victim deliberately lied to their bank even after acknowledging that they had been told it was a scam.

Android now requires you to deliberately turn on the ability to side-load. It will give you prompts and warnings, force you to take specific actions, give you pop-ups and all sorts of confirmation steps.

And people still click on.

Let's go back to Google announcement. This change isn't being rolled out worldwide immediately. They say:

This change will start in a few select countries specifically impacted by these forms of fraudulent app scams, often from repeat perpetrators.

…

September 2026: These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand. At this point, any app installed on a certified Android device in these regions must be registered by a verified developer.


The police in Singapore have a page warning about the prevalence of these scams. They describe how victims are tricked or coerced into turning off all their phone's security features.

Similarly, there are estimates that Brazil lost US$54 billion to scams in 2024 (albeit not all through apps).

There are anecdotal reports from Indonesia which show how easily people fall for these fake apps.

Thailand is also under an ongoing onslaught of malicious apps with some apps raking in huge amounts of money.

It is absolutely rational that government, police, and civic society groups want to find ways to stop these scams.

Google is afraid that if Android's reputation is tarnished as the "Scam OS" then users will move to more secure devices.

Financial institutions might stop providing functionality to Android devices as a way to protect their customers. Which would lead to those users seeking alternate phones.

Society as a whole wants to protect vulnerable people. We all bear the cost of dealing with criminal activity like this.

Given that sideloaded Android apps are clearly a massive vector for fraud, it obviously behoves Google to find a way to secure their platform as much as possible.

And Yet…


This is quite obviously a bullshit powerplay by Google to ensnare the commons. Not content with closing down parts of the Android Open Source Project, stuffing more and more vital software behind its proprietary services, and freezing out small manufacturers - now it wants the name and shoe-size of every developer!

Fuck that!

I want to use my phone to run the code that I write. I want to run my friends' code. I want to play with cool open source projects by people in far-away lands.

I remember The Day Google Deleted Me - we cannot have these lumbering monsters gatekeeping what we do on our machines.

Back in the days when I was a BlackBerry developer, we had to wait ages for RIM's code-signing server to become available. I'm pretty sure the same problem affected Symbian - if Nokia was down that day, you couldn't release any code.

Going back to their statement:

To be clear, developers will have the same freedom to distribute their apps directly to users through sideloading or to use any app store they prefer.


This is a lie. I can only distribute a sideloaded app if Google doesn't nuke my account. If I piss off someone there, or they click the wrong button, or they change the requirements so I'm no longer eligible - my content disappears.

They promise that Android will still be open to student and hobbyist developers - but would you believe anything those monkey-punchers say? Oh, and what a fricking insult to call a legion of Open Source developers "hobbyists"!

I hate it.

I also don't see how this is going to help. I guess if scammers all use the same ID, then it'll be easy for Android to super-nuke all the scam apps.

Perhaps when you install a sideloaded app you'll see "This app was made by John Smith - not a company. Here's his photo. Got any complaints? Call his number."

But what's going to happen is that people will get their IDs stolen, or be induced to register as a developer and then sign some malware. They'll also be victims.

So What's The Solution?


I've tried to be pragmatic, but there's something of a dilemma here.

  1. Users should be free to run whatever code they like.
  2. Vulnerable members of society should be protected from scams.

Do we accept that a megacorporation should keep everyone safe at the expense of a few pesky nerds wanting to run some janky code?

Do we say that the right to run free software is more important than granny being protected from scammers?

Do we pour billions into educating users not to click "yes" to every prompt they see?

Do we try and build a super-secure Operating System which, somehow, gives users complete freedom without exposing them to risk?

Do we hope that Google won't suddenly start extorting developers, users, and society as a whole?

Do we chase down and punish everyone who releases a scam app?

Do we stick an AI on every phone to detect scam apps and refuse to run them if they're dodgy?

I don't know the answers to any of these questions and - if I'm honest - I don't like asking them.


  1. Post by @Gargron
    View on Mastodon


    ↩︎


#android #google #rant #scam

How Little Do Users Read?

