I hate Temu, but this (apparently contracted?) Grizzly Reports report isn't really all that trust inspiring, tbh.
Our experts identified a stack of software functions that are completely inappropriate to and dangerous
The stack difference to the Amazon app they list:
Package compile
Requesting system logs
Some code obfuscation
Mac address collection
Install permission
Wake lock
Meh. That's just a sliver worse than your regular, off the shelves proprietary corporate app. I don't see how they can pull off the promise of being a truly dynamic Android app from that report.
I do believe they hover up data, but they aren't otherworldly super hackers. They will probably just ask for the data and the users will hand it over in a second. For most people, it really is that simple.
So just like the majority of USAian apps out there? I think Temu fits right in. Why are people so concerned about what China is doing with their data, but not the very countries they live in or (more importantly) the dominant online surveillance presence: the USA?
One thing that's obvious here on Lemmy is that whataboutism works only in one direction. If an article is critical of China, Russia, Iran, or other dictatorships, you'd read, "But about U.S./EU/the West". But there are tons of articles here critical of Western countries, and it's accepted. Why is this? Just wumaos?
It's funny that every time someone points out the pot calling the kettle black the training kicks in to shout "whataboutism" and it must be "wumao". It's almost a meme. You don't think an article about Xi Ping's government warning about USAian surveillance would be mocked and ridiculed due to their Great Firewall? That wouldn't be "whataboutism" though, right? It would be a "critical opinion"?
Yeah, these are the 'tankies' who got banned on Reddit, right? I guess it takes time until they get a minority, but it's good that the community grows steadily.
I'm not sure I understand why this question comes up everytime some chinese app is in a news article.
Anyway, it should not come as a surprise, but "Arkansas Attorney General Tim Griffin", someone who works as AG for a state in the US, presumably is more interested in US interests than Chinese interests, and presumably places more trust in the government and businesses of the country he lives in than in the government (and businesses, for where there's a distinction anyway) of the country of his nation's economic rival.
The difference is, the place where I live has some data privacy regulations which actually get enforced, and I have some legal recourse against organizations which mishandle my data. China does not have such regulations and I do not have any recourse against organizations based there, so my risk from them is significantly higher.
Yes you can, most people aren't. In real life, by far the most common response I've gotten when talking about privacy is 😴 . My colleagues in tech will hotly debate China's surveillance, but happy use face ID on their iPhone, upload their entire life to Google or iCloud (including recordings of therapy sessions), send their blood into do a heritage check, nearly exclusively use Amazon for shopping, have an Amazon Ring camera at their door, and so much more.
“Temu is designed to make this expansive access undetected, even by sophisticated users,” Griffin’s complaint said. “Once installed, Temu can recompile itself and change properties, including overriding the data privacy settings users believe they have in place.”
So just like the majority USAian app out there?
Which apps do that? Because I am certain it's NOT the majority, and very skeptical about any other apps doing that.
🤖 I'm a bot that provides automatic summaries for articles:
Click here to see the summary
Temu—the Chinese shopping app that has rapidly grown so popular in the US that even Amazon is reportedly trying to copy it—is "dangerous malware" that's secretly monetizing a broad swath of unauthorized user data, Arkansas Attorney General Tim Griffin alleged in a lawsuit filed Tuesday.
Griffin fears that Temu is capable of accessing virtually all data on a person's phone, exposing both users and non-users to extreme privacy and security risks.
In their report, Grizzly Research alleged that PDD Holdings is a “fraudulent company” and that “Temu is cleverly hidden spyware that poses an urgent security threat to United States national interests.”
Investigators agreed, the lawsuit said, concluding “we strongly suspect that Temu is already, or intends to, illegally sell stolen data from Western country customers to sustain a business model that is otherwise doomed for failure."
Researchers found that Pinduoduo "was programmed to bypass users’ cell phone security in order to monitor activities on other apps, check notifications, read private messages, and change settings," the lawsuit said.
A Temu spokesperson provided a statement to Ars, discrediting Grizzly Research's investigation and confirming that the company was "surprised and disappointed by the Arkansas Attorney General's Office for filing the lawsuit without any independent fact-finding."
Not at all surprising. ChatGPT 'knows' a course's content insofar as it's memorized the textbook and all the exam questions. Once you start asking it questions it's never seen before (more likely for advanced topics that don't have a billion study guides and tutorials for) it falls short, even for basic questions that'd just require a bit of additional logic.
