Dovecot audit complete - <AUTHOR> https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#dovecot <comment><USER2> The libjpeg-turbo medium exploits are (as they said) interesting:

 _However, more interesting were the two medium vulnerabilities, which were initially reported as DoS bugs in the libjpeg-turbo library but on further investigation were found to be issues with the JPEG standard itself. These issues were reproduced across multiple JPEG implementations, can be triggered by entirely legal JPEGs, and so are not easy to mitigate in any JPEG library itself._

<comment><USER3> Those are probably fairly common in image compression standards - designers of image compression are not, in general, going to make their compression less efficient than it has to be. JPEG2000 in particular is likely to be far worse.

<comment><USER2> No, the opposite is true. Fast decompression is usually either the first or second priority for images.

<comment><USER4> I don't think you disagree with your parent.

</comment></comment></comment></comment><comment><USER5> That's a fantastic endorsement for Dovecot. It's interesting that security is not highlighted on the homepage[0], just mentioned in passing. Also interesting is the "special C variant that makes it much more difficult to write security holes"[1]

[0]: [https://www.dovecot.org](https://www.dovecot.org) [1]: [https://www.dovecot.org/security.html](https://www.dovecot.org/security.html)

<comment><USER6> is this is a good usecase for building this in Rust instead ?

<comment><USER7> There's currently going a discussion, whether Rust is ready yet for such a project. See [http://esr.ibiblio.org/?p=7303](http://esr.ibiblio.org/?p=7303)

<comment><USER8> ESR claims: _But you guys have competition out there: Go, Nim, Swift, D, and maybe other languages that aren't on anyone's radar yet._

All those languages are garbage collected or use automatic reference counting. Rust is unique in using its type system to automatically allocate and free memory. For the use cases where the overhead of GC is too high - Wich are the same use cases that generally call for C or C++ these days - Rust has no competition. I think this explains why Rust is still in the explore phase.

<comment><USER9> Having a garbage collector is no showstopper for writing an email server though.

</comment></comment></comment></comment></comment><comment><USER10> Anyone know how much MOSS Secure Open Source (SOS) budgets a year for audits and how they select a vendor to do an audit?

EDIT - Answer to the budget appears to be $500k to start: [https://blog.mozilla.org/blog/2016/06/09/help-make-open- sour...](https://blog.mozilla.org/blog/2016/06/09/help-make-open-source- secure/)

<comment><USER11> [https://www.mozilla.org/en-US/moss/](https://www.mozilla.org/en-US/moss/) says the yearly budget is about $3 million.

<comment><USER12> > Mozilla Open Source Support (MOSS) is Mozilla's program for supporting the > Open Source and Free Software movement, with a yearly budget of around $3 > million.

That's the yearly budget for the whole Open Source Support program.

The Secure Open Source "pillar" which saycheese was asking about is just one of three (the other two being Foundational Technology and Missing Partners) which presumably split that $3 MM.

<comment><USER10> Agree, MOSS is the "boss" of the SOS project; as stated in theSOS's budget appears to be $500k to start per: [https://blog.mozilla.org/blog/2016/06/09/help-make-open- sour...](https://blog.mozilla.org/blog/2016/06/09/help-make-open-source- secure/)

</comment></comment></comment></comment><comment><USER13> That's really interesting. I've been considering moving back to my own mail server from gmail for a long time but have been worried about the security issues.

This is one more thing pushing me in that direction.

<comment><USER14> I've been hosting my personal email on a $5/month DigitalOcean server, running Postfix + Dovecot, for almost two years. I think it's reasonably secure. I run updates regularly and trust the distro maintainers to release timely fixes for new vulns. Aside from that, I mostly ignore it because it works. I should probably look at the logs, but eh.

After the typical host hardening stuff (which isn't much work with modern OS defaults), I have configured SPF, DKIM, DMARC policy, opportunistic TLS for server-to-server, and mandatory TLS for IMAP client connections.

From a data privacy perspective, I know that nobody is mining the contents of my mailbox (except the messages I send to Gmail, etc. users!), and my server is not a high-value target for compromise. (Yes, DigitalOcean could snoop on my non-GPG-encrypted messages if they wanted. I guess I could migrate the server back to my own hardware.) I also encourage friends to use GPG, though this is orthogonal to one's choice of email host.

For clients I use Thunderbird on desktop and K-9 Mail on Android. Mobile push via IMAP IDLE works out of the box. (I also run a CalDAV/CardDAV server to sync contacts/calendar/todo across devices, but that is technically separate.)

Overall I'm really happy with the arrangement. The only annoyance was having my messages to Gmail users consistently marked as spam, but after doing everything suggested by mail-tester.com, I think I'm making it through most of the time.

<comment><USER15> What CalDAV/CardDAV server do you run?

<comment><USER16> I can recommend radicale [1]. It's very simple and doesn't need a lot of resources. It also supports authentication via an IMAP server so you don't have to keep a separate user database.

1: [http://radicale.org/](http://radicale.org/)

<comment><USER14> I also use Radicale. My only annoyance is that when you use its built-in HTTP server, the process eventually stops working if one of your clients has an intermittent connection (e.g. phone with a poor signal).

[https://github.com/Kozea/Radicale/issues/266](https://github.com/Kozea/Radicale/issues/266) [https://github.com/Kozea/Radicale/issues/388](https://github.com/Kozea/Radicale/issues/388)

I'm told that using a dedicated HTTP + WSGI server solves this, just haven't done the work yet.

<comment><USER15> Would it be easier to just have a cron job that checks every five minutes if Radicale is running and if it has fallen over restart it?

<comment><USER17> Can we stop hacking ill-conceived one-offs like this and just start to assume that a monitoring utility (Monit, Supervisor, Munin, Nagios, ServerDensity, Solarwinds to name a few) in some form is the standard for notifying of anomalies and automation of process recovery?

Moreover, systemd has a OnFailure directive that activates other units when the process exits uncleanly. Upstart has a similar directive. With a more classical approach, `respawn' is a utility that can invoke and maintain the running status of a process launched from System V Init, or you could use the regarded inittab solution.

I've seen answers to questions similar to this on StackOverflow respond with scripts that are nothing more than a while(true) loop that checks to see if a PID exists in languages ranging from Bourne shell to Python and NodeJS. This is the wrong way to do it, especially the Node one. Lets take a language intended to be used inside a web browser client and slap it onto a server to be used for process monitoring. I'm sure it does a fine job with it's while loop, but we're hitting copper pipe with a tire iron wondering why our lightbulb isn't turning on here.

<comment><USER18> The GP's using it for personal use (I think). OP merely suggested a hack to let GP get on with their life as quickly as possible in 2 lines of bash and one crontab entry - and without learning a new process monitoring utility's configuration. Obviously this wouldn't be suitable for a production site for many users.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Makes one wonder how they achieved this. I can find a passing mention of a "special C variant that makes it much more difficult to write security holes"[0], but no more details on whether they enforce this (and how), nor on other techniques to improve security.

Do they have a rules checker? Are they running static analysis? Which security-related compiler flags are they enabling? Other tools they use to achieve this? Or is it just a lead developer who really groks C and security, and who reviews all PRs?

It'd be interesting to see what that other projects can learn here to improve security...

[0] [https://www.dovecot.org/security.html](https://www.dovecot.org/security.html)

<comment><USER20> Much like djb's code it's forcing the most error prone parts (string handling, memory) to go through a library, or simply forbidding the error prone constructs entirely (static buffers).

</comment></comment><comment><USER21> Could anyone here point me in a good direction for hosting my own mail server? Is Dovecot a good solution? I can figure out a hosting solution but I would like to know about best practices for implementation and security. Thanks in advance ~

<comment><USER22> Dovecot + postfix are a good combination. Getting whitelisted by major mail providers could be more of an issue.

<comment><USER23> If you're on DO or Linode or similar, you start with a new VPS and check the IP it's assigned in all the RBLs and spam blacklists. (Google "multi rbl check", there's a bunch.) If it's on any of them, tear down the VPS and stand up a fresh one, and repeat until you get a clean IP. Then keep it that way by not running an open relay.

Beyond that, the main deliverability improvements, in approximate order of value, are: PTR record with the hostname you send mail from; DKIM; SPF; DMARC.

My mail server runs all of these, and I've yet to encounter trouble sending to anyone, including Gmail, which is often mentioned in threads like these as being a special issue. Admittedly I've been running mail from that IP since 2004, so have a long history of not being a spammer, but as long as you start out with a clean IP and keep it so, and make sure all your sender legitimacy boxes are properly checked, I don't see any reason why you should have undue difficulty.

