flutter_eval v0.6 is the largest update yet and a truly viable option, though still limited, for Flutter code push. Been working super hard on this and excited it's finally out! #flutterdev https://t.co/Y3U4IRwz1S
@Sykursen Hey Guillame, I made flutter_eval. It is pure Dart code with no FFI or native plugins so it is effectively sandboxed. Also, there will be a URI gated runtime permissions system for any file/network/sensor access to prevent hijacking.
You've probably heard me complaining about the lack of a Dart interpreter recently.
And thanks to ethanblake4 we now have (early stage) code-push for Flutter: https://t.co/derMA4PBfD ! ๐คฏ
one more thing about wind tempos -- the "so holy" sample was always one of rika's favorites, i was going to not use it at one point, but she loved it so much that i tried hard and found a way to make it work in Wind Tempos #nurture
@giuliohome_2019@campuscodi Lol. fortunately this is 1000x easier than making a quantum computer... and also 1000x easier than looking like that guy๐
@giuliohome_2019@campuscodi It's not at all the same thing as Twitter's oAuth API. Instead we would reverse engineer how the *official Twitter app* does login and mimic those network requests exactly, thus obtaining full account access. Done correctly, there is no way for Twitter to detect this.
@giuliohome_2019@campuscodi While it's been reported to Google and they may do something, it's actually NOT a vulnerability/bug. It's a flaw with the entire *concept* of oAuth in apps. The same idea I did would work with Facebook or Apple sign-in sign-in. A real fix would require huge changes to the OS.
@giuliohome_2019@campuscodi Here's an app that does something similar and could easily be stealing the token: https://t.co/6tpPhNOswt
And no it's not open source because I don't want it to be easy to use these methods. I have given the source to security researchers and to Google.
@giuliohome_2019@campuscodi actually, if you read to the end of the article, i already published an app in the Play Store that did this. and 'signature spoofing' is only to allow the official Google *apps* (google maps, youtube) to use microG - but it can still use your account data regardless.