Planet F-Droid

May 29, 2020

NewPipe

NewPipe 0.19.4 released: Stream fixes, SoundCloud comments, and more

Keep on streaming with a fresh update to NewPipe. This one comes with a lot of bug fixes, improvements and more features. This also fixes an error when trying to watch YouTube videos.

Testers needed

We need testers for new versions of NewPipe! If you have a KitKat, Android TV, or “battery optimized” device, please add yourself to the relevant section of the testers wiki page and you will be mentioned when you are needed.

Additions

Thanks to @B0pol, there is now support for SoundCloud comments! Go see if they recommend any similar music to your favorite track! He also added PeerTube playlist support.

There is now a Restricted Mode setting for YouTube. This will help keep some of the weird stuff on YouTube away. Thanks, @vnagel!

Support for vnd.youtube://ID links was added by @Stypox, so when sharing from other apps the links will work in NewPipe.

@wb9688 added support for YouTube’s learning playlists, so it should be easier to learn new subjects!

In PeerTube, viewing the parent channel of a channel is now possible when watching a video of the sub-channel. This allows you to navigate easily to the channel that is related to the channel whose video you are watching. That’s a lot of channels, so thanks @Royosef.

Bug fixes

The bug where trying to open a video made a “Could not get any stream” error appear was fixed by @wb9688 in the extractor.

He also fixed sending e-mails from the crash reporter, so next time you get a crash and choose to report it via e-mail, the error will be in the contents! This change will help errors get noticed by the developers faster.

The “open in browser” button now actually opens the link in your default browser instead of giving an option of what to open it with. That was fixed by @B0pol.

Another contribution by @wb9688 was to stop a freeze that happened when pressing “Download” on a PeerTube video.

@B0pol fixed some crashes related to different languages being set. Hindi, Ukrainian, and Polish speakers don’t need to worry about NewPipe crashing due to their language anymore.

Improvements

Speaking of translations, the debug settings (for if you are running a test build of NewPipe) are now translateable. Help out by translating through Weblate. Thank you, @wb9688 for helping people around the world use NewPipe!

The extractor version was updated by @Stypox, bringing better performance. The extractor release notes better explain this.

@B0pol made YouTube searches able to be corrected in case of a typo.

NewPipe now uses vector drawables instead of PNGs for the icons in the app. This decreased the app size in general and gave a good chance to upgrade some libraries from legacy versions to new ones. Great work, @Stypox! Icons should now scale very well.

Some buttons now have their colors set based on what service you are using. Thanks for the theming help, @B0pol.

Gesture controls now don’t interfere with the status bar or navigation bar, which should stop you from accidentally changing the volume or brightness when checking notifications. This was the first contribution of @AioiLight!

If any of you use Kodi and were wondering why the button showed up when it didn’t work, thank @Stypox for making the button for Kore only appear on the supported services (YouTube and SoundCloud).

Under the hood

This section is for internal changes with this release. These aim to make the lives of the developers a little bit easier. Ktlint, a linter for Kotlin, was added. This essentially checks for errors in the code and ensures that the way things are formatted are the same. Now there won’t be a problem about using spaces or tabs to indent, so thank you, @wb9688! :)

Also upgraded were a bunch of dependencies NewPipe uses, done by @wb9688. The target SDK was upgraded to API level 29 (Android 10), LeakCanary was updated for debug builds, the crash reporter was updated, and many more miscellaneous libraries were brought to the present.

Conclusion + internal news

There are some issues with 0.19.4 regarding the file picker and other things, so it is possible that a 0.19.5 will be coming out shortly to address these problems. Please also remember to be nice to the developers of NewPipe! There have been some interesting comments from a small minority of people using foul language.

Where to get the latest version

NewPipe notifies you about new versions, you can download them when you press the notification. An alternative is the GitHub release page. If you use the F-Droid app, it notifies you as well about an update for NewPipe - please keep in mind that it can take F-Droid a while to update their repository. If you have problems installing you may need to uninstall NewPipe then reinstall (make sure to backup data).

Please let us know what your experience of the latest release is, especially bugs in need of fixing. As usual, you can reach out to us via IRC (#newpipe on freenode), open issues on GitHub or ideally use our built-in crash reporter to send us machine-readable issue reports. You can even send in fixes yourself.

May 29, 2020 23:00

OsmAnd

Custom Package or your own plugin for OsmAnd

Custom Package or your own plugin for OsmAnd

May 29, 2020

We announced in our last OsmAnd 3.7 (Android) release about custom package. What is it? How can you create your own custom package?

OsmAnd is a "Swiss knife" among similar applications. We always try to create very useful and flexible app. Experienced OsmAnd users are our gold team because it is not easy to start using OsmAnd for 100 percent at once.

In the earlier versions, we have added customization of your navigation profiles. In the last version of OsmAnd (3.7) you can customize the Configure map menu, Drawer, etc. In general, you can send your navigation profile to your friends with all your settings anytime.

But if you want to send not only profile dependant settings, but rendering files, fonts, routings, maps, and other data, we have added this opportunity. You can create your own plugin file for this. The plugin file is a special zip file in the .osf format. In this article you can see a comprehensive tutorial on how to do your own plugin for OsmAnd.

Let's start!

OSF-file is a renamed zip-file which contains json-files and folders. Here, you can download files from our example. This finished plugin you can download here.

(Image not available offline)

Read more about the JSON-format here. You can open and edit this format with any txt editors. We will use the Sublime Text editor for the reference. You can check your code here.

We want to add that we made the opportunity to modify JSON file for not only programmers, but for all our users.

Our general JSON file is "items" contains commands for import JSON-files, obf-files, icons, etc.

__________________________________

items.json
Click here to see items.json example

{ "version":1, "items":[ { "type":"PLUGIN", "pluginId":"test.plugin", "version" : 1, "icon": { "" : "@plugin-id.png" }, "image": { "" :"@plugin-image.webp" }, "name":{ "":"Test Plugin", "ru":"Test Plugin: RU language" }, "description":{ "":"This package is a test package and displays test information.", "ru":"This package is a test package and displays test information. RU language." } }, { "type":"RESOURCES", "pluginId":"test.plugin", "file":"res" }, { "type":"DOWNLOADS", "pluginId":"test.plugin", "items":[ { "path":"test", "name":{ "":"My offline maps", "ru":"RU: My offline maps" }, "icon":{ "":"ic_world_globe_dark" }, "header-color":"#002E64", "description":{ "text":{ "":"This package is a collection of online and offline map sources of various types.", "ru":"RU: This package is a collection of online and offline map sources of various types." }, "button":[ { "":"Telegram chat OsmAnd", "url":"https:\/\/t.me\/OsmAndMaps" } ] } }, { "scope-id":"offline-maps", "path":"test/Waterway", "header-color":"#002E64", "name":{ "":"Waterway", "ru":"RU: waterway" }, "icon":{ "":"ic_world_globe_dark" }, "items":[ { "name":{ "":"Offline Waterway map SA", "ru":"RU: Offline Waterway map SA" }, "filename":"waterway.obf.zip", "type":"map", "timestamp":1582994500, "containerSize":28195301, "contentSize":28195301, "description":{ "text":{ "":"Zoom min: 0
Zoom max: 19
Countries: SA", "ru":"RU: Zoom min: 0
Zoom max: 19
Countries: SA" }, "image":[ "https://drive.google.com/uc?id=16HjUHsSWNgeQI0bmuup9ohpyrg6rWkHH&export=download" ] }, "downloadurl":"https://drive.google.com/uc?id=10iP2VZexHtHC0QLhACZ1QoEy-duNN5Wg&export=download", "firstsubname":{ "":"Waterway", "ru":"RU: Waterway" }, "secondsubname":{ "":"", "ru":"" } } ] }] }, { "type":"PROFILE", "pluginId":"test.plugin", "file":"bicycle_test.json", "appMode":{ "iconColor":"RED", "iconName":"ic_action_motorcycle_dark", "locIcon":"BENTLEY", "navIcon":"BENTLEY", "order":32, "parent":"bicycle", "stringKey":"bicycle_test", "userProfileName" : "Test Prof" }, "prefs" : { "drawer_logo": { "" : "@logo.png"}, "drawer_url" : { "" : "https://osmand.net"}, "drawer_items" : { "hidden" : ["dashboard"], "order" : ["map_markers", "my_places", "search"] }, "context_menu_items" : {}, "configure_map_items" : {}, "route_service":"OSMAND", "renderer":"test-rendering.render.xml", "routing_profile":"routing-test.xml/test-car" } }, { "type":"FILE", "pluginId":"test.plugin", "subtype" : "rendering_style", "file":"\/rendering\/test-rendering.render.xml" }, { "type":"FILE", "pluginId":"test.plugin", "subtype" : "routing_config", "file":"\/routing\/routing-test.xml" }, { "type":"SUGGESTED_DOWNLOADS", "pluginId":"test.plugin", "comment-1" : "search-type are latlon (closest by latlon), worldregion (by boundaries if name matches worldRegion downloadName as we do for default types), by default natural order, limit finds first N elements", "comment-2" : "predefined scope-id are @type of indexes.xml map, srtm_map, road_map, wikimap, wikivoyage, hillshade, slope, fonts, voice, depth ", "comment-3" : "names filters ignore case by name.contains(filterName)", "items": [{ "scope-id" : "test-downloads", "limit" : 1, "search-type" : "latlon" }, { "scope-id" : "road_map", "names" : [ "Poland_lesser-poland_europe_2.obf.zip", "netherlands_noord-holland_europe"] }, { "scope-id" : "wikimap", "search-type" : "worldregion" }] }, { "type":"NAVIGATION_ICONS", "pluginId":"test.plugin", "items" : [{ "locationIcon": { "" : "@bentley-car.png" }, "locationIconId": "BENTLEY", "navigationIcon": { "" : "@bentley-car-moving.png" }, "navigationIconId": "BENTLEY" }] }, { "type":"QUICK_ACTIONS", "pluginId":"test.plugin", "items": [{ "name": "Test quick action", "actionType": "osmbug.add", "params": "{\"dialog\":\"false\",\"message\":\"Message\"}" }] }, { "type":"POI_UI_FILTERS", "pluginId":"test.plugin", "items": [{ "name": "Test Search", "filterId": "test_search", "acceptedTypes": "{\"sustenance\":[\"bar\",\"alpine_hut\"]}" }] }, { "type":"MAP_SOURCES", "pluginId":"test.plugin", "items": [{ "sql": false, "name": "OsmAnd (test)", "minZoom": 1, "maxZoom": 19, "url": "https:\/\/tile.osmand.net\/hd\/{0}\/{1}\/{2}.png", "ellipsoid": false, "inverted_y": false, "timesupported": false, "expire": -1, "inversiveZoom": false, "ext": ".png", "tileSize": 512, "bitDensity": 8, "avgSize": 18000 }] } ]}

There are many import types for OsmAnd itmes.JSON. You can find all of types here. We will describe some of import types ("type") in this article.

In the first part of items.JSON we can create and add your plugin. The first import type will be "PLUGIN".

Note: you must create and add this line for each type: "pluginId":"test.plugin". Where test.plugin is a name of your package.

(Image not available offline)

To import icon images of your plugin to OsmAnd you can create folder (in our example "res" folder) where we store our image files. This type name is "RESOURSES".

(Image not available offline)

The "DOWNLOADS" type: you can add any files (sqlite, obf, fonts...) for downloading. You can see the general types of downloading files here.

(Image not available offline)

In "scope-id" you can add all necessary information about url of your files, name, description and etc.

(Image not available offline)

In type "PROFILE", you can add a navigation profile which added with your Plugin. You can find all info about your navigation profile during export and read the JSON file. In the JSON file you can find types of added items.JSON: "QUICK_ACTIONS", "POI_UI_FILTERS", "MAP_SOURCES", etc. Our advice is to start creating a navigation profile with all parameteres, export navigation profiles, copy needed from navigation profiles.osf (items.JSON) to your PLUGIN.osf (items.JSON).

(Image not available offline)

In type "SUGGESTED_DOWNLOADS", you can install maps which OsmAnd suggests when you import the new plugin.

(Image not available offline)

In type "FILE" you can add files from folders in your Plugin to OsmAnd. The "subtype" of these files you can find here. In our example we added routing.xml and rendering.xml files. You can read here and here on how to create these files.

(Image not available offline)

When all files in folder and items.JSON will be ready, you can zip all your files in one container. After that you can rename .zip file format to .osf. After that, your Plugin.osf will be ready for adding to the OsmAnd app.

In this article, we try to explain the first steps of your own Plugin creation. In the future, we want to add OsmAnd market in our application so you can share your own plugins, maps, and navigation profiles with others.

__________________________________

OsmAnd at Facebook, Twitter, and Reddit!

Join us at our groups of Telegram (EN), (IT), (FR), (DE), (RU), (UA).

Get it on Google PlayGet it on AmazonGet it on App Store

May 29, 2020 15:00

Tutanota

The open source email service Tutanota fights for your right to privacy.

All Tutanota apps are Libre software to provide an open source email alternative to Gmail, Yahoo, GMX and others. To us this includes to publish our Android app on F-Droid. Unlike other secure email services, Tutanota does not use closed third party code - whether from Google or others - because we must be in full control of the open source code to offer maximum security and privacy. Our focus on open source and encryption combined with our deep respect for your right to privacy, makes Tutanota the best secure email service.

May 29, 2020 00:00

May 28, 2020

Pine 64

Welcome New Community Members!

With thousands of Pinebook Pro laptops and PinePhone smartphones shipping in the next days and weeks, I felt that a short introductory blog post aimed at newcomers was in order. To this end, the primary purpose of this entry is to give you an overview of all the resources at your disposal. You can follow the shipping progress of both devices in a dedicated PINE64 forum thread. I will update the...

Source

by Lukasz Erecinski at May 28, 2020 15:42

/e/ foundation

/e/OS Fairphone 3 Twitter Giveaway Rules

Fairphone 3 Twitter Giveaway Rules

No purchase is necessary to enter or win. A purchase does not increase the chances of winning.

1. Eligibility: This Giveaway is open only to participants who are over 18 years of age, Living in the European Union and Great Britain who have a Twitter account in compliance with all of Twitter’s Rules and Guidelines and an access to the Internet.

2. Agreement to Rules: By participating, the Contestant (“You”) agree to be fully unconditionally bound by these Rules, and You represent and warrant that You meet the eligibility requirements. In addition, You agree to accept the decisions of the Organizer, /e/ as final and binding as it relates to the content of this Giveaway.

3. Giveaway Period: Entries will be accepted online starting May 29th, 2020 on and ending June 5th, 2020. All online entries must be received by June 5th, 2020at 11:59 PM (GMT+2).

4. How to Enter: The Giveaway can be entered via /e/’s Twitter account here. You must Retweet the contest announcement, tag @e_mydata in your Retweet and follow @e_mydata on Twitter. Only one entry per physical person is accepted throughout the duration of the Giveaway. The entry must fulfill all Giveaway requirements, as specified, to be eligible to win a prize. Entries that are incomplete or do not adhere to the rules or specifications may be disqualified at the sole discretion of /e/. You may not enter more times than indicated by using multiple email addresses, identities, or devices in an attempt to circumvent the rules. If You use fraudulent methods or otherwise attempt to circumvent the rules, your submission may be removed from eligibility at the sole discretion of /e/. You must provide the information requested.

5. Prizes: There will be three Winners selected in total. The Grand Winner of the Giveaway (the “Winner”) will receive a Fairphone 3 smartphone with /e/OS pre-installed. (Value of 479.90€. Actual/appraised value may differ at time of prize award.) Two Runner Ups will also be randomly selected. The first Runner Up will win a 20 GB storage plan for a year on ecloud, starting at the date when the prize is claimed. The second Runner Up will receive an /e/ t-shirt and stickers of the project. The specifics of the prize shall be solely determined by /e/. No cash or other prize substitution shall be permitted except at /e/ discretion. The prize is non transferable. Any and all prize-related expenses, including without limitation any and all federal, state, and/or local taxes, shall be the sole responsibility of the Winner. No substitution of prize or transfer/assignment of prize to others or request for the cash equivalent by Winner is permitted. Acceptance of prize constitutes permission for /e/ to use Winner’s name, likeness, and entry for purposes of advertising and trade without further compensation, unless prohibited by law.

6. Odds: The odds of winning depend on the number of eligible entries received.

7. Winner Selection and Notification: Winners will be selected by a random Retweet Picker under the supervision of /e/. Winners will be notified by direct message on Twitter within 2 days following selection. /e/ shall have no liability for any Winner’s failure to receive notices due to spam, junk e-mail or other security settings or for the Winner’s provision of incorrect or otherwise non-functioning contact information. If the Winner cannot be contacted, is ineligible, fails to claim the prize within 5 days from the time award notification was sent, or fails to timely return a completed and executed declaration and release as required, the prize may be forfeited and an alternate Winner selected. Receipt by Winner of the prize offered in this Giveaway is conditioned upon compliance with any and all federal, state, and local laws and regulations. ANY VIOLATION OF THESE OFFICIAL RULES BY WINNER (at /e/’s sole discretion) WILL RESULT IN WINNER’S DISQUALIFICATION AS WINNER OF THE GIVEAWAY, AND ALL PRIVILEGES AS WINNER WILL BE IMMEDIATELY TERMINATED.

