Posts by doublelayer 11303 publicly visible posts • joined 22 Feb 2018
I'm not buying the "inadvertence" either, but they do manage to inadvertently misdirect other packages (not them specifically, just the general class of package delivery companies) often enough that they've probably had this statement sitting on a shelf for a while.
As I understand it, it can only use one of these cores, but would run. However, if it didn't run, you could have a full Linux kernel spin up just to virtualize it and still wouldn't realize it. It's sometimes a bit amazing to think how old software's requirements compare to available technology today.
I'm wondering whether this is actually just AOSP with their layer on top, for the simple reason that the app market has made it pretty clear that they're not going to start writing for another mobile platform what with the failures of Windows Phone, Firefox OS, and Ubuntu Touch, all of which had some buy-in from a few hardware manufacturers. I could see Huawei spending a bit longer reimplementing some compatibility with Google Play Services because they know a lot of apps will refuse to run otherwise, so that might explain it. It could also be a project run by a small team as a just-in-case, so not a major priority with many devs until it really became important.
I would actually be more likely to assume a startup would do this properly, for the simple reason that most startups have fewer types of devices and use cases that need to work properly. I do not have any confidence in Huawei's ability to replace android with something else on devices in the field without requiring extra assistance from users. They will need to deal with users who have very little internal memory free, users who have made unusual system modifications, users who have replaced parts of the hardware (cracked screens, etc.), devices running on 2, 3, and 4G cell networks all over the world, and running in some cases firmware developed specially for specific mobile providers to lock them to that provider and to interact with providers' systems. These from the same people who forgot to turn off telnet for their routers (it wasn't an intentional backdoor, probably not at least, but it was a pretty bad mistake). No confidence at all. However, I also would not have confidence in any manufacturer who tried this, not Samsung, not Google, not Apple, not anybody. It's too large a change to go perfectly, at least in my experience, and I don't see any reason to believe that Huawei has a special method of escaping that.
They might have done that. Microsoft might have tested the 1809 build of Windows on lots of models, preventing the driver blue screens. Router manufacturers might have security tested their basic firmware, having fewer vulnerabilities. Samsung might have put some of their Galaxy Folds into the field before sending them to reviewers, catching the easily damaged mechanisms. Samsung might also have put their Galaxy Note 7s into more vigorous testing, catching the exploding batteries.
Just because a company is big, that doesn't mean they will be perfect. Huawei doesn't have a reputation as some technogenious which always knows what is going on and produces flawless products. If they did, your defense of them based on nothing might have some logic. In reality, they're a normal tech company that has its history of making mistakes and being generally fine. Saying that they might have some trouble trying to update a billion devices in the field to something that might be an entire replacement of the operating system is a very sensible worry, born out by the experience of trouble that happened every other time such a massive change was attempted.
No on all counts.
"So I can buy the one phone that I'm sure the US/UK government don't have backdoors to?"
You can't be sure of that. Nobody really knows to what extent if at all there is a backdoor running on current phones. Huawei might harbor one just as well as any other manufacturer. If the backdoor you've supposed into existence was part of Android, perhaps inside Google's blobs, it would apply to all Android phones including those from Huawei. If you're concerned enough that the U.S. and U.K. have backdoored phones, you should at least give thought to other countries, like, just to pick a name at random, the People's Republic of China having one too.
"With an open source OS and alternatives to the Google spyware?"
You've supposed the open source into existence too? Can I suppose things about these devices and that will just happen? They'll have a magic chip inside them that emits a new type of radio frequency that cures cancer. You have no basis for that. While Google's spyware will be gone, plenty of Huawei and partner's spyware will have replaced it. If you want open, get open, such as Lineage OS with FDroid apps on it. Do not expect a company to ride in as a savior; it isn't going to happen.
