Technology
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
view the rest of the comments
I suppose I could be convinced, but my gut reaction is this is a bad idea. Most people aren’t security oriented, and would put themselves at risk with poorly updated websites that are an attack vector for bad actors… There’s a lot more at stake in regards to what personal data lives on your phone… the richest concentration of your PII.
Also, my battery life is already precious. And what if you’re out of cell range or the network is overloaded? Your site just stops working?
Even if your security oriented it seems many frown upon any self hosting whatsoever.
I wouldn't expect anything like this proposal to be mandatory. I'd want it as something I could turn on if I felt I needed it.
If you give people this ability, most of the ones who use it are going to put themselves at risk.
Maybe you feel that’s their own problem. Sometimes you need to protect people from themselves. The phone vendors sure as hell don’t want to start seeing news stories of their devices getting hacked all the time.
And how do you feel about your site visitors not being able to hit your page when your local network is overloaded?
Having my phone not be able to do something I want it to do is my problem.
That's why you have it turned off by default.
Compared to how it is right now, when I can't run a site on my phone at all? It would be a significant improvement.
I meant, it’s arguable that if people use this feature and expose themselves, that’s their own fault. I’m not sure what you thought I meant.
It’s off by default, but still there for uneducated and unskilled people to turn on and leave themselves exposed.
Vs just paying a few bucks for linode that’s got multiple 9s of uptime? It doesn’t seem worth it.
What's the practical difference between listening on [::]:80 and POST-ing an encrypted bundle of JSON? For this to be a problem, you need to run internet connected code on the device already.
Also, nobody is forcing you to host a website on your phone! It's just weird that you can't do it if you want to.
Here’s what I’m imagining. The phone is listening on port 80, probably running some jacked up plug-in to play a favorite song. The user probably installs it and then forgets it’s there. The plug-in becomes severely out of date, running code with multiple zero day exploits. In the best case scenario it is running your battery down and using up your bandwidth, it’s commonly just unavailable because your metro area cell network is jammed so your visitors can’t access the site at all, and worst case it can be tricked into running local scripts that do nefarious things.
It'd be hard to forget about because persistent daemons require a persistent notification. Android also submits regular reminders about background apps if you've hidden the persistent notification.
This risk exists with all apps, though! Abandoned apps regularly get bought out and infected with adware or other malware. Anything user content facing has the risk to be exploited down the line.
I think people have become quite paranoid about open ports since the XP era where every machine hooked up to the internet would be infected within seconds. People still use Windows 7 as daily drivers and so far the risk is much lower than I ever expected at least.
You are commenting as if everyone who would turn this feature on would have the technical acumen to understand how any of it works.
And you are commenting as if this isn't possible for malicious use already on any port above 1024. Unless you have a firewall installed, there's a good chance an app on your phone has opened a port right this moment.
The only change I would need for Android is that a) the 70s UNIX privilege port legacy should be dropped and b) phones should have a special, popup based permission, like location access. The risks are all there already, if we're going to be risking random adware serving up crapware and destroying your data connection, we might as well see the benefits as well.
We get it dude; you wanna run servers off of android.
Good thing the base is open source, you can go ahead and build that dream phone OS that doesn’t care about your personal security.
Nobody else wants to do this so I’m not sure why you’re arguing to hard for everyone to be able to do it. Why would I want to self host a website on a phone and expose myself to a million new attack vectors when there’s free hosting available en masse?
I run a server now for lots of local stuff and I still pay for a web server so my home isn’t constantly exposed to the internet at large. Why the fuck would anyone want to do that, IDK. it’s a fucking privacy nightmare.
The boat is already full of holes, so let’s poke more!