<comment><USER23> (That's approximate _descending_ order of value, to be clear. In particular, if you don't have a matching PTR record, you're hosed whatever else you try to do.)

<comment><USER24> Looking at the incoming mail in my server, I discovered that there are big legit mail senders who have a non-matching PTR. I suppose that at some point gmail et al stopped using that rule, or they just look for certain patterns in the PTR name, or something.

</comment></comment></comment></comment></comment><comment><USER25> Wow, congrats. Good engineering. I remember Dovecot for being the easy option back when I ran my own mailserver.

</comment><comment><USER26> What is a good smtp server to go with it in terms of security and reliability?

<comment><USER27> The most _secure_ in absolute terms is qmail[1] but I found OpenSMTPd[2] to be a joy to work with, something that can not be said for any other SMTPd system I worked over the years (postfix, sendmail horror, exim, qmail and OpenSMTPd). OpenSMTPd seems to be fairly secure[3].

[1]: [http://www.qmail.org/top.html](http://www.qmail.org/top.html)

[2]: [https://www.opensmtpd.org/](https://www.opensmtpd.org/)

[3]: [https://www.opensmtpd.org/security.html](https://www.opensmtpd.org/security.html)

<comment><USER26> Thanks

</comment></comment></comment><comment><USER28> This title badly needs a (semi)colon before "auditor".

<comment><AUTHOR> I hit the 80 char limit :( It was a struggle to get everything in there. Was going to use DONE instead of complete, but that didn't read right.

<comment><USER29> You can drop the "by" and have

> Mozilla sponsored Dovecot audit complete; auditor Cure53 "extremely > impressed"

<comment><AUTHOR> I had that as one the options, but wanted to have Dovecot first, not Mozilla as it is their product.

But you have given me an idea :)

EDIT: Doh, cannot edit. Email sent.

Dovecot audit: Mozilla sponsored complete. Auditor Cure53 "extremely impressed"

<comment><USER29> That is even more confusing. How about:

Dovecot audit complete: Mozilla sponsored auditor, Cure53 "extremely impressed"</comment></comment></comment></comment></comment>


WeChat Surveillance Explained - <AUTHOR> https://citizenlab.ca/2020/05/wechat-surveillance-explained/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=23109997](https://news.ycombinator.com/item?id=23109997)

<comment><USER3> Thank you. That is the full report. This site is its summary and an FAQ.

</comment></comment><comment><USER4> If I've understood correctly, the test used was something along the lines of: two non-chinese accounts send back-and-forth messages including benign content (maybe a picture of a pie) and less-benign content (maybe "I like Falun Gong almost as much as I like the CDC"). Then, chinese accounts would observe that the picture of the pie might be censored. I don't actually see an unambiguous description of what messages were sent, or how strong the effect is. Those questions don't really matter for addressing "are non-chinese accounts monitored?" (unless CL is outright lying, obviously yes), but they _do_ matter for the _fun_ question:

Can this be used to construct an attack on WeChat? Providing targeted misinformation for training, to suggest correlations where there really are none, thus triggering WeChat to have a higher false-positive rate when censoring messages?

I'm reminded of RMS's famous practice (and a script in emacs, IIRC): automatically append various keywords to the bottom of emails to screw with any US surveillance that might be getting too nosy.

EDIT: I'm a dope, and should have read the full report (here: [https://citizenlab.ca/2020/05/we-chat-they-watch/#part-2--- t...](https://citizenlab.ca/2020/05/we-chat-they-watch/#part-2---technical- assessment)) before commenting.

As far as I can tell, an attack isn't possible. WeChat would ideally like to analyze each document or video sent for sensitive content, but it takes some time (on the order of 20 seconds, maybe), and so that analysis can't be performed before messages are supposed to be delivered. However, if WeChat has already seen the video, then it can make the judgement quickly, and perform real-time censorship. Thus, sending a sensitive video the first time won't be blocked, but all subsequent sends will be. CL's result seems to be that if the first video send is between non-chinese accounts, that's still enough to get it analyzed and blocked the second time.

<comment><USER5> That it actually takes 20 seconds implies to me that actual people are viewing the content. I don't see any automated system taking that long as I do believe they would just throw more resources at the problem.

<comment><USER4> I dunno, to process a video (maybe 20-80 seconds) and scan for suspicious text/speech? I was impressed that it was under a minute.

I wonder though... do we know enough now to know at what rate actual people view the content, vs just automated processing?

</comment></comment></comment><comment><USER6> If they're using pure MD5 such that collisions work, then using steganography techniques to embed random bytes encrypted with some obvious cipher will bypass the initial autocensor while simultaneously driving the Chinese intelligence services crazy trying to decrypt the random bytes in every image sent. Note that using this approach may cause threat of harm to any sender or recipient within China's sphere of influence.

<comment><USER5> Or the other way around: send clean content first, then use a collision for the nasty content.

<comment><USER6> That's what they tested in the article.

</comment></comment></comment><comment><USER3> Reminds me of the "free" online games, where the free players provide the environment for the addicted "pro" players who pay a fortune for "extras" and upgrades.

</comment><comment><USER7> It's sad to see that the media drama around some of the Facebook's practices made some of my friends/colleagues quit Facebook and switch to WeChat.

It's like refusing to eat eggs and milk for ethical purposes and then switching to steaks.

<comment><USER8> Any good alternatives?

I'm a Chinese here, many "Digital immigrants"(1) from China uses Telegram as replacement to WeChat, because I guess it's groupchat feature.

However, Telegram itself is not a surveillance-avoidance/privacy protection tool of course, as you need a phone number to register, and an valid phone number is really hard to get anonymously.

Foot notes:

1: "Digital immigrants" means people who digitally lives outside the network border of their own country, not the dumb buzzword that Wikipedia tries to feed you

<comment><USER9> Never used WeChat for obvious reasons, but matrix(1)/riot.im(2) may be what you're looking for.

1\. [https://matrix.org/](https://matrix.org/) 2\. [https://about.riot.im/](https://about.riot.im/)

</comment></comment></comment><comment><USER10> Why is this being downvoted?</comment>


Want to know what a pocket-radio is? - <AUTHOR> http://www.pocket-radio.com/index.php

<comment><USER2> appears there is no way to log in, only to sign up. i've got two accounts created under the same email address, logging out kicks me back to the signup page, where is login?</comment>


Yahoo's Jerry Yang, a nice person and a pioneer of the web, must go - <AUTHOR> http://www.economist.com/research/articlesBySubject/displaystory.cfm?subjectid=348963&story_id=12597041 <comment><USER2> Maybe microsoft can hire him with that 42 billion dollars. 100,000 dollars.

And then buy yahoo for him to run. 12 billion dollars.

And still have 30 billion dollars to burn down orphanages or whatever Microsoft does with it's cash.</comment>


ESP Report Sets Off Debate on Data Analysis - <AUTHOR> http://www.nytimes.com/2011/01/11/science/11esp.html

<comment><AUTHOR> Posted by request -- yes, over a year old, but still an active topic of conversation among social scientists.</comment>


Misskey, a decentralized microblogging platform with ActivityPub support - <AUTHOR> https://github.com/syuilo/misskey <comment><USER2> Is this just a fork of Mastodon?

<comment><AUTHOR> No, it's a separate project that got ActivityPub support this year.</comment></comment>


1969: The World's First Artificial Heart - <AUTHOR> http://www.theatlantic.com/technology/archive/2010/10/the-worlds-first-artificial-heart/63949/

<comment><USER2> That's pretty cool, I wonder if there will be a day where we won't need heart donors and an artificial heart could do the job.</comment>


Apple moves to trademark the term 'startup' in Malaysia - <AUTHOR> http://www.digitalnewsasia.com/digital-economy/apple-moves-to-trademark-the-term-startup-in-malaysia

<comment><USER2> I'm surprised that a single English word can even be trademarked, even in a non-English speaking country. If the word is in Webster's dictionary, it should be off limit. Imagine other companies rushing to do the same.

</comment><comment><USER3> Oh dear lord! Won't they stop at anything?!