"And it has the same premium hardware as Apple/Samsung but costs half as much"
It has different premium hardware, and it costs the same. Their flagships are also ludicrously overpriced. They have cheaper models, and just like those from every mid-range and low-range manufacturer, they are just fine and will work for lots of people, but do not have the latest and greatest components. If you want latest and greatest at a lower pricepoint, choose a company like Xiaomi or the Oppo brand who do not have a ridiculously-expensive lineup and are better at charging a price commensurate with performance.
I've seen several of these comments recently. Just because you don't like the action of the U.S. government, that doesn't make the company harmed by that action into the best thing on Earth. I am inclined to agree that the restrictions placed on them don't make sense from the stated security benefit and are a purely political stunt for the purposes of a continued trade war. I think that, as such, they should be reversed. That doesn't make Huawei a wonderful company that is out to make my life great and is being repressed by someone who wants to keep the underdog down. The goal of this is money, not a backdoor. It's shortsighted to assign good and evil tags out without considering the large area in the middle where these things reside.
It does make a lot of sense and that's why most companies do it. However, a company that is run by one person with all the power, while frequently inefficient or actively mismanaged, isn't the same as a dictatorship. The power over a corporation is based on how much of it, or in this case, its voting shares, a person owns. Even if he left as CEO, he would still be able to dictate policy by choosing another CEO and telling them what to do. This is entirely legal if inadvisable.
In this case, the stake in the sense of how much power can be wielded is exactly the same, and better described as imaginary than real. Since there is a majority shareholder, whatever they say goes. The activist with 10% and the activist with 10 shares have exactly the same amount of power and will receive the same amount of respect. Yes, they could try to do a stunt like dropping all 10% at once, but A) they don't actually own that large a chunk, B) they wouldn't want to take that kind of loss to send a message, and C) someone else would buy it and Facebook would not care at all about the former investor.
Just because some set of people who do something have qualifications, that doesn't mean that everyone else using the verb has those qualifications or that those qualifications are important. For example, penetration testing can be very well done and very useful, with lots of different attack vectors that can be tested by very experienced people in real world scenarios. You can also get a penetration tester who just tries a small number of really obvious things. That's why you have to choose one who knows what they're doing. In this case, the audit seems to have found some problems with security, who didn't do anything when they saw people breaking through a door. Yet they seem to have blamed the IT people, who did everything well as far as they knew.
Computer room has a door? Check. Computer room door is locked? Check. Locked door doesn't unlock with unauthorized cards? Check. Door is sturdy enough not to be shoved open? Check. So I think they yelled at the wrong group. If they were supposed to test security, they did something potentially useful, but if they were there just to audit IT, they were wrong to try to break through a door.
Person 1: "But journalists also need to be held to account, if their actions cause harm."
Person 2: "[Y]ou are dangerously wrong. [...] Was the Washington Post responsible for Nixon's resignation?"
If I understand both of you, you're arguing different points. Person 1 was saying that journalists who cause problems should be held to account, which would not include things like a resignation; that was a result of revealing facts. If, instead, the result of the leak was that someone died (E.G. location of person targeted by assassins), then there would be a more serious problem. Meanwhile, person 2 is worried that "cause harm" is a very general term that can be defined more broadly than it should. Again, I may be misunderstanding the points here, but I think there's something valid in both.
"He isn't charged with treason, he is charged with espionage."
This part of the discussion has escaped specifically the topic of the article and now is considering treason and related legal frameworks from a theoretical perspective. Nobody is arguing that he has committed treason; they just want to know whether a non-citizen can be charged with treason given its definition. In fact, some are arguing that it would be impossible for people in his situation to commit treason.
"There are so many agencies that unless the States take charge of implementing some sort of authentication or 2FA challenge-response mechanism, the telcos have really no viable way to do so in an emergency situation."
Then telco and police alike should get going and build "some sort of authentication or 2FA challenge-response mechanism". In the meantime, they should not respond to any request unless they can confirm the entity calling and the legitimacy of the request. After the system is implemented, they should reject immediately any request to go around this system. If a police unit forms, it can choose to set up under that system with required auditing and transparency, or it can resign itself to the fact that it can't access this information. "Because it's hard" is not an acceptable reason to violate people's rights.
