15 ms·
Introducing Netflix Stethoscope
- zump 10y agoLol looks liek some bootstrap CRUD crap. People are getting 375k for this?
- bbarn 10y agoIs there a place one can actually use this tool? My daughter uses my account, and I'd actually like to see the results of her setup.
- Zaheer 10y agoI believe this is tailored towards employees rather than end-users
- moftz 10y agoI haven't tried it myself but it appears as if you can get this up and running on your own collection of devices assuming you can all get them managed under the built-in google device management or using JAMF for iOS. It's nothing really related to Netflix other than that they are using this on their corporate-owned devices to make sure everything is secure. I guess this is simply just a nice way to combine a bunch of different data sources from mobile device management services (android, ios, windows, etc) into a single dashboard. I don't really run enough things that would require something like this but I can definitely see this helping businesses that want to do MDM.
- always_good 10y agoAside, I've been looking into writing some basic browser extensions for Netflix, like allowing a hotkey to toggle between English <-> Spanish subtitles so I could quickly lookup words I don't know. Or increase playback to 1.25x speed since I primarily use Netflix for language learning. But I've been having a hard time figuring it out. Inspect the playback bar to see what I'm talking about. Anyone have any luck extending the playback UI or hooking into it?
- BrandonMarc 10y agoHow do you use Netflix for language learning? I'm curious.
- infecto 10y agoWatch content in the language you are learning. Its pretty helpful if you are not surrounded by native speakers. I think most of my friends who grew up in Asia all watched Friends.
- jplasmeier 10y agoI would imagine it would help a lot with learning cultural idioms as well. Given that a large percentage of the mannerisms my friends and I use are copied from TV, it would be invaluable to be exposed to the language elements which speakers of that language actually use.
- lorenzhs 10y agoIt helps a lot with understanding spoken language in a variety of settings, pronunciation, idioms, and all the other little things that make language appear natural. Watching movies and TV shows in a foreign language that you already know somewhat but aren't comfortable with yet is tremendously helpful, and it's also fun. Great way to help become fluent.
- stordoff 10y agoEven if you barely know the language, I've found it beneficial to listen to foreign language audio with subtitles (YMMV). It mean that when I actually try to learn parts of the language, I already have somewhat of a feel for it, so what I'm learning solidifies into something usable more quickly, and I don't spend as much time stumbling with pronunciations/verb conjugations etc.
- always_good 10y agoMy problem with foreign audio + English subtitles (if that's what you meant) is that my brain just reads the subtitles and tunes out the audio for the most part. I think anything is better than nothing, though. I personally watch movies/shows now always with foreign subtitles.
- dguido 10y agoReally glad they're thinking about osquery support in the future. Of the data sources they support, osquery would be the most functional free and open-source one which might help get Stethoscope more widely deployed.
- JimRoepcke 10y agoWow that site hijacks the edge swipe to go to another blog post instead of letting the browser go back. Gross.
- zodPod 10y agoImgur does that as well on mobile. It's a terrible design because I'm scrolling down sometimes and it switches images instead. Not a big fan!
- traek 10y agoThat's because it is, for some reason, hosted on Blogger (which even Google themselves have abandoned for their corporate blog).
- scrollaway 10y agoI'll be glad to see Blogger die. Such terrible UX. Still today, its editing interface is awful and reminiscent of the early 2000s WYSIWYG editors. Still today, some Blogger blogs I visit (including one of my own old ones) simply DO NOT LOAD, they are stuck at an infinite loading Javascript spinner. Even still today, it insists on serving me all its content in the language of the country I'm currently visiting, even though I have my language set to en-us in my Google account and on my browser and I consistently change its language settings back to English.
- nacs 10y agoTheir new entirely-JS based layout only happened after Google bought them. Before that, Blogger's sites were completely degradable and perfectly functional without Javascript enabled. Then Google decided to remake all the templates to be fully JS driven and added a ton of page weight to the site.
- compuguy 10y agoSo what does google use for corporate blogs, then?
- 10y ago
- secfirstmd 10y agoVery interesting tool. Tried to build something like this awhile ago but it became a bit messy. Glad to see Netflix have done it. I can see myself using this for a number of groups we work with.
- andrepd 10y agoWow. "Jailed" is a compliment, now. You shouldn't own your devices, it's a security risk. Please keep your phones nice and safe and locked-down in our hands. Totally backwards. As Mr Trump would put it, SAD!