</comment><comment><USER4> why that word?</comment>


Which Encryption Apps Are Strong Enough to Help You Take Down a Government? - <AUTHOR> http://gizmodo.com/5989770/which-encryption-apps-are-strong-enough-to-help-you-take-down-a-government <comment><USER2> Nice try, but to take down a government with encryption, you first need an internet that is not in under control of the government. Syria, Iran, North- Korea, China: they all control the people And the Internet. What would help would a combination of mesh-networks and encryption. But that just creates another critical resource: energy. It's pretty hard to bring down a non- democratic government in a non-kinetic way.</comment>


Students at Fake University Say They Were Collateral Damage in Sting Operation - <AUTHOR> http://www.nytimes.com/2016/05/06/nyregion/students-at-fake-university-say-they-were-collateral-damage-in-sting-operation.html <comment><USER3> From the article:

 _Ultimately, the students said that because the Department of Homeland Security's website certified the University of Northern New Jersey, they believed the institution was legitimate. In addition, the website of the New Jersey Education Department listed it as approved. So did the website of the Accrediting Commission of Career Schools and Colleges, a national body._

It's easy to think "Oh, those students knew they were being duped, they knew what they were getting into"\- but if you're coming from another country with a completely different way of doing things, and this university which appears to be accredited AND have the blessing of the US Government pops up going "Apply here and we'll give you a visa, you don't have to go to class and we promise it's above-board"... I don't think that's going to immediately register as a scam. Odd, maybe, but then you see they're accredited and you think "well if it was a scam they wouldn't have accreditation."

<comment><USER4> Absolutely. It was downright sinister of the DHS to implicate the students in this when they themselves legitimized the school in no less than three different places. To quote the article, "if you can't trust the government, who can you trust?"

I understand what the government says by "you have to know the law", but it's idiocy to expect everyone to be a lawyer, and instead we all use our best judgement.

Maybe the signs were clear that UNNJ were fake, maybe they weren't, but fraud implies a _knowing_ and _willful_ attempt to break the law, and almost all of these cases seem far from it. It's shameful to make most of these students appear in immigration court.

<comment><USER5> It looked legitimate except for the part where you didn't have to go any classes or learn anything. You don't have to be a lawyer to understand that goes against the spirit of the law - and if your intent is to walk that line not getting a lawyer is irresponsible.

<comment><USER6> Laws that are self-defeating to their ostensible purpose are almost the _norm_ at this point, though. I don't expect anyone, as a matter of law, to say "wait, that's ridiculous, that incentivizes me to do X, when obviously the law exists to promote not-X, so obviously this scheme to ramp up our X is shady."

If you want an example, here's one off the cuff: the law that says you can only bring free water out at restaurants if the patron asks. If anything, the automatic water _displaces_ the consumption of other drinks, which generally require other ag products that are far more rainwater intense per liter consumed. So if I'm a waiter, am I undermining or supporting "the spirit of that law" if I remind people to ask?

<comment><USER7> Where is that law? I know tons of restaurants that offer free water without being asked.

<comment><USER6> Recent California thing: [http://sf.eater.com/2015/3/17/8237891/serving-water- californ...](http://sf.eater.com/2015/3/17/8237891/serving-water-california- prohibited-without-request-bars-restaurants)

</comment></comment></comment></comment></comment></comment><comment><USER8> This sounds like entrapment.

I don't know US laws at all, but I thought the "leave the car doors open and wait for someone to steal it" method of catching bad guys was against the law?

<comment><USER9> There are only two conditions for entrapment - government inducement of the crime, and the defendant's lack of predisposition to engage in the criminal conduct. [1] And I think this qualifies on both counts. The students were looking to get into the US, but the government pushed this visa mill on them indirectly, via the brokers (who wouldn't have had a dual-accredited fake university to pitch without the government's aid). Had these brokers not reached out to these students, it's unlikely that they would have sought out the same illegal method to enter the country. (This is assuming the brokers reached out the students, and not the other way round).

[1] [https://www.justice.gov/usam/criminal-resource- manual-645-en...](https://www.justice.gov/usam/criminal-resource- manual-645-entrapment-elements)

<comment><USER10> The brokers reaching out to the students doesn't mean entrapment, even if we took the case where the brokers actually were government agents. To be entrapment, someone working on the government's behalf would have to do something that would even convince a lawful-minded person to commit the crime.

<comment><USER11> > To be entrapment, someone working on the government's behalf would have to > do something that would even convince a lawful-minded person to commit the > crime.

As a lawful-minded individual, if multiple government websites tell me the institution is accredited, and the head of the institution tells me that work- for-credit is sufficient for student status, I am reasonably convinced that it is legal for me to enroll and apply for a visa.

Just how deep into the letter of the law do I have to dig to discover this isn't legal?

<comment><USER12> I think the difference here is not that it was entrapment, but that it wasn't a crime at all. Unless the law says this crime is strict liability, then the prosecutor would need to show that these individuals intended to commit the crime they were committing.

For example, say you have a bucket in your yard, I go and stick a sign up saying 'Free bucket to good home.' and someone else comes by and grabs the bucket. Focusing only on the third person's actions for a moment, even though they took a bucket that they had no right to take, and they would likely have to give back, they never committed a crime because they never intended to steal the bucket. They only intended to take a bucket being given away freely. (This is different from 'ignorance of the law isn't an excuse'; that would apply if they did intend to steal a bucket but thought stealing wasn't illegal.)

(Now there is still an issue with the government doing something similar with strict liability laws and I'm not sure how that one works out.)

</comment></comment></comment></comment></comment><comment><AUTHOR> FWIW, a Chronicle article that focuses on how the Feds maintained their fake web presence: [http://chronicle.com/article/Inside-the-Elaborate- Web/235982](http://chronicle.com/article/Inside-the-Elaborate-Web/235982)

The Internet Archive has a copy of the now defunct unnj.edu: [https://web.archive.org/web/20160327093120/http://www.unnj.e...](https://web.archive.org/web/20160327093120/http://www.unnj.edu/)

<comment><USER13> Given that you need to meet these eligibility criteria to even register a .edu domain name I think this shows a pretty concerted effort to make this look like a legitimate institution and dupe the students in the first place.

[http://net.educause.edu/edudomain/eligibility.asp](http://net.educause.edu/edudomain/eligibility.asp)

</comment></comment><comment><USER14> Astonishing excerpt:

          The official confirmed that one person did enlist, and that only one person
          was employed by Facebook, one person by Apple, two at Morgan Stanley and
          several at other prominent financial institutions.

I wonder if these company HRs were actually doing any background checks at all? They certainly do ask for a lot of forms to fill out...

<comment><USER15> I had a background check once. They asked for my dates of attendance at my alma mater, which I provided. Then they called for clarification, because the dates they got from the university didn't match - I took 4 years to do a 4 year degree, graduating in 2009, but somehow the information they got suggested that I started in August 2007 and "left" in October 2008 - <USER2> they did agree that I had a degree.

I tried to explain to them that the dates they had managed to get from the university were for a job I had on campus, and that I hadn't done a bachelor's in a year. "Yes, sir, but if I can just confirm that you were there August 2007 through October 2008, then this will clear things up." So I did the expedient thing.

<comment><USER16> I had an incredibly similar experience. My employer's third party background check company was able to confirm my degree, but claimed I'd gotten it in a year, and so my entire school section was listed on the report as (large, red): "UNCONFIRMED" (they never contacted me). I was somewhat worried, since there's some strong language about how if this background check doesn't go well the offer is voided or something, but my recruiter just laughed and said it happens all the time.

</comment></comment></comment><comment><USER17> The only way to get a job here for some people is to get a student Visa. This sting is just morbid. All of that to arrest a thousand workers. Wrong priorities?

<comment><USER18> I'm pretty okay with enforcement action against this sort of fraud. What about people that actually want to come here to study?

I'd also be okay with radically simplifying and opening the Visa system, but I don't want the existing concessions to go to people that are intending to abuse them.

<comment><USER17> > What about people that actually want to come here to study?

There are no quota on student visas

> that are intending to abuse them

I wouldn't call that an abuse. Rather, the only solution for many people if they don't want to stay/work illegally.

<comment><USER18> If they aren't studying it is clearly an abuse of the intent of the Visa.

It is confusing that the Visas are supposed to be issued in relation to an institution approved by the US government. Given that rule, it probably doesn't need to be up to the applicant to verify that their course of study is approved (I'd be fine charging a fee to cover that verification, but it should be done as part of issuing the Visa).

<comment><USER19> >If they aren't studying it is clearly an abuse of the intent of the Visa

It's a fairly victimless crime... the visas' feelings aren't being hurt, that's for sure.

In this particular case especially, the Department of Homeland Security "verified" the school. How can you expect immigrants to do any more research than getting the approval of the DHS?

