• RustedSwitch@lemmy.world
    link
    fedilink
    English
    arrow-up
    36
    ·
    edit-2
    1 year ago

    I suppose I could be convinced, but my gut reaction is this is a bad idea. Most people aren’t security oriented, and would put themselves at risk with poorly updated websites that are an attack vector for bad actors… There’s a lot more at stake in regards to what personal data lives on your phone… the richest concentration of your PII.

    Also, my battery life is already precious. And what if you’re out of cell range or the network is overloaded? Your site just stops working?

    • Falken@lemmy.ca
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      Even if your security oriented it seems many frown upon any self hosting whatsoever.

    • FaceDeer@kbin.social
      link
      fedilink
      arrow-up
      2
      arrow-down
      1
      ·
      1 year ago

      I wouldn’t expect anything like this proposal to be mandatory. I’d want it as something I could turn on if I felt I needed it.

      • RustedSwitch@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        1 year ago

        If you give people this ability, most of the ones who use it are going to put themselves at risk.

        Maybe you feel that’s their own problem. Sometimes you need to protect people from themselves. The phone vendors sure as hell don’t want to start seeing news stories of their devices getting hacked all the time.

        And how do you feel about your site visitors not being able to hit your page when your local network is overloaded?

        • FaceDeer@kbin.social
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          Having my phone not be able to do something I want it to do is my problem.

          Sometimes you need to protect people from themselves.

          That’s why you have it turned off by default.

          And how do you feel about your site visitors not being able to hit your page when your local network is overloaded?

          Compared to how it is right now, when I can’t run a site on my phone at all? It would be a significant improvement.

          • RustedSwitch@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            1 year ago

            Having my phone not be able to do something I want it to do is my problem

            I meant, it’s arguable that if people use this feature and expose themselves, that’s their own fault. I’m not sure what you thought I meant.

            That’s why you have it turned off by default

            It’s off by default, but still there for uneducated and unskilled people to turn on and leave themselves exposed.

            … significant improvement

            Vs just paying a few bucks for linode that’s got multiple 9s of uptime? It doesn’t seem worth it.

    • Skull giver@popplesburger.hilciferous.nlOP
      link
      fedilink
      arrow-up
      2
      arrow-down
      2
      ·
      1 year ago

      What’s the practical difference between listening on [::]:80 and POST-ing an encrypted bundle of JSON? For this to be a problem, you need to run internet connected code on the device already.

      Also, nobody is forcing you to host a website on your phone! It’s just weird that you can’t do it if you want to.

      • RustedSwitch@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        Here’s what I’m imagining. The phone is listening on port 80, probably running some jacked up plug-in to play a favorite song. The user probably installs it and then forgets it’s there. The plug-in becomes severely out of date, running code with multiple zero day exploits. In the best case scenario it is running your battery down and using up your bandwidth, it’s commonly just unavailable because your metro area cell network is jammed so your visitors can’t access the site at all, and worst case it can be tricked into running local scripts that do nefarious things.

        • Skull giver@popplesburger.hilciferous.nlOP
          link
          fedilink
          arrow-up
          1
          arrow-down
          2
          ·
          1 year ago

          It’d be hard to forget about because persistent daemons require a persistent notification. Android also submits regular reminders about background apps if you’ve hidden the persistent notification.

          This risk exists with all apps, though! Abandoned apps regularly get bought out and infected with adware or other malware. Anything user content facing has the risk to be exploited down the line.

          I think people have become quite paranoid about open ports since the XP era where every machine hooked up to the internet would be infected within seconds. People still use Windows 7 as daily drivers and so far the risk is much lower than I ever expected at least.

          • RustedSwitch@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            2
            ·
            1 year ago

            You are commenting as if everyone who would turn this feature on would have the technical acumen to understand how any of it works.

            • Skull giver@popplesburger.hilciferous.nlOP
              link
              fedilink
              arrow-up
              2
              arrow-down
              3
              ·
              1 year ago

              And you are commenting as if this isn’t possible for malicious use already on any port above 1024. Unless you have a firewall installed, there’s a good chance an app on your phone has opened a port right this moment.

              The only change I would need for Android is that a) the 70s UNIX privilege port legacy should be dropped and b) phones should have a special, popup based permission, like location access. The risks are all there already, if we’re going to be risking random adware serving up crapware and destroying your data connection, we might as well see the benefits as well.

              • some_guy@kbin.social
                link
                fedilink
                arrow-up
                4
                arrow-down
                1
                ·
                1 year ago

                We get it dude; you wanna run servers off of android.

                Good thing the base is open source, you can go ahead and build that dream phone OS that doesn’t care about your personal security.

                Nobody else wants to do this so I’m not sure why you’re arguing to hard for everyone to be able to do it. Why would I want to self host a website on a phone and expose myself to a million new attack vectors when there’s free hosting available en masse?

                I run a server now for lots of local stuff and I still pay for a web server so my home isn’t constantly exposed to the internet at large. Why the fuck would anyone want to do that, IDK. it’s a fucking privacy nightmare.