• 2 Posts
  • 9 Comments
Joined 2 years ago
cake
Cake day: June 19th, 2023

help-circle
  • The bad news is that Android is still likely affected. Similar to Apple’s ImageIO, Android has a facility called the BitmapFactory that handles image decoding, and of course libwebp is supported. As of today, Android hasn’t released a security bulletin that includes a fix for CVE-2023-4863 – although the fix has been merged into AOSP. To put this in context: if this bug does affect Android, then it could potentially be turned into a remote exploit for apps like Signal and WhatsApp. I’d expect it to be fixed in the October bulletin.

    So a no-click device hack?


  • Per connexion would be pretty bad. Per network.

    Let’s say you want to set a static DHCP ip from your router. The only way to do so (from the router, I’m not talking from the phone), is by assigning an IP to a MAC address.

    If the address is randomised per connection, affecting a static DHCP ip would be impossible.

    Another thing a router often has is some sort of dhcp memory. It remembers the ip it gave to a certain MAC address for some time, then when the device connects back, it assigns the same IP it had before.

    So if the ip changes each time either the MAC address changes each time (not sure it’s default), or the router has no memory.






  • It’s not always easy to combine the different requirements for those companies.

    Some companies have trackers/advertising in their software. In that case, puting them open source would mean that everyone would see the code and be unhappy about the adverts.

    Another issue is pirating. Open sourcing the code could maybe allow easier pirating, either by removing the trackers/adverts or by just not buying the software.

    Managers can also not know, or not care about open source.

    Another issue is that open sourcing it in a way where someone can modify it, may create issues with some people trying to redistribute the software, even if the licence doesn’t allow that, which would create more legal work for those companies.