9 ms·

An ideal platform would use a foss compatible framework. It would allow the user to configure which server to use to push notifications(one server for all apps,

An ideal platform would use a foss compatible framework. It would allow the user to configure which server to use to push notifications(one server for all apps, since that is needed for battery reasons). Notifications would be encrypted with the apps key.

jayd16 7y ago
>allow the user to configure This may be an ideal solution for you but its really not for most people.
- jimktrains2 7y ago
  That something is configurable doesn't negate the ability to have sane defaults that most people won't touch.
  - joshuamorton 7y ago
    Often times even having configuration options creates surface for security issues. A good example of this is that there were scams that involved having people paste some script into their chrome devtools and steal data. This worked fairly effectively. Facebook ended up doing some magic to show a warning message in the devtools console to tell people that no, you really shouldn't paste random stuff here, it will do bad things. Configurability does come with a cost. And "the ability to reroute all push notifications through an arbitrary MITM" is a security cost that I expect wouldn't be worth it.
    - SkyBelow 7y ago
      Is the solution to begin, to a degree, treating adults as children?
      - gretch 7y ago
        To answer the question shortly: Yes But I actually think you are mis-portraying the situation is because I don't think the average adult has the ability to comprehend these things. It's not the difference between adults and children, but adults and expert adults. Here are some analogies to other parts of society that we don't have a problem with: Seat belt laws Hard hat required construction area Safety guideline in Handling of hazardous materials We basically said society doesn't trust you to decide for yourself about your safety - you just have to follow the rule.
        acollins1331 7y ago
        Except a large portion of society thinks seat belt and hard hat laws are bullshit and shouldn't even be legal to enforce. Hazardous materials handling is completely different though.
        SkyBelow 7y ago
        >It's not the difference between adults and children, but adults and expert adults. Part of me wants to challenge the existing groupings of adults and children where all that matter is if you have been around the sun 18 times or not. This is but one weakness in the existing grouping that furthers my questions, such as why do we allow the non-expert adults a vote over laws, but deny a 17 year old the same? I think if you take the groups of children, adults, and expert adults you will find upon reducing them to only two groups based on similarity that you are left with experts and non-experts.
    - throwaway2048 7y ago
      I very much doubt that Google is making the GCM push code proprietary for these reasons.
      - izacus 7y ago
        No the truth tends to be more banal - making everything replacable in configurable means more (paid) engineering work for Google engineers for what's, essentially, building infrastructure for competition. What would be the compelling business case for Google to do more work to enable removal of their own product?
    - gubbrora 7y ago
      Hence why I said encrypted. The impulse to protect people from themselves is a dangerous one. In the article itself we see that in practice it is used to push inescapable spyware. "But our spyware is better than their spyware!" Google says they will protect you. But the truth is they are just concern trolling to shut down marginally worse competitors. For kids and elderly that can't make decisions on their own it could be default -locked to some entity contractually bound to good ior. Locked with an administrator password. That would be a reasonable compromise.
      - izacus 7y ago
        Google actually released Capillary, which makes E2E encrypted FCM messages easier to implement: https://security.googleblog.com/2018/06/end-to-end-encryption-for-push.html https://security.googleblog.com/2018/06/end-to-end-encryptio... But yeah, if you want to avoid Google's servers, then it's not enough. But in that case, you're probably on Google-free LineageOS anyway right?
lern_too_spel 7y ago
This is possible to build on Android right now and something I've thought about myself. There is nothing stopping you or me from implementing it, and I've always thought that Amazon should have done it to make it easier to port applications into their ecosystem.

jayd16 7y ago

>allow the user to configure This may be an ideal solution for you but its really not for most people.

jimktrains2 7y ago
That something is configurable doesn't negate the ability to have sane defaults that most people won't touch.
- joshuamorton 7y ago
  Often times even having configuration options creates surface for security issues. A good example of this is that there were scams that involved having people paste some script into their chrome devtools and steal data. This worked fairly effectively. Facebook ended up doing some magic to show a warning message in the devtools console to tell people that no, you really shouldn't paste random stuff here, it will do bad things. Configurability does come with a cost. And "the ability to reroute all push notifications through an arbitrary MITM" is a security cost that I expect wouldn't be worth it.
  - SkyBelow 7y ago
    Is the solution to begin, to a degree, treating adults as children?
    - gretch 7y ago
      To answer the question shortly: Yes But I actually think you are mis-portraying the situation is because I don't think the average adult has the ability to comprehend these things. It's not the difference between adults and children, but adults and expert adults. Here are some analogies to other parts of society that we don't have a problem with: Seat belt laws Hard hat required construction area Safety guideline in Handling of hazardous materials We basically said society doesn't trust you to decide for yourself about your safety - you just have to follow the rule.
      - acollins1331 7y ago
        Except a large portion of society thinks seat belt and hard hat laws are bullshit and shouldn't even be legal to enforce. Hazardous materials handling is completely different though.
      - SkyBelow 7y ago
        >It's not the difference between adults and children, but adults and expert adults. Part of me wants to challenge the existing groupings of adults and children where all that matter is if you have been around the sun 18 times or not. This is but one weakness in the existing grouping that furthers my questions, such as why do we allow the non-expert adults a vote over laws, but deny a 17 year old the same? I think if you take the groups of children, adults, and expert adults you will find upon reducing them to only two groups based on similarity that you are left with experts and non-experts.
  - throwaway2048 7y ago
    I very much doubt that Google is making the GCM push code proprietary for these reasons.
    - izacus 7y ago
      No the truth tends to be more banal - making everything replacable in configurable means more (paid) engineering work for Google engineers for what's, essentially, building infrastructure for competition. What would be the compelling business case for Google to do more work to enable removal of their own product?
  - gubbrora 7y ago
    Hence why I said encrypted. The impulse to protect people from themselves is a dangerous one. In the article itself we see that in practice it is used to push inescapable spyware. "But our spyware is better than their spyware!" Google says they will protect you. But the truth is they are just concern trolling to shut down marginally worse competitors. For kids and elderly that can't make decisions on their own it could be default -locked to some entity contractually bound to good ior. Locked with an administrator password. That would be a reasonable compromise.
    - izacus 7y ago
      Google actually released Capillary, which makes E2E encrypted FCM messages easier to implement: https://security.googleblog.com/2018/06/end-to-end-encryption-for-push.html https://security.googleblog.com/2018/06/end-to-end-encryptio... But yeah, if you want to avoid Google's servers, then it's not enough. But in that case, you're probably on Google-free LineageOS anyway right?

lern_too_spel 7y ago

This is possible to build on Android right now and something I've thought about myself. There is nothing stopping you or me from implementing it, and I've always thought that Amazon should have done it to make it easier to port applications into their ecosystem.