frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Android May Soon Restrict On-Device ADB

https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/
79•shscs911•1h ago

Comments

luqtas•1h ago
finally my children will be secure and my bank account impenetrable!
mdp2021•42m ago
/s
3form•56m ago
What I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results:

- some people want A, or A might even be already in use

- A is problematic for $MODERATE_OR_MILD_REASON

- B is introduced and made default

- a config switch between A and B is never considered

So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.

Arbortheus•52m ago
Toxic max security.

Not everyone has the same threat model as you, $BIGTECHCORP.

rightbyte•42m ago
Isn't security just an excuse to push user hostile features?

Like, if security was a concern we would have simpler systems and still use 2fa devices for banks etc.

SXX•26m ago
Sometimes it's truly useful featutes, but having no toggle in settings making it terrible.

Like iPhone idle auto-reboot every 3 days. After a while they added "Allow Idle Reboot" flag but it only accessible via MDM and require device wipe and for switching it to be a managed device.

pjmlp•41m ago
Ask Jeeves toolbar disagrees.
einpoklum•38m ago
It's not even "max security". We are talking about those big tech corps which are infamous for sharing all of your private information with the government, and analyzing it so as to manipulate you in to buying things, and possibly for other obscure commercial purpuses.
SXX•21m ago
They dont care about security; only about control.

There are hundreds of millions of outdated Android devices that all Google attestation systems consider secure even though they all running Linux kernel that was never ever updated and can be rooted by anything.

Now try to install your own firmware on them without said outdated kernel... How dare you.

ducktective•41m ago
>a config switch between A and B is never considered

And why should modern corpo maintain additional complexity to pander to 1% of privacy-aware tech-savvy users?

stavros•35m ago
Google doesn't want you to be able to skip YouTube ads. It's as simple as that.
altairprime•13m ago
[delayed]
coffee33go•55m ago
https://archive.ph/gla4i

In case it is made private.

throawayonthe•51m ago
that seems pretty reasonable actually
mdp2021•32m ago
To only use ADB through a WLAN? No, it is not that reasonable
throawayonthe•22m ago
or over USB, from another device? this is about maybe restricting the wireless variant to only work on wlan0
amelius•32m ago
To iPhone users, perhaps.
kasabali•24m ago
I'm afraid in a few years iOS will actually (not as a joke) be the more open and customizable option
hagbard_c•17m ago
That seems rather unlikely given the the ways of the fruit factory. They don't stand to gain anything from loosening their stranglehold on their flock while they could lose substantially if someone were to open the gate and let the sheep escape. Nope, keeping them penned in is the best way to reliably fleece them.
throawayonthe•
satvikpendem•47m ago
Of course this was bound to happen, next you're telling me people will be surprised that the 24 hour limit for side loading will turn into some indefinite time period.
devsda•22m ago
It can and will most probably turn to indefinite time depending on the answer to the question "will we have a viable alternative to jump ship before that happens ?".

We don't need anything to completely capture the market, it has to be just enough to make Google hesitate or make it hard for Google to do it for legal reasons. Like how Firefox is ideally supposed to be for Chrome.

microtonal•18m ago
Many alternative AOSP-based systems work fine today and do not have the new Android Developer Verifier (wow, already rolled out to 500M+ devices [1], though still dormant).

To be honest, it is quite scary that Google is able to remotely roll out an app like that to all GMS Android phones. Of course, we all knew that, but it highlights again that Google can remotely take away functionality that you had before, brick your phone, etc.

[1] https://play.google.com/store/apps/details?id=com.google.and...

smolder•20m ago
It's almost like the Davos-and-other-secret-culb attending Epstein-class insane sociopaths have a plan for the direction of our economy. Insane people who think they are royalty are steering 8 billion people. They don't have crowns, or righteousness, or even outstanding intellects. They just have money.

Elon musk likes to say he's good at games. I could demolish him at every game he ever claimed to be good at. I would also beat him in boxing or MMA. The guy is a loser obsessed with status. I prefer to just be good at things and enjoy friendly competition. Elon musk couldn't beat me at a single thing other than impregnating women with kids he didn't know how to raise.

throw9394999•40m ago
This assumes user is the only person with physical access to unlocked phone.

All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.

SXX•34m ago
This is solvable by adding big huge warning that ADB is running. Not by removing feature.
charcircuit•37m ago
adb connecting a device to itself is just bad design and a hack. Either the capabilities should just be granted directly to the app or it should all be blocked.
qrobit•17m ago
Same can be said about loopback device in general. Why do you need to use networking when you are literally on the same device and can use binder/dbus and friends with native apps?

Shizuku uses Binder AFAICS[^1]. Looking deeper it seems that Shizuku does not connect to the device itself per se, but rather it has a privileged server launched manually through adb. Never used Shizuku, so can't say for sure.

[1]: https://github.com/rikkaapps/shizuku#how-does-shizuku-work

eviks•35m ago
> Spamming the thread will only cause Google developers to lock the issue, ignore valuable community feedback, or stop sharing public updates about this change entirely.

So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval

p-e-w•23m ago
The implication in the blog post that Google developers somehow “overlooked” or “misunderstood” important use cases here, and if only they were informed about them they would reconsider, is frankly insulting.
mdp2021•25m ago
Step back to the other issue (referenced in the page*), that Google would pushing on devices something that blocks applications that do not come from play.google.com . Was it not established that Google can only push that update on devices with a google account?

* https://keepandroidopen.org/

smolder•24m ago
RIP phones
microtonal•21m ago
I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing.

The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost?

