10 ms·

Did you know you can put a whole game inside of a push notification

259 points by ig0r0 6y ago

YeGoblynQueenne 6y ago
Did you know you can put a question mark at the end of a sentence even on twitter?
- startup_boner 6y ago
  punctuation is an obsolete historical artifact in the digital age just like captitalization i would rejoice if text encodings removed them altogether
  - turnerc 6y ago
    I cannot tell if this is satirical, I hope so.
    - deleted 6y ago
      [deleted]
    - greenn 6y ago
      I don't know if I'd say obsolete, but a question mark in the tweet, at least for me, would not have clarified or added anything
  - reaperducer 6y ago
    Stop clubbing baby seals http://oddlovescompany.com/wp-content/uploads/2012/09/February-07-2012-15-43-24-4280303449429622051282512499215744331134484750791913n.jpeg http://oddlovescompany.com/wp-content/uploads/2012/09/Februa...
  - ShaneMcGowan 6y ago
    why use lot word when few word do trick
    - fargo 6y ago
      when you president, they see
    - ineedasername 6y ago
      y use lot wrd wn few wrd do trk
      - itsDario1 6y ago
        y use lot
        phist_mcgee 6y ago
        y
    - wizzwizz4 6y ago
      Why so verbose? Concision is sufficient.
  - tobr 6y ago
    Guessing YeGoblynQueenne got the memo about capitalization, given how they spell “Twitter”.
  - HPsquared 6y ago
    whitespaceisalsovestigialifind
- nicky0 6y ago
  OK boomer
- Minenash 6y ago
  Did you know you can capitalize a proper noun, even on Hacker News?
- grawprog 6y ago
  Why necessarily at the end? It could have been one of these: Did you know? You can put a whole game inside of a push notification. Or maybe even: Did you know? You can put a whole game inside of a push notification!
  - YeGoblynQueenne 6y ago
    Even better.
djsavvy 6y ago
Does anyone know if there’s a similar API/technique for windows?
- contravariant 6y ago
  Surely you can just draw an extra window on top of all other windows?
xwdv 6y ago
When they said notifications are the platform of the future, this is what they meant. It’s not desktops, it’s not mobile, it’s notifications.
- vmception 6y ago
  Who said that
  - Razengan 6y ago
    They
bluefirebrand 6y ago
Seems like too much code to allow in a notification. Doesn't that seem like it would be just rife with potential exploits?
- JonathonW 6y ago
  These are not delivered along with the notification-- they're provided (client-side) by the application that the notification was sent for. So, while a notification could display dynamic content here depending on the content of the notification (for example, this is the same mechanism as used by Mail on iOS for mail previews) and the preview code should take the untrusted nature of the content into account if it does, it doesn't have to and it's not any different than running the application itself in terms of security issues.
  - lupire 6y ago
    A web browser displayed dynamic content all the time and is considered safe.
    - chmod775 6y ago
      No. Nowadays you should still disable JavaScript as well as video playback in your browser if you want to be safe. There was a brief period some years ago where browsers looked "pretty safe", but we have quickly backtracked by stuffing JS and browsers full of new APIs that are creating new vulnerabilities. Edit: Yes. Downvoting will surely reduce the amount of CVEs. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sandbox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sand... https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox There were also Chrome RCEs & sandbox escapes discovered in the wild as recently as November: https://twitter.com/benhawkes/status/1323374326150701057 https://twitter.com/benhawkes/status/1323374326150701057 https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-16009.html https://googleprojectzero.github.io/0days-in-the-wild/0day-R... And for Firefox: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-6820.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...
swen-rekcah 6y ago
Great. I’d love a little game, but the reality is that if anybody uses this it will just be for ads
- deleted 6y ago
  [deleted]
markus_zhang 6y ago
Just curious is it possible to abuse this for malicious code? Just a thought...
- jjeaff 6y ago
  If it can be exploited, then it likely has already been exploited.
- djrogers 6y ago
  The code isn’t delivered with the push notification, it’s code from an application already installed.
deleted 6y ago
[deleted]
figbert 6y ago
Neil Sardesai is a joy to follow – I highly recommend it. He probably knows more about internal macOS APIs than the devs.
elliotkillick 6y ago
That's interesting. You can also put an entire game inside of a bootloader.
- mgerullis 5y ago
  Or on a pregnancy test: https://twitter.com/Foone/status/1302820468819288066 https://twitter.com/Foone/status/1302820468819288066
deleted 6y ago
[deleted]
Andrew_nenakhov 6y ago
I'd prefer Apple to fix horrible notifications on iOS. Since they broke VoIP background notifications, developers have no way to reliably perform silent delivery of information to device. For example in a chat app that syncs with desktop you can deliver incoming messages, showing them as alerts, but you can't deliver your own, because you MUST show alert on every push notification. Another use case is removing notifications: once you message on another device, you want to remove notification on iOS as well. With current notifications it is extremely problematic. (Remaining background notifications in iOS work like shit - and please, do not start discussion that 'it is not needed' - It is BADLY needed, just ask anyone who has developer experience with this wreck)
- tomrod 6y ago
  > Since they broke VoIP background notifications, developers have no way to reliably perform silent delivery of information to device. Surely you mean fixed, not broken, as absolutely no one should be delivering information silently to a device they don't own.
  - wizzwizz4 6y ago
    The Apple philosophy is “give users zero agency” – and from that stance, yes, this is a fix. But I remember the days when a computer program was either a game, an extension of the user's will or the BIOS; by that philosophy, this should absolutely be possible. (But computers have been artificially complexified to the point that this isn't viable.)
    - catlifeonmars 6y ago
      > an extension of the user’s will I quite like this particular viewpoint. I’m stealing this philosophy for the next time I am designing a CLI.
  - Andrew_nenakhov 6y ago
    > as absolutely no one should be delivering information silently to a device they don't own. That's a very very very shallow thinking. You are advocating to break the internet. You are destroying every internet protocol that ever existed. They all silently deliver information to devices you likely don't own. Actually, we wouldn't need these dirty perversions with notifications if we had a proper background mode for apps. Like, you know, proper computers had for maybe 60 years.
deleted 6y ago
[deleted]
dpeck 6y ago
GamePigeon (https://apps.apple.com/us/app/gamepigeon/id1124197642 https://apps.apple.com/us/app/gamepigeon/id1124197642) does something similar. Completely unaffiliated but it’s a solid little gaming app and useful for playing games with older family members.
gdeglin 6y ago
Super neat use of iOS Content-Extensions! I didn't realize these were so well supported on Big Sur. For anyone looking to build something similar themselves, here's an example project on using a Content Extension to create an interactive notification: https://documentation.onesignal.com/docs/ios-image-carousel-push-notifications https://documentation.onesignal.com/docs/ios-image-carousel-... (Direct github link: https://github.com/jfishman1/OSNotificationContentExtension https://github.com/jfishman1/OSNotificationContentExtension)
ChrisArchitect 5y ago
But is it DOOM inside of a tweet? https://news.ycombinator.com/item?id=26599532 https://news.ycombinator.com/item?id=26599532