8. Rights Granted by You: By entering this content, You understand and agree that /e/, anyone acting on behalf of /e/, shall have the right, where permitted by law, to print, publish, broadcast, distribute, and use in any media now known or hereafter developed, without limitation, your entry, and public information available on Twitter, for news, publicity, information, trade, advertising, public relations, and promotional purposes. without any further compensation, notice, review, or consent.

9. Terms & Conditions: /e/ reserves the right, in its sole discretion, to cancel, terminate, modify or suspend the Giveaway should virus, bug, non-authorized human intervention, fraud, or other cause beyond /e/’s control that could corrupt or affect the administration, security, fairness, or proper conduct of the Giveaway. In such case, /e/ may select the Winner from all eligible entries received prior to and/or after (if appropriate) the action taken by /e/. /e/ reserves the right, in its sole discretion, to disqualify any individual who tampers or attempts to tamper with the entry process or the operation of the Giveaway or violates these Terms & Conditions and Terms or Twitter rules & guidelines. /e/ has the right, in its sole discretion, in order to maintain the integrity of the Giveaway, to void entries for any reason, including, but not limited to: multiple entries from the same user from different IP addresses; multiple entries from the same computer in excess of that allowed by Giveaway rules; or the use of bots, macros, scripts, or other technical means for entering. Any attempt by an entrant to deliberately damage any website or undermine the legitimate operation of the Giveaway may be a violation of criminal and civil laws. Should such attempt be made, /e/ reserves the right to seek damages to the fullest extent permitted by law. Such an individual would also risk suspension of their Twitter account per Twitter rules and guidelines.

10. Limitation of Liability: By entering, You agree to release and hold harmless /e/ and its subsidiaries, affiliates, advertising and promotion agencies, partners, representatives, agents, successors, assigns, employees, officers, and directors from any liability, illness, injury, death, loss, litigation, claim, or damage that may occur, directly or indirectly, whether caused by negligence or not, from: (i) such entrant’s participation in the Giveaway and/or his/her acceptance, possession, use, or misuse of any prize or any portion thereof; (ii) technical failures of any kind, including but not limited to the malfunction of any computer, cable, network, hardware, or software, or other mechanical equipment; (iii) the unavailability or inaccessibility of any transmissions, telephone, or Internet service; (iv) unauthorized human intervention in any part of the entry process or the Promotion; (v) electronic or human error in the administration of the Promotion or the processing of entries.

11. Disputes: This Giveaway IS GOVERNED BY THE LAWS OF FRANCE WITHOUT RESPECT TO CONFLICT OF LAW DOCTRINES. As a condition of participating in this Giveaway, participant agrees that any and all disputes that cannot be resolved between the parties, and causes of action arising out of or connected with this Giveaway, shall be resolved individually, without resort to any form of class action, exclusively before a court located in France having jurisdiction. Further, in any such dispute, under no circumstances shall participant be permitted to obtain awards for, and hereby waives all rights to, punitive, incidental, or consequential damages, including reasonable attorney’s fees, other than participant’s actual out-of-pocket expenses (i.e. costs associated with entering this Giveaway). Participant further waives all rights to have damages multiplied or increased.

12. Privacy Policy: Information submitted with an entry is subject to the Privacy Policy stated on the /e/ website.

13. Sponsor: The Sponsor of the Giveaway is /e/ and is in no way sponsored or endorsed by Twitter.

by Brittny Mendoza at May 28, 2020 15:29

May 27, 2020

Purism

Librem 5 Timeline Recap

Now is a great time to say “Thank you” to all our supporters, as you will see from the timeline recap video, it takes an immense amount of dedication and support to accomplish great things.

Purism has since 2014 been dedicated to bringing the world new kinds of devices, in 2017 Purism started on the long journey of building a mobile phone hardware with accompanying software, this is the timeline of the Librem 5 journey. The Librem 5 has a built-in ecosystem that corrects the issues that have cropped up in other platforms. We want to build secure products that protect your digital privacy without you needing to change a single setting.

Keep in mind that hardware is hard, changing the world for the better is arduous, and that it takes an entire team of dedicated experts working with a supportive community who persevere through many obstacles to create innovative and unique products. This timeline attempts to enshrine both how difficult the challenge is to make a secure phone from scratch, write a mobile operating system that can run on a laptop, desktop, or mobile device. All of that while maintaining a firm idealistic approach to user freedom, privacy, and security.

Our blogs make a pretty good timeline on their own, and Caliga in our forum has even collected all of the relevant blog entries here.

High-level Timeline Summy




Progress on upstreaming the kernel code is very noticeable when you compare how many lines of code we still change vs where we started. Back in 2017 we needed to add around 102,298 lines to 1,447 files for Linux version 4.18. That number has dropped to around 40,024 lines added to 156 files. As we continue to work in the open and with the community, this number will keep falling.

More recent progress is showcased on our blog. You can also register here to follow along.

Discover the Librem 5

Purism believes building the Librem 5 is just one step on the road to launching a digital rights movement, where we—the-people stand up for our digital rights, where we place the control of your data and your family’s data back where it belongs: in your own hands.

Preorder now

The post Librem 5 Timeline Recap appeared first on Purism.

by David Hamner at May 27, 2020 19:26

May 26, 2020

OsmAnd

OsmAnd 3.14 (iOS)

OsmAnd 3.14 (iOS)

May 26, 2020

Great news for iOS OsmAnd users!

We're glad to announce the new OsmAnd version for iOS.

Update your OsmAnd, check out all the new features and let us know if you like everything!

We promise to continue improving the OsmAnd app and make it even more useful for trips and everyday rides to make your life set.

(Image not available offline)
  • Beta of Public transport navigation
  • New offline slope maps
  • Update UI for Contour lines
  • Update UI for Overlay/Underlay screens
  • Update Map markers
  • Update Favorites menu
  • Beta of Public transport navigation

    In the new release, we would like to introduce Navigation for public transport which is currently in the beta phase for the iOS version of OsmAnd. Each of you can try to navigate in your city by public transport now with OsmAnd. Most importantly, we use the Public Transport Version 2 (PTv2) for our Public Transport navigation algorithm. You can check your public transport here. Guidelines on how to build or correct public transport routes are provided in our blog.

    (Image not available offline)(Image not available offline)

    Video about public transport navigation in OsmAnd:

    New offline slope maps

    Added Slope maps, now you can control Slope and HillShade in new Terrain menu.

    You can estimate slopes in your route. We changed menu Hillshade (Overlay/Underlay) to Terrain (Overlay/Underlay) in Map menu where you can set slopes and hillshades for your map. Now you can choose transparency and zoom levels for your terrain layer. Switch on the Contour line plugin at first, you can read more about the Contour lines plugin here. Remember that you can download slope and hillshade maps for your region.

    (Image not available offline)

    Update UI for Contour lines

    The Contour lines menu was also modified. Now it’s more convenient to adjust the contour lines on your map. You can read more about the Contour lines plugin here. Note that you can download Contour lines for your region.

    (Image not available offline)(Image not available offline)

    Update UI for Overlay/Underlay screens

    We changed the UI of Overlay/Underlay screens (Map-> Overlay/Underlay).

    (Image not available offline)(Image not available offline)(Image not available offline)

    Update Map markers

    We added options to show lines and direction arrows to active markers, now you can switch between topbar or a widget. Read more about Map markers here.

    (Image not available offline)(Image not available offline)

    Update Favorites menu

    Now you can minimize Favorites groups in My places menu.

    (Image not available offline)(Image not available offline)

    And remember that only together we can achieve the best results!

    New features are coming SOON!

    ____________________________

    OsmAnd at Facebook, Twitter, and Reddit!

    Join us at our groups of Telegram (EN), (IT), (FR), (DE), (RU), (UA).

    Get it on App Store

    May 26, 2020 18:00

    Purism

    Librem 5 April 2020 Software Development Update

    This is another incarnation of the software development progress for the Librem 5. This time for April 2020 (weeks 14-18). Some items are covered in more detail in separate blog posts at https://puri.sm/news. The idea of this summaries is so you can have a closer look at the coding and design side of things. It also shows how much we’re standing on the shoulders of giants reusing existing software and how contributions are flowing back and forth. So these reports are usually rather link heavy pointing to individual merge requests on https://source.puri.sm/ or to the upstream side (like e.g. GNOME’s gitlab.)

    Short and instant messaging

    Chats (aka Chatty) handles SMS and instant messaging via XMPP. It has experimental support for various other formats via libpurple.

    • Arnaudd Ferraris fixed a bug where new SMS wasn’t shown: chatty!331
    • Internal refactoring by Sadiq continued
      • Add chat-view: chatty!310
      • Muc-info-dialog: Move invite code from chatty-conversation: chatty!312
      • Conversation: Simplify getting colors: chatty!313
      • Muc-info-dialog: Use ListBox to list users: chatty!314
      • Window: Simplify creating new chat dialog: chatty!315
      • Drop some unused code and functions: chatty!316
      • Add message-row and use it: chatty!317
      • Remove libfolks and libgee dependency: chatty!318
      • Avatar: Fix typo in property name: chatty!319
      • Add chatty message and use it: chatty!326
      • Move some error dialogs to the application class: chatty!327
      • Move more purple code to manager: chatty!328
      • Manager: Fix a (so far dysfunctional) check: chatty!329
      • Info-dialogs: Use chatty-chat to populate data: chatty!330

    Lurch plugin

    The lurch plugin is responsible for OMEMO encryption within libpurple:






    Phone Calls

    Calls (the app handling phone calls) can now be translated via the GNOME infrastructure thanks to Claude Paroz: calls!110. This prompted a Persian translation by Danial Behzadi.

    Compositor and Shell

    This section highlights progress in Librem 5’s GTK based graphical shell name phosh and its wlroots based compositor phoc:

    Phosh

    • Thanks to Claude Paroz Phosh’s translations moved to the GNOME infrastructure: phosh!487
    • Use a symbolic icon for the PolicyKit authentication prompt: phosh!485
    • There’s a patch that enables the shell to provide haptic feedback on top/home bar presses, app launch, and window close: phosh!423
    • Cleanup the compositor configuration file name to not cause confusion: phosh!491
    • Avoid excessive g_strdup() usage and plug leak on WiFi signal strength changes: phosh!489
    • Arnaud Ferraris fixed some typos in the source code that showed up when preparing the Debian upload: phosh!492
    • Rafael Fontenelle fixed the DOAP file’s repository URL: phosh!495
    • phosh: Update i18n files and add a check so that we don’t forget to add new files including translations to the i18n infrastructure: phosh!497
    • Allow to skip build and test in CI and only produce Debian packages. This can save some time when one only needs a package to install: phosh!498
    • Thanks to Zander Brown, phosh now has a notification list persisting unseen notifications: phosh!463
    • Thanks to Arnaud Ferraris phosh’s systemd unit dropped the hard-coded user name and directory making it more portable: phosh!493
    • Arnaud Ferraris fixed the long date format when using a French locale: phosh!501
    • Danial Behzadi contributed a Persian translation: phosh!499
    • Rafael Fontenelle updated the Brazilian Portuguese translation: phosh!496

    Phoc

    • Phoc now has a small testlib to ease adding automatic tests. This (among other things) allows to take and compare output content to saved screenshots: phoc!143 This also adds test to exercise some of the layer-shell related code.
    • Triggered by a compile warning that showed up when working on the above we fixed an issue in upstream Wayland so client and server headers can be included at the same time: https://gitlab.freedesktop.org/wayland/wayland/-/merge_requests/77
    • We now provide add test coverage information: phoc!144
    • Based on work by Arnaud Ferraris update the copyright information phoc!146 in preparation for an upload to Debian.

    Debian Packaging / Upload

    Arnaud Ferraris reworked phosh’s, phoc’s, and feedbackd’s packaging to make it suitable for inclusion in Debian. This complements wlroots and libhandy giving a more complete mobile stack in upstream Debian.

    Gnome Control Center (Settings) / GNOME Settings daemon

    • There’s a merge request for editing wired connections re-enabling more parts that were previously disabled because they weren’t adaptive.
    • Sadiq submitted a patch to upstream GNOME Settings that allows to show a QR code when enabling hot spot mode so it becomes easy for other devices to connect.

    System-Level integration

    feedbackd

    Feedbackd is responsible for haptic, audio (and later) LED based feedback:

    • Allow to set feedback level per application: feedbackd!12 This allows e.g. the shell and on screen keyboard to use only haptic feedback
    • We backported some packaging improvements from Debian: feedbackd!13

    Linux Kernel

    The process of upstreaming our Linux kernel work progress is covered in a separate report. The current one is for Linux 5.5 and 5.6 so this is about downstream improvements:

    • Linux 5.6 is now the default kernel version for Librem 5 and devkit based on this tree It is also getting point release (and hence security) updates on a regular basis:

    • In order to keep up with kernel development 5.7 based release candidate kernels are also available. These follow closely the release candidates tagged by Linus and are and installable on the phone as linux-image-5.7.0-1-librem5.

    • Improvements based on upstream devfreq support for clocking down the DRAM makes it possible to use the powersave governor instead of handling that in userspace.

    • Work continued in mainlining the needed parts of the display stack. We put out v11 of the NWL mipi host controller driver and tested Laurent’s mxsfb rework that will give us alpha planes

    • It’s now possible to read the (built-in) firmware version of the touch controller: linux-next!97

    • Martin did some initial cleanups for the phone device tree working towards a state that can be submitted for upstream inclusion: linux-next!125

    • NXP currently uses a downstream for of the arm trusted firmware to implement clocking down DRM but it would be good if the kernel would at least boot without that).

    Librem 5 base packages

    • Make it harder for apt to remove important packages: librem5-base#28

    • Releases

      • [librem5-devkit-tools 0.0.10](librem5-devkit-tools!146 including above mentioned devfreq changes but also additions to the automatic tests. We could also drop the *no_supertile= workaround for etnaviv by fixing this properly in the compositor.
      • librem5-base 17 Pulled in udisks2 (so GNOME Settings can display storage details) and gthd (so GNOME Usage can show thermal information).

    Lambda

    If you made it down here and want to start contributing join us on matrix. We certainly welcome patches and issue comments on https://source.puri.sm/. If you want to grab an issue and can’t think of a particular problem, check the easy and helpwanted tags in our gitlab instance. See you next month.

    The post Librem 5 April 2020 Software Development Update appeared first on Purism.

    by Guido Günther at May 26, 2020 10:38

    Tutanota

    Kids need encryption in today's internet.

    Parents that use the internet act like small children when playing 'Hide and Seek': Toddlers just cover their eyes when hiding, thinking if they can't see themselves, no one else can see them either. That's how parents handle their kids' data: When they store events and pictures on online servers, they keep telling themselves that only they can access the data. It is, after all, protected with a password.

    May 26, 2020 00:00

    May 23, 2020

    OsmAnd

    OsmAnd 3.7

    OsmAnd 3.7

    May 23, 2020

    Great news for Android users!

    We're happy to announce the new 3.7 OsmAnd release for Android devices.

    Update your OsmAnd, the new version has become even more convenient for your trips!

    (Image not available offline)
  • New offline slope maps
  • Full customization of Favorites and GPX Waypoints
  • Customize items order in Context Menu, Configure Map, Drawer
  • Wikipedia as separate layer in Configure map
  • Create your own POI filter / maps with total flexibility
  • Add options to restore settings for custom profiles
  • Full GPX routes from Navigation support traffic lanes and complete turn instructions
  • Custom Package
  • What else is in this release?
  • New offline slope maps, see slopes directly on the maps

    You can estimate slopes in your route. We changed menu Hillshades to Terrain in Configure map menu where you can set slopes and hillshades for your map. Now you can choose transparency and zoom levels for your terrain layer. Switch on the Contour line plugin at first, you can read more about the Contour lines plugin here. Remember that you can download slopes and hillshade maps for your region.

    (Image not available offline)

    Full customization of Favorites and GPX Waypoints - custom colors, icons, shapes

    You can customize Favorites and GPX Waypoints. When you edit or create a new point you can choose colors, icons, and shapes for it. Now your points will be more interesting on the map. Read more about favorites here.

    (Image not available offline)(Image not available offline)

    Customize items order in Context Menu, Configure Map, Drawer

    In the new OsmAnd update you can customize quantity and order of items in Drawer, configure map and context menu. Go to general menu (Drawer)-> Configure profile(Choose profile)-> UI Customization.