Mind you, memorizing everything is impressive and can get you a degree, but when tasked with a new problem never seen before ChatGPT is completely inadequate.
Right? Can students use the internet on this test? Because the LLMs have the entire internet to search for the answers, and I guarantee you those textbooks and exam questions are online and searchable.
I wonder how undergrads would do on the same exams given unlimited time and internet access but with LLMs blocked. That's essentially what the LLMs have.
It's probably not blatantly bypassing security and privacy features, what it is PROBABLY doing is using the user to bypass them by simply manipulating them to do it.
Social engineering is way easier than whatever bullshit you would need to do to bypass sandboxing and dynamically recompile, or whatever people are claiming, and my guess would be that this is what they're doing.
If the suit is claiming they are doing what i said, that's probably legal, and not going anywhere, unless tiktok ban bill 2.0. If the suit is claiming what others are claiming, it's still probably wrong and probably going to be tiktok ban bill 2.0.
Unfortunately these things aren't all that exciting at the end of the day.
“Since the rise of large language models like ChatGPT there have been lots of anecdotal reports about students submitting AI-generated work as their exam assignments and getting good grades.
His team created over 30 fake psychology student accounts and used them to submit ChatGPT-4-produced answers to examination questions.
The anecdotal reports were true—the AI use went largely undetected, and, on average, ChatGPT scored better than human students.
Scarfe’s team submitted AI-generated work in five undergraduate modules, covering classes needed during all three years of study for a bachelor’s degree in psychology.
Shorter submissions were prepared simply by copy-pasting the examination questions into ChatGPT-4 along with a prompt to keep the answer under 160 words.
Turnitin’s system, on the other hand, was advertised as detecting 97 percent of ChatGPT and GPT-3 authored writing in a lab with only one false positive in a hundred attempts.
The original article contains 519 words, the summary contains 144 words. Saved 72%. I'm a bot and I'm open source!
Linux founder Linus Torvalds, for example, has suggested that a lack of a standardized desktop that goes across all Linux distros has held back Linux adoption on desktop.
Yeah. Well, in on Linux in large part because of the diversity, choice, and options. If I wanted a monolithic, incestuous lock-in culture, I'd be on Windows, or a Mac.
Linux may have been simply making an observation, not a judgment, but fuck monocultures.
I'm thinking this comes from the consideration of taking imagery at the root of people's brains when they hear Linux. Reiterating elements of the Windows or Mac UI over the decades, even if they had small visual changes, enable a significantly large population of the world to imagine the desktop even just while mentioned in a passing. Anyone that doesn't use either of these OSes at least can have a basic imagery popping up about it due to constant advertising of the desktop via direct ads, support pages, tech websites using generic desktop images, screen shares, etc.
Linux is wild west in this regard. Everyone knows how Windows or MacOS looks like thanks to their abundant copies of descriptive bounty posters, but only other Linux users are familiar with other Linux desktops and that is usually as the names of fellow bounty hunters.
Can someone explain to me how you can just simply program something to bypass privacy and security features? What is the point of having these features if you can literally just program something to ignore them? Like....??? Temu is obviously bad if this is true, but if it IS true, it shouldn't have been possible to begin with!!
Im not sure how they specifically bypass the features in other ways but I imagine some of it is from users accepting permissions under the guise of another use. For example, maybe you accept the microphone permission on tik tok to record video. With that permission in theory the app could now use it maliciously. Of course it should all depend on the users choice for that and im not sure beyond the scope of that.
TORfdot0 shared this comment below:
Someone else posted this report in this thread which does a good job of the deceptive practices and API calls the app uses to trick the user into giving permissions up willingly and otherwise collect data it shouldn’t.
one of the most obvious ways is to simply not bypass them, and then do it from within the application itself. That way you can essentially man in the middle the rest of it, though this would require a rather specific set of events and a particularly nested design of an app.
I don't think Microsoft (or Apple) want people to have personal computers anymore in the way that PCs have historically existed. That is to say, they don't want your computer capable of running arbitrary code of your choosing. They don't want your computer to have the potential to do everything, to run everything, to make anything.
They want to control and lock down all aspects of your machine and what it can do, retain ownership of hardware via software licenses, and monetize every click and keystroke.
Microsoft doesn't want you to have a functional computer anymore, they want you to have a dummy terminal that runs Office 365 and Copilot.
It's cool and all, but I'm surprised it's not 10% at this point. Microsoft is shitting in their customers mouth and Apple is a luxury brand at this point.
arstechnica.com
Hot