"What I'd like to know is how letting them fail and leaving us with just Verizon and ATT as the only abusive duopoly in town is good for us?"
That couldn't functionally happen. These companies are massive and can continue or restructure in time to avoid a financial failure. However, let's assume that they don't do so and do eventually fail. Market share of 12% and 17% is a valuable commodity to a buyer. That buyer could not be either remaining company for antitrust reasons, and could not be the same company. So there would be a lot of administrative restructuring, but there would still be four providers. It is conceivable that one could be mismanaged so much that it loses all its market share, but that's a lot of supposition and previous market share numbers don't seem to show that. So regulation is likely to prevent a triopoly and at least delays one for a while, hopefully long enough for other people to get into the market because they know that competition will be supported and they will have a chance.
"[T]he actual technique does not necessarily have to be malicious in practice (for example, a bank might use it to uniquely fingerprint your phone as an anti-fraud measure)"
About that... NO! The bank does not need to fingerprint my phone, given that they won't be fingerprinting anyone's non-Apple devices. Nobody needs a unique fingerprint that I can't wipe. History to determine whether a request is likely to be legitimate or not, sure. Sneaky tracking data, no. In addition to it being creepy, it wouldn't actually help very much given that only a small number of devices can use it even if Apple unpatches the vulnerability.
Saying things like that makes it sound like you think there is a legitimate use for this invasive technique. There isn't.
An app can probably be more trusted, but the more concerning one is a script on a website. A user can be tracked inside an app by many more reliable mechanisms, so the only benefit to apps. in using this is to try to track a user after they've deleted an app and reinstalled it. Concerning, yes, but not a very frequent thing to do. Meanwhile, sites that can fingerprint via scripts are much more worrying. If it takes a second to do that, lots of sites will do it successfully. If we can extend this to a minute, fewer sites will bother and plenty won't get a chance to finish before the user closes it. Still, I think the best way is to deny sites access to those measurements. If a thing needs those, they can write an app.
What shop? A bunch of them are owned by the mobile providers or have signed a contract with one of them. The devices are locked. You can get plenty of unlocked devices from online or the occasional retailer, but your choice is much reduced because they don't always have the specific one you want. You can get into the area of importing devices from other places, but that's a lot of hassle compared to the benefit.
It's only a ban against Huawei, not China as a whole. And in practice, both countries could hurt each other quite strongly by refusing to export chips. Most of the chips concerned are designed in the U.S. and manufactured in China. If the U.S. won't export them, the Chinese can't use them. If the Chinese won't allow them to be manufactured, the U.S. can't use them. Of course, the U.S. could shift manufacturing to other places, mostly Taiwan and South Korea, and the Chinese could either design their own replacements or start manufacturing the chips from designs they had previously, but both would take longer and come with major downsides. So if either country tries that, expect some pain.
You're troubled about the privacy implications of social media and your primary suggestion is QQ? The one that transmits a bunch of cleartext messages straight into the servers run by the Chinese government? They of social credit score fame? Viber doesn't have those implications but isn't exactly known for their privacy, either. Try things like Signal or Telegram.
I appreciate the enthusiasm. I really hope it is proven correct. Unfortunately, I don't think we will see a viable third alternative. Huawei will probably have something. Whether that is AOSP-based or something less compatible, I doubt it will be released as open source for everyone else, and I doubt that it will really provide useful things over standard AOSP let alone something less supported but more powerful like Lineage OS. Meanwhile, while other companies may indeed worry about android access being cut off, they will probably worry even more about a third OS eating into their market share because they would have to expend resources on building and maintaining it, let alone advertising it. If it dies like every other attempt at a mobile OS (Windows phone, Ubuntu Touch, Firefox OS, ...) they will be out that development cost, the hardware that didn't sell cost, the loss of android market share cost that Apple can try to pick up, and the made Google angry cost. Companies have a lot of financial people who do not like that type of mathematics.