    (Image not available offline)

    You can copy settings of UI Customization from another profile or reset to default. Of course, you can hide items and change their order.

    (Image not available offline)

    Wikipedia as separate layer in Configure map, select only needed languages

    During travel, you need to know about interesting places near you. Now you can set viewing Wikipedia articles on the map with needed languages in a special menu. For this go to Configure map-> Wikipedia, choose the required languages for articles. After that, POI of Wikipedia will appear on the map. Read more about Wikipedia articles in OsmAnd here.

    (Image not available offline)(Image not available offline)(Image not available offline)(Image not available offline)

    Create your own POI filter / maps with total flexibility

    You can create your custom search of POI, and show its on the map. To do it, go to Search menu-> Categories-> Custom Search. After that, choose the necessary categories, select your items and click Show. For viewing POI on the map you can click to Show custom filter on the map. Now you can see your custom search of POI on the map.

    (Image not available offline)(Image not available offline)(Image not available offline)(Image not available offline)

    When you use your own Custom Search, you can add more details of searching. For this, click the Filters button and choose additional settings for your searching. You can save your Custom search by clicking to Save button on the screen. Now you can find the required POI by clicking to own category in the searching list.

    (Image not available offline)(Image not available offline)(Image not available offline)(Image not available offline)

    Add options to restore settings for custom profiles

    If you change the base profile settings you can reset them to default. To do this, go to the general menu-> Configure profile (choose the Base profile)-> Actions (Reset to default).

    Full GPX routes from Navigation support traffic lanes and complete turn instructions

    If you save navigation route as a GPX file or with a measure distance tool, this GPX file will keep all the information about traffic lanes and complete turn instructions.

    (Image not available offline)(Image not available offline)(Image not available offline)(Image not available offline)

    Custom Package

    Now, you can create your own plugin with custom settings and all your parameters for OsmAnd. It is not easy and soon we will add a tutorial to our website on how to do it.

    We think it will be very easy to send the necessary setting, maps, rendering files, navigation profiles, etc. to your friends and other OsmAnd users. You can create your own assembly for OsmAnd.

    (Image not available offline)(Image not available offline)

    What else is in this release?

    • Fix UI sizes on tablets

    • Fix bugs with RTL

    _________________________________________________

    OsmAnd at Facebook, Twitter, and Reddit!

    Join us at our groups of Telegram (EN), (IT), (FR), (DE), (RU).

    Get it on Google PlayGet it on AmazonGet it on App Store

    May 23, 2020 10:00

    May 21, 2020

    Purism

    Librem 5 Update: Fresh Dogwood Pictures

    As we mentioned in our Dogwood update post, we have been busy testing the significant changes that have gone into the Dogwood batch. In the previous post we just showed a few pictures of the board with some testing wires attached but we figured you’d like to see more. Now that we are about ready to wrap up testing we wanted to share some additional Dogwood pictures. Like with previous batches Dogwood is a small batch process. We’ll see mass-production processes with the next batch Evergreen.

    Dogwood with exposed back showing updated flash and camera location, cover for wifi and cellular modem, and updated battery.Dogwood with exposed back showing updated flash and camera location, cover for wifi and cellular modem, and updated battery.
    Dogwood with the new cover removed, showing the slots for the Wifi card, cellular modem, and battery.Dogwood with the new cover removed, showing the slots for the WiFi card, cellular modem, and battery.
    Dogwood back coverDogwood back cover
    New-to-Dogwood internal wifi and modem coverNew-to-Dogwood internal wifi and modem cover
    Dogwood with the full-length cover removedDogwood with the full-length cover removed and main PCB exposed
    Dogwood internal plastic frame to align the battery and M.2 cards. Includes M.2 hold down clips.Dogwood internal plastic frame to align the battery and M.2 cards. Includes M.2 hold down clips.
    Dogwood PCB with camera and coax alignment frame installedDogwood PCB with camera and coax alignment frame installed
    Dogwood frame with USB C PCB, screen, speakers and heat sink compound installedDogwood frame with USB C PCB, screen, speakers and heat sink compound installed

    We are really excited about all the progress we’ve made in Dogwood since our Chestnut batch. Stay tuned for more updates about specific improvements in Dogwood and if you are still haven’t ordered your Librem 5 now’s the time!

    The post Librem 5 Update: Fresh Dogwood Pictures appeared first on Purism.

    by Purism at May 21, 2020 08:02

    May 20, 2020

    Purism

    Anti-interdiction Update: Six Month Retrospective

    It was only six months ago that we formalized our anti-interdiction services so instead of being a “hidden menu item” that you had to ask about, it was available as a drop-down along with the PureBoot Bundle. While some vendors offer tamper evident tape to their boxes, to my knowledge we are the only hardware vendor to offer such a complete suite of custom anti-interdiction measures including:

    • Glitter nail polish on screws
    • Customized tamper-evident tape on a bag surrounding the laptop and its box
    • PureBoot Bundle (to detect firmware/OS tampering) with a custom PIN
    • Shipping the Librem Key and laptop separately (optionally to separate addresses) to further frustrate interdiction
    • Customized threat model coordinated over encrypted email
    • Sending pictures of the laptop measures we performed over encrypted email

    We’ve processed a lot of orders between now and then and I thought now would be a good time to look back on the last six months and talk about how the program has gone so far and what I’ve learned.

    A close-up of the unique pattern of blue glitter nail polish on the center screw.A close-up of the unique pattern of blue glitter nail polish on the center screw.

    Surprisingly Popular

    When we first announced formal anti-interdiction services I expected it to be a fringe upgrade that only a small number of people in high threat situations would pick (like me actually, we tested an early version of the anti-interdiction procedure before the days of PureBoot and before I worked at Purism with my personal Librem 13v1 order). I have been surprised by just how many people from all walks of life have upgraded to our anti-interdiction services. While some people are definitely picking it because they are in a high threat situation, others just want the peace of mind that comes with knowing their laptop won’t be tampered with in transit without their knowing about it. We’ve also seen orders from Enterprise customers who are considering adding this service to all their future orders.

    Glitter is Gold

    The glitter nail polish measure is also very popular and just about every anti-interdiction order opts for glitter nail polish on either the center screw or all screws of the laptop. We offer a range of colors customers can choose from and our customers have selected just about every option at this point, with silver and blue the most popular (although orange is my personal favorite–it looks great against the black finish).

    Anti-interdiction glitter nail polish on all screwsAnti-interdiction glitter nail polish on all screws

    Diverse Threat Models

    One of the other things that surprised me (but maybe shouldn’t have) was the diverse set of threat models I saw from anti-interdiction customers. For each anti-interdiction order, we work with the customer to figure out their threats and build a simple threat model that we address with the custom anti-interdiction steps we pick. At first I expected most of the anti-interdiction customers would be the ultra-paranoid who are already familiar with encrypted email. So far I’ve seen a wide range of threats from very low (the customer is just curious about the procedure and wants peace of mind) to very high (the customer has already experienced interdiction in the past by a strong adversary).

    The custom nature of this process means we can adapt the measures to the threat and as you might expect the average case has fit somewhere between the two extremes. For instance, communicating over encrypted email isn’t strictly required depending on your threat. In the case the customer doesn’t have the means or expertise to set up encrypted email, we adapt how we communicate so that it’s still reasonably secure even without encryption. In that case we only disclose sensitive information (such as pictures or a custom PIN we’ve generated for the customer) after they have received the hardware. On the other hand the average customer tends to have some familiarity with email encryption and often already has a key set up, but doesn’t necessarily have a specific threat in mind.

    Process Keeps Getting Faster

    Adding anti-interdiction measures to our laptops is rather labor-intensive between all of the email back-and-forth and all of the extra steps we perform. We have tried to set a price that captures all of that extra, custom labor and when we processed some of the first orders I did question whether we charged enough. The first few orders took a lot of extra effort and time and as a result the first anti-interdiction customers often had to wait an extra few weeks to get their order depending on how fast they responded to emails.

    As time has gone on patterns have emerged and the whole process has become more streamlined and faster so that now, adding anti-interdiction adds only a small delay. Most of the delay simply comes from the fact that most customers choose to wait to ship their laptop until they have confirmed they have received the Librem Key.

    What’s Next

    Six months on I would have to say that the anti-interdiction service has been a success. We have processed far more orders than I initially thought and for a very diverse range of customers. Now that the process has become more streamlined we should be able to complete future anti-interdiction orders even more quickly and are looking for other ways we can make it even faster. We have also expanded anti-interdiction services beyond laptops and adapted it to Librem Server, Librem Mini, Librem 5 and Librem 5 USA. If you want to find out more about our anti-interdiction services, check out this blog post.

    The post Anti-interdiction Update: Six Month Retrospective appeared first on Purism.

    by Kyle Rankin at May 20, 2020 19:33

    /e/ foundation

    Leaving Apple & Google: New Apps Installer is available, /e/-Fairphone 3 in stock and shipping

    Leaving Apple & Google: New Apps installer is available, /e/-Fairphone 3 in stock & shipping

    /e/OS Apps Installer V2, with XAPK support and Progressive Web Apps – is available!

    The new Apps Installer V2 is now available in /e/OS!
    It features better Android application support and now handles the XAPK file format.

    What does this mean for you? More recent Android applications, available faster.
    Furthermore, you will also be able to choose what type of apps you want to display: all of them or only Open Source!

    Early support for Progressive Web Apps has also been added, with an initial selection of PWAs. At first, PWAs will open in the web browser but we will soon add full integration in the home screen so that they fully behave like regular applications.

    Want to use it? Update your /e/OS to the latest available build!

    Go to Settings > About > System Update on Nougat and Oreo, and Settings > System > Advanced > Updater in Pie.

    /e/OS and Fairphone 3: in stock, now shipping!

    /e/ Fairphone 3 is a unique combination that offers a new and fairer approach to resources and personal data for all.
    Order your brand-new /e/ Fairphone 3 today.

    If you already own a Fairphone 3, you can download /e/OS for your phone at no cost like for any other supported smartphone.

    How to contribute and support the /e/ project?

    We are often asked how to contribute to the /e/ project and we are pleased to answer this question because users’ contributions are key to the success of an ambitious project like ours.

    The time is now! There has never been so many questions and comments about user’s data privacy, Google, Apple and alternatives to regain control over data privacy… The timing is great and you can contribute in many ways:

    Test /e/OS, report bugs, contribute to patches!

    Anyone is really welcome to report issues with /e/OS, and possible solutions. Just make sure you can reproduce the problem, post appropriate context information, possibly some “logs”, and ideally… a solution 🙂

    Help others! Join the global community!

    We have a growing community of users who are discussing their experience with /e/OS. Join now, you will be able to help others answer common or uncommon questions they have about /e/:

    Join /e/ Community Forum
    Join the Support Channel

    Join discussions, spread the word!

    It’s important to share your experience on our forums, tell us about what you like, your frustrations… It helps us to identify improvements for the product and make it a premium mobile ecosystem.

    Also, please share the word! Every day, new users discover /e/ and love the project. We need everyone to ensure that as many people as possible learn about the project. We can’t count on mainstream media for this!

    So share with friends and your community channels, talk about /e/ on social media, say why you like it!
    You can also share what we post on Mastodon and Twitter

    Contribute financially

    With your help, we can support a growing team of passionate contributors, keep /e/ completely independent and make /e/OS sustainable over time.

    Every donation helps the project to pursue additional development, rent servers for compilation and to host your e.email account or the community forum, pay for domain names and other key expenses amongst other things.

    If you can afford a recurring donation, become a /e/ Patron!

    Otherwise, choose from the different donations options, and get a reward in return!

    Subscribe to our Telegram announcement channel to get latest news!

    Follow us on Twitter and Mastodon: @e_mydata

    by Brittny Mendoza at May 20, 2020 16:23

    Tutanota

    L3S of Leibniz University and Tutanota launch research project to secure emails against quantum computer attacks.

    We are happy to announce that we are working together with the L3S Research Institute of the Leibniz University of Hanover on PQmail - a research project with the goal to implement quantum computer resistant cryptography available for everyone in Tutanota.

    May 20, 2020 00:00

    Guardian Project

    On the classification of tracking

    This position paper tries to outline a framework for defining trackers in smart phones and lists mechanisms for identifying them. It hopes to serve as the foundation for the work done in the Tracking-the-Trackers project.

    In section 1 we start with an abstract analysis of levels of unwanted behaviour in the context of tracking.

    Next, in section 2, we focus on an attacker’s perspective, on anonymity and pseudonymity. This foundation allows us to define terms which are needed throughout the paper.

    Finally, we list proposed mechanisms for identifying trackers - based on the threat model (attacker) as well as the level of acceptable tracking.

    Scope

    This document talks about trackers in general on mobile devices (smartphones). However, for the purpose of verification, we exclusively focus on Android apps. First of all, Android has a 85% global market share, secondly Android apps (APKs) are easier to work on. With iOS apps, monitoring trackers (or instrumenting running code) is not as easy as on Android based systems. Therefore, whenever any claims are made, we refer to the Android ecosystem. We however believe that very similar behaviours exist on iOS based systems.

    Also, this document does not talk about contact tracing (as in Covid-19 contact tracing).

    Section 1: Levels of unwanted behaviour

    The following section tries to categorize tracking respectively potential unwanted behaviour in apps by level of severity. This is done with a perspective for categories (labels) in a machine learning approach.

    Level 0: No tracking at all / no network communication

    The most harmless situation: an app is downloaded or shared in an anonymous way (Tor, etc.) and only uses offline features and/or uses unlinkable side channels for updates (for example flash cards). An example could be a map application which only displays a map and reads a phone’s GPS position to display the user’s location. There is no network communication at all and it still offers a useful service to its users. Map updates may be installed via flash cards or other physical transportation media. The app does not need to request a new map interactively from any server.

    Level 1: Inadvertent tracking

    This category includes tracking but the service provider and the app never intended to actually use the resulting data / meta-data for the purpose of tracking individuals.

    Example: to illustrate this category, recall our map app from above. Only this time, it does request map (base layer) updates from a map server every 7 days. It also checks every day, if the map viewer app is the latest version. Based on this information, an attack could theoretically derive weekly IP address “beacons” from some user. Since the update check was not personalized, an attack can not be for sure, if an update request is from the same person or not. Hence, a user still has potentially enough anonymity.

    This and the next category probably (to be verified) constitute the majority of “clean” apps.

    Level 2: Unintentional tracking by use of chatty libraries

    This category tracks users already quite heavily. The motive is not to increase ad revenue, build up user profiles to sell them nor to pass on the data to an aggregator. The unintentional tracking stems more from the fact that the app developer(s) used libraries which help them in developing the app and/or which are simply useful for the overall user experience.

    Example: if we revisit our map example, we could imagine that the map app now also includes a search functionality. Users can type in the initial letters of a street name and for every letter they type, an AJAX HTTP request is sent to the map server. In addition, the developers felt that it would be useful to receive APM (application performance monitoring) logs as well as crash reports as well as a set of libraries to measure which features of an app the users actually use the most. These logs are sent periodically to some log collection server run by the developers.

    Note that we still do not talk about (Google, Facebook etc) cookies here. We only talk about watching what users are typing (including backspace and corrections - an attacker can literally watch their thoughts via the global click-stream).

    Level 3: Ad-revenue focused tracking of users and/or user behaviour (pseudonymized)

    With this category, we are entering the area often described as surveillance capitalism: users are receiving cookies (if it’s a web based app) and or have unique IDs embedded in the app and these unique identifies (which are not tied to a person in the first place and hence are a ‘nym of the user) are being sent for nearly every network interaction. These IDs may (but not necessarily have to ) serve as authentication / authorization token ( see OAUTH 1,2, OpenID Connect) or may be purely auto-generated and simply serve for tracking actions users takes over the course of his day (so that the interest of a user may be extracted). These tracking IDs may then be forwarded and sold to aggregators.

    While this may be acceptable to some users, since the techniques use pseudonymization, there is an implicit trap hidden in this approach: unique IDs are usually long enough so that they are unique globally (for example UUID strings). Thus, they can easily be correlated with real PII data and the pseudonymization vanishes instantly.

    Level 4: Ad-revenue focused tracking of users and/or user behaviour (linked to person)

    This category fits most non-open source commercial apps such as FB messenger, twitter, etc. (but it can occur as well in open source apps). The business model is to fully understand a user, his/her interests, his/her behaviour, location (-> location tracking), and very important - his/her circle of friends (contacts), etc. The “gold” in the app gold rush is a users’ interest and intent. In order to serve him/her adds better and faster (in the sub-millisecond range). Again, as in the previous category, these tracking IDs may then be forwarded and sold to aggregators.

    We assume the vast majority of apps fall into this category.

    Level 5: Full scale stealthy tracking (surveilling the spouse, kids, state actors, APT attacks, general surveillance, etc.)

