Hacker News Reader

kuhsafton What we talk about when we talk about sideloading

For music and movies, yes. Though with movies, you even have HDMI HDCP and DisplayPort DPCP to make it harder.

For games though, the game binary is the media. Game console developers have been very successful at preventing pirating.

kuhsafton What we talk about when we talk about sideloading

Xbox, post-360, has been very successful at doing so.

kuhsafton What we talk about when we talk about sideloading

Which is the same as root-of-trust attestation.

Which is better:

- Having applications provide kernel-level software to provide attestation.

- Or having the OS provide root-of-trust attestation, but also requiring signed binaries, and preventing global root privilege escalation.

The third option would be neither, but players want some sort of anti-cheat.

kuhsafton What we talk about when we talk about sideloading

> And yet the pirates still have all of their content, because DRM doesn't work. One pirate cracks one locked device and can download their entire catalog with it.

I know and I'm saying what we are seeing is a push to plug all those holes. iOS, Android, macOS SIP, Windows Secure Boot. All root-of-trust systems, so that only operating systems that prevent copying can download it in the first place.

Those pirates aren't using locked devices to copy content. They are using devices lacking copy protection.

kuhsafton What we talk about when we talk about sideloading

> For streamed content the pirates only need one person to crack one device

Thus the push for locked devices.

> What it's nominally supposed to be for is so that a server can verify that the device is approved before providing some service.

Which is why Neflix wont work with a device failing Play Protect.

> The first is what makes it useless for copy protection

Not if you require a locked device to download the artifact in the first place to prevent copying.

kuhsafton What we talk about when we talk about sideloading

> spared me of the headache of dealing with pirated things

Without any sort of DRM and today's internet speeds, pirating digital media would probably be like Napster

Greenheart Games famously purposely released a different version of Game Dev Tycoon for pirating. You can read the blog post here: https://www.greenheartgames.com/2013/04/29/what-happens-when...

kuhsafton What we talk about when we talk about sideloading

And Steam implements its own DRM and takes 30% from game publishers. Also, they don't stop game developers from providing their own DRM which require root-of-trust, like CoD or BF6 which require Secure Boot.

kuhsafton What we talk about when we talk about sideloading

> I can't help but think there might be some effect here that's locking us all in similar to how the U.S. healthcare system can't seem to shake for profit insurance.

Yeah. It's called capitalism, where the reasoning behind everything is "How can businesses make a profit?". And in the U.S., it's also, if the business doesn't make a profit I'll starve.

kuhsafton What we talk about when we talk about sideloading

I think it's more equivalent to when game consoles check the license on disc media.

It used to be via hardware in the disc reader, then online license checking. And now it's fully digital, media and license.

The fucked up part is the fact that we can't transfer digital ownership of purchases. But at least I can use my purchases across multiple devices. Maybe this is what we should use blockchains for, but it would still require a locked device with root-of-trust.

---

> It's not an acceptable move from google.

By all means, you can have an unlocked Android device with a non-Google sanctioned OS and not use Google Play. That way you can use any app that doesn't require Google Play Protect.

Companies are OK with it because it makes them money. The majority of users are OK with it because they can use those companies' apps.

kuhsafton What we talk about when we talk about sideloading

Steam is a bit different, since that originated as a PC digital marketplace before complete root-of-trust DRM from HW->bootloader->OS->SW.

If anything, I would bet on a shift where Steam on Linux requires a signed OS like Windows Secure Boot. Call of Duty and Battlefield 6 already require Windows Secure Boot.

Wait, a signed Linux OS with Secure Boot already exists. It's Android Play Protect.

Also on Linux, you only get Widevine L3, which limits video and audio quality for DRM web content.

kuhsafton What we talk about when we talk about sideloading

It's less likely that game consoles and smartphones will become fully unlocked like personal computers. I would bet on the opposite where personal computers have the same HW/SW model as smartphones. We are already almost there with macOS SIP and Windows Secure Boot. The only thing missing is removal or isolation of root privilege escalation.

kuhsafton What we talk about when we talk about sideloading

> It is interesting though how this same conversation doesn't exist in the same way in other areas of computing like video game consoles

Historically, when the first game consoles with game cartridges existed, the hardware was much more niche than the available personal computers. Game system developers designed hardware specifically for games, and game developers developed for those specific systems. Also, physical media for games provided an ownership model and DRM.