- bholzer 10y agoThis is focused toward companies to ensure employee security. It's no secret that jailbroken phones are less secure, and if an employer is giving phones to employees for work use, it's perfectly reasonable for them to enforce a rule that phones are not jailbroken or out of date.
- problems 10y ago> It's no secret that jailbroken phones are less secure There is no evidence that jailbroken or rooted users have resulted in any significant compromises. At least in the Android world, you must still approve any application which wants root access and rooting your phone allow you to gain access to some pretty impressive security tools you otherwise wouldn't have available to you. Generally speaking, users who are rooted or jailbroken are sophisticated enough to handle this on their own - and often use it to improve their security, not damage it.
- moftz 10y agoIf you are using the phone for work, you shouldn't be opening up access to a local admin account. Rooting/jailbreaking is a double edged sword. You get more control over the device but you also open up access to malicious applications. Just because you may be smart enough to run a rooted phone without compromising it, doesn't mean everyone else is capable. Keeping the phone locked down can greatly help prevent intrusions and otherwise unwanted code from running. You can do a lot more damage as root than you can as a user. You were given that device to do work on, not take apart and do whatever you wish with it. If you want your own dev device, buy your own phone. I see plenty of coworkers who carry around two devices each day. Companies that lock down the employee computers to only allow whitelisted applications to run deal with a lot less reimaging and malware cleaning that those that give local admin access to the employee. It does result in employees having to request installation of things outside the standard core software but it still takes less time than dealing with typical malware.
- verandaguy 10y agoThe page is down for me as of 13:20 EST. Cached version: http://webcache.googleusercontent.com/search?q=cache:xcxywckCegkJ:techblog.netflix.com/2017/02/introducing-netflix-stethoscope.html+&cd=1&hl=en&ct=clnk&gl=us
- deleted 10y ago[deleted]
- fred256 10y agoAre you trying https instead of http? It's only hosted on http (because they use Google Blogger with a custom domain name)
- amalag 10y agoHow would this protect against phishing?
- jedberg 10y agoIt's not super clear from the writeup, but a big part of it is providing security notifications to users. So when a backend system detects what looks like a suspicious account access, it can notify the user and ask them to confirm their action. If they say, "I didn't do this" than their account can be immediately locked down until the issue is resolved by talking to a person.
- crudbug 10y agoHow do you detect whether a device is Jailbroken/rooted ? [Edit] : Found this - https://github.com/scottyab/rootbeer https://github.com/scottyab/rootbeer I think this will be useful for applications that want to know if the execution environment is safe or not - Banking / Payments etc.
- tylorr 10y agoMy first guess would be to attempt an operation that only works if the device is rooted.
- elastic_church 10y agoOne thing I used to do was check if the hosts file had been modified, or something like that. I had conditional paths for showing ads, and some rooted phones had blocked ads based on IP address.
- irfanka 10y agoTry executing something that needs root-level access(?)
- cprecioso 10y agoIn Android, you can use the Google SafetyNet API, that checks whether the system partition has been modified or mounted r/w, the existence of the su binary and some more clues like those. I don't know the current state of jailbreak detection in iOS, but I do remember that some time ago, as a rudimentary jailbreak detection, iBooks tried to run unsigned code at launch, and if it ran, the app would refuse to open.
- crudbug 10y agoInteresting, I am guessing there is some kind of learning net behind SafetyNet API - Harvesting all the device infos.
- evanreichard 10y agoSafetyNet is pretty flexible. It actually isn't implemented inside any APK - "The SafetyNet service reaches out to a Google server and downloads a binary package with the code. It goes to great lengths to validate the integrity of the package, for example using hardcoded certificates (pinning). This binary package is essentially a JAR file that contains a classes.dex file with java bytecode. Play Services caches it in dalvik-cache (snet.dex) and loads it dynamically using reflection." [1]. I think right now the only way "around" it has been Magisk [2]. [1] https://koz.io/inside-safetynet/ https://koz.io/inside-safetynet/ [2] https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...
- huangc10 10y agoAlthough the focus is mainly on the Stethoscope security feature and what it has to offer, but does anyone else find the giraffe with the stethoscope a bit odd, creepy and out of place? I think they were going for a "friendly" approach but it just doesn't do it for me. Now, you may argue that the logo isn't important but some users will utilize a tool purely based on aesthetics...why a creepy giraffe? Am I missing something in American pop culture..? (I'm Canadian...)
- charia 10y agoYou're right, the giraffe looks odd and creepy. They should change its facial expression to be a bit more neutral.