    This category would fit any technique which tries to secretly monitor as many actions on the whole smartphone (or potentially also via the smart phone on computers) of a person.

    Example: kids tracking apps. Or hidden apps which check what your husband/wife is doing on his/her phone (and forwarding call logs , messages, etc.). State actors tracking dissidents, journalists or any chosen target also would use these techniques.

    Often these apps can be identified by their extended permissions but not necessarily so. Well written apps in this category may be impossible to detect without major reverse engineering efforts.

    Conclusions

    Our work in the Tracking the Trackers project limits itself to Levels 3 and 4. We intentionally omit level 5, since this is a cat-and-mouse game with the attackers. It is rather trivial to change some behaviour for an attacker while our detection mechanism remains open source.

    Section 2: an attacker’s perspective and a taxonomy

    “There is nothing as practical as a good theory” – Kurt Lewin

    This section builds upon the work of Pfitzmann and Hansen1 who did (to the author’s knowledge) the first thorough comparison of terminology in literature with respect to the concepts of anonymity, linkability, pseudonymity, etc. We believe that their work is a good framework for thought. It also hints at some connections to Shannon’s information theory and probability. However, the paper does not follow through on the maths.

    The core insight of their work is that - if you include metadata of communication flows over the internet, and if you assume an attacker which can observe the whole network (passively)2, then true anonymity is nearly impossible to achieve for any regular app or program.

    In this paper, we first briefly describe Pfitzmann’s and Hansens’ model and especially their attacker’s model / threat model. We then replicate their definitions and add some definitions of our own. The next step is to link their definitions to our categories of tracking.

    Equipped with these theoretical tools, we can proceed to define what we consider tracking in Android apps and derive feature sets for an ML based approach.

    The Pfitzmann-Hansen threat model

    The threat model assumes a classical sender-receiver (source/sink) information model where the communication network is usually the internet. They assume an attacker to be yet another (possibly all-knowing) passive receiver. If messages pass the communication network, attributes (i.e. meta-data3 such as time + time zone when a message was sent, received, the packet size, the protocols used etc) may be derived by a receiver. These attributes may become another new message.

    sender-receiver-model

    If we apply Pfitzmann’s and Hansens’ model to our levels, we arrive at the following insights:

    • Level 0: the app is quiet → no harm, an all-knowing attacker can see the download of a level 0 app in the very best of cases.
    • Level 1: the passive attack may derive IP addresses (and hence some ideas of a user’s location) and time stamps of when the app was in use. → the passive attacker can already track the user to some extent iff (if and only if) he also has access to the telecom’s IP address assignment database for that particular time window. This is usually only possible for nation state attackers. out of scope.
    • Level 2: In this scenario, it already depends a lot if the app is sending APMs, crash reports, or other “chatty library” messages. If unencrypted, a passive attacker may - already in this category gain a lot of information on the user. we propose to include detection of APMs/crash reporting libraries in future versions of the tracking the trackers project.
    • Level 3: While it is nice to notice that the developers tried to pseudonymise tracking in this category, it does not help the user very much. As long as a passive attacker may detect the pseudonymized IDs in messages flowing to a central server, he wins. He can track the user. Countermeasure: a guaranteed rotation of these unique IDs/tokens every x seconds (at fixed intervals). → we propose to look at this level of tracking in our research in order to identify unique tokens/API keys, unique IDs in apps which are easily detectable in order to guide the F-Droid store developer on how to avoid common pitfalls associated with fixed IDs/API keys etc.
    • Level 4: for an attacker, this is the gold mine. Here, nearly every action may be passively observed. This is the case, we assume to be the most prevalent one in most apps (proof: just take a random app and look at the tcpdump stream of data it sends every second). We will aim to detect the most common tracking libraries.
    • Level 5: here the attacker basically gains an upgrade from a passive attacker to an active attacker should he wish so. Game over for the user → out of scope for our research.

    Summary

    We identified a rough categorization of 5 levels of tracking. We reasoned what information an attacker may gain at each level and we defined the scope of our research.



    1. “Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management – A Consolidated Proposal for Terminology”, 2008, Andreas Pfitzmann (TU Dresden), Marit Hansen (ULD Kiel). http://dud.inf.tu-dresden.de/literatur/Anon_Terminology_v0.31.pdf [return]
    2. An assumption which is not far fetched - see the Snowden papers. [return]
    3. Compare with the quote “we kill people based on metadata” by the former CIA/NSA director Hayden. https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata [return]

    May 20, 2020 00:00

    May 19, 2020

    Fairphone

    We need to talk about smartphone innovation

    Dear smartphone industry, I think it’s about time we have an honest discussion about one of the guiding principles of this business. Let’s talk about “innovation”.

    Now that the world has slowed down, I have found some time to ponder the questions surrounding this buzzword. And to be honest, we’re even getting these initial questions wrong. Should it really be about how we are innovating and which project is the newest disruptor, or should we start asking why we’re pursuing these things and on what level?

    Over the past few years, we’ve been experiencing “innovation” in its literal, material form, while the drumbeat of reveals and releases steadily became more frantic.

    The rapid succession of these innovations has led us to the point where the next big thing is always just around the corner, yet rarely ever amazes. The race for bezel-less screens, in-display fingerprint readers and the rear-camera count is in full swing. Don’t get me wrong. I see the appeal in a lot of these hardware upgrades – But is the functional improvement between flagships big enough to justify treating smartphones as a disposable commodity?

    Let’s take the term “innovation” and expand it from the 100-megapixel range to a broader company level. While stuck at home, I’ve been getting into gardening, so forgive my vegetable reference, but imagine a company as an onion. The outermost layer or surface level would be communications — how brands express themselves. Peel it back one layer, and you see marketing — of the services, promotions, pricing, and products made by the business. Beyond that lies the core, upon which everything else is built – the business values, culture, processes, and systems. Let’s stop thinking of innovation as a surface level commitment. For all companies, innovation needs to be more profound; Not token gestures on the outer layer, but a fundamental rewiring of business from the core.

    Bas van Abel shares Fairphone’s origin story at TED x Amsterdam.

    Fairphone wants to challenge the dominant story about what’s right, what’s normal, and what’s possible. By demonstrating solutions, calling upon the industry to embrace those solutions, and giving consumers a choice, Fairphone seeks to transform first itself, then the electronics industry, and ultimately the entire consumer economy.

    We are staffed, funded and supported by people who believe that a just and circular economy is not only possible; it’s essential.

    And it’s being built today. Not a moment too soon because technology will create vast and profound shifts. The mobile-first world has yet to really arrive. The problem is that building a new smartphone, specifically mining the rare materials inside them–represents 85% to 95% of the device’s total CO2 emissions for two years. That means buying one new phone takes as much energy as recharging and operating a smartphone for an entire decade. But the trend behind the scenes of this industry seems counter-intuitive: The more smartphones have become similar, the more we are told that they are different — and this is still working for tech giants. Tech-sites are rigorously comparing and ranking data on differences, for which you need specialized to be an expert to describe to what extent the effects it produces are exactly ‘different.’

    We are being directed to pay attention to incremental changes while the use-value of smartphones is very similar. A lot of what is sold as a material benefit is just psychological. Or put differently, tech-specs are not the guiding factor you’d want them to be. Rather than obsessing about the minor details that still distinguish smartphones, it would be more honest to say that most smartphones are now identical. Grand product releases try to hide the elephant in the room: there is almost no innovation taking place at the technological level. The smartphone in 2020 is pretty much the same as it was in 2019. That’s a good thing. It means, if you have a working smartphone, you’re fine ignoring all the talk about innovation for a while and holding on to it.

    That’s right; the most sustainable phone is the one you already own.
    Want to make yours last as long as possible? Here’s how >>

    The post We need to talk about smartphone innovation appeared first on Fairphone.

    by Jan at May 19, 2020 16:18

    Purism

    Purism and Linux 5.7

    Following up on our report for Linux 5.5 and 5.6 this summarizes the progress on mainline support for the Librem5 phone and its development kit during the 5.7 development cycle. Our contributions improved support for the hardware found on our Devkit as well as phone components like the accelerometer and GPU.

    Devkit updates

    We have greatly improved support for the Librem 5 Devkit by describing more hardware components that will work with mainline Linux right now. Along with fixing the Wifi hardware killswitch and smaller improvements, the proximity sensor and audio codecs have been added:

    IMU sensor

    The following small addition concludes the work on supporting the accelerometer on the devkit and adds the correct mount matrix that describes how it is oriented on the board.

    Vivante GPU

    The GC7000 GPU on the imx8mq often failed to enter power saving mode when idle. This was fixed with the help of Lucas Stach with the following series:

    This improves the power consumption of the Librem 5 considerably when in active use.

    Misc fixes

    We enabled runtime power management for the Librem5’s light and proximity sensors

    Mainline redpine wifi driver saw a minor bug fix

    Sources

    Have a look at our Linux tree to see what is currently being worked on and tested (or help if you feel like joining the fun :). For the upcoming release we’ll be able to operate the full display stack on the Librem 5 Devkit with mainline Linux, and possibly have a basic device tree description for the phone, so stay tuned.

    The post Purism and Linux 5.7 appeared first on Purism.

    by Martin Kepplinger at May 19, 2020 08:25

    Tutanota

    Privacy win: Surveillance of German BND is unconstitutional.

    Since the Snowden leaks in 2013 everybody knows that secret services around the world are monitoring online traffic. The German BND is no different. However, in Germany privacy rights are strictly protected by the German constitution. Now, the Federal Constitutional Court has ruled that the surveillance by the BND is unconstitutional and must change. A win for privacy - and another reminder that only end-to-end encryption can protect our data.

    May 19, 2020 00:00

    May 18, 2020

    Tutanota

    Why we need quantum-resistant cryptography now.

    The Internet as we know it depends on encryption: confidential communication, financial transactions, critical infrastructure - all of these are at risk if encryption can be broken. Today all sorts of players heavily invest in developing quantum computers - for manifold reasons. These computers promise to bring great advantages and speeds to information technology. But, in particular, they are developed for unprecedented surveillance machines. The race is on between quantum computers and quantum-resistant cryptography.

    May 18, 2020 00:00

    May 15, 2020

    Privacy Browser

    New WordPress 2020 Theme

    The theme for the website has been updated from WordPress Twenty Nineteen to Twenty Twenty. Overall I like the effect. The only downside I have seen so far is that the menu doesn’t work if JavaScript is disabled. Someday, if I have some free time, I might contribute to the WordPress project to fix that.

    by Soren Stoutner at May 15, 2020 17:32

    Pine 64

    May Update: PineTab pre-orders, PinePhone Qi charging & more!

    With the PinePhone and Pinebook Pro production well under way and shipping in just a few days time, we’ll now be turning our attention to the other projects we have in the pipeline. There is a fair bit of material to cover this month – the main piece of news, however, is that we’ll be taking pre-orders for the PineTab at the end of this month! This may be the longest blog entry in some time...

    Source

    by Lukasz Erecinski at May 15, 2020 12:30

    May 14, 2020

    Purism

    Your Own Personal Enclave: The Smart Card Reader on the Librem 5

    There are many unique features in the Librem 5 that make it stand out when compared to other smartphones. The easily-accessible hardware kill switches with lockdown mode, removable WiFi and cellular modules, and the fact it uses the same PureOS operating system as our laptops get the most attention. These are great examples of how Purism approaches innovation differently from most tech companies. We favor open standards and build solutions that put the user in control, not us. While that’s often meant we’ve had to avoid proprietary off-the-shelf solutions and do things ourselves, in other cases it’s meant using existing tried-and-true open technologies like OpenPGP smart card readers in a new way–as a secure enclave fully in the user’s control.

    We recently got the smart card reader functioning on our Librem 5 Dogwood batch and I realized we haven’t talked much yet about the smart card reader. In this post I will discuss why we decided to add an OpenPGP smart card reader to our phones and how we intend to use it.

    What’s Smart About Smart Cards?

    Smart cards are ubiquitous technology. You can find them in everything from modern credit cards to USB security tokens like our Librem Key. The idea behind smart cards is to have a discrete and tamper-resistant chip that can store secrets securely and perform a set of cryptographic operations using those secrets without having to expose the secrets outside of the smart card. Data goes in, the smart card uses its secrets to manipulate that data, and modified data goes out.

    In the case of an OpenPGP smart card, the secrets you store are private GPG subkeys like you might use to encrypt or decrypt email or files, or sign code you are contributing to. While you can store GPG keys on your local hard drive (and many people do), storing them on an OpenPGP smart card (such as on a USB security token like the Librem Key) adds a few extra layers of security.

    The first layer of security a smart card adds is by preventing keys from being copied. Once a private key is copied onto a smart card, it can never be copied back out. If an attacker were to compromise your computer, they could make copies of your GPG private keys in your ~/.gnupg directory on their own computer and attempt to brute force the password. If they were able to guess the password you used to secure those keys, they could use the keys to sign and decrypt things on your behalf on their own computer. Yet if those keys were on a smart card and the smart card were inserted the most they could do is sign and encrypt/decrypt things on your behalf while they had access to the computer–and only if they could guess your PIN. They couldn’t make copies of the key and use it elsewhere and the moment you removed your key from the computer they would no longer have access.

    The second layer of security a smart card adds is that it performs cryptographic operations with your keys on the smart card itself. Your private keys are never copied into system RAM even temporarily.

    Finally, a smart card becomes an authentication factor referred to as “something you have” like a physical key or an identification card (a password is “something you know”). The portable nature of smart cards means that you can keep them with you at all times and since they can only be in one place at a time, they can prove that the user has possession of authentic secrets.

    Why Put a Smart Card In a Smart Phone?

    While desktop and laptop computers sometimes have smart card readers, and there are a number of specialized handheld devices used for point of sale and other functions that contain smart card readers, to our knowledge the Librem 5 is the only smartphone to have one. We recognized the value of smart cards for storing secrets securely when we developed our Librem Key for use with our laptops. Since a person’s phone arguably stores even more sensitive information than their computer, we felt it was important that it have some way to protect that information with strong secrets on a tamper-resistant chip.

    Dogwood PCB CPU side downDogwood PCB CPU side down. The smart card reader is on the bottom left side of the main board next to the red wire.

    Smart Card or Secure Enclave?

    Phones need a way to protect against attackers who might root the device and extract cryptographic secrets from RAM and many phones today that solve that problem with a discrete chip known as a secure enclave. The chip behaves in many ways like a smart card in that it stores secrets and has a set of cryptographic operations it can perform but these chips are permanently soldered onto the PCB.

    Along with any user secrets secure enclaves also tend to store certificates provided by the vendor. This is because in addition to handling your secrets securely, they also enforce the vendor’s secure boot and software verification system. By storing these certificates in the secure enclave they can make sure that you only run authorized firmware, software, and even can only attach authorized 3rd party hardware to the device. The reason you see secure enclave chips on modern smartphones has more to do with enforcing vendor control over the hardware and software and less to do with protecting your own secrets.

    When we set about to solve the problem of secret storage on the Librem 5, we decided against a permanent secure enclave chip in favor of a smart card reader for a few reasons:

    • While there are exceptions, many secure enclave implementations are closed hardware that run proprietary firmware.
    • We believe users should own their own hardware so we weren’t interested in technology that risked removing control from the user.
    • Smart card readers are well-understood, ubiquitous and open technology with free software implementations.
    • Smart cards are removable and replaceable by the owner at any time and are relatively inexpensive to replace.

    So you can think of a removable smart card like your own personal secure enclave fully under your control.

    Librem 5 Smart Card Use Cases

    Having an integrated smart card reader in the Librem 5 opens up all sorts of possibilities. Here are a few of the use cases we are already working toward with the Librem 5.

    Secure GPG Key Storage

    The obvious first use case for a smart card is to provide the owner a secure place to store their GPG keys. While you can already do this with some other smart cards it requires you to store keys on a separate USB security token with Near Field Communication (NFC) capabilities. On other smart phones whenever you want to perform GPG operations you have to take out your security token and hold it up to the phone. While that is a secure workflow, it’s also somewhat inconvenient–especially if you use GPG frequently. Our approach combines the convenience of storing your GPG keys on the local file system with the security of storing them on a smart card.

    Simple Disk Unlocking

    We intend for the Librem 5 to feature disk encryption for the root disk and at the moment all of the standard tools are there like you would have on any Linux computer. The one missing bit left to be developed is software we can fit inside the initrd file to allow the owner to enter their disk unlock passphrase on the touchscreen since unlike a normal Linux computer the Librem 5 doesn’t have a physical keyboard.

    On our laptops we already have mechanisms within PureOS that allow you to unlock your disk with GPG keys on a Librem Key. Once configured, you get prompted for your GPG PIN at boot and the smart card decrypts a GPG-encrypted file that contains the LUKS disk unlock secret. After we complete the software to allow passphrase entry on the Librem 5 touchscreen at boot, it will be simple to add the ability to unlock with your GPG keys instead.

