Yeah, apps are bad, but what concerns me (well, scares me to my bones, actually) is the prospect of malware below the app level. The operating system, drivers, and hardware are all ripe for abuse at an unimaginable scale. The "baseband" blob in particular seems like a holy grail of invasive surveillance. And, theoretically, there's a huge opportunity for the manufacturer of the PCB and every chip on it, to add what is logically a blob - a region of the chip that is mostly dormant, but reacts to some signal and come's alive. And we cannot verify that these features don't exist because they are too small!

I mean, if I was China I'd be actively pursuing inserting this kind of trojan horse in everything. Yeah, you'd only get to use it once at scale, but that's all it would take. And you'd probably get away with targeted use for a long time before anyone discovered it.

This, that is, national security, is the best reason to pass "right to repair" laws, and build out replacement hardware and software options that are verifiably open. Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.

> Heck, if I was with NSA I'd be pushing hard to fund that kind of work with NSA money.

But what if the NSA had their own backdoors installed in hardware made by US firms?

AFAIK very few PCB- or chip-level electronics are made in the USA. And this kind of insertion would best be done at the last possible moment, at the factory. So if you don't have the physical factories, you don't get this opportunity. No doubt the NSA (or any national intelligence agency) would want this, but you can't have it unless you have the physical fabs.

So, being practical engineers, if I was the NSA I'd make deals with telecom's to 'assist' with writing the baseband. But the irony is that the device manufacturer could easily disable this backdoor in favor of their own. Oops! :)

> But the irony is that the device manufacturer could easily disable this backdoor in favor of their own.

I'm not sure it works that way. Perhaps the NSA could force certain US companies to specifically design and install backdoors, and require these backdoors to be always active. (One of my possibly ungrounded/paranoid fears is that they do this with Intel ME).

The balance of likelihood is they do on both Intel and AMD management engines as that's what any competent agency should do in this age. To my mind, there's no other real reason for the explosion of interest in ARM chips on server. ARM design is sufficiently well understood and simple that usable chips can be designed and fabbed away from the control of US companies even if it provides poor performance trade offs.

When I was a little boy, I heard a myth about argument between the US and Japan, The US said, we can remotely bomb any place that has a Television, and Japan replied, we can remotely bomb any place that has a Transistor Radio. I totally believed that back then.

I was sort of hoping someone here would tell me I'm being paranoid, or that there is a way to externally verify a chip with ~10nm features...or that there is some other reason why the nation that is the world's 3D printer won't do this.

Free-electron lasers could use _coherent_ soft-xrays to basically "Hologram" the interesting parts (maybe after grinding it to be very thin).

We need to legally ban online targeted advertising, as it causes far more problems than it solves.

I'm sure the internet will do fine with a less intrusive monetization scheme.

Yes, exactly this. Advertising in all forms is explicitly attempting to co-opt your decision making capacity. My company wound it's way to being an ad-tech company (started as saas) before we sold and it just felt totally icky.

I've been advocating for heavy regulation of the advertising industry, not just online but everywhere, for the last few years. Not just industry and entertainment but the entire political system and journalism have been co-opted by advertising and sales practices.

Yes and as a side-effect some of the brighest minds in the world may end up working on more pressing issues than getting people to click on links.

I'm good with this.

The only rebuttal I ever hear is, well, how are your favorite websites going to stay up if they can't be free? Will you pay for them all?

And the funny thing is, the websites I use fall into three categories:

1. Free, and super cheap to host, unlikely to be affected by loss of advertising revenue at all (e.g., my hobby blog)

2. Free, and I can live without them easily, because the entire commercialization scheme is inherently destructive to a positive experience(youtube; facebook)

3. Free, but have other commercialization schemes underway or provider their owners with some other sort of value, and would very likely remain viable in their current or similar format without advertising (Penny Arcade; SMBC Comics; Stratechery-ish; H-N; RP online)

4. Non-free (Netflix, medical journals; various patreon-based fora/discord channels/etc.)

1 & 4 are the primary sources of value for me. 2 could disappear overnight and I would barely notice. 3 would either adapt to survive, or die, and the total loss of value to me would be non-zero, but small.

