It’s easy to misremember something, use shortcuts or assume too much when doing a hobby research project.
This is now more important than a random side project and it should be treated accordingly.
Just to make it clear, I’m not accusing anyone and I don’t suspect bad intentions; I’d just like to see as many details as possible.
Because the assertions being made are rather more serious?
They claim they weren't:
> tl;dr; I'm a nerd who figures out how apps work for a job.
Which makes the claims that he "lost the data" difficult to believe.
I checked quickly tiktok apk, but couldn't find the relevant part.
Most possibly, he is mixing some bridging functions which are mapping functions or resources from dex files. (such as https://github.com/alibaba/ARouter, which I suspect tiktok uses)
such as:
@Route(path = "/test/activity") public class YourActivity extend Activity { ... }
https://github.com/termux/termux-packages/wiki/Termux-and-An...
And I'm just a dumb boiler-maker / welder.
It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.
Lots of people with technical clue's are also lazy as fuck about doing uninteresting work like setting up proper backups. Also somewhat paranoid about putting backups on other peoples infrastructure like dropbox (especially unencrypted).
I just wish affordable tape drives never disappeared.
I'm a bit at a loss for words to be honest.
I don't know if the guy whose dog ate his homework actually did the homework.
But I know that as a system administrator/security analyst I've had to push back HARD against some really stupid the things the development team wanted to do. And I'm sure the development team thought I was stupid for requiring things like auditable artifacts, limited permissions for developers, and daily backups. They wanted to push out code as quickly and easily as possible.
Knowing tech doesn't necessarily mean adhering to the platonic ideal of 'computer best practices.' This is actually the root cause of most security breaches.
...plus, the family pictures you had on your personal laptop are probably worth a lot more than a lot of the code out there that isn't being backed up. ;)
I will say this: box.net's webdav support is quite useful if you want cloud storage without a client like Dropbox, OneDrive, etc. I have having a background process constantly running just so I can keep up to date files that never change, and that I either don't need locally (backups) or are too large to want multiple copies of (CD images), or get locked/constantly modified (browser profile).
Except Dropbox has stopped supporting encrypted linux filesystems, and Box doesn't support Linux.
>It seems absurd to me that anyone with half a technical clue wouldn't use some kind of off-device / off-sit backup.
For most technical people I know, having data on an unencrypted disk is unacceptable. They wouldn't accept a scenario where a thief steals their laptop and simply has access to all their files. They wouldn't accept that risk just because a convenient "backup" service suddenly stopped support. They'll simply back data up another way.
I don't know what the lay of the land is for Mac/Windows users.
As I say, these services are as useful as the services they replaced 15 years ago from my perspective.
I fail to see where in my comment was anything related to "MacOS using encrypted linux filesystems" which, as of itself as a sentence, is confusing.
My comment's parent was explaining that anything worth keeping was worth backing up, and how easy it was to set up back-up even for someone with the commenter's skill level, using services like Dropbox.
My comment was explaining that certain users who have encrypted filesystems on Linux cannot use Dropbox, for Dropbox stopped supporting them around November 2018, which makes Dropbox unusable for these users who have to come up with back-up schemes excluding Dropbox or Box.
BTW Dropbox works fine under linux, just not in all setups.
That's great that you have 5GB (or less) of backup-worthy data.
For anyone else like you, that's the simple and happy solution that solves the problem well enough, and you're done.
What about if you have more than 5GB? What about if you have privacy concerns? What if your offsite backup is an offline backup and you can't access it due to a pandemic restricting access and travel?
All of the above impacted me and my ability to keep my backups going, and I've had to think about how to rebuild my backup strategy, as I've lost access to the remote site where my offline backup disks are stored.
Doing small backups is easy if you just want another copy somewhere else.
Doing bigger backups on a long term sustainable basis for large amounts of data with privacy requirements is less easy.
Anyway, you deserve a cookie for having done a backup at all. You're doing better than many.
Most of the stuff I produce is random garbage that isn't worth keeping. There's a good chance that this guy didn't think he had anything particularly interesting or worth keeping. Once you feel you understand how the app works, you don't really need the work you put into figuring it out anymore.
Also what you suggested is not symmetric, let me explain:
- There is a claim tiktok is downloading some zip file, extracting and executing.
making this claim is almost free, for me to claim otherwise, requires to reverse engineer all the app, then check 100s of possibilities to execute code in android app.
For example I took a quick look, and couldn't find anything related to this claim.
Also I checked reports from some "security" companies, there is nothing concrete there too. Mostly they talk about some SDK from appsflyer, which is used by a lot of apps, getting a lot of data, including IMSI etc (which is a US company btw)
But if you still ask me if it is running downloaded code, I cannot say 100% certain "no".
I believe claims should need proof, not the other way around.
> I'm getting a lot of DM's asking me to prove the majority of this with a paper and snippets of the offending code. I have a decent amount of my notes on my other laptop that recently had a motherboard failure and the majority of that data is on the laptop's SSD. It's a macbook pro, so recovering the data isn't exactly super simple. I have some frida scripts that I pushed to my git server as well as some markdown files + conversation logs I've had with exploit devs, but not much else. In order to get everyone the proof they require, I'll likely need to reverse the app all over again which isn't something I have time for right now.
Just sounds like "my dog at my homework".