    Secure Authentication

    GPG provides three different classes of subkey you can store on a smart card. The first type of key is for encryption, the second is for signing and the third is for authentication. The authentication subkey is often not created and isn’t in wide use, but it’s something you can use for secure authentication for services such as SSH and there are already plugins in place to allow this kind of functionality. This would mean you could store SSH authentication secrets safely on your smart card and SSH from your Librem 5 to remote machines without risking that your SSH private key might be copied and reused by an attacker.

    General-Purpose Secret Protection

    We can also take advantage of the smart card to provide a general method to protect other secrets on the device by encrypting them with your GPG keys stored on the smart card. You might use this not only to encrypt local files or entire removable SD cards, but you could also use it to protect a local password vault or other sensitive files.

    Recoverable Secrets

    Given so much can depend on the secrets stored on a smart card, it’s important that you be able to backup and restore it in case a smart card chip fails or is lost. Because the smart card is removable and it uses standard GPG keys, you can use the same standard methods to backup and restore GPG private keys like you would with a laptop and a Librem Key. If a secure enclave chip fails you are out of luck, but because the smart card is not only removable, it is relatively inexpensive, you can easily create a backup smart card when you first set your keys up and store it in a safe place along with a thumb drive that contains your full set of private keys.

    User Personas

    The workflow I’m most excited about with smart cards on the Librem 5 is the idea of user personas. You can configure the Librem 5 so that all of the things that make up a person’s unique identity on the Librem 5 are removable: the cellular modem (IMEI), the cellular SIM card (IMSI), the WiFi card (MAC address), the microSD card (personal files and settings), and the smart card (user secrets).

    A common problem people have with their smartphone is how to handle their sensitive data when they travel. When you travel you are not only more likely to lose your phone or have it be stolen, you also risk a customs official searching through or even copying your data as you cross a border. While some people have come up with elaborate steganography or safe word approaches to attempt to smuggle data across borders, the most secure approach is one where you travel only with data you can afford to lose such that you can fully comply with any customs agent requests. This is where user personas come in.

    If you think of a user persona like a traditional user on a Linux system you can imagine a scenario where that user’s home directory is stored on a removable microSD card and secured with GPG keys on a smart card. You can then get a different pair of microSD cards and smart cards for each user persona you want to set up.

    For instance you might have a “normal” persona that contains your personal contact list, personal social media account secrets, your personal calendar, work files and similar information. All of these files, settings and secrets would be protected by GPG keys on a smart card. To set up a new persona you could then store (or backup) all of that information on a microSD card and wipe that user account clean.

    Travel Persona

    For travel you can then create a “travel” persona that contains only the files, accounts, contacts, and calendar entries you need for your trip. These files and settings can be protected with a different set of GPG keys you have stored on a separate smart card. Then if your phone gets lost or stolen or if a customs agent searches it, the only files and settings that are at risk are the ones you explicitly need for travel. If you want to go an extra step you could even swap out the cellular modem (for instance if you are a US citizen traveling to Europe you might swap the US version of our cellular modem for the EU version so you have access to more European cellular frequencies). Then when you arrive you can get a local prepaid SIM and be on your way with a completely compartmentalized travel persona. When you return from your trip you can swap back in your personal microSD card and smart card and restore your personal persona.

    Conclusion

    I hope now that you are as excited as I am about the possibilities an integrated smart card reader gives you with the Librem 5. We constantly aim to balance your freedom, security and privacy and develop solutions that provide you not only with strong security, but also full control over your own hardware. We feel the OpenPGP smart card reader in the Librem 5 is another example of a strong but open security method that puts all the keys in your hands.

    The post Your Own Personal Enclave: The Smart Card Reader on the Librem 5 appeared first on Purism.

    by Kyle Rankin at May 14, 2020 14:14

    May 13, 2020

    Tutanota

    Encrypted Birthdays

    At Tutanota we always try to encrypt as much of your data as possible. Unfortunately, we made a mistake which led to unencrypted storing of birthdays of your contacts. This has happened for the birthdays of contacts which have been created or edited after June 2018. Please note that this bug only affected the birthdays of your contacts. All other attributes of your contacts (name, email address, etc.) have been and will always be stored end-to-end encrypted.

    May 13, 2020 00:00

    May 12, 2020

    Purism

    Librem 5 Dogwood Update

    Summary: We are almost at the end of the Dogwood board verification and have found and fixed a number of issues with the initial Dogwood boards. We believe we will be able to complete testing and start shipping Dogwood phones out within a few weeks. We have also been working on Evergreen in parallel to procure the remaining components we need for mass production.

    We know the community is eager to hear any updates we might have about the Librem 5. Like with our Birch and Chestnut updates, we are trying our best to give you correct information for each batch with a reasonable level of confidence without venturing into speculation or guesses. This is especially important when it comes to reporting hardware updates as it can take time and iterations to trace down a problem into the component or mistake that caused it and often first guesses for a root cause prove to be incorrect.

    Like everyone else we have been impacted by the COVID-19 pandemic and back in February we published an overall shipping update based on the best information we had at the time including dates for Dogwood:

    • End of March: Librem 5 Dogwood internal hardware revision for the Purism team
    • End of April: Librem 5 Dogwood batch for customer pre-orders

    We started receiving the internal Dogwood hardware revision a bit later than expected in April and started the work to test and verify the changes. As we mentioned in our Breaking Ground post, the Librem 5 is an entirely new phone built from the ground up and that means significantly more testing and tweaking than with an off-the-shelf design. Unlike with Birch and Chestnut batches, which only had minor tweaks on the previous batch based on problems we uncovered during testing, Dogwood represented a much larger change–a CPU flip to the other side of the PCB to help with heat dissipation–that meant a full redesign of the PCB layout.

    Dogwood PCB CPU side upDogwood PCB CPU side up

    We knew it would take longer to test Dogwood compared to Birch and Chestnut and budgeted extra weeks for the tests assuming we didn’t come across any major issues. Once testing was complete we would apply any fixes and then send out the remaining Dogwood batch to customers. Like with Birch and Chestnut we wanted to bring you along for the ride and give you updates as we have them, but up until now there honestly hasn’t been all that much to report except that the testing was in progress. This kind of testing of every component in a long checklist is tedious work and is only interrupted with a bit of excitement when something doesn’t work as expected and you must drop everything to figure out why.

    Dogwood Hardware Fixes

    It’s been about a month since we started that verification and as expected we did find some issues with the initial Dogwood boards. Overall the glitches we found have been minor from a design and fix perspective such as an incorrect MOS FET transistor part and a minor mistake in the CPU power supply, but were glitches which resulted in odd and sometimes much larger problems in the functionality of the device ranging from damaging the USB section of the CPU in one case and disabling an entire I2C bus in another! It’s taken more time than expected to trace through these problems and then apply and test fixes especially in the case of the CPU since it required reworks in the PCB that were difficult to make on the existing boards and new CPUs.

    Dogwood PCB CPU side downDogwood PCB CPU side down

    Another system we have been looking into since Birch is GNSS (aka GPS). GNSS is a pretty delicate thing, the GNSS satellite signals are so weak, it’s like trying to spot an 80W light bulb in orbit (that’s about the energy equivalent). What is received on the ground here on earth is usually below the noise level of the antenna and takes pretty significant signal processing to get data from it. This means that the GNSS antenna signal path must be pretty close to perfect.

    Besides this with Chestnut we discovered that ST Micro, the manufacturer of the TESEO LIV3 GNSS multi constellation receiver we are using in the L5, silently changed the recommendations for the antenna input electronics design. Now in Dogwood we see that GNSS reception still wasn’t great so we went back to suppliers and the drawing board, applied some more changes and are now finally getting a fix!

    Of course, now is the time to apply all of these fixes, before we go into mass production. As you might expect, changes are much more complicated with larger volumes, which is why we chose the public small batch approach to begin with and invited you to come along with us for this ride. At this point we have successfully verified almost all of the components with only a handful left to go and we feel we are pretty close to being able to greenlight the remaining Dogwood PCB production within a week so we can start shipping a few weeks after that. While this has been going on we have also been working in parallel on Evergreen to complete procurement of the components we’ll need for mass production.

    What’s Next

    Now that we are almost to the end of Dogwood hardware verification, soon we will be able to shift focus from testing individual components on a PCB to evaluating Dogwood and the CPU flip in particular as a whole. We know many people are curious about the impact of the CPU flip on heat dissipation and we intend to publish more detailed analysis soon in a future update.

    The post Librem 5 Dogwood Update appeared first on Purism.

    by Purism at May 12, 2020 21:45

    Privacy Browser

    Mastodon Account

    A while back a user suggested I setup a Mastodon account for Privacy Browser, but at the time I didn’t feel that I needed anything in addition to all the existing communication platforms I was using. But, as is typically the case, over time my perceptions have changed, and I thought it would be nice to have a platform where I could toot about Privacy Browser’s development as I work on features between releases. I expect I will use it similar to the blog posts I write after each release, but more focused on giving insights to each feature I am developing as things are shaping up for a new release.

    The account is registered at https://fosstodon.org/@privacybrowser.

    by Soren Stoutner at May 12, 2020 05:42

    May 11, 2020

    Tutanota

    Tutanota launches MTA-STS support for custom domains with Let's Encrypt.

    We are excited to let you know that with our latest release we have implemented MTA-STS support for custom domains by joining forces with Let’s Encrypt. While today almost all email providers support this important security extension for their main domain, it is still very hard to get for people using their own domain to send and receive mails. This must change as MTA-STS brings much greater security to all email users.

    May 11, 2020 00:00

    May 10, 2020

    Handy News Reader

    Gain a Good Habit of a Backup.

    What backup is?

    When it comes to any surprising event, it’s always good to be prepared at least to some degree – thanks to which You can feel comfortable regardless of which way the wind blows. In case of smartphones and computers sometimes You may stumble upon unpleasant surprises, such as app crashes and the like – after all, there is all pretty convoluted stuff under the hood, and sometimes something may don’t work the way it should. Unfortunately as a result of those cases it is possible for You to loose something – from Your preferences of using a particular app (reflected in its settings) to the data stored within it. However much You can loose, there is often a need to start from scratch, all over again – which usually is pretty time-consuming.

    There is, however, a good workaround invented especially for such cases – and it’s called “backup”. Many apps are equipped with their own backup feature, which – when it comes to app crash or any other serious failure – often allows You to easily and quickly restore everything to the point when it all worked the right way. It is often possible to restore both Your preferences and personal data. And sometimes an app may be even smarter: it may backup and restore completely by itself (!), so You don’t need to pay any attention to it, even if some crash occurred – the whole thing will be restored in a moment, and You couldn’t even tell that anything has happened.

    Below You’ll find all the important things about backup within Handy News Reader.

    What is included within the backup?

    1. All Your content sources, including their arrangement in groups (if You use them).
    2. Your set of Favorites (articles to read later or to preserve).
    3. All Your app’s preferred settings.

    You can either initiate the backup on demand at any given moment- or schedule it to be automatically initiated over a desired time span (e.g., every 6 hours). Regardless of which way You prefer, the backup file (HandyNewsReader_auto_backup.opml) will be always saved into the feedex folder within Your device internal storage.

    In case of the app’s crash this file – present in that very location – will help Handy to restore itself automatically, so You won’t even be bothered by restoring the app by hand.

    If You’d like to have a backup file placed also on Your sd-card:

    1. Go to settings › Advanced › Data folder and choose External memory (the one with the path containing “storage/xxxx-xxxx” – where x’s stand for a string of mixed letters and digits).
    2. In such a case backup location will be:

    Android/data/ru.yanus171.feedexfork/files/feedex

    If You want to backup HNR at any given moment:

    On any article list open the menu and choose Backup now.

    To schedule the automatic backup:

    1. Go to settings › Advanced › check Enable automatic backup.
    2. Tap Auto backup interval below to set up how often Handy should perform the backup.

    If You want to restore Handy News Reader from the backup:

    1. Paste the backup file (HandyNewsReader_auto_backup.opml) into the feedex folder within Your device’s internal storage.
    2. Launch the app – it should automatically restore itself from the backup, which may take a few moments.

    by Thomas Leigh (noreply@blogger.com) at May 10, 2020 14:38

    May 09, 2020

    Handy News Reader

    Read non-RSS Websites.

    Sometimes You may stumble upon other cases: websites which are not equipped with RSS. They will require some more effort to add them to Your “Dream Magazine” - but they are rather rare cases.

    Would You like to receive new articles or blog posts from a non-RSS website?

    Go to sidebar › + › Add a custom feed or search for one › enter the URL address of a website › check “Web Page – Links” on the bottom and confirm by ✓.

    In this mode, however, Handy uses all the links present on a website to locate and download their content (potential articles/posts). Since websites often contain other links as well, the result may require a little bit of refining, which unfortunately has to do with a more complicated stuff, so-called regular expressions. It works like that:

    1. Try to find out whether links to actual articles have any common denominator within their address. For example: https://vk.com/wall-55395457_4737
    2. Define a regular expression based on this common denominator. Regarding the example above in which links to actual posts differ only with digits, a regular expression rendering their common denominator may look like this: vk.com\/+wall-\d+_\d+
    3. On the sidebar tap a non-RSS website You’ve added.
    4. From the three-dot menu icon in the upper-right corner choose “Delete non-starred” to reset the feed.
    5. Once again pull out the sidebar, long tap on the non-RSS website to enter edit mode.
    6. Switch to “FILTER” tab on the top › + › select “ACCEPT” › enter Your regular expression in the “keyword(s)” field › check “...is a regular expression” and “Apply to title of link address” › confirm by “OK”.
    7. Go back to the sidebar, choose the non-RSS website and tap the refresh icon on top to check the results of the adjustments.

    You may read a little bit more on regular expression matter here – or You may experiment with it using this site.

    by Thomas Leigh (noreply@blogger.com) at May 09, 2020 14:30

    Make Articles Cleaner.

    One of the most powerful features of Handy is the ability to clean up article content according to Your Own preference. The wonderful thing is that it refers not only to (predictable) in-article advertisements, but virtually to almost any repetitive parts which You might find unnecessary, e.g., About the author notes, social network “share” section, “Related stories”, etc. With Handy You should be able to make those parts automatically hidden, in most cases. To do so, You need to point out those unwanted elements first. Here how You can do that:

    1. For the sake of this tutorial, open this article in Handy: share its link from any other app and choose “Read now”.
    2. Once You see the article within Handy, locate an example of an unwanted repetitive part, let’s say it would be the ad:

      Suppose this is the advertisement section.

    3. Now, You need to load the article text in the special way which allows You to see additional “tags”. “Tags” are parts which often go alongside with various article elements, and remain visible only under the hood. In Handy, however, You can temporarily throw an eye on such tags to use them as “pointers” for further indication what article elements should be hidden.
    4. So let’s begin with loading the article in this special mode: open the menu (three dots on the top right corner or just tap on the screen, if You use full-screen mode) and choose Edit Content View.
    5. You will notice that now many additional elements have showed up – those are “tags” mentioned above, each of them enclosed within square brackets. Now, locate the advertisement section which You’d like to be automatically hidden (in this case it is the sentence: “Suppose this is the advertisement section.”). Note the tag (called “affiliate”) which precedes it. Tap on that tag and choose “Hide”.
    6. Tap End editing floating button on the screen to exit Edit Content View. The advertisement block should be gone and not be seen within further articles of the parent content source (feed) :) .

    by Thomas Leigh (noreply@blogger.com) at May 09, 2020 14:30

    May 07, 2020

    Handy News Reader

    What is Handy News Reader?

    This app lets You both to read the Web in a convenient way and stay up to date with all You are interested into. Gather Your favorite sources of content (RSS channels, regular websites, Google News) and You will be constantly provided with all the new stuff out there.

    Furthermore, You can adjust the content to display only what You find worth Your attention: You can skip articles on undesired subjects, You can hide both in-article advertisements and other unwanted parts (such as About the Author notes, social networks boxes, links to related stories, etc.).

    Cherry on the top may be a notification on what You find especially important: You can be notified (regardless of regular updates notifications) whenever articles meeting particular criteria have showed up.

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Off-Line Ready.

    If You use mobile data plan, Handy provides You with several features which make off-line usage of the app not only possible, but free of unpleasant surprises.

    First of all, each and every article present within Handy should be available off-line. You can adjust this feature further to Your Own liking by defining how long articles should be preserved – and what data caps should be applied for the app. Let’s begin with

    Articles preservation.

    Go to settings › Article refresh › Articles preservation time.

    Furthermore, You can set custom preservation time for each content source. To do so, pull out the sidebar and long tap on the item You wanna adjust to enter its edit mode. Then You’ll find an option to check: Custom articles keep time. Check that option and choose the desired interval.