So by all means. Kill off the ads. Don't give me any bs about the value of the free internet. It's worth what I paid for it.

What harm?

Of the top of my head:

* Journalism no longer prioritizing truth, but eyeballs/clicks. * Immense user frustration * Waste of bandwidth (energy costs, etc)

I bet there are many more.

Even without targeted advertising journalism would still use advertising, they'd just make way less money.

I agree with your first part, but the second part isn't true if it were prohibited to do targeted advertising for everyone.

It's an arms race, you only earn less without targeting when your competitors are targeting. When all advertising is equally poorly targeted, everyone's getting their fair share of the available advertising dollars.

The collection, purchase, sale, and distribution of sensitive user information without the users consent.

If it had a bigger clearer warning - like the cookie banner, then there'd be no harm?

Insatiable consumerism and discontentedness

The book Dragnet Nation, from ~5 yrs ag, did a great job (then) on this subject. That along with Chaos Monkeys help escalate my fear and paranoia. Anyone I engage on the subject? They're oblivious.

https://www.amazon.com/Dragnet-Nation-Security-Relentless-Su...

This is a good explanation suitable for the layperson. Though there are a few confusing bits, like:

> And every app is potentially leaking data to five or 10 other apps.

it's overall absolutely very good, relatively excellent.

I don't understand why this reporting doesn't include the phone companies? They have far more data.

Much of the public's understanding of cell phone tracking has centered around the cell provider, the telephone network, and big players like Facebook and Google. They're missing a big piece. The NYT is shedding light on this missing piece.

This article puts the spotlight on yet another group of companies and another tracking mechanism. These companies are small, virtually unknown to the public, and they're providing SDKs which others are building real and useful mobile apps upon. One example given was an otherwise legitimate weather app which pulls your location to provide local weather data. You grant the app access to your location information because it has a reason to have it, and it does something useful with the data.

The article introduces the public to what you probably already knew. Those SDKs can (and do) ingest that same location data for their own purposes. In the article, they find that the SDK provides your fine location data to a location services company (Cuebiq) for a total of twenty times over the course of an eight minute walk. Most users have no idea this is going on behind the scenes. They just see the weather app.

The article isn't attempting to dismiss other forms of tracking. It is trying to better introduce a new form of tracking that most people poorly understand, if at all.

Related recent thread: https://news.ycombinator.com/item?id=21833718

Since the article title is baity, we changed it in accordance with the HN guidelines (https://news.ycombinator.com/newsguidelines.html). If anyone suggests a better title, we can change it again.

I think the article's original title should stand. While some people might consider it "baity", I would describe "Smartphones Are Spies" as an accurate description of reality and the content of the article.

The article is making an a public accusation: a lot of spying is happening, and they are naming some of the (in their opinion) responsible parties. Changing that to a title that only indicates the general subject of the discussion ("location data marketplace") obscures the article's thesis: "Your smartphone is probably sending your precise location to companies right now." (which is just a more detailed way of saying "smartphones are spies")

[regardless, it's your house, use whatever titles you want]

As I said, I'm happy to change it to something better if anyone suggests it, but "Smartphones are spies" is obviously sensational and this thread is already filling up with low-quality comments.

The definition of a better title on HN, btw, is: more accurate and neutral, and preferably using representative language from the article.

we need to create an app development regime that does not "trojanize" apps or pirate any derivative data.

In my eyes the mobile industry as a whole has voluntarily succumbed to a supply chain attack

Good job. That 'location pings' animation looks chilling. Very appropriate.

At least in this case they mention that explicitly at the end of the article:

"Like other media companies, The Times collects data on its visitors when they read stories like this one. For more detail please see our privacy policy and our publisher's description of The Times's practices and continued steps to increase transparency and protections."