<comment><USER18> I edited in my second paragraph shortly before you posted, I agree that it's a bit much to require a verified school and then setup a fake school that appears to be verified.

</comment></comment></comment></comment></comment></comment><comment><USER20> Wait, hold on - let me break this down a little more simplistically:

Communities of foreign-born peoples, possibly already living in the US (undocumented / falsified records) exist. There are "brokers" who cater to these communities, engaging in a fraudulent enterprise of getting Student Visas for these foreign nationals, usually under the umbrella of a made-up university. With this made-up university, these people can claim to be students yet spend their time working - for whom, over or under the table, I'm not clear from the article.

What is quite clear:

> _Most of the students were from China and India, where working with brokers > is a familiar way of doing business._

This model of using brokers is not to be envied, and if 25 (or more) "students" were led into submitting their documentation in order to commit fraud in the US...well, I've got no sympathy. Make a point. In the US, the concept of "brokers" often includes licenses and duties to perform in earnest (insurance, securities, health plans, etc), not assisting with committing fraud.

I understand the strong desire to come to the US, legally or illegally, and stay however possible. That's what's being preyed upon as well. There are certain cultural practices in the US though, while not perfect, I still think have meaning and importance.

This article does a good job putting humanity to those affected, but seems, um, a bit tone-deaf as to the bigger picture...in that to find people willing to commit fraud, the setup had to be 'believable' enough. Methinks it was. Caveat Emptor.

<comment><USER21> Bigger picture? The bigger picture is Americans think going to school and working should be illegal for anyone else but themselves, and that it's okay to hurt young students trying to get ahead in the name of protecting their xenophobic and hypocritical immigration laws. Your presidential candidate's biggest idea is a fucking giant wall to keep the mexicans you love to employ out.

What a joke. If you think there's any sense to stings like this you're deluded.

<comment><USER22> These students were not going to school. They knew they wouldn't be taking classes. Are you arguing this wasn't a scam?

<comment><USER23> Most universities will let you do an internship or something instead of a class. And, this university _was_ accredited by a reputable organization, so they held this out as something that a great number of reputable people and organizations had supposedly said was OK. And these were foreigners in particular, so they might not have the same warning signals that US natives might have.

At the end of the day the US higher-ed system is largely pay-to-win anyway. If you just want to check the boxes so you can make it through the HR filters and move onto a decent-paying job, most schools will happily oblige. All they care about is if the check clears, there's plenty of students who surf the internet through their gen-eds and easily pass. College is what you make of it, and it's simply not that weird to see an accredited university offering a super- easy course load.

If the difference you're seeing here is that they don't hold a lecture for the kids to skip, who cares? Sounds like cost optimization to me - eliminate the tutoring and you can get your name on a piece of piece of paper and check that box even more cheaply.

</comment></comment></comment></comment><comment><USER24> _"Typically in any fraud investigation, it is our policy that we do not refund any money," Mr. Phillips, the Homeland Security spokesman, said._

Sounds like the ones committing fraud here were the US government. But, would you really expect anything different?

</comment><comment><USER25> > _Twenty-five students were listed as anonymous co-conspirators, but > officials say all of them knew they were committing fraud by not going to > class._

In my country there's no obligation whatsoever to go to class.

You can skip as long as you like (except some special lab courses) and s long as you are able to pass the final exams, you are OK.

And even if you don't show up for the exams, you can try again next year (kids working while studying often take like 10 years to complete a 3 year course, but you could still be considered a student after 15 or 20 years, as long as you registered every year -- of course some privileges, like student discounts and being able to live in the dorm etc were not available to you anymore after the 4th year or so).

</comment><comment><USER14> From the related coverages linked on the bottom of this article, there is this surprising info.

          The official confirmed that one person did enlist, and that only one person was employed by Facebook, one person by Apple, two at Morgan Stanley and several at other prominent financial institutions.

I wonder if these company HRs were actually doing any background checks at all? They certainly do ask for a lot of forms to fill out...

<comment><USER26> They graduated first from other schools, then got these jobs. When the students lost the H1-B lottery, they then enrolled in the UNNJ. There's probably questions for HR to ask ('you lost the H1-B lottery, how are you still here?') but it's not related to applying to these schools with a fake university on the transcript (again, one that had multiple accreditations).

</comment></comment><comment><USER21> Duping and hurting innocent people who want to study or work in the US so they can collect their paycheck and pat themselves on the back for, what? Nothing. The brokers only exist because of the US's absurd anti-immigration policies! When I studied in America, _ALL_ the foreigners including myself worked illegally to earn money to pay for school. Meanwhile, the American students were rude, lazy, and constantly complained about having to go to class 30 hours a week. Try having to wash dishes for $3/hr on top of that under the threat of deportation! America's rhetoric about "free markets" is completely bullshit. They're a heartless nation when it comes to education and healthcare.

<comment><USER27> You can go somewhere else.

I'm liberal as can be , but you can't agree to the rules of a student visa and then say their so unfair.

</comment></comment><comment><USER28> I have known many people of similar background quite closely and also talked to recruiters who help them get jobs. One thing I have invariably noticed none of them was tricked into shady visa related things. They absolutely wanted shortcuts legal or not.

There are many more universities still working on same model. They are legal in very strict and narrow sense but intention is to have students who just want visa to land in US. This model proliferated during stricter H1 scrutiny as student visa proved another way to enter US and work.

</comment><comment><USER29> Sting Operation is illegal in Japan. A proof of crime acquired in an illegal way is not proof in japan.

I don't want to set foot on American soil because I cannot trust the law of USA.

</comment><comment><USER30> Am I the ink one who wants one of those UNNJ t-shirt?

</comment><comment><USER31> Imagine you started a new Department of Internal Security, got a .gov domain, built up a large website with forms to have people apply for some kind of visa, and took money from random people who thought it was a federal agency. Would you be guilty of something?

</comment><comment><USER32> See also [https://www.buzzfeed.com/mollyhensleyclancy/students-at- fake...](https://www.buzzfeed.com/mollyhensleyclancy/students-at-fake- university-say-theyre-victims-of-government)

</comment><comment><USER33> At least the UNNJ t-shirt should be some kind of collector's item.

</comment><comment><USER34> Here's how it worked:

www.nbc.com/saturday-night-live/video/winston-university/n9203

</comment><comment><USER35> If I was told that all I needed to pay was $4500, and don't have to attend classes, for a course that the every student in other universities attend classes for, would I not have second thoughts about the university ? Every student who joined UNNJ knew it was a scam, and they were an accomplice

</comment><comment><USER36> That's messed up

</comment><comment><USER34> Sounds like the Billy Crystal SNL routine.

</comment><comment><USER37> Eh, it was clear to all involved that this was a fake university with no real classes, even if it appeared that the university had fooled the DHS.

</comment><comment> rm_-rf_slash I think we can all agree that DHS was in the wrong for having a sting university accredited, but I think it's fair to say that if a foreign national is too thick to see the scam in being enrolled in a university that doesn't make them take classss to get a student visa, then we don't need them, and if they are so unscrupulous to see the scam for what it is and they break the law regardless, then we don't want them.</comment>


The mother of all Android malware has arrived - <AUTHOR> http://www.androidpolice.com/2011/03/01/the-mother-of-all-android-malware-has-arrived-stolen-apps-released-to-the-market-that-root-your-phone-steal-your-data-and-open-backdoor/ <comment><USER3> This is an epic screwup by Google and the mobile carriers, but it's also a useful warning to Google's competitors.

1) This problem was reported to Google a week ago, through multiple channels, by one of the app vendors who got ripped off: [http://www.reddit.com/r/Android/comments/fvepu/someone_just_...](http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/) Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints, allowing lots of skeevy software to linger on the market.

2) The phone carriers are apparently very slow to patch root exploits.

3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees.

But a word of warning to iOS, WebOS, and Blackberry users:

4) Although the lax behavior of Google and the carriers made this exploit easier, we'll eventually see problems like this on most mobile platforms. Apple has allowed (benign) root exploits to slip through their approval process in the past. If your phone is vulnerable enough to be rooted, it's vulnerable enough to be owned by a malicious app.

<comment><USER4> "3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees."

Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything.

And Apple has never let a "(benign) root exploit" through approval.

<comment><USER3> _Isn't the appeal of Google's app store that it isn't curated?_

Yes and no. As a developer, I certainly love the relative ease and freedom of Google's Market. But as user, I don't want to fear clicking "Download" or "Buy". Apple succeeds, in part, because their App Store provides a certain measure of trust, and users are willing to open their wallets.