    Data caps.

    You can:

    • allow article refresh only over Wi-Fi » settings › Article refresh › Refresh only over Wi-Fi,
    • define the overall data limit for a single refresh » settings › Article refresh › Max single refresh traffic,
    • define the maximum weight of a single in-article image » settings › Article refresh › Max image size,
    • define the maximum number of images allowed to be downloaded (per article) » settings › Article refresh › Max image download count,
    • You can also exclude chosen content sources from the automatic refresh » go to settings › Article refresh › check Only selected, then pull out the sidebar, long tap on the content source You’d like to exclude and uncheck Auto refresh feed;

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Convenient Reading.

    In Handy, we’ve made the reading experience interestingly convenient. Especially worth Your attention may be:

    • Handy remembers the current reading positions for each article.
    • Tap the top or the bottom of the screen to scroll the text. Scroll alongside the left edge of the screen to adjust text brightness.
    • We’ve enhanced text scrolling with last line preservation, thanks to which You may find “text walls” easier to read. Go to settings › Operation › Page scroll 90%.
    • Article titles can be stripped of links, thanks to which You will never unintentionally open them. Go to settings › Article text › Title link.
    • You can clean up the content by removing all the unwanted parts, such as in-article advertisements, About the Author notes, social media sections, “related stories”, and so on (read more about it in “Advanced” section of this documentation).
    • You can create a desktop shortcut to any particular article – thanks to which You don’t have to find it through Your whole article collection every time You want to continue reading – just tap and enjoy :) . You will find this option within in-article context menu › Share › Add article shortcut.
    • Handy adjusts to Your preferable way of reading: when You have just a few moments to throw an eye on what’s new, You can quickly flick through all the new articles, choosing (by swipe top-down) which ones to preserve to read later. Once You have more time to read, just open Favorites from the sidebar and You’ll find those articles there. Once You’ve finished such an article, Handy will automatically remove it from Favorites.

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Customize the Appearance.

    Here is how You can adjust Handy News Reader to Your Own visual taste. There are several aspects which already can be customized:

    1. Go to settings › Theme › check Custom colors.
    2. Tap Text and background color to customize the appearance of a single article displayed both on article list and while reading.
    3. Tap Toolbar & buttons color to set one color for both the app’s toolbar (displayed on the top, if not hidden) and in-article buttons (displayed below an article, given they are not hidden).
    4. Go to settings › Article text › check or uncheck Margins
    5. Check or uncheck Justified text.
    6. You can also adjust in-article links by (un)checking Underline links and tapping Link color and background.
    7. Below article text You’ll find a few buttons displayed by default (e.g., “Show original text”, “Reload full text”) – You can change their arrangement or hide them completely – tap Button layout.
    8. Go to settings › Page Header › check Show clock if You’d like to have the current time displayed on the top right corner while reading. Once checked, two additional options will show up: the ability to adjust the clock’s size and colors.
    9. Check or uncheck Show battery level.
    10. Check Reading progress bar if You’d like to see a visual representation of the reading progress. Once checked, there will be two additional options, allowing You to set the bar’s thickness and color.
    11. Go to settings › Article list › Read articles – to set background and text colors for articles which have been read or opened.

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Available Gestures.

    on the sidebar:

    • long tap on a website – edit the website,

    on article lists:

    • long tap on an article – delete the article completely,
    • swipe right on an article – mark the article as read,
    • swipe left on an article – add/remove the article to/from Favorites,

    while reading an article:

    • swipe top down – add/remove the article to/from Favorites,
    • swipe alongside the left edge of the screen – adjust text brightness,
    • swipe left/swipe right – next/previous article,
    • tap the top left corner – previous article,
    • tap the top right corner – next article,
    • tap on the top center/the bottom center of the screen – scroll the text,
    • tap the right edge of the screen – scroll down the article,
    • tap the bottom left corner – toggle full screen mode,
    • tap the bottom right corner – toggle Action Bar,
    • if You are using full-screen mode (settings › Article text › Fullscreen reading mode), tap on the screen to invoke context menu;

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Subscribe or Just Read (Supported Content Sources).

    The main advantage of Handy News Reader is the ability to subscribe various content sources. It may be a website with interesting articles, a blog with interesting posts – or so-called Google News. Whatever You choose, Handy will be checking if are there any new content published on those websites. If so, the app will download them for You and preserve for further (even off-line) reading.

    Would You like to receive new articles or blog posts from an RSS-equipped website?

    Go to sidebar › + › Add a custom feed or search for one › enter the URL address of an RSS feed (or just a website address if You don’t know the former) or just the keyword to browse a Feedly catalog of RSS websites › check “RSS” on the bottom and confirm by ✓.

    Find out is a website equipped with an RSS.

    In Chrome:

    1. If You use on Your desktop PC Chrome – install this extension.
    2. Then – still in Chrome – open the website You are interested in. Notice a small orange rectangular icon on the right top corner of the Chrome window – click it.
    3. If the website is equipped with RSS – You should see one or more addresses – right click on the one which has “RSS” word and choose Copy link address.
    4. Open the Notepad, Word or any other text editor and paste the address (Ctrl+V).

    In Opera:

    1. If You use on Your desktop PC Opera – install this extension.
    2. Then – still in Opera – open the website You are interested in. Notice a small icon (three arcs) on the right top corner of the Opera window – click it.
    3. If the website is equipped with RSS – You should see one or more addresses – right click on the one which has “RSS” word and choose Copy link.
    4. Open the Notepad, Word or any other text editor and paste the address (Ctrl+V).

    Handy lets You to subscribe also websites which are not equipped with RSS – see “Read non-RSS Websites” in the “Advanced” section of this documentation.

    What is RSS and why You might like it?

    Probably You could point out websites – which You find worth (re)visiting to find out another interesting posts or articles. While there are plenty of blogs and other websites out there – as far as the layout is concerned, they are accordingly much different from one another. Therefore each time You want to check out the new content they provide – it requires to almost constantly switch Your attention between various bookmarks, tabs and layouts. Moreover, it isn’t unlikely that Your favorite websites have been re-designed once for a while – and You are again in the need of figuring out where particular things are placed now.

    Fortunately there is a way to browse the content You like in a much easier and distraction-free way (maintaining Your attention focused in one direction, without disturbances): using so-called RSS reader.

    RSS: (It is that) Really Simple Solution.

    To put it simple, **RSS is a way of delivering content **directly to You****, i.e., without a need to visit a bunch of websites You follow every time You wanna check them out. Using RSS those websites are – in a sense - “visiting You”, by sending to You their new stuff (it is like a magazine subscription). Moreover, however many websites You subscribe – they are presented to You in a unified way, therefore creating a completely new - Your “Dream Magazine” :) . It consists of Your favorite content - and it is constantly up-to-date (so there are no “issues”, but constant receiving new articles).

    As You probably guess, this way is completely free of distractions/switching attention mentioned above. Moreover, it is much less time-consuming: no need to open several websites, just one click (or tap) and You see every new thing out of Your favorite set of sources. It also consumes much less data because the only thing which is loaded is an article = the actual content, not the whole layout around it. There are plenty of various data-consuming things on websites – which in case of RSS are not necessary.

    Sounds appealing? It is fantastic that this way You may follow (subscribe) almost any website You want – including blogs, YouTube channels and even podcasts

    Would You like to receive news on selected topics, provided by Google News?

    Go to sidebar › + › Google News Topics.

    Another thing is that You can use Handy just to read any particular article out of any subscription (feed) – You might find such an article using Your web browser of preference and then Android “Share” feature – or You may simply use built-in web search engine within the app itself.

    To read an article found in other apps (e.g., web browser):

    In the other app select the article URL address and use Android “Share” feature › then choose “Read Now” or “Read Later”. Article will be placed into “Without a feed” group in Handy.

    To browse the Web directly within Handy:

    Long tap on HNR icon and choose Article Web Search. Alternatively You’ll find this option i.a., within context menu in the app.

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Article Sets and Groups.

    Handy organizes articles within four main sets (or feeds):

    • Unread – here You’ll find all the articles which You haven’t read or opened yet, all the newly obtained articles, and all articles which You have marked as “unread” by hand.
    • Starred – this is the place for all the articles You (or Your in-app filters) have added to Favorites. Those articles are never removed automatically.
    • Without a feed – this is the place for articles opened via “Read it now” or “Read it later” actions, whether initiated from other app (by Android “Share” feature) or from Handy itself.
    • All articles – this set displays all the articles from all the sets listed above.

    Apart from the main sets You can organize Your content sources into custom groups (which are placed below the main sets on the sidebar).

    To create a custom group:

    Tap a pencil icon on the sidebar, then a folder icon on the top right.

    When You add a new content source (a website, a blog, etc.) to Handy, You can ascribe any of the existing groups to it right off the bat – or You can do this later (long tap on the website name on the sidebar to enter its edit mode).

    by Thomas Leigh (noreply@blogger.com) at May 07, 2020 20:41

    Fairphone

    Research spotlight: How much does a miner earn?

    Long before we made a single phone, Fairphone was working to better understand and improve mineral supply chains. Many years and three phones later, we’re still focusing on our mission of driving important materials projects and pioneering research that has a positive impact on how materials are sourced, used and reused – improving both environmental factors and the lives of those working with these materials.

    One of our focus materials for improvements is tin. As part of our goal to continually increase transparency and find areas where we can make the most impact, we commissioned two studies which examine this material at two opposite points of the supply chain: virgin tin mining in the Democratic Republic of the Congo (DRC), and the state of tin recycling in China (to follow in part 2). While this research is specific to a single material, the complexities and issues in the tin supply chain accurately reflect the challenges when it comes to fair materials as a whole.

    Keep reading to learn more about the high-level findings from the miners’ revenue study, as well as more insight into the issues related to tin. And if you want to dive deeper, be sure to read the full reports and listen to our recent Fairtalks podcast where we hear more straight from the researchers themselves.

    Why are we so interested in tin?

    Tin is essential for electronics manufacturing. In phones, for example, it’s commonly used in solder paste – a kind of metal “glue” that’s used to attach tiny components to the printed circuit board (PCB).

    Despite the impression that it’s not quite as precious as some other metals, our current available reserves of tin might only last 20 or 30 more years.

    And with a variety of interesting applications like energy storage, the demand for this material just keeps growing. Besides balancing long-term supply and demand, the issues in the tin supply chain mirror those of many minerals, from poor wages and unsafe working conditions to lack of regulation and environmental destruction.

    Our initial interest in tin stemmed from its classification as a conflict mineral. Following the implementation of the Dodd-Frank Act, most major electronics companies stopped sourcing tin from the DRC and surrounding countries, due to the concerns that it might be linked to funding warlords and illegal conflict. However, besides cutting off funding from criminal activities, when companies stopped buying tin from these regions, they also cut off the incomes of miners and their families.

     

    To support the economies in these regions and stimulate the production of traceable, conflict-free tin, Fairphone began working with the Conflict-Free Tin Initiative (CFTI) to source tin and integrate into our supply chain. To this day, we are still using this tin.

    While sourcing conflict-free tin is an important achievement, it only addresses a limited number of issues. For our fair material ambitions, we want to examine and find ways to improve a much wider variety of social and environmental factors. By undertaking these recent research projects, we’re able to understand the tin supply chain even better – looking at specific issues related to virgin mining, as well as the sources of waste (and potential for recycling and recovery) at every phase of this material’s use.

    ASM miners don’t earn enough to cover basic expenses

    For tin and other materials mined in the DRC, we are especially focused on artisanal and small-scale mining (ASM). Instead of avoiding the sector altogether, which is happening often in the electronics industry, Fairphone actively looks for ways to engage ASM in our supply chain.

    Supporting these (often informal or loosely regulated) operations offers the best opportunities for making lasting changes that have a direct impact on local communities.

    Working with the International Peace Information Service (IPIS), an independent research institute, Levin Sources, a consultancy that works to build responsible mineral supply chains, and with support from MVO Nederland, we were involved in a research project that aims to provide a better understanding of why ASM communities remain extremely poor and identify the factors that impact their income.

     

    One of the key findings of the report was that ASM tin miners in the DRC don’t earn enough to cover the needs of their families. For example, in eastern DRC, a couple employed full-time in the artisanal mining sector might earn a combined income of USD 202. However, with an average of four dependents, they would need USD 243 to cover their basic needs.

    Despite this, ASM is still one of the best sources of income in this region of the world, especially for people with limited education who don’t own land or other assets.

    To improve miners’ incomes, the report recommends that those who purchase tin (such as electronics companies) should remain engaged with ASM supply chains and continue to source materials in line with due diligence guidelines. In addition, stakeholders throughout the supply chain should join forces and focus on finding paths to a formalized tin market.

    This advice aligns with Fairphone’s approach of active collaboration with AMS mining communities, working with like-minded partners to positively influence incomes and local development.

     

    The current situation makes issues even more pressing

    This research is very valuable to Fairphone’s vision of improving the electronics industry, which includes collaborating with and holding other stakeholders to a higher standard. However, since these two reports have been finalized, the world as we know it has undergone a massive transformation. The entire economy has taken a huge hit. The different stages of the tin supply chain, and certainly the people working in it, have been directly affected. Factories in China have slowed production or temporarily closed their doors. And in places like the DRC, incomes are increasingly unstable, and due to travel and shipping restrictions, the price of basic goods keeps rising.

    So while all of the figures we calculated were in a pre-COVID world, this situation does provide an important lesson: it serves to illustrate how interconnected our world is, and how necessary it is to consider every part of the supply chain when attempting to create lasting change.

    Listen to our Fairtalks podcast with Angela Jorns from Levin Sources and Guillaume de Brier from IPIS to learn more.

    The post Research spotlight: How much does a miner earn? appeared first on Fairphone.

    by Tirza Voss at May 07, 2020 08:48

    May 06, 2020

    /e/ foundation

    Leaving Apple & Google: /e/OS installer in beta, pre-order your /e/ Fairphone 3.

    Leaving Apple & Google: /e/OS installer in beta, pre-order your /e/ Fairphone 3.

    The /e/OS “easy” installer is now available in beta

    The /e/OS “easy” installer is now available for a wide range of phones: the Samsung Galaxy S6, S7, S7 Edge, S9 and S9 Plus (all Exynos based models)! If you have one of these phones and want to install /e/OS, don’t wait!
    Download and test now!

    You can help have this installer support your smartphone of choice: its source code is available, and you can adapt the installation scripts to more devices, based on the installation procedures already available online.

    A “how to add a new device” documentation is available online here.
    You can also discuss this project on the dedicated community forum discussion thread.

    The installer is currently running on Linux and we are looking for contributors to help create a version for both Mac and Windows. Feel free to join and help! As the software is in Java, it’s mostly packaging.
    Discuss this project on the dedicated community forum discussion thread.

    Finally, we would like to take the opportunity to thank our alpha testers who have helped to test and bug fix previous versions. Kudos to them!

    We are thrilled to get your feedback on the installer and welcome many more users to /e/!

    /e/OS and Fairphone 3
    Fair with people and the planet. Fair with your data.

    Please welcome Fairphone 3 to our range of deGoogled phones!
    We are thrilled to announce a partnership with Fairphone to launch the first privacy conscious and sustainable phone, fair for the planet and your personal data.

    In 2013, Fairphone launched a movement for fairer electronics highlighting major issues across the smartphone value chain in mining, design, manufacturing and life cycle. Since then, Fairphone has changed how phones are made, expanding the market for products that put ethical values first.

    For many, fairer technology isn’t just about the device and its components, it is also about the software that powers the product; and so when Fairphone community members were asked what their preferred alternative operating system (OS) was for the next Fairphone, the Fairphone3, they voted for /e/OS, the pro-privacy, deGoogled mobile ecosystem.

    /e/ Fairphone 3 is a unique combination that offers a new and fairer approach to resources and personal data for all.
    Pre-order your /e/ Fairphone 3 today. Available starting May 14th.

    If you already own a Fairphone 3, you can download /e/OS for your phone at no cost like for any other supported smartphone.

    How to contribute and support the /e/ project?

    We are often asked how to contribute to the /e/ project and we are pleased to answer this question because users’ contributions are key to the success of an ambitious project like ours.

    The time is now! There has never been so many questions and comments about user’s data privacy, Google, Apple and alternatives to regain control over data privacy… The timing is great and you can contribute in many ways:

    Test /e/OS, report bugs, contribute to patches!

    Anyone is really welcome to report issues with /e/OS, and possible solutions. Just make sure you can reproduce the problem, post appropriate context information, possibly some “logs”, and ideally… a solution 🙂

    Help others! Join the global community!

    We have a growing community of users who are discussing their experience with /e/OS. Join now, you will be able to help others answer common or uncommon questions they have about /e/:

    Join /e/ Community Forum
    Join the Support Channel

    Join discussions, spread the word!