It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.

pigggg•11m ago
Isn't this because of the kimwolf (and now 6+ other botnets) that are taking advantage of people running residential proxyware unknowingly on the device which permits outbound connections to 127.0.0.1 on tcp/5555 to auth in and exec wgets or drops a loader that grabs the ddos malware APKs and install it?
magic_hamster•20m ago
This is about control, not security. As in, Google's control over your device, your experience, your features and choices. This and Google just isn't interested in supporting an open OS anymore. Maybe they think it makes them liable.

Either way the writing is on the wall, and has been for a while.

returnInfinity•15m ago
bullish on google stock

revenue must go up

22m ago
i'm running graphene

Android May Soon Restrict On-Device ADB

https://kitsumed.github.io/blog/posts/android-may-soon-restrict-on-device-adb/
95•shscs911•1h ago•42 comments

Claude Opus 5

https://www.anthropic.com/news/claude-opus-5
1519•alvis•15h ago•853 comments

GC and Exceptions in Wasmtime

https://bytecodealliance.org/articles/wasmtime-gc
78•phickey•4d ago•2 comments

Hannah Fry Wins the Leelavati Prize in 2026 for Mathematics Outreach

https://www.maths.cam.ac.uk/features/professor-hannah-fry-wins-leelavati-prize
151•agnishom•6h ago•28 comments

UK AISI / Caisi Preliminary Assessment of Kimi K3's Cyber Capabilities

https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber...
53•walrus01•4h ago•14 comments

NYC Apartment Aquaponics

https://erinmurphy.dev/projects/project-2/
21•mm1119•4d ago•7 comments

ARC-AGI Leaderboard

https://arcprize.org/leaderboard
55•rzk•2h ago•46 comments

Postgres LISTEN/NOTIFY actually scales

https://www.dbos.dev/blog/postgres-listen-notify-scalability
296•KraftyOne•13h ago•53 comments

Extinct Media Museum Tokyo

https://extinct-media-museum.blog.jp/otemachi/
19•sohkamyung•2h ago•1 comments

Opus 5 is currently #1 on Artificial Analysis Intelligence Leaderboard

https://artificialanalysis.ai/models
274•aarondong•12h ago•150 comments

India's first privately-developed rocket reaches orbit on debut launch

https://arstechnica.com/space/2026/07/indias-first-privately-developed-rocket-reaches-orbit-on-dr...
596•sohkamyung•5d ago•169 comments

My security camera shipped a GitHub admin token in its login page

https://hhh.hn/hanwha-github-token/
581•hhh•20h ago•189 comments

Book Corners: Community map of neighborhood book exchange spots

https://www.bookcorners.org
18•NaOH•2d ago•4 comments

Sperm Whales blow bubbles to achieve restful, vertical sleep

https://news.st-andrews.ac.uk/archive/sperm-whales-blow-bubbles-to-achieve-restful-vertical-sleep/
91•hhs•9h ago•12 comments

Show HN: I simulated closing the Strait of Hormuz on real oil trade data

https://globaloilnetwork.staffinganalytics.io/
169•eliotho•1d ago•82 comments

Taylor Farms Called White House to Try to Delay Cyclospora Recall

https://www.wsj.com/health/taylor-farms-cyclospora-recall-delay-call-41fef0bc
206•JumpCrisscross•5h ago•90 comments

An old patent inspired the new "Y-zipper", a three-sided fastener

https://news.mit.edu/2026/three-sided-y-zipper-design-0504
187•crescit_eundo•2d ago•38 comments

PartialString – A finite-difference time-domain physical modelling synthesiser

https://differentinstruments.com/
11•shmeano•3d ago•0 comments

Designing an Ethernet Switch ASIC

https://essenceia.github.io/projects/ethernet_switch_asic/
176•random__duck•4d ago•44 comments

Firefox Containers Preview

https://blog.mozilla.org/en/firefox/firefox-containers-preview/
316•twapi•3d ago•97 comments

Kimi K3 exploited the latest Redis server

https://twitter.com/fried_rice/status/2080059356322918777
215•Alifatisk•1d ago•57 comments

Nvidia, Microsoft, Meta warn against overregulating open-weight models

https://www.cnbc.com/2026/07/24/nvidia-microsoft-meta-open-weight-ai-models.html
595•louiereederson•19h ago•260 comments

Half-Life 2 running natively on HaikuOS

https://discuss.haiku-os.org/t/haiku-nvidia-porting-nvidia-driver-for-turing-gpus/16520?page=18
297•m0do1•19h ago•55 comments

IRGC claims it destroyed Amazon's Bahrain data center

https://houseofsaud.com/irgc-claims-destroyed-amazon-bahrain-data-center/
289•thisislife2•22h ago•348 comments

Don't Take the Black Pill [video]

https://www.youtube.com/watch?v=zLZwpH5lCD4
173•signa11•15h ago•151 comments

Fil-C: Garbage In, Memory Safety Out [video]

https://www.youtube.com/watch?v=5F-2Y1LPRek
133•Bootvis•1d ago•136 comments

Future euro banknote design proposals

https://www.ecb.europa.eu/euro/banknotes/future_banknotes/html/all-design-proposals.en.html
181•robin_reala•23h ago•166 comments

Man convicted of child sex crime by added _ char "Fus Ro Dah" Skyrim username

https://www.cbc.ca/news/canada/nova-scotia/how-a-single-underscore-led-to-an-innocent-halifax-man...
13•walrus01•1h ago•9 comments

Marimo now runs in PyCharm

https://marimo.io/blog/pycharm
106•cantdutchthis•2d ago•29 comments

Buz – A fork of Bun using modern Zig, with sub-1s incremental builds

https://ziggit.dev/t/buz-a-drop-in-replacement-for-bun-using-modern-zig-with-sub-1s-incremental-b...
274•kristoff_it•23h ago•175 comments