On the average Web page, users have time to read at most 28% of the words during an average visit; 20% is more likely.
Jakob Nielsen (Nielsen Norman Group)

diaspora - Link to source
#1986
Now I see I'm up to no good
(No, no good)
And I wanna start again
Can't remember when I felt good
(Felt good, baby)
No, I can't remember when
Debbie Gibson is 55
youtu.be/4T1t5OFOYDU?si=Sa0uXh…

Debbie Gibson - Only in My Dreams (Official Music Video)

You're watching the official music video for Debbie Gibson - "Only in My Dreams" from the album 'Out Of The Blue'. "Only in My Dreams" reached No. 4 on the B...
YouTube

mastodon - Link to source

Harvard Study PROVES No Racial bias in police shootings! REACTION
February 19, 2024

the Conservative TAKE

Odysee

odysee.com/@theConservativeTAK…


Harvard Study PROVES No Racial bias in police shootings! REACTION

A study by a Harvard professor released this month found no evidence of racial bias in police shootings even though officers were more likely to interact physically with non-whites than whites. Kyle r...
Odysee

mastodon - Link to source

So there's a new title on the nonbinary circuit: Mg.

The original Tumblr member who posted it said:

'since mrs, ms, and mr are all descended from the latin word magister, i propose the gender neutral version should be mg, short for "mage"'

A question for #nonbinary people:

Hypothetically assuming the go-to nonbinary title is Mg, how would you want it to be said out loud in front of your name? ("Mg FirstName LastName")

  • Magister (30%, 33 votes)
  • Mage (47%, 51 votes)
  • I don't mind (9%, 10 votes)
  • Something else (replies welcome!) (13%, 14 votes)
108 voters. Poll end: 3 days ago

pleroma - Link to source

There's a woman on my tour who... might... know more(???)... about Star Wars(???)... than me??? Anyway we talked during the entire lunch hour while everyone else was staring like 👀. Unfortunately she's married. To a man. Cause if not I'd be like I mean I have a spare room back home we could combine Star Wars collections or something...

She used to work at a comic book store like wtf...

This has never happened before and it probably will never happen again.

This entry was edited (1 week ago)
in reply to Chasing Waterfalls

pleroma - Link to source

astarsscreams ☀️🍉

@ChasingWaterfalls @Lady_Penelope @GalacticTurtleIt’s a bit of both? Dead (probably natural causes) or so obnoxious that you don’t want him any more. We’ve also previously discussed the idea of all of us and our kids living together and keeping all the men in a separate house somewhere 🤣 and none of us want to remarry if death/divorce happen because men are too much work.
in reply to Chasing Waterfalls

pleroma - Link to source

Feart n Tired 🏴󠁧󠁢󠁳󠁣󠁴󠁿

@ChasingWaterfalls @Lady_Penelope @astarsscreams as we have said many times, all the effort to match people with a romantic partner and none goes in to matching people with a best friend. And not aiming at anyone in this conversation, at all, but there is a tendency for people WITH a best friend to assume those of us without can just go find one.
in reply to Chasing Waterfalls

pleroma - Link to source

GalacticTurtle 🤠🇺🇸👽

@astarsscreamsIndeed. I think the truest forms of friendship are exceedingly rare. One friend of mine has spent her whole life wanting a "best friend." The ride or die do everything together type. I told her that what she's imagining doesn't genuinely happen in the lives of most people. She of course is under the impression that she is one of a handful of outliers who hasn't received a "best friend" certificate.

But I do think that if friendship held more cultural significance, more people would find themselves with deeper and higher quality friendships - on average - than they do right now.

This entry was edited (1 week ago)

mastodon - Link to source

From "The Spectator"

thespectator.com/topic/stop-th…
or
archive.ph/nP3mO

When you call for an ambulance the local government may charge Medicare or Medicaid an inflated amount. Then pocket the difference between the private company's fee and what the USG was charged. Like 4x the cost of the ambulance.

Similar inflation may occur for other services.


Stop the Medicaid ambulance grift

A little-known accounting trick has turned paying for an ambulance via Medicaid into a bloated scam that enriches public agencies
Chad Hagan (The Spectator World)
⇧