- hbhakhra 10y agohttps://en.m.wikipedia.org/wiki/Uncanny_valley https://en.m.wikipedia.org/wiki/Uncanny_valley This explains some of what you are describing
- huangc10 10y agoThanks for the link! I've actually never thought about this concept and it actually does describe a bit the way I feel about the giraffe. The designer did a great job drawing it...but something just doesn't feel right...
- danudey 10y agoThe giraffe feels like it's asking you to lie down on the table and relax, in the same way that Hannibal Lecter might.
- WatchDog 10y agoUncanny valley refers to near life like looking humans, not animated anthromorhised animals that don't look like the real thing at all
- verletx64 10y agoIts the Giraffe from Madagascar. Maybe.
- ams6110 10y agoI deleted Netflix from my phone when the lastst update demanded access to my media files and photos, microphone, and call information.
- endorphone 10y agoIt doesn't demand it, and in fact those are just basic defaults when using the new permission model/build APIs, though they default to off. In my 7.1.1 permissions Netflix lists those three, and none of them are granted nor have they ever been requested by the app.
- ams6110 10y agoThey were presented when I tried to install the lastest update, and there was no option other than "Accept". They don't need that stuff so I deleted the app.
- cryptoz 10y agoThat's fair, but it sounds like you're running an older Android version? In this case, your blame should lie with Google's old permissions model being not-fined-grained enough rather than at anger with Netflix over the permissions. Given the constraints on making the app, in order to satisfy you (no new permissions) they would have to halt feature development for things that customers demand, like offline play. You can upgrade your Android version possibly, to find that the Netflix app will not require those permissions if you install it.
- camiller 10y agoYou are not on Android 7 yet. Prior to "Nougat" the fine grain permissions control was not available so permissions were an all or nothing thing at install time. Starting with version 7 you only enable a specific permission the first time the application needs it. And you can change them later if you wish on the permissions section of the application in app manager. https://goo.gl/photos/2rvYmX6WNgGVfEsJ7 https://goo.gl/photos/2rvYmX6WNgGVfEsJ7
- ebarock 10y agoInteresting. Trying to find some sort of correlation between this and the core business of Netflix. Not sure they relate with each other. What does that means? Netflix devs are "tired" hehe. :)
- madethemcry 10y agoThis is related to employees only right? I would have thought a large company like Netflix is using something like G Suite and therefore can just use Google Apps Device Policy to simply enforce the best security settings (6 digit code, software updates and so on) on Android devices. And I bet there is something comparable for iOS devices isn't it? https://play.google.com/store/apps/details?id=com.google.android.apps.enterprise.dmagent&hl=en https://play.google.com/store/apps/details?id=com.google.and...
- JoBrad 10y agoWhile this is related to employees, it seems to be focused on other devices which are not under any group/device policy. > By providing personalized, actionable information–and not relying on automatic enforcement–Stethoscope respects people's time, attention, and autonomy, while improving our company’s security outcomes.
- WatchDog 10y agoI'm wondering how they plan on rolling this out, do they just send a company wide email asking everyone to download the app? As an employee if I refuse or ignore the directive am i subject to disciplinary action?
- rsmets 10y agoThere was a startup that addressed this issue of personal devices potentially leaking personal or business sensitive information. The idea was the device is protected all the time, not just while on the office network. They were Mojave Networks but looks like their website is no more. Acquired by Sophos... I guess their called Cloud Web Gateway now. See links. https://www.crunchbase.com/organization/mojave-networks https://www.crunchbase.com/organization/mojave-networks https://www.sophos.com/en-us/press-office/press-releases/2014/10/sophos-acquisition-of-mojave-networks.aspx https://www.sophos.com/en-us/press-office/press-releases/201... https://www.sophos.com/en-us/products/cloud-web-gateway.aspx https://www.sophos.com/en-us/products/cloud-web-gateway.aspx
- davidu 10y agoMojave was a great idea. I've tried and failed to recruit the founder and engineering leader for Mojave at least three times. :-)
- finid 10y agoWe also want people to be comfortable making these changes themselves, on their own time, without having to go to the help desk. The part of that that I don't agree with, is "on their own time". What if the change that needs to be made an urgent security fix?
- the_duke 10y agoIt means that you don't have to bother with IT if you want to install an App, for example. Many company provided phones are locked down completely, you can't install or upgrade anything yourself.
- toephu2 10y agoYou obviously have never worked at any large company before.