At a minimum, Google needs to respond _quickly_ to malware reports, and to enforce anti-piracy rules vigorously. Allowing attackers to pirate and republish apps allows them to attack many more users than they could reach by developing malicious-but-popular applications from scratch.

 _And Apple has never let a "(benign) root exploit" through approval._

Yeah, I think that was an incorrect statement on my part. Apple has passed major, hidden functionality that violates their policies, but I was mistaken in thinking a root exploit was involved. For a mea culpa, see the thread at <http://news.ycombinator.com/item?id=2279823>

</comment></comment></comment><comment><USER5> Bear in mind that this is just something casting a wide net by using the android marketplace.

There's enough bugs and 0day floating around in webkit as well as unpatched exploit code to take on Safari, the Android browser and Chrome at the moment.

From a mail over the weekend about a pentesting exploit kit we subscribe to:

        This release introduces two new exploits for the webkit CSS rule
        deletion vulnerability. Use safari_parentstylesheet to exploit
        all those pesky OSX machines (fully up to date and patched)
        and android_parentstylesheet for anything running android 2.2 and
        below. Moreover, using android_hotplug you can further escalate
        your privileges to root. Being offsensive has never been so good!

        ==New Modules==

        o safari_parentstylesheet (Safari <= 5.0.3 64bit webkit css rule deletion vulnerability)

        o android_parentstylesheet (Android <= 2.2 webkit css rule deletion vulnerability)

        o android_hotplug (Android privilege escalation vulnerability)

That's just one pentesting tool we use and that's _a legitimate toolkit_. Malware targeting webkit in general is on the increase, with various payloads for safari, chrome, osx, ios and android. It's still the minority by far, but it is growing. Heck, even Metasploit's getting in on the game ([http://blog.metasploit.com/2011/01/mobile-device-security- an...](http://blog.metasploit.com/2011/01/mobile-device-security-and-android- file.html)).

Incidentally if you want to see a video of the safari bug in action, you can download one from [http://partners.immunityinc.com/movies/Lightning_Demo_Safari...](http://partners.immunityinc.com/movies/Lightning_Demo_Safari01.zip)

There's also one on owning android at [http://partners.immunityinc.com/movies/Lightning_Demo_Androi...](http://partners.immunityinc.com/movies/Lightning_Demo_Android.zip)

<comment><USER6> I'm not sure after your paranoia inducing post anyone is going to download zip files from links you provide.

Are these videos somewhere on the web in viewable form?

<comment><USER5> If you watch the android video you'll see that a link will do the trick, not even a download. So it makes no difference really - either you trust the link or you don't. Scary, huh?

I'm not aware of these vids being anywhere else but they are from the guys who make the aforementioned framework.

</comment></comment></comment><comment><USER7> "I demand a walled garden, and I will gladly pay 30% to ensure all apps are reviewed, approved, and subject to the whims of the closed-shop store providing them."

This is obviously a serious issue - as the OP notes, the double-edged sword of openness. Still, the speedy response of Google makes me feel warmer than the (not-so-common now) decidely un-speedy application process Apple put many developers through.

Edit: As jevans points out in response, and others have noted in this discussion, Google's 5 minute response time might be better characterised as '1 week of sitting on their hands when the developers complained, and 1 rapid response when it went public in a loud way'.

I'm feeling less warm now, and looking fondly at the non-smartphone Nokia I own which is so clearly targeted at the 11-year-old-girl's-first-phone market that it came inside a pink cardboard handbag. But has no malware.

<comment><USER8> The Apple walled garden is way more dangerous, because it's almost as easy to slip malware into your code (remember, Apple doesn't do full source code audits), and the false sense of security makes users even more complacent. It really is a perfect example of security theatre.

<comment><USER9> They do static analysis of your executable and check what you call, which is why they know if you're using a private API and reject you because of it. They've also caught bugs in my app and sent it back.

I believe the advantage of Objective-C for them is that all messages pretty much go through one point in the runtime (as far as I know). That signature is probably very obvious, and they can probably do a lot of looking at your code with very little effort. If you have malware in your code, there's a pretty good chance they'll find it based on what it does. I imagine they can see a lot more about our apps than you'd think, since they probably run them in a debug build of iOS.

I can think of literally dozens of things they can look at, and I don't even have access to their systems to know what data is available. They have hundreds of engineers who have probably figured all of that out, and automated it for the approvers, too.

And how would we know? Is a malware author going to blog and say "I tried to slip malware into the App Store, and they denied it?" Since an attempt costs $99 (I can't imagine you'd keep your account after a failed attempt), that raises the bar to trying. I seriously doubt we're the first to think of exploiting iOS, and you haven't heard a word about it...

I think _security theater_ is a bit of a stretch, frankly.

<comment><USER8> _They do static analysis of your executable and check what you call_

Doesn't Objective-C have dynamic binding? I'm sure you can determine what function to call at runtime, which means you can always get past a static analysis.

 _I can think of literally dozens of things they can look at_

I can think of literally dozens of ways any analysis can be subverted. Even dynamic analysis wouldn't work in case the thing uses a timebomb or even something simple like downloading data from the internet (apps do that right), and sending in a special payload that instructs the application to do something evil once you reach, say, 1,000 users. Apple wouldn't test your application by installing it on a thousand phones, would it?

<comment><USER9> > Doesn't Objective-C have dynamic binding? I'm sure you can determine what > function to call at runtime,

You need a message name (@selector), and the names are strongly typed -- meaning, they're pretty obvious with reflection tools. If there's a way to send a dynamic message without putting a @selector in your code, I don't know it, and I'm willing to learn.

When you start talking about the POSIX layer and stuff near the bottom (C), traditional wisdom applies there: what does your app link against? If you're linking against the dynamic libraries near the bottom of the stack and walking their contents (to avoid putting a string in your binary of what you're looking for, perhaps?), Apple's probably going to check that disassembly pretty heavily.

> Even dynamic analysis wouldn't work in case the thing uses a timebomb

You keep on writing time bomb as if it's some magical device that circumvents all security. A time bomb _needs a callback_ in the binary, and Apple's going to wonder why your app registers a timer for a specific date. This is what you don't seem to get: Apple has a disassembly of your entire binary, and they can see when they run it that you register a callback for December 2012. Where does that callback go? Code in the binary.

Same thing with your 1,000 phones case: clearly something needs to count, and the obvious candidate is a Web server of some kind, and then the app needs to _actually do something_ if the response comes back as 1,000. Which means that code needs to be _in the binary_.

Or you need to download code from the Web server to execute. Which is _easily_ detectable by Apple, and you'd never get approved.

> something simple like downloading data from the internet (apps do that > right)

You will be rejected if it's used as any part of execution, and they can (and do) check that. If you even touch APIs that try to sneak data into executable pages, I bet they'd terminate the app in record time.

Trust me, they've thought this through. The reason that I asked if you're speaking from experience is because you're making a lot of FUD claims which are easily fixable. Seriously, buy a Mac and try doing something malware-like with the iOS API. Then try submitting it to Apple. Otherwise, you and I are both bags of hot air, theorizing about hypotheticals.

<comment><USER10> I find it pretty hard to believe the iOS review monkeys have the technical ability to reason about the disassembly of a binary (if sufficiently obfuscated there are maybe 1000 people tops on Earth with the ability to do this).

As long as the operating system has a dynamic linker all bets are off wrt. static analysis, and the halting problem definitely applies to automated analysis.

If the OS allows writable pages to ever be executable then you can pretty easily hide your nasty code in the low order bits of an innocent looking data file (say an image), then pull them out and execute them at runtime.

<comment><USER11> iOS doesn't allow writable pages to be executed. As I recall that was one reason why Android 2.2's V8 javascript JIT was so much faster than iOS's.

Also, use of dlopen() is not allowed. A long time ago I heard of two AR apps that used it (they dynamically linked against CoreSurface, to copy the bits from the camera preview into an opengl texture) but I haven't heard of anyone sneaking an app using dlopen() into the store in over a year.

<comment><USER10> hence "to ever be executable", they don't need to be writable _and_ executable, as long as at one point they are writable (for you to dump your code in), then at some point they're executable (writable or otherwise).

as for dlopen(), you could just compile that directly into your app rather than using it from libc/libdl, bypassing that limitation entirely.

<comment><USER12> On non-jailbroken iOS you can't mark a section of memory as executable once it has been writable (and vice-versa, apparently). Executable pages are also checked against a signature by the kernel before they're used.