259 points by ig0r0 6y ago

YeGoblynQueenne 6y ago

Did you know you can put a question mark at the end of a sentence even on twitter?

startup_boner 6y ago
punctuation is an obsolete historical artifact in the digital age just like captitalization i would rejoice if text encodings removed them altogether
- turnerc 6y ago
  I cannot tell if this is satirical, I hope so.
  - deleted 6y ago
    [deleted]
  - greenn 6y ago
    I don't know if I'd say obsolete, but a question mark in the tweet, at least for me, would not have clarified or added anything
- reaperducer 6y ago
  Stop clubbing baby seals http://oddlovescompany.com/wp-content/uploads/2012/09/February-07-2012-15-43-24-4280303449429622051282512499215744331134484750791913n.jpeg http://oddlovescompany.com/wp-content/uploads/2012/09/Februa...
- ShaneMcGowan 6y ago
  why use lot word when few word do trick
  - fargo 6y ago
    when you president, they see
  - ineedasername 6y ago
    y use lot wrd wn few wrd do trk
    - itsDario1 6y ago
      y use lot
      - phist_mcgee 6y ago
        y
  - wizzwizz4 6y ago
    Why so verbose? Concision is sufficient.
- tobr 6y ago
  Guessing YeGoblynQueenne got the memo about capitalization, given how they spell “Twitter”.
- HPsquared 6y ago
  whitespaceisalsovestigialifind
nicky0 6y ago
OK boomer
Minenash 6y ago
Did you know you can capitalize a proper noun, even on Hacker News?
grawprog 6y ago
Why necessarily at the end? It could have been one of these: Did you know? You can put a whole game inside of a push notification. Or maybe even: Did you know? You can put a whole game inside of a push notification!
- YeGoblynQueenne 6y ago
  Even better.

djsavvy 6y ago

Does anyone know if there’s a similar API/technique for windows?

contravariant 6y ago
Surely you can just draw an extra window on top of all other windows?

xwdv 6y ago

When they said notifications are the platform of the future, this is what they meant. It’s not desktops, it’s not mobile, it’s notifications.

vmception 6y ago
Who said that
- Razengan 6y ago
  They

bluefirebrand 6y ago

Seems like too much code to allow in a notification. Doesn't that seem like it would be just rife with potential exploits?

