News for hackers. Stuff that matters.

biktor_gj

First things first: I never implied (or wanted to imply) that you were introducing malware in that patchset, just that you could introduce it and I wouldn't be able to find that in a PR so big. Sorry if that came out wrong.

Still, that 3.18.140 kernel is ancient, it's not worth doing anything with it unless we find a bug that prevents something from working. Especially since there _is_ a mainline effort, and there's a 6.0 based tree that has most of the things working already except for some bugs with the nand and audio.

And that's the reason why there hasn't been a new release lately, because I hadn't had a lot of time, and because I'm spending all my little remaining energy on trying to get the userspace working with mainline.

For those who may not know, the userspace acts as a sort of bridge between the baseband and the Pinephone, by proxying stuff between them (that's how you can hijack some things and implement voice calls and SMS). When moving to mainline, there's certain devices that cease to exist, some others needs adapting, and I'm taking the time to try and get openqti to be more flexible and out of the box support different audio settings for different models, different flash configurations (for those modems which don't have a dedicated user data partition etc)

It has had different phone numbers before, but we always ended up having some issue with some app where the it (correctly) thought the number was invalid, wouldn't allow you to reply etc.

So I settled with two easy to remember numbers: +22 33 44 55 66 77 for normal user<-->modem communication and +22 33 44 55 66 78 for Cell Broadcast message relays

Re:PGPP (Pretty Good Phone Privacy) Beta Launch on Thursday August 11, 2022 @05:02PM (#32431676)
Probably on every connect, there are ways to randomize your IMEI on every boot on certain phones though (that might be not very legal in some countries)
Re:Doubling the PinePhone storage speed with a soldering iron on Wednesday November 17, 2021 @11:45PM (#29262052)
I did the mod with a Pinecil and some tweezers in my kitchen table in 15 minutes. Might look hard but if you have steady hands and a $25 soldering iron you can do it without issues
On the other hand, I have a XPS 15 9500 I use with Linux all day and never had an issue with anything. Always suspends, never wakes up by itself, no hardware issues... My work 16" MBP on the other hand killed the battery after one week in "suspend" when I was on vacation, probably due to the Power Nap functionality, which sounds pretty much like the Modern Standby being talked on.
Re:Scanning your iPhone for Pegasus on Sunday August 01, 2021 @01:13PM (#28027964)
I'm no expert, but if you ask me, I would completely erase the phone, upgrade it via DFU, and start fresh. After setting it up again, run another backup and rerun the tool to doublecheck. That or ditch the phone
Re:Building a DIY Smart Doorbell on Tuesday June 29, 2021 @01:19AM (#27672093)
Given there's an electronic lock on the other side with a keypad, it makes me think that thing has its own actuator and didn't want to mess with it. Otherwise it would just be a matter of adding an "Electric strike?" (https://www.tesa.es/en/site/tesa/products/electromechanical-...), feed it 12/24v through a relay connected to the pi zero, and add another api endpoint
Re:Whistleblower: Ubiquiti Breach “Catastrophic” on Wednesday March 31, 2021 @02:05AM (#26644003)
There was no option to bypass cloud login when it got to my hands, apparently that has been "fixed" with some update, but if you buy a device and it comes with an outdated firmware, as it tends to be the case with their cameras and APs, your only choice is activate on cloud, setup, update, factory reset, setup on local.

About 2... I guess when you got access to all their source and infra is just a matter of pushing an update to enable ssh and they don't even need to even push a key. My problem with the keys is that they come bundled with it and you don't know it. There's no reason for them to install a key in there without your consent. Imagine Microsoft presetting an Administrator account on every Windows Server without telling anyone... It's just a security problem, even more in a firewall

Re:Whistleblower: Ubiquiti Breach “Catastrophic” on Tuesday March 30, 2021 @04:14PM (#26639819)
After the Unifi Video fiasco, I bought a UDM Pro to test Unifi Protect.

Once I saw it required cloud login I got scared. After I saw an ubiquiti ssh key preinstalled in a device with unfeteted internet access I shut it down to never bring it up again

Re:Nextcloud Hub 21 on Tuesday February 23, 2021 @08:14AM (#26236860)
You can connect multiple accounts from the desktop client if that's what you mean... If you mean nextcloud to nextcloud there's also federation, but haven't really tried that as I've never needed it.
Re:Pine64 Februrary Update: Show and Tell on Monday February 15, 2021 @02:06PM (#26145966)
That count is only of quectel and qualcomm binaries and libraries, busybox, sysvinit, scripts, config files etc. where not in that pack.

True though, most of them don't do anything interesting, or only one interesting thing for the thousand that could do in a typical scenario

Re:Homebrew 3.0 on Friday February 05, 2021 @10:11AM (#26037128)
Not parent, and I'm not going to say it sucks, the project takes a lot of work from a lot of people and I ain't the one pissing on other people's work, it definitely could use some improvements syntax wise though, What was it, brew install? Brew cask? Oh , now is brew cask install... or was it brew install --cask?