<comment><USER10> that's pretty incredible, I'm genuinely surprised.

I suppose it's possible when you start from scratch, there's no way they could do that on the Mac.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> This was inevitable - Google takes a laissez-faire attitude towards copyright violation on Android market, which is full of ripped-off IP - games with names and artwork belonging to other companies, rip offs of Rolex logos for clocks, etc - that I've personally reported and that have always been ignored by Google.

If they don't care about the small stuff - and it seems they don't - <USER2> nastier was always going to come along.

Hell if they'd bothered to notice one of the submitted apps was 'Spider Man' perhaps this would already have been averted.

<comment><USER14> The way it is supposed to be done is with a DMCA complaint, and I don't think you can do that unless you own the IP in question. Or are you saying that they are ignoring DMCA complaints? That is a much more serious accusation.

<comment><USER13> Android Market has a 'flag' button that lets you specify, eg, that 'Wolverine' isn't anything to do with Marvel but uses Marvel characters and artwork. They ignore this and similar copyright infringement flags.

You have to own the content to file a DMCA complaint.

</comment></comment></comment><comment><USER15> The fact that they're collecting IMEIs is interesting. One of the little discussed facts about smartphones is that they make it trivially easy to change the IMEI.

On the Galaxy S you can simply mount the NVRAM where it is stored as r/w and change it, and any other data you want.

For those who don't know the IMEI number is what physically identifies an actual handset, like a MAC address, except that the networks/authorities view it as being more of a watertight way to identify someone, as up until recently changing them has required a soldering iron.

This malware's behaviour implies what I have suspected for some time, that there is a black market for IMEIs, likely being used for organised criminals to remain anonymous, or to enable the resale of stolen handsets.

Anyone fancy taking a guess at what an IMEI is worth on IRC these days? CC#s are meant to be about $0.10 each aren't they?

<comment><USER16> Haha, I don't know, it's always been easy to get a new IMEI. Go to one of those "cell phone support forums", advertise an unlocking service, ask for IMEI, receive in your email. With a little more work you could monetize it but botnets for CC#s are probably a lot easier, and 419's provide even more pay for the effort involved. But then again i'm not a kid in some 3rd world country looking for a quick buck so who knows, Android apps could be a really interesting proposition.

</comment></comment><comment><USER17> I think that this illustrates a point that's worth making about the difference between Android devices and iOS devices. There is no 'better' - there is a tradeoff. This is the same tradeoff that Linux elsewhere offers, really.

This is the tradeoff: "if you are willing to invest your time, mental energy, and vigilance into bending your device to your will, avoiding traps such as mention in the article, and doing upkeep, a Linux-based device will give you enormous and awesome capabilities, leveraging the full power of having a general-purpose computer in your pocket."

I am glad that that's available, because for some people, that's a great tradeoff! But it's important that there be another tradeoff available, which iOS is currently the flagship of: "if you are willing to accept more limited capabilities, you can have those capabilities in a form that Just Works and does not require your vigilance, time, and mental energy."

I propose that the market share of Android and iOS roughly reflect the number of people for whom each of these tradeoffs, is the one they want. Of course we may want different things at different times - but when we buy these devices, we are voting with our dollars as to which tradeoff, overall, serves us best. I hope that both retain vigorous market share, because different people are best served by different tradeoffs.

</comment><comment><USER18> Coincidentally, this is exactly the kind of thing Google's recent Zynamics acquisition is meant to find automatically through binary code analysis.

<comment><USER19> If I was google I'd have a giant server room full of VM's running android hosting every app in the app store with monitors of their state. Then you can monitor not just what the code is predicted to do but what it actually does.

</comment></comment><comment><USER20> _"as well as remotely removing them from user's devices"_

...well that is an interesting feature!

<comment><USER21> This is surprising. Does anyone know if Google can actually do this? Maybe provide a reference.

<comment><USER22> They said they could and would do it, just as Apple and Microsoft have said they could do it.

<comment><USER23> Nokia can't do it, but the people don't like their Symbian UI. Those are the priorities I guess.

</comment></comment></comment></comment><comment><USER24> Completely missing from both the article and the comments: the list of permissions these malicious apps requested. I'd really like to know whether they found a way around the permissions model, or if this is a case of users clicking 'OK' to a prompt that says "do you want to let this app root you?"

<comment><USER25> The apps included root exploits. The thread on the Android subreddit has lots of details.

</comment></comment><comment><USER26> I am for openness of the Android platform. I don't believe that a review process, like Apple's, would be beneficial. However, the Android market is not like the web. On the web, if you are selling a downloadable piece of software, and I come along and buy a copy, break your DRM and start selling it myself, you have a surefire way to get me to stop. What you can do is talk to my payment processor and tell them I am committing fraud. They don't like that, and will shut things down. While the law is fuzzy and I am innocent until you can prove I am ripping you off, the payment processor has a contract with me that says that I will not do anything illegal, and they will enforce it.

Now, on the Android Market, there is effectively, only one payment processor: Google. And they have a conflict of interest, since they also own the platform. They can either police all the apps (a la Apple) or they can ignore all fraud reports. The in-between gets them into a lot of grey territory about what constitutes fraud, etc.

</comment><comment><USER27> There is one thing everyone is missing, Apple does have a process of verifying the identity of the author even if there was a malware that was slipped in it is easy to identify the author and report to authorities that in itself is a good deterrent against trying. remember malware writers want low hanging fruit first and and Android extremely ripe for it.

</comment><comment><USER28> I found this: _"Update: holy cheeseballs, they've been pulled already! Took less than 5 minutes from first contact to pull!"_ utterly amazing. That goes against ... well, pretty much everything I've ever heard about Google's speed and ability to respond to humans saying something.

Too bad it was over a security incident, but at least it proves that Google can react.

<comment><USER29> Actually, reading the thread on the Android subreddit one of the affected developers said he filed complaints over a week ago with no reponse nor action taken. That is until it reached the (Android sub?)reddit-frontpage.

Google doesn't really do as much customer-service as it does PR-management, and that seems to be the way Google usually handles these things. Very few problems are addressed before they turn into high-profile cases of bad publicity. And really: That is pretty bad.

Let's not let Google-fanboyism blind us from the facts: Google is one of the worst companies on the planet when it comes to customer-service.

<comment><USER30> _Very few problems are addressed before they turn into high-profile cases._

Really? How would you tell if that wasn't true?

<comment><USER29> Good question. If I should answer it 100% honestly, I would say I've reached that conclusion trough very unscientific means: personal experience and a possible "postive" conformational bias.

Examples of this would be me having issues with Google services or applications, Googling for answers and then finding forum-posts on the Google forums discussing the problem.

These posts would mainly consist of 3 things: 1. Original poster asking for advice on a problem he has. 2. Other people experiencing the same problem, stating so and in some cases offering workarounds of various quality and reliability. 3. A complete lack of response from Google's end. No confirmation that it is a known bug with or without workarounds or a confirmation that this is a bug and that it is being investigated. Nothing.

These threads, when I find them, tends to be at least a year old if not more, with a staggering amount of people experiencing the same problem and all this with the issue at hand remaining unfixed. To quote a comment I read in one of those threads: "It's pretty obvious that Google doesn't listen and Google doesn't care".

Moving back to your question: "How would you tell if that wasn't true?". I guess in these cases I actually wouldn't, so it is indeed a good question.

But I know that for all the issues I've had, I still have them and they are still entirely unadressed by Google. Reporting problems to Google feels like showeling data into a write-only device and I can't think of any company I've dealt with which has had such a complete absence from its customers when it comes the products and services it offers. None.

Things like reliable customer service is why companies likes to send their money towards Microsoft: With Microsoft you may have Microsoft-costs, Microsoft-problems and Microsoft-quirks, but there is a huge support-apparatus ready 24/7/365 to help you get your problems solved. To put it bluntly: Customer support is not a "I'm feeling lucky"-button.

</comment></comment></comment></comment><comment><USER31> Google needs to do something. They absolutely do not need to mimic Apple's policies or impose any radical new limitations but the current situation is starting to spiral out of control. Once this starts hitting 'normal people' it could have massive repercussions. They need to stop this before the average person fears installing software onto their device or the entire third party ecosystem is going to be stunted. When you think about the depth of personal information, location awareness, microphone, camera, etc the ramifications of this are huge. The first virus that leaks SMS messages, owns Facebook accounts, or turns on cameras to spy on people could basically end Android as a viable consumer product. Of course we've seen this all before on PCs but I think the stakes are higher these days especially with devices that are so personal and highly connected.

