Skip to content

Rumour: Google intends to discontinue the Android Open Source Project – OSnews

Technology
41 15 115
  • A Deep Dive into All Four Generations of the Honda Acty Truck

    Technology technology
    1
    1
    0 Stimmen
    1 Beiträge
    0 Aufrufe
    Niemand hat geantwortet
  • New Google AdSense Fill Empty In-Page Ads

    Technology technology
    2
    1
    21 Stimmen
    2 Beiträge
    5 Aufrufe
    S
    I've not seen an ad in years, so they can try to monetize me but will fail spectacularly
  • Something I noticed

    Technology technology
    2
    3 Stimmen
    2 Beiträge
    15 Aufrufe
    H
    This would be better suited in some casual ranting community. Or one concerned with tech bros. I think it's completely off topic here.
  • Climate science

    Technology technology
    12
    2
    138 Stimmen
    12 Beiträge
    24 Aufrufe
    Z
    What is the connection to technology here?
  • 33 Stimmen
    7 Beiträge
    25 Aufrufe
    C
    AFAIK, you have the option to enable ads on your lock screen. It's not something that's forced upon you. Last time I took a look at the functionality, they "paid" you for the ads and you got to choose which charity to support with the money.
  • Covert Web-to-App Tracking via Localhost on Android

    Technology technology
    3
    29 Stimmen
    3 Beiträge
    20 Aufrufe
    P
    That update though: "... completely removed..." I assume this is because someone at Meta realized this was a huge breach of trust, and likely quite illegal. Edit: I read somewhere that they're just being cautious about Google Play terms of service. That feels worse.
  • There's no chance he signs it but I still hope he does

    Technology technology
    15
    1
    36 Stimmen
    15 Beiträge
    49 Aufrufe
    E
    And they've been doing it more blatantly and for longer than most tech companies.
  • 1 Stimmen
    8 Beiträge
    28 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.