Ethan Elshyeb

If we don't study the mistakes of the future, we're doomed to repeat them for the first time.

[Ethan Elshyeb @e_elshyeb]

flutter_eval v0.6 is the largest update yet and a truly viable option, though still limited, for Flutter code push. Been working super hard on this and excited it's finally out! #flutterdev https://t.co/Y3U4IRwz1S

[Ethan Elshyeb @e_elshyeb]

@Elca_Gaming @PlaySumD Could be this also https://t.co/cK9aE1ZkDM

[Ethan Elshyeb @e_elshyeb]

@Sykursen Hey Guillame, I made flutter_eval. It is pure Dart code with no FFI or native plugins so it is effectively sandboxed. Also, there will be a URI gated runtime permissions system for any file/network/sensor access to prevent hijacking.

[Aloïs Deniel @aloisdeniel]

You've probably heard me complaining about the lack of a Dart interpreter recently.

And thanks to ethanblake4 we now have (early stage) code-push for Flutter: https://t.co/derMA4PBfD ! 🤯

[Ethan Elshyeb @e_elshyeb]

https://t.co/yrcbzz7HBd

[Ethan Elshyeb @e_elshyeb]

⬛⬛🟨⬛⬛
⬛🟨⬛🟩🟨
🟩⬛🟨🟩🟨
🟩🟩🟩🟩🟩

[Ethan Elshyeb @e_elshyeb]

Just released my first song 'iconoclast' on spotify and all major platforms! https://t.co/LdINyYJAiy

[Ethan Elshyeb @e_elshyeb]

@parker_yoinks @theneedledrop @porterrobinson He sorta answered this https://t.co/ujD72lbboV

[porter robinson @porterrobinson]

one more thing about wind tempos -- the "so holy" sample was always one of rika's favorites, i was going to not use it at one point, but she loved it so much that i tried hard and found a way to make it work in Wind Tempos #nurture

[Ethan Elshyeb @e_elshyeb]

initial stage of my #Flutter pure-Dart code push system! @FlutterDev #flutterdev

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi Lol. fortunately this is 1000x easier than making a quantum computer... and also 1000x easier than looking like that guy😂

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi It's not at all the same thing as Twitter's oAuth API. Instead we would reverse engineer how the *official Twitter app* does login and mimic those network requests exactly, thus obtaining full account access. Done correctly, there is no way for Twitter to detect this.

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi While it's been reported to Google and they may do something, it's actually NOT a vulnerability/bug. It's a flaw with the entire *concept* of oAuth in apps. The same idea I did would work with Facebook or Apple sign-in sign-in. A real fix would require huge changes to the OS.

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi Also, the DoorDash app, for a more widely used example

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi Here's an app that does something similar and could easily be stealing the token: https://t.co/6tpPhNOswt

And no it's not open source because I don't want it to be easy to use these methods. I have given the source to security researchers and to Google.

[Ethan Elshyeb @e_elshyeb]

@giuliohome_2019 @campuscodi actually, if you read to the end of the article, i already published an app in the Play Store that did this. and 'signature spoofing' is only to allow the official Google *apps* (google maps, youtube) to use microG - but it can still use your account data regardless.

[Ethan Elshyeb @e_elshyeb]

@WglGreen @RydMike @FlutterDev @modulovalue @lesnitsky @norbertkozsir @rodydavis yes, but it's not at that stage yet. Core features still need to be implemented, and I would want to work closely with anyone doing that.

[Ethan Elshyeb @e_elshyeb]

@astrondelta Omg that's my photo

[Ethan Elshyeb @e_elshyeb]

Check out the article I wrote: https://t.co/EBEoOPMPCL

[Elon Musk @elonmusk]

@priscillabanana X Æ A-12 Musk