JonathonW 6y ago
These are not delivered along with the notification-- they're provided (client-side) by the application that the notification was sent for. So, while a notification could display dynamic content here depending on the content of the notification (for example, this is the same mechanism as used by Mail on iOS for mail previews) and the preview code should take the untrusted nature of the content into account if it does, it doesn't have to and it's not any different than running the application itself in terms of security issues.
- lupire 6y ago
  A web browser displayed dynamic content all the time and is considered safe.
  - chmod775 6y ago
    No. Nowadays you should still disable JavaScript as well as video playback in your browser if you want to be safe. There was a brief period some years ago where browsers looked "pretty safe", but we have quickly backtracked by stuffing JS and browsers full of new APIs that are creating new vulnerabilities. Edit: Yes. Downvoting will surely reduce the amount of CVEs. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sandbox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sand... https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox There were also Chrome RCEs & sandbox escapes discovered in the wild as recently as November: https://twitter.com/benhawkes/status/1323374326150701057 https://twitter.com/benhawkes/status/1323374326150701057 https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-16009.html https://googleprojectzero.github.io/0days-in-the-wild/0day-R... And for Firefox: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-6820.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...

swen-rekcah 6y ago

Great. I’d love a little game, but the reality is that if anybody uses this it will just be for ads

deleted 6y ago
[deleted]

markus_zhang 6y ago

Just curious is it possible to abuse this for malicious code? Just a thought...

jjeaff 6y ago
If it can be exploited, then it likely has already been exploited.
djrogers 6y ago
The code isn’t delivered with the push notification, it’s code from an application already installed.

deleted 6y ago

[deleted]

figbert 6y ago

Neil Sardesai is a joy to follow – I highly recommend it. He probably knows more about internal macOS APIs than the devs.

elliotkillick 6y ago

That's interesting. You can also put an entire game inside of a bootloader.

mgerullis 5y ago
Or on a pregnancy test: https://twitter.com/Foone/status/1302820468819288066 https://twitter.com/Foone/status/1302820468819288066

deleted 6y ago

[deleted]

Andrew_nenakhov 6y ago

I'd prefer Apple to fix horrible notifications on iOS. Since they broke VoIP background notifications, developers have no way to reliably perform silent delivery of information to device. For example in a chat app that syncs with desktop you can deliver incoming messages, showing them as alerts, but you can't deliver your own, because you MUST show alert on every push notification. Another use case is removing notifications: once you message on another device, you want to remove notification on iOS as well. With current notifications it is extremely problematic. (Remaining background notifications in iOS work like shit - and please, do not start discussion that 'it is not needed' - It is BADLY needed, just ask anyone who has developer experience with this wreck)

tomrod 6y ago
> Since they broke VoIP background notifications, developers have no way to reliably perform silent delivery of information to device. Surely you mean fixed, not broken, as absolutely no one should be delivering information silently to a device they don't own.
- wizzwizz4 6y ago
  The Apple philosophy is “give users zero agency” – and from that stance, yes, this is a fix. But I remember the days when a computer program was either a game, an extension of the user's will or the BIOS; by that philosophy, this should absolutely be possible. (But computers have been artificially complexified to the point that this isn't viable.)
  - catlifeonmars 6y ago
    > an extension of the user’s will I quite like this particular viewpoint. I’m stealing this philosophy for the next time I am designing a CLI.
- Andrew_nenakhov 6y ago
  > as absolutely no one should be delivering information silently to a device they don't own. That's a very very very shallow thinking. You are advocating to break the internet. You are destroying every internet protocol that ever existed. They all silently deliver information to devices you likely don't own. Actually, we wouldn't need these dirty perversions with notifications if we had a proper background mode for apps. Like, you know, proper computers had for maybe 60 years.

deleted 6y ago

[deleted]

dpeck 6y ago

GamePigeon (https://apps.apple.com/us/app/gamepigeon/id1124197642 https://apps.apple.com/us/app/gamepigeon/id1124197642) does something similar. Completely unaffiliated but it’s a solid little gaming app and useful for playing games with older family members.

gdeglin 6y ago

Super neat use of iOS Content-Extensions! I didn't realize these were so well supported on Big Sur. For anyone looking to build something similar themselves, here's an example project on using a Content Extension to create an interactive notification: https://documentation.onesignal.com/docs/ios-image-carousel-push-notifications https://documentation.onesignal.com/docs/ios-image-carousel-... (Direct github link: https://github.com/jfishman1/OSNotificationContentExtension https://github.com/jfishman1/OSNotificationContentExtension)

ChrisArchitect 5y ago

But is it DOOM inside of a tweet? https://news.ycombinator.com/item?id=26599532 https://news.ycombinator.com/item?id=26599532