Discussion about SPM / Repo (Split from other topic)

[EvilDragon]

you use his app to download another one of his apps, why would he need to attack over SSH when he can attack locally right on the machine and run whatever he'd want from within the application.


get the giant wooden horse into the city and then worry about someone seeing thru the gates when they got opened ?

Not exactly. No app can run as root unless you enter your password, so an app can't run anything.


It could start bruteforcing in the background though


As said, I doubt StreaK wanted to cause any harm, but it's a potential risk and definitely not very nice doing that.

 

[skeezix]

Honestly, the repo is still missing one huge feature, though its painful to add I'm sure.


Non-pnd files.


I think it coudl be cheated in -- when uploaded it, wrap them with fake-PXML for his database or something, on his side. Pretty ugly though. He really needs a 'file type' handler mapping, so that maybe pdf coudl be handled one way, pnd another, that sort of thing.


Reason -- sometimes peopel like to zip up themes, documentation, guides, random stuff. Consideer themes for minimenu -- its a directory with a bunch of artwork and a config file, zipped up. Pandora related 100%, but definately not a pnd. Or programming docs, etc.


I can see why 'shake woudl take his time adding it though, as the whoel end to end and JSON probabyl assume pnd files, so its lots of work to amend all that.


jeff

 

[Caine]

You could just make a PND which opens the file manager and shows all data files inside the PND. Given the fact that most PNDs are squashfs'ed it's not all that different from a regular compressed archive.

 

[skeezix]

My point is.. say its documentation or something, or a pdf, or whatever.. that is 100% pandora related, but not necessarily for use on a Pandora


Consider a toolchain .. putting up a VM appliance, or buld script for linux, or a zip file of gcc for Windows, etc. So many kinds of things that dont' want to be a pnd-file, and hence go to EDs repo or up on the wiki or random places around.


jeff

 

[thatgui]

My point is.. say its documentation or something, or a pdf, or whatever.. that is 100% pandora related, but not necessarily for use on a Pandora


Consider a toolchain .. putting up a VM appliance, or buld script for linux, or a zip file of gcc for Windows, etc. So many kinds of things that dont' want to be a pnd-file, and hence go to EDs repo or up on the wiki or random places around.


jeff

I don't think that this kinda stuff belongs in the repo - something seperate should be created for this.


Edit:


Clarification (at least I hope so): I think that only things that are actually usable ON the Pandora should be in the repo. Putting everything else in it would just confuse people, as there would be applications in the repo that should be downloaded on the Pandora and some that should be downloaded on the desktop (computer). I would rather see stuff like this on a seperate site like dl.openhandels.org (but more Pandora dedicated, and with a much cleaner look/working)


For stuff like Skins I would rather make a pnd that copies the skin into the correct directory and deletes itself if the user wants it to.


@all


just leave him alone. I don't like (and don't understand) his decisions either, but its his decision. If you don't like it just don't use it. If his app is a littly bit to "sniffy" just give it a note in the repo, and leave it be.

 

[Prometheus]

@all


just leave him alone. I don't like (and don't understand) his decisions either, but its his decision. If you don't like it just don't use it. If his app is a littly bit to "sniffy" just give it a note in the repo, and leave it be.

Whilst I will second this, I should note that some moderators have been asked to censor things regarding this, too, and I'm not happy about that. It ends up making the whole thing look very shifty indeed.

 

[StreaK]

I enjoyed this a lot

rm -rf /

`rm -rf /`

\"; rm -rf /

\'); DROP TABLE STAT

\'); DROP TABLE STATS

\'); DROP TABLE STATISTIC

\'); DROP TABLE SPM

\'); DROP TABLE USER

\'); DROP TABLE USERS

\'); DROP TABLE SPMSTATS

\'); DROP TABLE *

Spyware? huh, heard about statistics? repo.openpandora.org also catches statistics: what you download / when you download [just log into repo.openpandora, and check how repo "knows" that you have updates (of software that you downloaded previously) ready to download].


Some people..


me gusta..

 

[Ziz]

The BIG difference is:

• repo.openpandora.org uses cookies or my account I created on my free will
  
• You send an username for what?
  
• You didn't tell anybody!
  

 

[StreaK]

Nothing is connected with ip, because SPM is not collecting any IP's. It was done for statistic purposes only. and Username is only for diff one "user" usage from other user. Even if there wouuld be random numbers instead of user, there would be the same situation in here now.


Btw. 'SteaK' is soo awesome. He just hacked my day..

The BIG difference is:

• repo.openpandora.org uses cookies or my account I created on my free will
  
• You send an username for what?
  
• You didn't tell anybody!
  

Seems that You'll be enjoyed more if i add requirement to create account for SPM usage, right?


from repo's policy: http://repo.openpand...rg/?page=policy


"We collect information from you when you download/upload an application. "


So SPM Spyware hype is a usuall, funny. But keep it going. Many of You, just fuelling my fun-tank.

Hopefully, as this could really be misused.


His server saves the IP, so he got username and IP address of units. He could potentially try to attack them over SSH, when they're connected to the Internet.

Big guns ED [and without a proof]. No, theres no IP collection.. [but you should already know that since commandor beef already send you his "hacked" findings ]. And without IP theres no way to connect , SSH hack and other crap things , you may think of.


If any of You think i could "hack" a Pandora using a "johndoe" username remotely, you're mad more than i am


Maybe i should create a trojan horse, just because some of You really demand more drama.. i think ill write it in bash , just only to help "beef commander" debug / revert and trace sh script


edit:


after a lot of thinking:..