    It’s important to share your experience on our forums, tell us about what you like, your frustrations… It helps us to identify improvements for the product and make it a premium mobile ecosystem.

    Also, please share the word! Every day, new users discover /e/ and love the project. We need everyone to ensure that as many people as possible learn about the project. We can’t count on mainstream media for this!

    So share with friends and your community channels, talk about /e/ on social media, say why you like it!
    You can also share what we post on Mastodon and Twitter

    Contribute financially

    With your help, we can support a growing team of passionate contributors, keep /e/ completely independent and make /e/OS sustainable over time.

    Every donation helps the project to pursue additional development, rent servers for compilation and to host your e.email account or the community forum, pay for domain names and other key expenses amongst other things.

    If you can afford a recurring donation, become a /e/ Patron!

    Otherwise, choose from the different donations options, and get a reward in return!

    Subscribe to our Telegram announcement channel to get latest news!

    Follow us on Twitter and Mastodon: @e_mydata

    by Brittny Mendoza at May 06, 2020 15:22

    Guardian Project

    Free Software Tooling for Android Feature Extraction

    As part of the Tracking the Trackers project, we are inspecting thousands of Android apps to see what kinds of tracking we can find. We are looking at both the binary APK files as well as the source code. Source code is of course easy to inspect, since it is already a form that is meant to be read and reviewed by people. Android APK binaries are a very different story. They are first and foremost a machine-executable format. On top of that, many developers deliberately obfuscate as much as possible in the APK to resist inspection.

    That means inspection requires using tools to look into the binary APK format. There is actually a massive amount of work that goes into inspecting APKs because this is required in order to do useful malware analysis. For the most part, these inspection techniques are the malware companies’ “special sauce”, so they are proprietary and generally kept secret. On top of that, malware companies keep secret a lot of the conclusions they about what is useful data to collect, and what should be ignored.

    One key piece of the Tracking the Trackers project is to make all of research, tooling, and conclusions free, open, and publicly available. First and foremost, that means the tools must be free software. They should also be easily installable so the barrier to entry for new inspectors is as low as possible. We focus on getting software as part of Debian, since once there, so many people have access to those packages since Ubuntu, Kali, and so many other GNU/Linux distros are based on Debian.

    What is available in Debian already

    Our work with the Debian Android Tools Team and Debian Java Team over the years means many key tools are already included in Debian and its derivatives, including:

    • key Android SDK components like apksigner, dx and android.jar
    • apktool
    • dexdump/dexlist
    • enjarify
    • LibScout
    • libsmali
    • procyon

    Tools we are using

    One key aspect of our research is that working with terabytes of APKs, this is necessary to be able to spot and map out as many trackers as possible. Since feature extraction can be a slow and resource intensive process, we needed to use some tools that emphasize speed over flexibility. Even with fast extraction tools, we still have to build up tailored processes to speed things up. Some of these straightforward feature extraction processes would take months to run on ~3TB of APKs on a 32-thread machine with 144GB of RAM.

    apkverifier, apkparser, and droidlysis are generally useful, but not yet in Debian. So we packaged them to make them easily available. They are currently in the Debian NEW queue, awaiting final review before inclusion.

    These tools have been assembled into scripts to run the actual feature extract processes, they are maintained in the https://gitlab.com/trackingthetrackers/extracted-features repo. When the actual data generated is small enough and there are not copyright conflicts, the data is also included there. Mostly, the data sets are too large and sometimes touch on copyright restrictions, so they are unfortunately not publicly available.

    There are lots of other tasks, including managing large APK collections, gathering data to generate statistics about the features, and downloading publicly available tracker SDK. Those scripts are maintained in https://gitlab.com/trackingthetrackers/scripts.

    Gradle Plugins

    When working with source code, then it is possible to do other kinds of analysis. Most Android apps are built with the Gradle tool. So we reviewed a wide range of Gradle plugins, and found these three useful in our investigations.

    Tools we reviewed

    We looked at quite a few existing tools, and found many interesting and useful ones. While they all produced useful output, many of these were not useful to this project because they were tailored around the use case of a person inspecting a small set of apps, so for example, they were too slow or did not produce machine readable output suitable for working with large APK collections.

    • android_permissions_harvester - for finding which permissions are used based on method calls
    • droidlysis - cryptax’s (aXelle’s) tool: “DroidLysis is a property extractor for Android apps”. See also her talk at hacklu 2019
    • APKiD - “In addition to detecting packers, obfuscators, and other weird stuff, it can also identify if an app was compiled by the standard Android compilers or dexlib”[1]
    • redex - “taking advantage of Redex allows us to normalise the applications prior to analysis”[1]
    • kaitai_struct_formats - generic binary struct parser tool, useful for directly parsing Android classes.dex files.
    • binaryanalysis-ng - a framework for unpacking files recursively and running checks on the unpacked files. Great for someone who needs to inspect small sets of a wide variety of file types.
    • redexer - infer with which parameters the app uses certain permissions (we name this feature RefineDroid)
    • apk-static-xref - staticallly generate a cross-reference-graph (XRG) of a component (e.g., Service) of Android APK file
    • smalisca - Static Code analysis tool that generates call graphs

    May 06, 2020 00:00

    May 05, 2020

    FreeYourGadget

    Gadgetbridge 0.44.0: Initial WatchX(Plus) support and much more

    Gadgetbridge 0.44.0 has been released! Let's play the F-Droid waiting game.

    This release finally merges support for WatchX(Plus). Support for this watch has been contributed to "ksiwczynski", "mkusnierz" and finally "mamutcho", who also did the final polishing before official inclusion. We do not own the device ourselves, but we believe it works ;)

    Thanks to a donation of a brand new ZeTime (THANK YOU!), I could finally test the state of ZeTime support and fix some long standing issues, plus add support for rejecting calls from the watch. There will be probably further fixes in the next release.

    Further improvements and fixes were also done for Fossil Hybrid HR, most of them contributed by Daniel Dakhno again. Thanks! :)

    For all user-facing changes since the last blog post, check the following list:

    Version 0.44.0

    • Initial support for WatchX(Plus)
    • Add support for Amazfit GTR Lite (untested and incomplete)
    • Fossil Hybrid HR: Fix some issues with custom widgets
    • Fossil Hybrid HR: Allow setting alarm titles and descriptions
    • Fossil Hybrid HR: Fix step data parsing
    • Amazfit GTS: Fix setting menu items with low MTU
    • Amazfit GTR: Allow setting menu item like GTS
    • ZeTime: Support setting the watch language
    • ZeTime: Support rejecting calls
    • ZeTime: Try to fix weather conditions on newer firmware
    • ZeTime: Fix could not synchronize calendar on connect
    • ZeTime: Fix calendar event time and date
    • ZeTime: Send up to 16 upcoming calendar events on connect if option is enabled
    • Allow set light/dark theme according to system settings (new default)

    Version 0.43.3

    • Fossil Hybrid HR: Initial support for activity tracking (no sleep yet)
    • Fossil Hybrid HR: Support setting alarms on newer firmware
    • Amazfit GTR/GTS: Fix flashing watchfaces and maybe firmware/res update (still untested)
    • Amazfit GTS: Support enabling/disabling menu items on the watch
    • Implement transliteration for Korean

    Version 0.43.2

    • Fossil Hybrid HR: Allow choosing and cropping image to be set as watch background
    • Fossil Hybrid HR: Option to draw circles around widgets
    • Fossil Hybrid HR: Experimenal firmware update support
    • Fossil Hybrid HR: Fix vibration strength setting
    • Huami: Do not display firmware information and whitelist information when flashing watchfaces
    • Huami: Disable air quality indicator on Huami devices instead of showing 0
    • Bangle.js: Change encoded char set to match Espruino's 8 bit fonts
    • Steps/Sleep averages: Skip days with zero data

    Version 0.43.1

    • Initial support for Amazfit Bip S (incomplete, needs the official app once to obtain the pairing key)
    • Amazift Bip Lite: Allow relaxing firmware checks to allow flashing of the regular Bip firmware (for the brave)
    • Fossil Hybrid HR: Fix notification history on newer firmwares
    • Fossil Hybrid HR: Add option to disable widget circle
    • Bangle.js: Don't set time if the option is turned off in settings
    • Bangle.js: DST and time zone fixes
    • Add Arabic-style Eastern Arabic numerals to transliteration

    by Andreas Shimokawa at May 05, 2020 22:00

    Tutanota

    Do your trust your email service? Here's what to look out for when it comes to choosing a trustworthy service.

    Email is a highly sensitive matter: bank statements, social media logins, personal emails - a lot of information is stored in everybody's mailbox. As data leaks and identity thefts are the biggest threats online, it is crucial to review your email choice and pick a secure email provider that you can trust. In this blog post, we explain what is important when it comes to trusting an email service.

    May 05, 2020 00:00

    May 03, 2020

    Tutanota

    Google is listening to your most intimate moments without your knowledge - an interview with Tim Verheyden.

    On Press Freedom Day we have interviewed Tim Verheyden, the journalist who broke the story that not just the machine but also Google employees are listening when we talk to devices like Google Home. The analysis of our voices by Google might be acceptable to some, but listening in on our most intimate moments without our knowledge is a privacy violation that many did not expect. Thanks to the free press, Tim could uncover a problem with Silicon Valley subcontractors that transcends Google.

    May 03, 2020 00:00

    May 02, 2020

    NewPipe

    NewPipe 0.19.3 released: Android TV, YouTube Music, greeting new team members and so much more

    Another day in quarantine, another release of NewPipe. This one comes with a lot of bug fixes, improvements and more features. It can not get better then that.

    Android TV

    “Hey, release-post guy,” I hear you say, “I can already run NewPipe on my Android TV, what is the difference now?” Well, now you can actually use it. You can scroll through long video descriptions, can focus what element you want to focus on (and have the first one focused whenever you open a page which is important, I think.), the native keyboard is used instead of an on-screen one, you can seek videos however you like, no annoying ripple effects - it is great. So great, you should probably buy an Android TV just for using NewPipe! All of this happened mostly thanks to @Alexander–. They made their first contribution back in October, but now found time to come back and enhanced the TV experience greatly, thank you. Other people involved in this are @B0pol (who improved the detection of non standard devices as Android TVs), @revathskumar (who found issues), @Pentaphon, @christianfl, @Disonantemus (all found an issue), @sorryusernameisalreadytaken (who found a lot of issues), @wb9688 (who made it possible to open channels when long clicking comments from them) and @TobiGr (who was himself).

    YouTube Music

    Since 2015, the YouTube Music app exists; since 2018, a web app is there. As of today, you can search for content of this music platform in NewPipe. This looks a little something like this:

    @wb9688 is responsible for integrating this into the extractor (a module for getting the content from the platforms) and in the Android app, big thanks for allowing us to indulge in our music habits as much as we like without having reaction videos jumping in our search results.

    Bug fixes

    Imagine you would see a button where you would not expect one to be. Sounds scary, hmm? @mauriciocolli took care of it. It won’t hurt anyone anymore. He also improved the error experience. Even though we obviously don’t want you to see any, now they are the right ones at least. @wb9688 (if you think you will read this name a lot of times in this post, you are not mistaken) fixed an issue where age restricted videos were shown even though the related option was turned off.

    @B0pol fixed the generation of crash reports in the background by using a different JSON library which doesn’t provide invalid JSON in some cases (this library was already used by the extractor). A temporary fix for bookmarked playlists which names changed to null was provided by @mitosagi. Now you can null away all you want. @Stypox tried one more time to fix the handling of reCAPTCHAs for some more types of them and is probably questioning his sanity at this point. Thank you though!

    Improvements

    @wb9688 improved the background check for new versions, it uses the same JSON parser as other functions of the app now, which will make adding more features to it in the future easier. @mauriciocolli added code in his third contribution to avoid unnecessary changes to upload dates of saved streams, so they do not jump around in your bookmarked playlists anymore. Thanks to @XiangRongLin, the playback parameters you change in the options are now applied in every player, which leads to a more unified experience. The third contribution of @B0pol greatly improves the user experience when NewPipe faces unsupported content. Instead of crashing, you will see a big kaomoji now. Definitely an improvement.

    The title of our app, NewPipe, is shown in the upper left corner when you open the sidebar. Sadly on some devices with custom fonts it was forced to be in two lines, not anymore, thanks to the fourth contribution of @mauriciocolli. The resizing of the pop-up window was greatly improved by @harshlele. This was a long-lasting issue and everybody should be happier now. @Stypox found time for a second, little contribution: You can now long-press on the background and pop-up buttons in headers of channels and the videos from that channel are then added to the respective queue. @GradyClark made a big contribution which allows you to delete watched videos from your bookmarked playlists. Now you can easily create a watch-later playlist and occasionally delete the ones you watched from there with one button press. The contribution of @Stypox needs to be mentioned here as well, he greatly improved the efficiency of this action.

    Under the hood

    This section is for internal changes with this release. To start it off, @wb9688 made a big change in enforcing Checkstyle, which should provide us with even more beautiful code then we already had in this project. Related to this, Checkstyle is also tested in the CI and UTF-8 is enforced for Gradle. @Stypox fixed an issue where the build name was not probably overridden.

    The extractor got some improvements not mentioned so far: @Royosef added support for PeerTube video channels (accounts there were already supported), @B0pol added the supported countries for SoundCloud and @wb9688 changed the media.ccc.de url to the new one.

    Also worth mentioning here is that we’re now using our fork of nanojson instead of the upstream version. A difference is that it supports {this: 'kind', of: 'json'} instead of {"just":"this"}, which is needed to support more content providers in the future.

    Conclusion + internal news

    That is it for this release. We would like to use this section and your attention to provide you with some internal news: We want to introduce the following members who have recently joined our team: @B0pol is a persistent contributor and now has an official badge. @wb9688 rejoined the team, he added SoundCloud support back then and now focuses on PipeCast. Also @Poolitzer (Me. I have been here the whole time), who wrote a lot of the recent blog posts and is in general a great human being.

    As usually, a big thanks goes out to all the people who made this possible, especially those not mentioned: Developers for helping out fellow developers, testers for testing, maintainers for maintaining, translators for translating and users like you for reporting the bugs in the first place. If you’d like to get a more technical view into the app, you can find the release page here and the corresponding PR here.

    As a little additional announcement, thanks to said translators, Acehnese is now supported as an app language.

    Where to get the latest version

    NewPipe notifies you about new versions, you can download them when you press the notification. An alternative is the GitHub release page. If you use the F-Droid app, it notifies you as well about an update for NewPipe - please keep in mind that it can take F-Droid a while to update their repository.

    Please let us know what your experience of the latest release is, especially bugs in need of fixing. As usual, you can reach out to us via IRC (#newpipe on freenode), open issues on GitHub or ideally use our built-in crash reporter to send us machine-readable issue reports. You can even send in fixes yourself.

    May 02, 2020 23:00

    May 01, 2020

    Handy News Reader

    What’s New With ver. 0.13.5?

    Since the last official release (0.12.2) we’ve introduced further improvements thanks to which You can both read more - and read more conveniently :) . As usual, the whole set of features and improvements makes the new HNR version pretty exciting. Let’s take a closer look.

    Widen Your Reading Portal.

    As far as non-RSS websites are concerned, we introduce another way of obtaining the content: Web Page - Divide. This mode may come in handy especially in case of reading forum threads, but also other websites with repetitive content blocks. A more in-detail description of this feature You’ll find here.

    Read Distraction-Free.

    We’ve take one step further distraction-free reading experience by expanding full-screen mode over article lists (some Tap Zones included!). We’ve also added the ability to hide in-article buttons (the ones which You could find below article text).

    More Customization.

    You can now customize the app to the higher degree by applying Your color of preference to Action Bar, status bar, and in-article buttons mentioned a moment ago :) .

    Improved Performance.

    First, we’ve improved the refresh process (updating content sources). Previously, it incorporated other article-related operations as well (such as deleting old articles) - now we’ve excluded some actions from the refresh operation itself, making a separate dedicated place for them (see Delete old articles in the menu). Thanks to this change the refresh operation should perform faster.

    Second, we’ve added the ability to “lock” HNR in memory while reading an article - thanks to which, once You’ve switched to some other Android app, You should always be sure that the article You’ve been reading will wait for You, not letting the OS to close it (e.g., due to Android Snooze feature).

    Other Improvements.

    Among all the rest we’ve improved the app settings organization, including one place in which You can set up everything which has to do with page header (reading progress bar, time, battery level, etc.).

    As You may know, Handy lets You browse the Web directly in the app, via Article Web Search feature. Previously it was 100%-based on DuckDuckGo - now we’ve added the ability to further search via Google or Yandex, within external browser.

    In the meantime, stay tuned for the new HNR documentation, both on our website and for off-line use :) ! Most of articles are re-written and reorganized to be not only up-to-date, but also much more user-friendly and easier to comprehend.

    by Thomas Leigh (noreply@blogger.com) at May 01, 2020 22:13

    Widen Your Reading Portal.