- baby 10y agoI'm sure there is a way to rephrase this to bring some valuable input to the discussion rather than just patronizing the parent comment.
- j_koreth 10y agoYou obviously never commented. /s (sarcasm don't kill me)
- sctb 10y agoWe detached this subthread from https://news.ycombinator.com/item?id=13699542 https://news.ycombinator.com/item?id=13699542 and marked it off-topic.
- Fiahil 10y agoThat logo reminded me of those rubber toys for babies : http://www.sophielagirafe.fr/en/ http://www.sophielagirafe.fr/en/ This is so close, it has to be intentional !
- nkg 10y agoSophie never had that creepy smile!
- phjesusthatguy3 10y ago>7 admirer married >7 admires sidearm "That's an awful purty wife you got there; shame if something happened to you"
- ghubbard 10y agoThis was probably supposed to be a comment on the Anagram article: https://news.ycombinator.com/item?id=13696196 https://news.ycombinator.com/item?id=13696196
- mtw 10y agoIsn't Netflix motivated to see if you changed your network (such as using a VPM)? I don't see why this wouldn't call home and report you
- darklajid 10y agoSo, 'jailed' is a reason to mark it as 'requires attention'? Well played, well played.. Honestly, I won't run a non-rooted device (although I admit that the current way to root a device is questionable in parts). But here's a real, honest question: Why would services stop working because of root access? Why can't Android Pay work on a rooted device. Samsung's crappy equivalent (I use neither, but I think those are often considered examples for 'stops working if rooted' issues)? I also own my credit card. Just like my mobile. What is the danger that these services try to protect against, why is root a problem in these cases?
- nl 10y agoRooting can allow software to elevate privileges enough so it can see outside its sandbox and access other software's private storage. That means (for example) spyware has one less thing stopping it form manipulating (eg) Android Pay to steal money.
- thefifthsetpin 10y agoServices like Android Pay quite reasonably elect to not work if the device appears like it may have been compromised. It's not easy to tell if a device is rooted because the user wanted root access or because a virus got in. But suppose you established that the user intentionally rooted the phone (somehow). It'd still not be clear whether the rootkit that the user used was trustworthy. Even if you established that it was trustworthy (stretching the bounds of reasonableness; who is auditing these?), you couldn't assume that the user hadn't run other malicious programs. That last point is true for non-rooted phones, of course, but since this user had root access those hypothesized malicious programs become much more dangerous. (Also, I doubt you own or have root access to your credit card. But what would you do with it if you did? All I can come up with is to consolidate a few of them onto one piece of plastic.)
- garaetjjte 10y agoIt's easy: just ask the user.
- 10y ago
- zobzu 10y agonot installing corporate spyware on my personal phone thx bai
- vosper 10y ago> Stethoscope is powered by a Python backend and a React front end. The web application doesn’t have its own data store, but directly queries various data sources for device information, then merges that data for display. I thought the "various data sources" scenario was exactly what Falcor was for - interesting that they used React.
- Y_Y 10y ago"As we say in the Netflix Culture Deck, responsible people thrive on freedom, and are worthy of freedom." But you arbitrarily can't watch stuff in Incognito Mode?
- deleted 10y ago[deleted]
- flying_kangaroo 10y agoCan't have people watching two streams on the same computer. Common sense or something.
- kiallmacinnes 10y agoI have to admit, the screenshot they picked seems like a really bad example :) Most Android devices can't just be updated to the latest version, which is counter to the proposed goal of being user actionable.. Won't this particular check just result in alert fatigue? Once any single alert comes in that the user has no control over, they HAVE to ignore it, and once they ignore one, it's easier to choose to ignore more..
- pirocks 10y agoIs anybody else using firefox having crashes caused by this webpage?
- TheAceOfHearts 10y agoMy current policy is to keep work and personal devices completely separate. Call if you need me urgently, otherwise it can wait until the next work day. I used to have my work email and Slack on my phone. Eventually we started to implement stricter security, which I found disagreeable, so I purged everything work-related.
- memco 10y agoIf anyone from Netflix reads this can you fix pinch to zoom on iOS on your blog please? I kept trying to read the article, but the text is small and every time I tried to make it bigger the swipe to navigate articles gesture was triggered. Not very accessibility friendly.
- shshhdhs 10y agoSame here. Only way I could read this on mobile was using iOS Safari's text formatter thing that shows up in the URL bar.
- BucketSort 10y ago"Give us data."