4 ms·

I've been in the OEM industry for years and can't believe this happened in production. For something like texting/RCS, there are thousands of phones being test

by foobaw 8y ago

I've been in the OEM industry for years and can't believe this happened in production. For something like texting/RCS, there are thousands of phones being tested thousands of time by thousands of people with multiple additional checkpoints (ODM, Google, Carriers). It's a core functionality so it's extremely tightly verified. RCS was first implemented about three years ago for phones so it's shocking that this kind of bug happened now. I also worked on the initial infrastructure for this so I can't imagine how this bug was even introduced. My bet goes to it being a server-side issue, especially since it's carrier-specific, and not a software bug.

ikeboy 8y ago
If it's possible to be a server side issue, then no phones are ever secure.
- AFNobody 8y ago
  SMS and phone calls were never secure.
  - ikeboy 8y ago
    SMS and phone calls should never let the server see every file on your device, or every image
    - DINKDINK 8y ago
      >SMS and phone calls should never let the server see every file on your device, That may be the case but the bug could still be on the server side: Carol the Client: Hi Steve, will you send this photo to 111-1111? Steve the Server: Hi Carol, I've sent your photo to 555-5555 Unless you encrypt the data to your recipient's client-side held key, the opportunity for the server to err and data leak, persists.
      - breakingcups 8y ago
        That doesn't explain the case where all photos on the phone were silently sent to a contact.
exikyut 8y ago
This is the first time I'm hearing about RCS at all. I know SMS is ancient, but I had no idea it had been superceded like this. (Probably because I've never had a smartphone - they're a bit beyond my budget.) I (very vaguely) know that SMS works on top of SS7. I just checked out https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services, which was interesting but doesn't have that many technical details. I'm very curious to understand how RCS works technically. I get the impression it can work over IP as well as carrier-integrated data transfer?
- foobaw 8y ago
  GSM's official specification document is what we used when we implemented everything. "Advanced Messaging" and "IP-based messaging" were some other ways we referenced the feature like you said. Carriers definitely have to support this themselves and set transfer limits, provide the web-view, etc...
- bambamboom 8y ago
  What do you do? There are (were) wonderfully fast windows phones for for $20
  - exikyut 8y ago
    Appreciate it hugely. It's actually the data costs that are prohibitive - I've only just started looking around, but my first quote is $39 for 2GB and 500 free minutes ($1/min after that) from Telstra, Australia's juggernaut. I did recently think I critically needed to stay in touch (this is why I have the numbers above), but that requirement seems to have settled a little, which is why I'm less motivated to get on the merry-go-round of plan-hunting now. Chances are prepaid is probably what I'll end up doing ("yeah this is my number this week", here we come, lol). What I _really_ want is an IoT/M2M contract, but I have no idea how to look for those :D Oh - as for what I do, currently working on kickstarting that :) this sums up the difficulty FWIW: https://news.ycombinator.com/item?id=15004608#15005811 https://news.ycombinator.com/item?id=15004608#15005811 (I'm working on it, it's fine)

by foobaw 8y ago

ikeboy 8y ago

If it's possible to be a server side issue, then no phones are ever secure.

AFNobody 8y ago
SMS and phone calls were never secure.
- ikeboy 8y ago
  SMS and phone calls should never let the server see every file on your device, or every image
  - DINKDINK 8y ago
    >SMS and phone calls should never let the server see every file on your device, That may be the case but the bug could still be on the server side: Carol the Client: Hi Steve, will you send this photo to 111-1111? Steve the Server: Hi Carol, I've sent your photo to 555-5555 Unless you encrypt the data to your recipient's client-side held key, the opportunity for the server to err and data leak, persists.
    - breakingcups 8y ago
      That doesn't explain the case where all photos on the phone were silently sent to a contact.

exikyut 8y ago

This is the first time I'm hearing about RCS at all. I know SMS is ancient, but I had no idea it had been superceded like this. (Probably because I've never had a smartphone - they're a bit beyond my budget.) I (very vaguely) know that SMS works on top of SS7. I just checked out https://en.wikipedia.org/wiki/Rich_Communication_Services https://en.wikipedia.org/wiki/Rich_Communication_Services, which was interesting but doesn't have that many technical details. I'm very curious to understand how RCS works technically. I get the impression it can work over IP as well as carrier-integrated data transfer?

foobaw 8y ago
GSM's official specification document is what we used when we implemented everything. "Advanced Messaging" and "IP-based messaging" were some other ways we referenced the feature like you said. Carriers definitely have to support this themselves and set transfer limits, provide the web-view, etc...
bambamboom 8y ago
What do you do? There are (were) wonderfully fast windows phones for for $20
- exikyut 8y ago
  Appreciate it hugely. It's actually the data costs that are prohibitive - I've only just started looking around, but my first quote is $39 for 2GB and 500 free minutes ($1/min after that) from Telstra, Australia's juggernaut. I did recently think I critically needed to stay in touch (this is why I have the numbers above), but that requirement seems to have settled a little, which is why I'm less motivated to get on the merry-go-round of plan-hunting now. Chances are prepaid is probably what I'll end up doing ("yeah this is my number this week", here we come, lol). What I _really_ want is an IoT/M2M contract, but I have no idea how to look for those :D Oh - as for what I do, currently working on kickstarting that :) this sums up the difficulty FWIW: https://news.ycombinator.com/item?id=15004608#15005811 https://news.ycombinator.com/item?id=15004608#15005811 (I'm working on it, it's fine)