Back in 2009, anynone with a Nokia could have a personal website running on their own phone. Sadly this amazing piece of tech was never widely adopted. Today’s phone are far more powerful than those Nokias both in performance and battery backup and still we don’t see anyone running a server on their phone. Why?
I think this was never implemented on phones because there’s no incentive for large corporations to work on something like this.
What’s the practical difference between listening on [::]:80 and POST-ing an encrypted bundle of JSON? For this to be a problem, you need to run internet connected code on the device already.
Also, nobody is forcing you to host a website on your phone! It’s just weird that you can’t do it if you want to.
Here’s what I’m imagining. The phone is listening on port 80, probably running some jacked up plug-in to play a favorite song. The user probably installs it and then forgets it’s there. The plug-in becomes severely out of date, running code with multiple zero day exploits. In the best case scenario it is running your battery down and using up your bandwidth, it’s commonly just unavailable because your metro area cell network is jammed so your visitors can’t access the site at all, and worst case it can be tricked into running local scripts that do nefarious things.
It’d be hard to forget about because persistent daemons require a persistent notification. Android also submits regular reminders about background apps if you’ve hidden the persistent notification.
This risk exists with all apps, though! Abandoned apps regularly get bought out and infected with adware or other malware. Anything user content facing has the risk to be exploited down the line.
I think people have become quite paranoid about open ports since the XP era where every machine hooked up to the internet would be infected within seconds. People still use Windows 7 as daily drivers and so far the risk is much lower than I ever expected at least.
You are commenting as if everyone who would turn this feature on would have the technical acumen to understand how any of it works.
And you are commenting as if this isn’t possible for malicious use already on any port above 1024. Unless you have a firewall installed, there’s a good chance an app on your phone has opened a port right this moment.
The only change I would need for Android is that a) the 70s UNIX privilege port legacy should be dropped and b) phones should have a special, popup based permission, like location access. The risks are all there already, if we’re going to be risking random adware serving up crapware and destroying your data connection, we might as well see the benefits as well.
We get it dude; you wanna run servers off of android.
Good thing the base is open source, you can go ahead and build that dream phone OS that doesn’t care about your personal security.
Nobody else wants to do this so I’m not sure why you’re arguing to hard for everyone to be able to do it. Why would I want to self host a website on a phone and expose myself to a million new attack vectors when there’s free hosting available en masse?
I run a server now for lots of local stuff and I still pay for a web server so my home isn’t constantly exposed to the internet at large. Why the fuck would anyone want to do that, IDK. it’s a fucking privacy nightmare.
The boat is already full of holes, so let’s poke more!