</comment><comment><USER32> If someone who knows a lot about these things has a few moments to spare, I'd love if you could answer [http://www.quora.com/iOS-vs-Android/What-are-the- relative-me...](http://www.quora.com/iOS-vs-Android/What-are-the-relative- merits-of-iOSs-and-Androids-application-sandboxing-models) on Quora.

</comment><comment><USER33> Never mind walled gardens, but Google could at least run some basic virus scanner before posting stuff on the market.

<comment><USER34> Smartest post on this entire thread.

They clearly analyze the APK before uploading and look at the Manifest, etc, so why not do a rootkit scan of some kind.

</comment></comment><comment><USER35> I saw that there was a rootkit for Android botnet C&C presented at Shmoocon. Is this a similar attack, or something different? [http://www.grmn00bs.com/2011/01/30/smartphone-code- release-f...](http://www.grmn00bs.com/2011/01/30/smartphone-code-release-for- shmoocon)

PDF: [http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_Georg...](http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_GeorgiaW.pdf)

Video: <http://vimeo.com/19372118>

</comment><comment><USER36> Actually, that the malware contained a root exploit is fixable sooner or later.

The next insight will be, that even if the sandbox had worked, this type of attack still is possible by using the user's trust in the brand of a well- known app to use the permissions granted to it for malicious intents. There's no easy way to avoid that up front automatically.

</comment><comment><USER37> So, was there any app-scanning software capable of detecting this before the warning? I have Lookout installed on my droid, but I have always wondered at its effectiveness. It has a "there are no crocodiles, so it must be a great crocodile repellant" feel to it...

</comment><comment><USER38> I know it's probably off-topic, but would it have killed them to link to the original reddit thread?

They were more than happy to copy the whole story and quote verbatim from the thread. Strikes me that a direct link would have been the polite thing to do.

</comment><comment><USER39> For developers who need to provide mobile access to their hosted apps, this event makes it easy to decide on a path with regard to "Native apps / Web apps ?" question.

<comment><USER15> Except that as discussed, there are plenty of code execution flaws in mobile builds of webkit that will do just as well as any flaw in the native app API.

One XSS or SQL injection vuln in your webapp and your users could be just as rooted as the victims of this malware. Exactly like in the desktop browser world.

</comment></comment><comment><USER40> As far as I know, I was at a security conference in January, there is no code signing and no sandbox on Android. That is not a good scenario for "security".

<comment><USER41> You are absolutely wrong. All apps in the Market are signed, and apps are sandboxed by running them with separate Unix userids.

<comment><USER40> Okay I am wrong.</comment></comment></comment>


Ask HN: Jumping into Android Development - <AUTHOR> I like taking a jump in the deep end approach.
I'm a Java developer turned iPhone developer.
What books do you recommend? When I first started iPhone development, I bought hundreds of dollars of books and it helped tremendously to have different teachers on paper. What are the best-of-class Android apps (in terms of user experience) that you like? What are your favorite apps? What is the best part about working with Android?
I'd like to port a fairly complicated iPhone application to Android. Since I want to support the widest range of Android devices, I'm targeting the G1 as the lowest common denominator. The existing iPhone application heavily relies on CoreData, and I feel that is the biggest hurdle. Are there are any CoreData like persistence frameworks? I, admit too, that I am scared of the "unholy mixture of XML and GridBagLayout" that is required to build UIs in Android - but that is a secondary concern.
Is three weeks, give or take a few days, too aggressive a deadline for doing a port from iPhone to Android? I will compromise where needed. <comment><USER2> I'm not a fan of learning from technical books, but that's just my style. I like figuring out exactly what I need to do and Googling it one piece at a time, side-by-side with having the docs as reference.

You could start by reading the dev guide from the top: [http://developer.android.com/guide/basics/what-is- android.ht...](http://developer.android.com/guide/basics/what-is- android.html).

You should read the Activity lifecycle some ten times at least: [http://developer.android.com/reference/android/app/Activity....](http://developer.android.com/reference/android/app/Activity.html). To avoid countless headaches at the beginning, clamp your app to only portrait or only landscape mode if it makes sense.

Also read over the Intents doc a number of times as they are another crucial part of the system: [http://developer.android.com/guide/topics/intents/intents- fi...](http://developer.android.com/guide/topics/intents/intents- filters.html).

The Android SDK contains various samples that will get your going quickly.

Having a G1 to test with is a good idea. They are painfully slow, so if you get the G1 right, everybody else will be happy. Quick stat: devices by platform: [http://developer.android.com/resources/dashboard/platform- ve...](http://developer.android.com/resources/dashboard/platform- versions.html).

Designing the interface layout is pretty painless. The framework is well thought out.

<comment><AUTHOR> Thank you for the tips on intents. I second you on the books as I like to exercise my Google foo; I don't read those books I buy - most are pure reference. I think I've gotten the books simply to feel like I'm becoming X (in the geek friends over, coffee table sense). And there are times where bringing the book(s) to a park sans computer makes me realize the concepts better. I didn't realize the G1 was so slow! But if it works on the G1, then I'm golden.

Going to use my dead tree allotment and _print out_ the Activity and Intents reference documents you highlighted. Thank you.

</comment></comment><comment><USER3> Stackoverflow with the [android] tag is going to be your biggest resource for q & a in my opinion. Googling for Android dev stuff is a pain as you get a lot of strange and barely useful Google groups threads and clones.

As for books, I bought a beginners book to get started, but you're probably beyond that if you have Java experience.

The Google examples and dev starter page are enough to get rolling actually.

Also, regarding targeting devices; in your manifest, you can set a lowest possible SDK and a target SDK and compile against 1.6, and then allow for the device to do the density control and you can almost target all the devices in one APK. You just have to make sure not to use any code that doesn't work in the 1.5/1.6 versions of Android - but if you're in eclipse, it will help out a little with this. My games are getting downloaded by 1.5 users and Droid 2.x users.

I think the thing you'll hate the most right out of the gate is the 24-hour return policy in the Android market - especially since you're coming from iPhone.

People can buy your app, but you don't know if it's a sale for 24 hours when it finally closes. In that limbo time, they get to use it for free and just by uninstalling they get their money back - or rather - their transaction never happens. It's great for the end user, but hard to cope with as a developer who thinks they have sales, but overnight they just go away every now and then. I've had up to 25% cancellation rates on bad days.

Whatever you are creating, I hope it has repeat value, I think that's one of the only ways to get around the cancellation problem.

<comment><AUTHOR> I know I can possibly use Titanium to cross-develop to multiple platforms simultaneously but I like to think if you can develop iPhone and Android apps for a client that are near functionally equivalent - you have a stronger base when dealing with large and/or quasi-governmental agencies that have accessibility rules. Of course, mobile formatted websites are always going to work for the widest spectrum.

</comment></comment><comment><USER4> If you're already a java developer, you should probably be able to jump in just from the official docs: <http://developer.android.com/guide/index.html>

Follow along with the tutorials, then download some of the sample apps to work with. I've also found that downloading the source code to the Android project itself is pretty worthwhile. You can look at the source to almost all of the apps included in a default installation (dialer, camera, music, browser, etc.)

Last I checked, most of the books are being outdated pretty fast. Don't even bother with any book that doesn't cover 2.0 at least, 2.1 preferably.

For most apps, covering the broad range of devices isn't very difficult. The emulator that comes with the SDK will let you emulate different display resolutions. You can also run any version of the Android OS on the emulator to test your app under different OS versions.

The "unholy mixture of XML and GridBagLayout" is actually pretty easy if you've ever worked with an HTML CSS grid framework like Blueprint, 360Grid, or YUI grid. At least, it's made pretty good sense to me so far. It _would_ be nice if there was a good visual layout tool available... but oh well.

I'm not aware of a CoreData like high level persistence framework. App data storage is usually done with the built in SQlite libraries. I believe you're on your own so far in building higher level abstractions on top of that.

<comment><AUTHOR> > It would be nice if there was a good visual layout tool available... but oh > well.

Titanium doesn't have a visual designer but I wonder what would happen overnight if Google bought Appcelerator.

</comment></comment><comment><USER5> This may help: [http://www.tbray.org/ongoing/When/201x/2010/04/25/LifeSaver-...](http://www.tbray.org/ongoing/When/201x/2010/04/25/LifeSaver- Lessons)

</comment><comment><USER6> _What books do you recommend?_

I've depended entirely on the web for learning Android development, but I've heard good things about the Android books from <http://commonsware.com/>. He has some helpful (free) tutorials available as well.