Google services are blocked in China, including the play store. No Chinese phone accesses this store directly, though there exist side channels to access some of it. For this reason, lack of Google play availability will not dramatically impact the ability to sell the devices inside China. Outside China is a very different story. It is also worth considering that even those phones in China need chips from the various companies who have agreed not to sell them to the company, which may cause problems for them in the short term until they find alternate suppliers for the functionality or arrange for a third party to purchase the chips and send them on.
It's also important to realize that American parties aren't as unified as some parties in other countries. Although lots of other countries compete for internal chaos inside political parties, the parliamentary systems popular outside the Americas make consistent discord more fragile than does the presidential systems in the U.S. and many Latin American countries. One member of a party may be totally in favor of something that another member is extremely opposed to, and they can get into fights about whether it goes through or not before any other party gets involved. This particular lawmaker doesn't necessarily have the support of his party, and may not even have the support of many people in the legislature at all.
The problem with rooting the device and installing a custom OS is that very few phones are supported. I'm happy to do so, and I have one phone here already running lineage OS, but the list of devices for that, while the longest I've seen for such a build, is quite short. The phone I was talking about, an older LG one sitting in a drawer, has no known rooting path described online, and certainly no build already for it. I may have enough knowledge to build the lineage OS build for the device, but that would be a lot of work that wouldn't help much because I do not have access to install it. I don't know enough about low-level manufacturer-specific things to find my own rooting path without spending a lot of time learning about it, and since this phone is an old one I haven't thrown away, it's not really worth the trouble to me. The result being that I can't actually do anything with this device to disable Google's data collection.
I beg to differ. Let's consider the processor in an older iPhone and the one in the Pixel 3a:
Iphone 7: four cores (two 2.3GHZ high performance plus two more lower-power ones)
Pixel 3A: 8 cores, two 2.0GHZ cores and six 1.7 GHZ cores
The iPhone's cores have a pretty good single-threaded performance, better than many snapdragon cores, but not dramatically so depending on what the cores are called on to do. Now, let's look at some phones that cost less than 200 currency units, as defined by GSM Arena. I'm not sure exactly what currency unit they're using, but it's either euros, pounds, or U.S. dollars, as they use all three on various pages. Also take note that GSM Arena uses old prices, usually a price that was seen shortly after launch, so this includes only devices whose release price was under 200 units. Many other candidates are available whose price has been reduced to that level, but don't show up in the quick search I did.
Xiaomi Redmi Note 7 specs: eight cores: two at 2.2GHZ and six at 1.8GHZ, 4/6GB memory, clearly outstripping the pixel
Realme X specs: eight cores: two at 2.2GHZ and six at 1.7GHZ, 8GB memory, clearly outstripping the pixel
Samsung Galaxy A20 specs: eight cores: two at 1.6GHZ and six at 1.35GHZ, 3GB memory: not as good as the pixel, but not all that much worse
Nokia 4.2 specs: eight cores: two at 2.0GHZ and six at 1.45 GHZ, 3GB memory: A little worse than the pixel
Oppo A3S specs: eight cores: eight at 1.8GHZ: probably about on par with the pixel
These aren't all of the models, as I only considered one for each manufacturer. As you can see, several outstrip the pixel, and if I had included multiple candidates from each manufacturer, it would be even more of them. Even those that do not exceed the pixel in power have respectable processor performance, having eight cores and not having weirdly underpowered cores either. If you're doing something very processor-intensive on a phone, these might not be enough, but this is not the budget android device of old. It is perfectly capable of the standard smartphone use case.
