[jimrandomh]

As far as I can tell, this is a big overreaction to a misunderstanding.

I'm a developer with remote adb enabled, using it in the normal intended way (to install new builds of an Android project I'm developing, retrieve log files related to it, etc). Currently, I access this via VPN (tailscale), but it's exposed to connections (and any pre-auth security vulnerability risks) on any random public wifi network I connect to. Adding the ability to restrict this to just tailscale will be an improvement, for me.

The proposal at the top of the thread is that you specify which interface you want it to bind to, when you set up remote adb, rather than binding to every interface. Nothing in that proposal suggests that "localhost" would be rejected as a choice of interface. One person suggested binding only to "wlan0", but that was a short throwaway comment that is obviously wrong (wlan0 is less-trusted than VPNs) and obviously not what they're going to do.

[kitsumed]

The person who made that suggestion ([e-mail]) is presumed to be the one of the main maintainer of ADB as their name (Fabien Sanglard) showed up in non-redacted in the history and CC here (https://android-review.googlesource.com/c/platform/packages/...) after it was linked in the original Google IssueTracker. We can confirm they are a Google employee as per their @google.com top domain name. (For users reading, please don't target this person, it won't change anything AT ALL, i'm stating this since its public informations, and for proof)

Their email is also in the CODEOWNER of ADB, and they made the recent ADB Wifi 2.0 presentation at Droid-Con Paris.

They stated, "Connection to localhost has also been the source of exploits where apps are using that socket to adbd to escalate their privileges," which suggests that internally they viewed it primarily as an exploit bad actor uses. Without feedback, they would most lickly not consider changing their point of view, this is why the blog post was made.

The article shows that this is technically possible for bad actors to use it, assuming the user allow it, but highly unlikely in practice: https://kitsumed.github.io/blog/posts/android-may-soon-restr...

I do agree, however, that many of the comments, mainly on Reddit, blow the issue way out of proportion. Based on the website analytics, I can also confidently say that most people didn't even open or read the blog post. That's fine with me, though. My goal was to get the attention of actual developers and more technical users.

I have been very carful in the blog post not to write something too dramatic like some news outlets do, but if no one read it, I can't do anything about it.

EDIT: I have purposefully left that person name out of the blog post I originally made to avoid encouraging people to message them directly. However, if I need to update the blog or publish some kind of follow-up with supporting evidence, I may end up linking it. I'm not sure tbh.

[subarctic]

Thanks for clarifying, if your read is correct and they're just putting more control in the user's hand then this isn't an issue at all