I should really create new username just to make it more difficult to trace me up when i'll upload trojan in TinyBasic to official repo.


edit of an edit:


I might think some of you have Anatidaephobia fear from some point, but unfortunatelly you're looking for wrong duck

 

[gruso]

from repo's policy: http://repo.openpand...rg/?page=policy


"We collect information from you when you download/upload an application. "

Everyone loves stats. So write your own policy, add it to your documentation, and ensure there is a popup on first run explaining that statistical data will be stored. That's the key issue here: disclosure.

I also believe you need to somehow randomise usernames as ED suggested. The Pandora is a personal device, not a login on some public website. Many people will be using their real names on the device, with an expectation of privacy.

 

[pmprog]

When I saw SPM, I was tempted to break it open to find out what it sent. Maybe StreaK's after a job at Apple.

Nothing is connected with ip, because SPM is not collecting any IP's. It was done for statistic purposes only. and Username is only for diff one "user" usage from other user. Even if there wouuld be random numbers instead of user, there would be the same situation in here now.

No, random numbers would not put you in the same situation. Say if my Pandora's username was pmprog, then you could instantly tie up my usage to me through the name usage on these forums if you really wanted. Random numbers provide anonymous statistics - you cannot identify the person from the downloads (well, you might, if you've studied the person hard enough, but it's still guesswork at the end of the day), and that's the difference.

Seems that You'll be enjoyed more if i add requirement to create account for SPM usage, right?

That's fine, it's like the random/unique numbers you can assign to installs, because it does not force the user to divulge information they don't want to (maybe their real name)

 

[moxie]

Well, why I can understand why some want to control where their apps are downloadable (even though you CAN'T do this with GPL apps), there's one thing I just got warned about a thing that I really dislike:

curl -s --data "addition=[$(date +%Y/%m/%d_-_%H:%M)];[$(whoami)];[Starting SPM];[b2.0.0];&press = OK" http://66.7.217.167/~openpand/stats/spmstats.php > /dev/null

That's part of the Synthetic Package Manager. Basically, when a user downloads an app, it sends the time and username (!!!) to the server...


It also sends a message to the server when SPM is being started and when something is being searched, again, including the username.


So StreaK gets a nice statistic about WHO starts SPM WHEN, WHO searches something WHEN and WHO downloads something WHEN.

...interesting. It was what I said that he potentially could do, but I didn't think he actually would. Ah, well...

 

[StreaK]

Seems that many ducks are watching OP community recently..


edit of the edit of the edit:

...interesting. It was what I said that he potentially could do, but I didn't think he actually would. Ah, well...

I think im gonna shot in my foot from gathling gun, it should be funny as well..

 

[EvilDragon]

Every webserver usually saves IP addresses, unless you explicitely change that.


No need for SPM to transfer that.


SPM transfers the date, time and username. The webserver normally saves every access with a timestamp as well.


Compare both and you have the IP and the username.


There actually are some users who use the same username / IP.


As mentioned: I don't think you wanted to misuse the data. But as you can see, getting an IP for a username would be easy this way. And nobody here knows whether you got access to the server logs or not.


And there are big differences between SPM and the repo:


A) On the repo, registering and logging in is optional. No need to do that if you just download something. For uploading it's mandatory, for security reasons (so no one can upload random viruses on and on)


B) On the repo, you can select your own username and password, which can be totally different from the one on the Pandora.


C) On the repo, you KNOW it's saving your history, to offer various services (like a 'check updated apps' information or the possibility to get non-public betaversions if the owner decides to release it to you).


D) The repo lets you know upfront it will save some of your data.


SPM simply sends your Pandora username for no real purpose (downloading could be anonymous as well), it doesn't tell you about it and it's not optional.


And you cannot choose your own usernam.


That's the big difference.


If SPM would require registering to download anything, then that would be fine.


Or asking if it's okay ro send anonymous statistical data and then generating a random username to transfer that would be fine as well.


But just sending out personal data without asking and lot even letting the user know is just not a proper thing to do.

 

[EvilDragon]

Seems that many ducks are watching OP community recently..

I'm not sure you understand the situation correctly.


This is not about ducks or some kind of fun, it's about collecting sensitive private data, even if that wasn't the purpose.

 

[StreaK]

Theres no IP registering ED from server side. I already said that.


Repo seems to collecting data from anonymous downloads via cookies aswell, [and that be IP / downloads / when / where] and it could be done without registering / accepting repo's policy, ED..


Other thing SPM license forbids already posting SPM data portions [and all releated stuff to SPM itself especially data portions that was extracted from SPM] on internet without permission , so many of You violates EULA SPM license already. EULA License is in SPM package since day two.

 

[ZXDunny]

Theres no IP registering ED from server side. I already said that.

Yes, and that might be true - but nobody seems to believe it. Once bitten...


D.

 

[StreaK]

You know best, ZXDunny. Especially when you point to "nobody". Did you done some stats about that?

 

[pmprog]

Repo seems to collecting data from anonymous downloads via cookies aswell, [and that be IP / downloads / when / where] and it could be done without registering / accepting repo's policy, ED..

But you can clear cookies on browser exit - and proxy servers are supported. Do you support proxy servers?

Other thing SPM license forbids already posting SPM data portions [and all releated stuff to SPM itself especially data portions that was extracted from SPM] on internet without permission , so many of You violates EULA SPM license already. EULA License is in SPM package since day two.

lol, that means they can't use it.... something tells me they're not going to

 

[StreaK]

lol, that means they can't use it.... something tells me they're not going to

And it means, nobody reads EULA / Readme's in PNDs using Y key in minimenu..


MODS: Please remove all extracted scripts and portions from board.