I don't think anyone thinks Apple's prices are in any way justifiable, but that doesn't suddenly make this phone well-priced. Yes, it's better than Apple, Samsung, and Huawei in the flagship realm. But you can get a phone for much less that has similar specifications. This article has described it as similar to a flagship, but it's really not. It has a slower processor, less memory, and less internal storage than all other flagships and many other low or mid-cost phones. That doesn't make it insufficient; I've long contended that it is hard to tell whether an android phone has 4, 6, or 8 GB of memory, but it is important to avoid categorizing it as one of the most advanced, because that misleads potential customers into thinking that the price tag is a bargain, when it is in fact a bit overpriced.
I would not get a pixel, instead going with a cheaper android device. There are a few good reasons to do that:
1. A lot of them have comparable specs and can't really be told apart.
2. Many of these, especially Xiaomi devices, are supported by lineage OS, so you can use that if you prefer it or want to extend the life of the device.
3. Looking in the low-cost field gives you more options so you can find a phone that has features you are more likely to want (for example, you can have a headphone jack, SD card slot, waterproofing, or a removable battery in various models, though all at once is harder to find).
4. If it turns out you really hate android, which happens from time to time, you have spent less money on your device and don't feel as bad when you sell it again.
I have to say that point 1 is the most important. While this article is extremely laudatory of the pixel, calling it low-cost, it really isn't when you compare it with the numerous good phones in the 100-200 price range. It's low-cost only when it is compared with flagships, which are all so high-cost as to be utterly ridiculous. The only thing I've consistently heard about being better in the pixel is the camera, but you will certainly get a serviceable camera in a cheaper phone, so it depends on your requirement for mobile photography.
Oh can it? I've never heard that before. Nobody's ever told me that. I have this phone over here that I can do that on. Just give me a few minutes... You want to explain why this phone, on which I don't have any google account configured, is still making DNS requests to google domains and shows play services as using a bunch of CPU and network on some occasions? It's also informed me that its performing a play protect scan of my phone. I have no malware, at least so sayeth Google when they checked my list of installed software against Google's servers. Which is some data. If this is happening, I'm guessing other data is coming out, too. Yes, I can go into settings and disable play protect. I can't disable google play services, though.
One major reason is to provide an extra obstacle to the mass creation of accounts. Since each account needs a unique email address, a spammer would need to create separate addresses for each account created. Yes, they could set up a mailserver and have a nearly infinite supply of those, but a monitor could notice this and ban all addresses under the domain they're using. So that means they have to use publicly available accounts, most of which have some method of preventing a very large number of accounts from being set up in short order or by one user. This also lets them report things should a user do something like break the law, and provides them a method of communicating with the user if the user needs to, for example resetting the password, informing of data breaches, etc. Most of this would not work anymore given a key-based authentication system, so people don't do it so often.
It depends very heavily on what the chips are doing. For operating systems under heavy use, the extra threads can produce real benefits because a lot of threads are cycling through those times they need to compute and those times where they don't. Whenever you really need performance on a multithreaded process that doesn't use much disk, network, etc., you would be best advised not to use it because four threads running under max capacity are usually better (exceptions apply) than eight threads that keep handing control over to others. This again varies, including how much memory each thread uses and how it makes use of a cache.
You can do exactly that. Not many people have decided to prevent you from using hyperthreading. Google has, but their OS is so lightweight (just a big browser) that it is unlikely to have a need for it and BSD has always been a configure all you like OS. Other things leave it on. However, we can't give you an accurate number of ongoing exploits because first, this is new and people haven't really had a chance to try to use it yet and second, nobody tells us when they're starting to exploit this and it doesn't have a simple definable signature we can search for. You'll have to make your decision on whether to hyperthread or not to hyperthread based on the technical descriptions alone.
Unfortunately, situations can be a lot more complex than they need to be. A "complex investment portfolio" can at times be created merely by having retirement accounts, even if there are no investments after that point. This differs greatly upon which country's tax regime is being considered, but you don't need to be super-rich, have created some complex set of accounts, or done something all that out-of-the-ordinary for the tax forms to become a lot less straightforward.
