You can likely disable developer mode after installing the app.

I’m not sure if you would have to re-enable it every time to sideload updates or new apps. You can also install via adb with no waiting period.

Adb also requires developer mode.

And my work doesn't permit it even with byod, it's so annoying. I've stopped running byod for that reason but now I'm stuck with two phones again.

Never byod. Besides MDM issues, it makes your personal device in scope for discovery if any lawsuit against the company.

Oh I don't live in America so this wouldn't happen, we don't have discovery here like that.

Besides, I would not comply anyway. I would just delete the device.

IANAL, however IIRC delete a device data is effectively destruction of evidence under most jurisdictions.

again IANAL but be careful.

If your device is under MDM it's already far more pwned than the topic of this article

Yes these days it is. It didn't use to be like that.

In the early days of BYOD, all they could do is delete the device if it would be lost. Which was not really a bother to me because I back it up to my own servers anyway, and in that case it would be lost anyway. And they would enforce a few basic things like setting a decent pincode and device encryption.

But lately the MDM and antimalware solutions have become more intrusive. Recently my work's MDM complained about an app I had on the personal side of my phone, something they should have no visibility of. Also they now want to route all the traffic through their VPN to inspect it which was obviously a non-starter.

Android 5 is where capabilities really took off, including the Device Owner profile which has pretty ultimate control over the device -- they've actually done some work to limit what admins could see across profiles in Android 11+

Android 7 is when always-on-vpn was could be enforced by an admin, in 2016.

> You can also install via adb with no waiting period

Is this confirmed? If so, that largely removes my issue with the 24 hour waiting period for enabling/disabling dev mode.

The 24 hour waiting period is only once per account, not on every activation, or even every device.

You can, but since android 7 IIRC apps don’t trust the user store by default (unless you have root and add it to the system store or patch the app to trust the user store)

There’s a limit of free hours per month that comes out to 2 cores and 12GB RAM. If you go over it then you get charged with the pay-as-you-go option.

It used to be 4 cores and 24GB RAM in the past for at least 4 or 5 years but it recently changed.

If you are on the pay-as-you-go tier, I would check if you are being billed. Always free for the ARM instances works by giving you a certain number of hours free, so if you go past that you may get billed

The suspension that was public facing lasted 90 minutes, but they couldn’t log into the account for hours

See https://bsky.app/profile/ezralevin.bsky.social/post/3my43atj...

The always free was recently cut to 12 GB RAM and 2 cores per month.

https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier...

Interesting. I just signed into my machine and checked

    ubuntu@instance-20250824-2334:~$ free -mh
                   total        used        free      shared  buff/cach  available
    Mem:            23Gi       3.5Gi       768Mi       7.7Gi        19Gi        11Gi
    Swap:             0B          0B          0B

I must be grandfathered in to the old one. Also I really need to add a swapfile lol.

This has been communicated heavily. They will kill your instance one day soon.

Yeah, I am fine with that. What I have on there is pretty low-stakes and everything I care about on there is backed up regularly with Restic to my local server. If they decide to do murder it, that will suck, I will be annoyed for like twenty minutes, and then I shall move on. It’s not like I paid for it.

I bet if you restart it it'll apply the new limits

Always free, with 12GB and 2 cores? What's the catch?

As far as I can tell, there really isn't one. I haven't paid Oracle any money since I started and the machine appears to work fine. I think they treat these things as loss-leaders in hopes that you bother your employer to get the more expensive non-free plans.

Sweet. I will have to take a look at.

Wow I am surprised to see this.

I created a tool that automatically follows ads to try to find scams.

But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too.

I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.

These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.

Yep. I Agree. I believe it's a question of economics, not technical challenges.

Google is absolutely smart enough to make these attacks un-economical. IMO they are unwilling to incur the loss in revenue this would involve (false positives, banned resellers etc).

Another major issue is google safe browsing whitelists many of these subdomains that the attackers like to host their scam pages on.

As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire. https://blog.google/security/using-ai-to-stop-tech-support-s...

I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.

> These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection.

Same issue with spam sms in my country: I think they geo-locate it so submitting the link to safe browsing project takes way too long

I don’t understand this being a “national security” threat.

Besides, mobile proxies exist which work differently. All you need is a mobile data plan that you run a proxy server on. It allows for easy IP rotation and since it’s a pool shared with other customers you cannot easily block it. This is because of things like CGNAT.

IP rotation is easy because reconnecting to the network gives you a new IP address.

Static residential proxies also are a thing, even if they are less effective sometimes.

Depending on the IP reputation as well as the kind of IP address you have, this can happen.

Google also prefers if you have a Google account logged in.

Phone verification services exist to give you a real number for the purpose of passing this kind of verification.

They even have APIs for these services. They make money since they can use the same number to verify different things.