I get the analogy, but being a package manager, but was it really that bad to use 'brew install', 'brew update', and 'brew upgrade' for everything?

And it's true that it is a little frustrating at times when you don't use it for a while, you 'brew install xx' and wait 4 minutes until "Updating homebrew" finished with its dozens loops between shells, ruby etc doing its stuff (which I assume is refetching repos, but couldn't know it from the output)

I use it because it's the most common thing for mac, but I miss APT and DNF everytime I use it, not going to lie

Right now, on Mobian, you will get more or less 2-3 hours of screen on time, with everything enabled (modem, wifi, bluetooth, max screen brightness and doing stuff with it

If you just let it sleep (modem on registered to the network, allowing for voice calls, all the rest of the phone suspended), you'll get about 24 hours of runtime.

I think there's still more power management fixes that can be done, mostly in BT/Wifi, but it's not bad at all for a phone that's still tagged as "dev"

Re:I Ripped Out a £6k Lighting System on Sunday November 15, 2020 @04:59PM (#25105322)
It depends a lot on cable quality, what you have on either side and the connectors in between.

At work we had to repurpose a pair 170ish meter cat 6 cables for some cameras and it has worked nicely for three years (with PoE even). We tried again with a 100m cable rated for exterior (plus female + patch cords) and it wouldn't even link at 100mbps

That is not true since Mojave. It will always tell you you have a pending update, it will dump a notification to update to Big Sur (already happened to me this morning), and it'll do it's best to confuse you to update.

Case in point: if you have catalina and you go to system preferences, system updates, you will have the big sur update in big, then some text on the bottom of the window saying something like "there are some other updates..." and then you'll see the security updates for your current OS

More because the Inetrnet came and allowed every vendor to sell directly from their webpage instead of going through the distribution channel, making retail software stores obsolete

There are two platforms that drive 100% of the mobile phone industry. One (Android) allows other distributors in the platform (even if they have to go through loops like sideloading an app and then allowing that app to install other apps). The other will kick and try to destroy you if you try to do something like that. Is that legal or anti-competitive in the US & Europe? We'll find out...

Re:Android 11 on Wednesday September 09, 2020 @07:38AM (#24419889)
The biggest announcement here seems to be the "Security updates from Google Play"

I don't know if that means Samsung doesn't get to decide when you get updates or if it means "we're delaying security updates from being pushed to AOSP so you better have Google Services installed if you want your vulnerabilities patched in a timely fashion"

Casio solved that problem 40 years ago with 4 screws and a rubberband. It is what it is, the same with soldered ram in laptops. Cheaper manufacturing + worse repairability == bigger earnings per quarter

Two screws on each side of the battery so it doesn’t move and a back cover with screws would get you the same waterproofing as glue. Instead a broken glass back will get you 600€ of repair in an Apple Service Center

Re:Librem 5 Phone Dogwood Thermals and Battery Life on Tuesday July 28, 2020 @04:12PM (#23980150)
Crust runs in a RISC cpu inside the Allwinner chip, and it only works in that. I don't know if the NXP chip has a 'dedicated' core to manage the actual ARM cores, but all the work done in Crust won't be portable to the Librem, if it can be done, it'll have to be done from scratch
Well, probably this was the result of some corruption in a parameter in the flash. On the early days of the Samsung Galaxy phones if you broke part of the efs partition the modem couldn't read the IMEI and would fall back to a generic one. This looks quite the same

Though with 13000 devices affected either it was a problem in manufacturing or someone in the Service Center was not doing the job too well...

Re:New 13-inch MacBook Pro on Monday May 04, 2020 @09:01AM (#23067475)
It's even worse when you notice that two of the four "new" models come with an 8th gen Intel CPU, and DDR3 memory, it's like they replaced the keyboard from the previous model and they're calling it "new".

Between selling cpu's 2 generations behind, the keyboard issues, and thermal problems in the Macbook Airs, it really seems like Apple is trying its best to alienate buyers from their laptop line. Just recommended a coworker a Macbook Air for her son, an i7, 16Gb of RAM and 512Gb SSD. From off to account creation, the fan was already running. By the time the laptop was showing the desktop it was burning to touch. Some more testing and I found out the CPU was at 94-98ºC after 4 minutes. Turns out it is by design (just take a look at the photos of the cpu cooler, separated from the fan https://www.ifixit.com/News/36480/theres-something-new-in-th...). She just returned the laptop and is exploring options from Dell and Lenovo.

Even if you like MacOS, you now have to wait before buying anything Apple until you can see a teardown just to see if it's going to survive even casual use.

Doesn't the Android emulator run in QEMU? And doesn't qemu actually emulate a Soundcard? So it makes sense that when the emulator starts and boots the kernel in the VM it will probe the devices and act as an audio in&out pass thru, like the virtual SD card, or like the network connection or everything else really...