If that's the paramount problem for you, you can take that source and compile it yourself. But that's not really that concerning, because the risk of someone maliciously compiling a different binary and somehow getting it to you is less than someone finding a bug in existing code. The latter is much easier and more likely to occur. The former requires that signal themselves do that, or maybe that Google does so (you have things like FDroid, though), and that could be detected without much difficulty. So my point, that it is easier to audit the code if you can read it, still stands and your objections as stated are largely irrelevant.
Signal is not vulnerable to this, but could conceivably have a similar bug. It is open source, so that bug is more likely to be detected if introduced. What's app was not forked from signal (in fact it existed years earlier), nor was signal in any way forked. They're just two apps that look kind of similar. All the infrastructure, people involved, and app code is entirely different.
You can't really detect that. However, if you kill the app, which will happen automatically if you install the update, it will kill any compromised sessions and prevent new ones from starting. You would not know whether you have been attacked or, if you were, what if any data was extracted. There is no log of this from the application itself, as any logs could be written by the malware.
It doesn't seem that it is escaping the sandbox at all. Unfortunately, from within WhatsApp's sandbox, the malware can access contacts, call history, microphone, and camera* because of videocalls. That's enough to compromise the user of the device quite a bit, even if it doesn't let you read email, browser history, or other types of data on the phone.
*If the videocall or voice call function has never been used on an IOS device, this exploit shouldn't allow those to be taken because the permission has not been granted. This distinction does not apply to android, and if a voice or video call was ever used, it wouldn't apply to IOS either.
I don't think they were saying that this hack was created by NSO/anyone external, but that the expertise needed to find and exploit it in the wild, as has been happening, is likely that of NSO/someone external. I thought the exact same thing when I read that line, but the paragraph after that makes it look like the above suggestion. Given that this program is not open source and has an encryption layer on all its network traffic, I would say that it is at least somewhat hard to find and probably signifies some level of sophistication on the part of the attacker abusing it.
This is perhaps the first example of such an ordinance, and I hope it leads to many more. Those who profess to support such legislation but don't do anything about it because they think it's not going to pass may now see that it can be done and get going on spreading such restrictions. Here's hoping they do so across all cities, countries, and continents.
How does that have any relevance to this question? It is possible for a completely honest company to have a bunch of money. It is possible for the worst monopolist on earth to be losing money anyway. Are you trying to say that Apple must be a monopolist because they have a lot of money? It seems a lot more logical to argue that Apple are a monopolist because they engage in monopolistic practices.
I think there is a lot to argue about that, and I think the margin should be lower or zero, but it is worth keeping in mind that you can have a payment system in an app that bypasses Apple's in-app purchasing system (E.G. please sign into your account, from which you will pay your bill with your credit card information). It is more difficult than letting a user press a button and authenticate with Apple, but it can be done and is in many applications. This option is very much not available when purchasing apps, although you can go the route of having a free application that makes you sign into an account and pay from there, which developers don't choose to do very often.
But the case is not at all about operating systems. They're not saying that there should be some alternative to IOS that runs on iPhones. At most, they're saying that IOS should allow sideloading, and they may simply be saying that there should be more control of app pricing and a lower commission. If a case did happen with the decision saying that apple needs to provide an alternative OS loading facility, it would be problematic for every manufacturer of android devices that has ever produced a bootloader that isn't unlocked. Even those that were hacked to provide the functionality didn't actually intend to provide consumer choice. So that probably wouldn't succeed, but is definitely not what's at issue in this case.
I'm not sure about that. From a user perspective, there are probably many advantages to the app method of getting a car. You don't have to try to catch one in transit. You don't have to call in and prearrange something. If taxi places started using apps, you'd still have to a) know which taxi locations are available and b) have installed their app when you are going to the place. And this does at least produce a larger supply of available transports. So there do seem to be real benefits to the users of these applications.