 _What is the best part about working with Android?_

For me: flexibility and transparency. I like to get my hands dirty and gain a deeper understanding of the system, and it's quite helpful having (1) access to the source code for almost the entire system and (2) root access on the device. Those things likely won't matter when you're writing your first Android app, but it will matter when you're doing something uncommon or complex.

 _Are there are any CoreData like persistence frameworks?_

I haven't needed any for my own apps, but the framework has integrated data storage engines. I imagine that someone has built a CoreData-like layer that uses them. This link might be helpful: [http://stackoverflow.com/questions/371538/any-good-orm- tools...](http://stackoverflow.com/questions/371538/any-good-orm-tools-for- android-development)

 _Is three weeks, give or take a few days, too aggressive a deadline for doing a port from iPhone to Android?_

Can you give us any more details? Your time commitment will vary significantly depending on the complexity of the app. If it's a 3D game, then three weeks might not cut it. If it's a reasonably straight-forward app that doesn't have a ton of features, then three weeks will be ample time given your prior experience.

A few other thoughts: don't be afraid of Android UI building. It isn't as scary as it sounds. heliodorj's comments about reading the Activity/Intent/Multitasking documentation are spot on -- making sure that you grok those concepts will save you time and frustration. Be sure to test on a real phone, preferably one that isn't super speedy so that you don't frustrate users with older hardware (e.g., the G1, aka HTC Dream).

<comment><AUTHOR> Thanks, have scaled back the time estimate. Goal is yo just start getting hands dirty and dirtier.

</comment></comment><comment><USER7> You may want to check out this free online seminar:

<http://creativelive.com/courses/android2/>

Here's the description:

Course: Developing Android Apps - A Twitter Client Instructor: Tony Hillerson Length: 6 Weeks

You can never have too many Twitter clients. In this programming course, Tony walks you through setting up sign ins, creating a public timeline, making sure your app is responsive and giving it style to stand out from the flock. Finally, for those times when 140 characters isn't enough, we'll extend our Twitter client to also post photos to the popular Twitpic image service.

</comment><comment><USER8> Highly recommended. [http://www.amazon.com/Professional-Android-Application- Devel...](http://www.amazon.com/Professional-Android-Application-Development- Programmer/dp/0470565527)

<comment><USER9> Reto (the author) is a wicked smart developer who is now on the Developer Relations team at Google. While I haven't read/used it myself (not a Java/Android programmer) I can speak to excellence of the author.

</comment></comment><comment><USER10> I really like the books by Mark Murphy at commonsware.com. I have submitted some errata to Mark, and I think I have a spare coupon code you could use for a 6 month subscription if you want to take a look. My email is in my profile. Mark also does a one hour Office Hours session about twice a week, and that's been helpful.

As for ORM, I have been using SQLiteOpenHelper and SQLiteDatabase directly, but I had heard that you can use Hibernate (edit: don't think this is true). Also, there is one that recently released but is not free (I have not tried it and have no affiliation): <https://www.activeandroid.com/>

As for platform target, I would just go with Android 1.6 unless you need something specific from the more recent releases. That covered most of the market in January, and there have been a ton of 2.0 and higher phones sold since then.

I'm far from an expert, but I'd be glad to chat with you if you run into any questions. (I'm working in the other direction, trying to learn some iPhone OS)

<comment><AUTHOR> Android 1.6 seems like a good LCD target and 2.2 seems like the new hotness.

> I'm far from an expert

Don't discount yourself. I honestly don't like the expert title, as I feel its misapplied in most instances. Feel free to post an Ask HN on Android to iPhone and I'll do a braindump (still trying to preserve my semi-anonymity but may drop it just to collaborate with the HN community)

I had no idea you could use Hibernate on a frigging phone. That scares the hell out of me - as in it opens the door for crazy thoughts like will mobile environments become so powerful you use real Java stuff like Spring.

<comment><USER10> My comment about Hibernate was wrong. A while back, I saw a thread on StackOverflow about ORM's on Android that linked to another thread about Hibernate. I just went back and looked and the linked comment was suggesting "lightweight alternatives to Hibernate."

Threads in question: [http://stackoverflow.com/questions/371538/any-good-orm- tools...](http://stackoverflow.com/questions/371538/any-good-orm-tools-for- android-development) [http://stackoverflow.com/questions/296587/light-weight- alter...](http://stackoverflow.com/questions/296587/light-weight-alternative- to-hibernate)

<comment><AUTHOR> Thanks for the correction. sqlite seems to be ok, marshalling and unmarshalling into Java.

</comment></comment></comment></comment><comment><USER11> Three weeks is pitifully small when coming online with android. The tools are much much less good than iPhone.

You're not really programming java per se, as a java like language missing half the API's you're used to. If you PM me a link to the iPhone app, I'll tell you my guess at a timeframe.

Secondly, the G1 (which runs 1.6) is not the lowest common denominator at the time. While it does have some of the wimpiest specs, other phones, such as the Moto Cliq, are still stuck on 1.5.

Additionally, I suggest you check out <http://commonsware.com/Android/> which had a nice section on scripting on the phone, which was invaluable for testing out UI design alternatives.

Not seeing your iPhone app, I honestly suggest telling them "This could take between 2 and 10 weeks, and will likely take more like 5 or 6".

While you're probably keen on eclipse, also check out how to develop without it, so you can use the debugger without eclipse getting in the way. It is a tad bit unreliable at times.

<comment><AUTHOR> I'm revising my estimates based on the feedback you and others here have provided, and I'm still going to dive in.

The app is a fairly typical CoreData-based tab bar app that makes heavy use of Google Maps (MKMapView) and UITableView. There is some custom UI in it but it's not that critical to the overall app.

To minimize risk in my approach, I'll address learning how Android's UI architecture works by just trying to create an app and tie screens together. And have a parallel lower-priority going on how to get some semblance of ORM (reading , not updating data) on the G1.

<comment><USER11> As far as the data goes, I believe you'll be able to get something going relatively easily that is a good enough replacement.

If you can ditch the custom UI for the app, that will help, as again, that's much harder in the Android world than the iPhone world to start with.

If all else fails, for a V1 (if this is only readonly), you can always write a program to dump your database into a java class which "hardcodes" the data.

Remember, you can update to the store in seconds on android. No review process, takes only 20 minutes or so to sign up for the whole developer account.

Additionally, this _Really_ got me when I started with it: You can't see the paid apps on the android store if you don't link your phone to a google account with a valid google checkout profile. I made a fake google account on the dev phone (which I wasn't sure I was keeping), and was confused as hell during the upload process because of this.

</comment></comment></comment><comment><USER12> You might be interested in this free 6-week course on Android development from O'Reilly starting next week - <http://creativelive.com/courses/android2/>

I saw this on HN about a month ago. I'm enrolled so I hope it is worthwhile.

</comment><comment><USER13> I can second the commonsware books mentioned previously. They are very helpful because you can download the source and run the apps to see how they work. Also check out the AppDemos that come with the sdk for examples.

The <http://android.git.kernel.org/> site has the source for lots of the bundled apps too. Especially useful to see how they put their layouts together.

<comment><AUTHOR> > Especially useful to see how they put their layouts together.

Thanks. I love examples because you can see the craftmanship.

</comment></comment><comment><USER14> As a developer who is taking on Android as his first mobile target, I have found that joining mailing lists for apps that are being group-developed helps a ton. Gina T (from lifehacker/smarterware) is starting a new app for her todo.txt idea that is totally OSS, so you can follow along, fork it and get into the code yourself, or use the community to find people to ask questions to.

</comment><comment><USER15> _Unlocking Android_ from Manning is excellent. Once you gain more knowledge you cam move on to _Pro Android 2_ from APress.

<comment><USER16> Does the former assume you will be using Eclipse?

<comment><USER15> UA shows you how to work with the Eclipse tools but overall it's fairly general, no reliance on Eclipse.

</comment></comment></comment><comment><USER17> GNUStep was working on a free coredata implementation</comment>


A surprise $2.5B in your bank account - <AUTHOR> https://www.bloomberg.com/news/articles/2020-08-21/bofa-customer-opens-mobile-app-and-finds-an-extra-2-45-billion <comment><USER2> Paywall: [https://outline.com/MazXKV](https://outline.com/MazXKV)</comment>