In 2003, Apple released the iTunes Music Store partnering with music labels to counteract the prevalence of music pirating. That was the first major digital marketplace with DRM and way before the App Store in 2008!

In 2005, digital distribution for video game consoles came with the Xbox 360, PlayStation 2, and Wii. Being game consoles with unique hardware, they kept their restricted licensed development model of previous generations.

The iPhone and App Store just followed that pattern. Unique hardware and a licensed digital marketplace to go with it.

Now, the hardware between video game consoles, smartphones, and personal computers are mostly unified; and the only real difference is software, but the restricted marketplace model still remains.

---

> The fact that mobile phones aren't yet just a standard type of portable computer with an open-ish harware/driver ecosystem that anybody can just make an OS for (and hence allow anybody to just install what they want) is kind of wild IMHO. Why hasn't the kind of ferver that created Linux driven engineers to fix their phones?

DRM. There are already devices where you can unlock the bootloader and install any OS on it. But then you won't be able to install apps that use the Play Integrity API to ensure DRM. Companies/developers want revenue and develop apps that require Play Integrity.

Any device that doesn't have DRM will never support a paid digital marketplace or paid content streaming.

> Is Android and iOS just good enough to keep us complacent and trapped forever?

Probably. Microsoft tried a DRM supported OS with Windows Phone and that failed.

---

That being said, digital marketplaces and DRM have there place to prevent piracy and allow developers and creators to make a living.

If someone has a solution to prevent piracy without a root of trust that would be ideal.

kuhsafton Apple alerts exploit developer that his iPhone was targeted with gov spyware

There's still no proof that it was Trenchant, and there was no evidence on the device. It's unlikely that it will ever be identified as an attack from Trenchant. Trenchant/L3Harris is a supplier for Five Eyes, and any attribution of their exploits will likely be concealed.

kuhsafton Apple alerts exploit developer that his iPhone was targeted with gov spyware

Right. I was talking about passenger safety. But sure, if you purposefully designed a vehicle that has poor pedestrian visibility and end up getting hit by that same vehicle due to that poor visibility, you shouldn't be surprised.

kuhsafton Apple alerts exploit developer that his iPhone was targeted with gov spyware

An engineer at Ford isn’t developing cars that actively harms passengers.

If you develop weapons, physical or digital, don’t be surprised if you end up on the receiving end.

kuhsafton SimpleW – Web Server Library .NET Core

You shouldn't have to change the SDK.

You can create a class library ASP.NET Core Server by using a FrameworkReference [1]. I can't remember the library, but there was one that had its own `IHostedService` with its own embedded ASP.NET Core Server startup within it.

If your `WebApplication` requires services, of course you're going to have to register its dependencies on its `IServiceCollection`. Though, you can use factory methods for service registration to use an external `IServiceProvider`.

For console applications, I would recommend using `Host.CreateEmptyApplicationBuilder` [2]. Makes it a lot easier to configure services for Console applications. It also handles `IHostApplicationLifetime`s.

[1] https://learn.microsoft.com/en-us/aspnet/core/fundamentals/t...

[2] https://gist.github.com/pethin/7e5edd7614ff2f51c06c086e1bc7c...

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

The closest comparison to SharePoint is probably a combination of Zoho Connect, Zoho WorkDrive, and Zoho Flow. Zoho's office suite also integrates with WorkDrive and has collaborative editing. They even have a desktop app for Writer.

Even then, SharePoint is more of a platform. You can build SharePoint apps and extend it.

There isn't a comparison for SharePoint Server. There really isn't any single thing like it for on-premise.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

The issue isn’t Windows vs Linux. It’s an application security exploit and it just so happens that it only runs on Windows.