Of course, there are many major downsides as well, both to the increased number of people driving about and the companies administrating the application. I'm not saying they're perfect, or even good. I can't say I use their services very frequently, either. But I don't think it's child's play for a taxi company to duplicate their benefits.
This is when security through obscurity actually has a chance, because security for an antivirus is very different than security for an operating system. The difference is this:
OS security: Malware can't get in, malware can't escalate, etc.
AV security: malware can't evade
In other words, malware wants to break into and exploit things in the operating system, but just wants to hide from antivirus. So the operating system components need to be audited by a lot of people to understand how they work and try to identify any holes before the malware people find them, but the antivirus system needs to prevent the malware writers from doing the same kind of thing to its code.
I remember a time where Amazon was nicer. Not perfect, of course, but you could usually find what you were looking for, which would be sold there. You could get a relatively exhaustive list of all the options for that thing and compare them. Then you could read the reviews and clearly figure out which were fakes, then purchase the thing, which would be sent to you easily enough. It was a very useful experience then. I think this was around the time I used to think of Google as an ally because they opposed crazy break-the-internet suggestions and released a bunch of code as open source. All of this has dramatically worsened. Google's worsening is clearly intentional, but I don't even know why Amazon let that happen to them. They have a lot of resources from selling all of this; one would think they would eventually realize that there are a few things, like having the search results at least match a little bit the search query, that couldn't help but enhance their business.
Those are bad, but another style gives them a run for their most disorganized title, which is companies in which one person or group is responsible for each specific technical area, and no person or group is responsible for more than two of them. If a real technical problem exists, so much time is wasted by the group who got asked about it with the group that should be doing it and the group who knows necessary information to do it that nothing happens. Meanwhile, when one group tries to do something that may be somewhat connected to the things they should do, they run into situations known by a different team but not properly documented, or otherwise properly documented on one of these sheets of paper in the big filing cabinet, and break something. At least somewhat ironically, this structure is usually created under the idea that the systems people should be more organized into specific groups.
They don't have to do that. They control the core, so they can keep adding things to it that are difficult to rip out of the code, and enforce their control that way. That means that some other browsers will, by using chromium, be forced to choose to stay with an old and insecure version, fork and reimplement all of that, or run Google code without protection.
That is true, but I have never seen a system elect to use 127.0.1.2 for an additional service, whatever that might be in this case, and almost every system only bothers to resolve 127.0.0.1 to the local machine unless specifically instructed otherwise. If the addresses were used for multiple internal interfaces, one would need 257 to reach 127.0.1.2. So I'm still not sure why that was suggested and I think I'll stick to 0.0.0.0 until I hear more.
Because 0.0.0.0 means unroutable, and the system won't try to do anything with it unless it has a bug. If I use 127.0.0.1, it will start trying to make connections to services on my machine. If I have a webserver running, that will add junk to my logs and return random 404s from that. Even if I don't have that, there will be some overhead as the browser/application initiates TCP connections that aren't going to work. Why bother? As for 127.0.1.2, I'm not sure why that was suggested. Yes, it's not localhost so it avoids the TCP overhead and local service problems, but it doesn't have any intrinsic benefits (as far as I know) over any other 127.* address, and is less likely to be checked than a proper unroutable 0.0.0.0.
No, what they should do is continue to allow a phone number to be sent as an identifier and a callback, but have that be a secondary one. Kind of like how an email can be sent from one account but have a reply to address for a different mailbox. Blocking would be done on the real number, which would always be sent. Caller ID would start with the real number, and if it wasn't found, continue on the stated number. That way:
If a company owns a block of numbers and sends the main one no matter who calls, the company name appears on caller ID, and the company can be blocked.
If I'm using a spoofing service to make a VOIP call from my number, it will show up as me, but clearly indicate that it's not my normal phone.
If someone else is making a call and spoofing my number, it will show up as me, but the number could still be blocked without blocking my real number, and it could also be tracked.
It is dangerous to allow impersonation of numbers without any detection.