Coding a special SDK image to adapt to the host system permissions doesnt make any sense. Android will always have access to hardware, and you're testing that it will work on Android, not on an emulator...

Re:Steam for Linux client adds support for Linux namespaces on Monday November 11, 2019 @02:40AM (#21502909)
Truth is, Windows is a mess when installing stuff also. Beside installation folder and registry, there is also user's AppData folder, \ProgramData in system drive, and then installers tend to leave some MSIs in \Windows\Installer, all the libraries in System32 and sometimes, they also place stuff in Program Files\Common files.

The best at isolation has historically been macis, and then again you have plenty of packages installing to /Library, kernel extensions, uninstallers being placed in Applications/Utilities, MS updater being placed in /System and so on

Re:Vue.js v3 released (pre alpha) on Friday October 04, 2019 @03:00PM (#21160815)
I'm a sysadmin with a mixed knowledge in C, PHP and Javascript

my first time both with Vue and the whole webpack & npm world went like this:

Day 1 I didn't understand anything

Day 6 I started getting confortable with the stack

Day 30 had working prototypes for a multilanguage site

One year later I have made three websites with about 1K visitors a month, and two vue-electron 'apps', one of them being a Digital Signage client for large videowalls at work. It is strange in the beginning, but if you have programmed before, it gets easier as you work with it quite fast

If Rich Rebuild's Youtube channel is to be believed, that's exactly what happens with Tesla if they're declared as dead and then someone buys it, fixes it but in Tesla's system the VIN has been declared dead. They lock you out of the supercharger network and won't sell you parts for it (at least that's what he explains)
Re:Complying with the EC’s Android decision on Tuesday October 16, 2018 @02:52PM (#18232103)
I don't speak lawyer, but what I understood is this: 1. Going forward, we'll allow two licensing tiers: full package and light 2. All manufacturers selling phones in the EU will have to choose the licensing level for new devices

Something tells me vendors will be _encouraged_ to choose a particular licensing model or Google will make the full integration cheaper to keep Chrome and Search on as many devices as before this change.

Oh my, how I miss Maemo...

I always wondered why... I mean I understand the processes will be different for each vendor, but shouldn't 1nm the same for all vendors? They might use different technologies to achieve it but it should be a measuring unit... What is the actual difference between Intel and everybody else as to count 10 Intel nm < 7 TSMC nms?

Maybe it's easy to find out in google but cant find the correct combination of keywords...

Unless the alternative is discarding the hardware completely.

See, it's all about pricing, not quality of the parts. Last iPhone I sent for repairs at work came back with an invoice of 340€ for a screen replacement. At work that's something we _have_ to do, we can't send the phones anywhere we want. But if it was a personal phone, if I'm out of warranty and I'm going to be billed 1/3 of the cost of the phone for a new screen, or 100€ for a refubrished part somewhere else, it would be an easy decission.

Now, if that aftermarket repair was out of the question, you start wondering if it's worth to spend 1100€ for the more basic version of the phone, or you just spend 200€ on a Xiaomi and if it breaks you still can buy 4 phones more if they break. Or maybe you buy an iPhone still, but then when it breaks you just throw it away and buy an Android phone. Maybe the first time it won't happen, but after you have spent 1500€ on a phone and something else breaks(battery? lightning connector maybe?) it comes to a point where you stop throwing money into the hole.

On the laptop side, I get what Apple is doing. It has their new flashy T2 chip with integrated Touch ID and they're trying to do the same thing they did with the iPhones and nobody is going to stop them (well, maybe in EU they force them to allow the sale of Apple Diagnostic software to 3rd parties or fine them)

They're trying to convert their computers into big iPhones and treating everyone like a child that has to be taken by the hand and told him what to do all the time. And that is my problem with Apple. I'm not worried of somebody putting a backdoor in my laptop (and if they wanted to backdoor my laptop a year ago they only had to type 'root' [enter] [enter], no need to open the case), I'm not that interesting to anybody or any agency, but I don't like to be treated like I have no rights on the things I buy, and I don't need permission from anybody to do whatever I want with whatever I paid with my money.

Re:Mmm, Pi-hole on Wednesday September 26, 2018 @12:50PM (#18077823)
It's a self-updating hosts file. If you only do it once in a month you'll start seeing ads again. Also you can edit the hosts file if you're rooted, but you definitely can't if you're running a stock unmodified ROM. If you're rooted and you only care about your Android phone, you can also install Adaway, which does pretty much the same thing without the whitelist capability (Get it on F-Droid), but if you have a number of devices to protect, and some of them are iOS devices, TVs or whatever that can't be rooted, jailbroken, or you don't have administrative privileges to, Pi-hole is a good choice (if you run pfSense at home you can also use pfBlockerNG, which is essentially the same thing too).

Older »