SharePoint Server is widely used and is a high value target.

Atlassian Server products have had their fair share of 0-day exploits. Atlassian also EOL their server products and forced a cloud migration.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

Canonical and Red Hat have certified hardware. Most corporate workers aren’t software developers. They just want their productivity suite for email, scheduling, messaging, documents, spreadsheets, and presentations.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

It’s been pretty consistent with how macOS MDM works with device profiles. The software to manage provisioning of device profiles may have changed, but at the OS level it hasn’t.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

> Perhaps it's not enough for there to be a "push" to Open Source because you've been failed by a proprietary solution, there needs to be a "pull".

Absolutely. A company isn’t going to create a GitHub issue and wait around. You can’t make service agreements with FOSS. There needs to be market forces to sell this software to corporations and it’s a hard sell.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

Do these companies support Net 30/60/90 payment? Do they provide enterprise support?

There’s a reason why corporations use HP and Dell machines. And there’s a reason why HP/Dell/etc don’t have Linux OSes on their corporate client machines. Well, they do, but companies don’t care to order them for the other reasons people have listed here.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

> A comment about adding "Redhat" to the mix is not talking about desktops (necessarily) but servers and security.

Why would you use RHEL to manage Windows client machines, when you could use Windows Server/Azure and get Microsoft support?

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

Most enterprise PCs are Windows machines and integrate with Microsoft services easily. The only way Microsoft is going to lose the enterprise market is if enterprise PCs move away from Windows.

But, for enterprises, the only reasonable migration away from Windows is Mac. JAMF Pro for Mac can be hosted on-premise on Linux. The majority of enterprise software runs on Mac. However, Macs are expensive so it's unlikely to overtake Windows enterprise machine usage.

Hardware support for Linux PCs is poor and lacks the manageable of Windows PCs with Active Directory and GPO, or JAMF for Macs. Enterprise software usually doesn't support Linux. Linux PCs are uncommon for personal use and corporations don't want to train users how to use Linux.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

CORRECTION: Chats are only journaled to Exchange mailboxes for data compliance. Messages are actually stored in Cosmos DB. https://youtu.be/V6B4KraD-FM?feature=shared&t=319

Contacts and voicemail are stored in Exchange.

Diagram of data storage locations: https://youtu.be/V6B4KraD-FM?feature=shared&t=454

M365 Groups are still SharePoint + Exchange.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

Yeah. Once you start working with the SharePoint API and Exchange API, you realize how it’s a miracle that Teams works at all. It’s bonkers.

I once figured out that you can go to the permissions page on the SharePoint site created by Teams and remove access for the corresponding M365 group.

M365 relies on SharePoint and Exchange, but they don’t rely on M365. So, you can potentially break Teams.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

It’s not cybersecurity. It’s legal, trust me. For large corporations, eDiscovery is huge. Failing eDiscovery can cost a company millions. Having a bunch of different data sources makes it impossible, so companies stick with M365 as corporate policy and call it a day.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

It’s impossible to stop using M365 while stopping usage of SharePoint (cloud or on-premises). See https://news.ycombinator.com/item?id=44640219

Here’s just one example:

Each M365 Teams Team creates an M365 Group which creates a SharePoint site and Exchange mailbox. Teams channel files are stored in that SharePoint site. Teams channel messages are stored in the Exchange mailbox.

Private files dropped in Teams are stored in OneDrive (rebranded SharePoint). Private Teams messages are stored in the sender and recipients’ Exchange mailboxes.

M365 is SharePoint and Exchange. EVERYTHING is built on top.

EDIT: changed ‘individual’ to ‘sender and recipients’

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

> It's not much effort to just drag and drop a file into … OneDrive …

See, there’s the problem. Once you touch anything M365, you’re using SharePoint.

People see SharePoint as a document collaboration tool. But, in reality, it’s real use is as a data storage platform.

kuhsafton Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

> Sharepoint is a poor amalgamation of like 18 different things.

You’ve got it backwards. Everything M365 is an amalgamation of Entra, SharePoint, and Exchange.