    A longer while ago our app could be considered as so-called “RSS-reader”. Although it allowed You to read the Web, it had been based on “RSS” which, however highly popular, hasn’t been applied on each and every website under the hood. There are still places not equipped with RSS, like, for example, some forums.

    The point is that we haven’t wanted to carry technological limitations into our users reading experience. In other words, we would love to read all the Web within Handy - not only those who has mysterious “RSS” inside ;) . So we’ve introduced new ways of obtaining content. First, we began with Web Page - Links as alternative type of loading websites into Handy. If You’ve been interested in some non-RSS website, You could point out (via so-called regular expressions) which particular links contain the actual content You’d like to read in Handy - or You could simply leave the thing “as is” in case You can’t be bothered with more advanced stuff (taking a closer look on links’ nomenclature and constructing appropriate corresponding regex’es).

    Yet Another Way of Obtaining the Content.

    Now, it’s time to take the next step and widen Handy News Reader’s portal into the Web: we’re happy to introduce yet another approach of obtaining the content from non-RSS websites: Web Page - Divide. It may be especially useful in case of forum threads, i.e. longer pages with a bunch of posts, one after another. Handy can look at those posts and present them as separate articles, thanks to which You can read a whole forum thread as article list. Moreover, if a thread is split into several pages, Handy will follow and load all the rest. This way You can read complete forum threads within Handy, being notified on new posts :) .

    by Thomas Leigh (noreply@blogger.com) at May 01, 2020 21:57

    April 30, 2020

    Fairphone

    Keeping your data safe with /e/OS

    We’re delighted to announce our new partnership with /e/ Foundation for an open-source operating system that prioritizes user privacy.

    /e/ Foundation is an international non-profit project with the mission to make user privacy accessible to all. When we asked the Fairphone community to choose an alternative operating system for the Fairphone 3, /e/OS was the clear favorite.

     /e/ Foundation’s founder Gaël Duval.

    This is clearly a great match: “Since the inception of /e/ Foundation and /e/OS, we realized that many of our users were not only concerned about their data privacy and limiting unnecessary data streams, they also wanted hardware that would last longer and be repairable,” says Gaël Duval, /e/ Foundation’s founder.

    Unlike many other operating systems, /e/OS doesn’t scan, access or track user data multiple times per day. All your favorite Android apps can still be used, with /e/OS notifying you of built-in trackers hidden within each app, so they know in advance of any potential threat to their data.

    The importance of data security

    Why did our community choose an OS that focuses on privacy? Chances are you’ve grown increasingly aware of data security over the past few years; this isn’t just about protecting your email password or credit card number anymore. We’ve seen first hand, in real-time, the cost of intensive data extraction on our society. From the Cambridge Analytica scandal to new concerns over coronavirus contact-tracing apps, these abstract data-mining forces are changing how we shop, eat, socialize, think, vote, live.


    We sat down with Gaël and marketing & operations manager Alexis Noetinger to discuss the importance of data security for individual users, as well as society as a whole. For the full-length conversation, head on over to Soundcloud, Spotify or Apple Podcasts.

    There are huge forces at play here, but we hope to influence them by increasing awareness and availability of open-source software like /e/OS. Until operating systems like this become the norm, it is up to each one of us to be vigilant about our own data. With enough concerned individuals joining the fight against data extraction, we can help to make data security a priority in our wider society.

    And that’s not all…

    /e/OS isn’t just stepping up Fairphone’s privacy game. “In the past, open-source software has helped us increase the longevity of our phones, enabling us to provide software upgrades for many years,” says our CEO, Eva Gouwens. Free from the constraints of centralized Android updates, open-source software allowed us to successfully upgrade the 3-year-old Fairphone 2 to Android 7 using open source and the existing hardware.

     Fairphone 3 with /e/OS: The first privacy-conscious and sustainable smartphone on the market.

    We often say that software is the unsung hero of longer-lasting phones. Experience has shown us that it takes a lot of time and resources to keep operating systems updated, especially on older phones. In an industry built around selling the newest, shiniest model, it’s no surprise that updates ad infinitum aren’t in the business models of the big corporate players. That’s why alternative software routes are the answer to keep your Fairphone running securely for longer.

    “Our partnership with /e/ Foundation is exciting because we both strive to change the way the tech industry operates in our own way,” says Eva. By joining together, we can all show that there are better, kinder paths to take, and step by step grow the movement for fairer electronics.


    The /e/OS Fairphone 3 is available for online purchase right now >>

    The post Keeping your data safe with /e/OS appeared first on Fairphone.

    by Agnes at April 30, 2020 10:48

    April 29, 2020

    Purism

    Easy Librem 5 App Development: Screen Recorder

    In this post I’ll share how I approach app development and show you how to build a screen recording app for the Librem 5. You can follow the rest of the “Easy Librem 5 App Development” series on our blog.

    The Librem 5 is ideal for all types of development because it has a Free Software Foundation endorsed operating system where all the source code is released publicly, it is the same operating system—PureOS—that powers the Librem Laptops, Librem Servers, and Librem Mini. This freedom allows development and full access to things like haptic feedback, ambient light sensor, accelerometer and proximity sensors, Bluetooth, and accessing the internet. And unlike other smartphones we don’t restrict what you can do on your device, which means you can create powerful apps like an unrestricted screen recorder!

    To get started pick your preferred development language and take a look at the libhandy and Librem 5 docs. Here are some examples of adaptive apps written in C, Python, Rust, and Vala.

    Research:

    Stand on the shoulder of giants, don’t overlook researching what has be done before, time spent in this phase can save you hours later. Be on the lookout for projects, forum or blog posts that have tackled similar problems. If you are struggling to find something, divide your app into smaller problems and piece together multiple sources to get closer to your solution.

    Prototyping:

    Now that you’ve divided your project up and know how to start solving each part it’s time to prototype! In this phase, you want to test each API, library or code snippet that you want to use. You are trying to solve the core logic of your app, the backend, without the user interface.

    Convenience:

    Once the backend problems are solved, it’s time to think about how you want to interface with the app. You can build a GTK or QT interface or use a tool like yad to automate parts of the process for you. A desktop launcher (icon) can be added in /usr/share/applications/ or ~/.local/share/applications/

    Example:

    Watch the full tutorial to see how I followed this process to create the Librem 5 screen recording app:

    Because we share so much code with wlroots in our compositor, applications targeting wlroots have a good shot at just working. wf-recorder is a screen recording app that falls into this category, it works well after following the apt setup directions.

    Here is the example GUI wrapper from the video:

    #!/bin/bash
    VIDEO="/home/purism/Videos/$(date +%Y-%m-%d-%H%M%S).avi"
    yad --title ScreenCapture --text "A simple GUI to record the screen" --button="Start capture:100" --button="Quit:0" --buttons-layout=center
    start_window_return=$?
    
    if [[ $start_window_return -eq 100 ]]
    then
        wf-recorder -a -f $VIDEO --codec=asv1 &
    else
        exit
    fi
    
    yad --title ScreenCapture --text "Screen capture is actively running. \nFile: $VIDEO" --button='Stop capture:100' --buttons-layout=center
    exit_window_return=$?
    
    if [[ $exit_window_return -eq 100 ]]
    then
        killall -2 wf-recorder
    fi
    
    if test -f "$VIDEO"
    then
        notify-send ScreenCapture "Video stored at $VIDEO"
    fi

    ~/.local/share/applications/screencap.desktop looks like:

    [Desktop Entry]
    Name=Screen Capture
    Type=Application
    Icon=emblem-videos-symbolic
    Exec=screen_cap.sh
    Categories=Utility;

    Conclusion:

    If you think of a cool app idea, give it a shot! Questions can be answered by us and our community over on our matrix channel or on our forum.

    Discover the Librem 5

    Purism believes building the Librem 5 is just one step on the road to launching a digital rights movement, where we—the-people stand up for our digital rights, where we place the control of your data and your family’s data back where it belongs: in your own hands.

    Preorder now

    The post Easy Librem 5 App Development: Screen Recorder appeared first on Purism.

    by David Hamner at April 29, 2020 15:02

    /e/ foundation

    Fairphone and /e/ OS team up to introduce first privacy conscious and sustainable smartphone

    Fairphone and /e/ OS team up to introduce first privacy conscious
    and sustainable smartphone

    Amsterdam, 29.04.2020 – Fairphone, the social enterprise designing, producing and selling smartphones that looks to change the industry and how products are made and puts ethical values first, and /e/OS, the privacy by design operating system that focuses on protecting user data, are partnering to launch the first privacy conscious and sustainable smartphone in Europe.

    With today’s announcement, thousands of people across Europe will have a chance to purchase Fairphone’s sustainable phone, the Fairphone 3 with /e/OS native (available to purchase at https://e.foundation/e-os-degoogled-fairphone-3/), offering them a new and fairer approach to resources and their personal data.

    In 2013, Fairphone launched a movement for fairer electronics highlighting major issues across the smartphone value chain in mining, design, manufacturing and life cycle. Since then, Fairphone has changed how phones are made, expanding the market for products that put ethical values first.

    For many, fairer technology isn’t just about the device and its components, it is also about the software that powers the product; and when Fairphone community members were asked what their preferred alternative operating system (OS) was for the next Fairphone, the Fairphone 3, they voted for /e/OS.

    /e/ OS is an open source operating system that provides a privacy-by-design environment. User data stays private by default, blocking unwanted data flows, saving battery power and bandwidth. There is no location or data scanning multiple times a day. Most Android apps can be used with the option for users to see how built-in trackers are hidden within each app, so they know in advance of any potential threat to their data.

    For both Fairphone and /e/OS, open source software is an important means to achieve their goals. One of Fairphone’s main objectives is to create long-lasting products. Open source software, such as /e/OS can help increase smartphone longevity. In fact, open source enabled Fairphone to successfully upgrade operating systems (without Qualcomm support), updating the Fairphone 2 to Android 7 using open source software.

    Eva Gouwens, Fairphone’s CEO comments: “Our partnership with /e/OS is exciting because we both strive to change the way the tech industry operates in our own way. We’re happy to be able to provide Fairphone users with phones that are not only sustainable, but also take special care to protect their personal data, for those that want data protection. We want people to keep their phones in use for longer and in the past open source software has helped us increase the longevity of our phones, enabling us to provide software upgrades for many years. A fairer phone is about the materials used to produce it, the fair treatment of factory workers and its increased longevity.”

    Gaël Duval, /e/OS founder comments: “Since the inception of /e/OS , we realized that many of our users were not only concerned about their data privacy and willing to reconquer their digital sovereignty, they also wanted hardware that would last longer and be repairable. Many adhere to the open source principles of transparency in their software and they look for a similar approach for their mobile phone. In general, they look for a more ethical approach to technology. It was therefore obvious to us that Fairphone would be a great platform for these customers, providing them with a phone that ticks the boxes of repairability, durability and ethical sourcing.”

    The Fairphone 3 with /e/OS will be available to purchase from 6 May 2020 on the /e/ online shop at https://e.foundation/e-os-degoogled-fairphone-3/ for RRP 479,90€ across Europe.

    Existing Fairphone 3 owners will also be able to download and switch to /e/OS from /e/OS website at https://e.foundation

    Note to the editor

    About /e/

    Founded by Gaël Duval, /e/OS builds mobile operating systems with pre-installed apps and online services that help users regain control of their personal data on their phones. /e/OS is committed to providing better data privacy and security for individuals and corporations, along with a state-of-the-art user-friendly experience.

    /e/OS is a global project, supported by an international core team of experienced entrepreneurs, developers and designers, and a vibrant growing community of contributors. It’s mission is to make technology that makes user privacy accessible to everyone.

    https://e.foundation

    For additional information and interview requests, please contact:

    Véronique Loquet and Brittny Mendoza

    Email: media@e.email

    About Fairphone

    Fairphone is building a market for ethical phones and motivating the industry to act more responsibly. We design, produce and sell smartphones to uncover the supply chain behind our products, raise awareness for the most urgent issues, and prove that it’s possible to do things differently. Together with our partners and collaborators, we’re working to make caring for people and the planet a natural part of doing business.
    Photos, videos, fact sheets and other materials are available at the Fairphone press page: https://fairphone.com/en/about/press/

    www.fairphone.com

    For additional information and interview requests, please contact:

    Ioiana Pires Luncheon and Lora Haspels

    Email: ioiana@fairphone.com and lora@fairphone.com
    Tel: +31 20 788 44 02

    by Brittny Mendoza at April 29, 2020 10:46

    Leaving Apple & Google: Introducing /e/OS for Fairphone 3. Pre-order today.

    Leaving Apple & Google: Introducing /e/OS for Fairphone 3. Pre-order today.

    /e/OS and Fairphone 3
    Fair with people and the planet. Fair with your data.

    Please welcome Fairphone 3 to our range of deGoogled phones!
     
    We are thrilled to announce a partnership with Fairphone to launch the first privacy conscious and sustainable phone, fair for the planet and your personal data.

    In 2013, Fairphone launched a movement for fairer electronics highlighting major issues across the smartphone value chain in mining, design, manufacturing and life cycle. Since then, Fairphone has changed how phones are made, expanding the market for products that put ethical values first.

    For many, fairer technology isn’t just about the device and its components, it is also about the software that powers the product; and so when Fairphone community members were asked what their preferred alternative operating system (OS) was for the next Fairphone, the Fairphone3, they voted for /e/OS, the pro-privacy, deGoogled mobile ecosystem.

    /e/ Fairphone 3 is a unique combination that offers a new and fairer approach to resources and personal data for all.
    Pre-order your /e/ Fairphone 3 today. Available starting May 6.

    Existing Fairphone 3 owners can download /e/OS at no cost like for any other supported smartphone.

    How to contribute and support the /e/ project?

    We are often asked how to contribute to the /e/ project and we are pleased to answer this question because users’ contributions are key to the success of an ambitious project like ours.

    The time is now! There has never been so many questions and comments about user’s data privacy, Google, Apple and alternatives to regain control over data privacy… The timing is great and you can contribute in many ways:

    Test /e/OS, report bugs, contribute to patches!

    Anyone is really welcome to report issues with /e/OS, and possible solutions. Just make sure you can reproduce the problem, post appropriate context information, possibly some “logs”, and ideally… a solution 🙂

    Help others! Join the global community!

    We have a growing community of users who are discussing their experience with /e/OS. Join now, you will be able to help others answer common or uncommon questions they have about /e/:

    Join /e/ Community Forum
    Join the Support Channel

    Join discussions, spread the word!

    It’s important to share your experience on our forums, tell us about what you like, your frustrations… It helps us to identify improvements for the product and make it a premium mobile ecosystem.

    Also, please share the word! Every day, new users discover /e/ and love the project. We need everyone to ensure that as many people as possible learn about the project. We can’t count on mainstream media for this!

    So share with friends and your community channels, talk about /e/ on social media, say why you like it!
    You can also share what we post on Mastodon and Twitter

    Contribute financially

    With your help, we can support a growing team of passionate contributors, keep /e/ completely independent and make /e/OS sustainable over time.

    Every donation helps the project to pursue additional development, rent servers for compilation and to host your e.email account or the community forum, pay for domain names and other key expenses amongst other things.

    If you can afford a recurring donation, become a /e/ Patron!

    Otherwise, choose from the different donations options, and get a reward in return!

    Subscribe to our Telegram announcement channel to get latest news!

    Follow us on Twitter and Mastodon: @e_mydata

    by Brittny Mendoza at April 29, 2020 08:00

    Jolla

    Sailfish OS Rokua is now available

    Rokua forms part of Finland’s first UNESCO Geopark. In Rokua it is easy to see traces of the Ice Age. The park’s many esker ridges and wooded sandhills are blanketed with silvery lichens. Scattered through the park are many kettle hole lakes nestling in sandy hollows.

    It has been almost a year since my previous blogpost aimed at a more tech savvy audience. With Sailfish OS Rokua it felt again like a good opportunity for such a blog post. The changes to the Sailfish OS user experience are available at the end of the document, if you want to skip the technical topics.

    There are a lot of things that are not visible for a casual Sailfish OS user. This 3.3.0 release contains a vast number of updates for the lower level of the stack. We’ve included for example the updated toolchain, a new version of Python and many updates to core libraries such as glib2. In this blog I will go through a few of the changes and what they mean in practice for users, developers and Sailfish OS in general.

    It is not just about updating one component – “Distribution jenga”

    As many of you know operating systems consist of hundreds of components. These components are connected to each other at either compile time, link time or run time. When we conduct low level updates, as we have in this release, the changes for one component multiply and we end up updating tens of components because of their dependencies.

    One such case was the update of the gobject-introspection package to version 1.63.2. The librsvg library started to fail during the process. This librsvg failure looked like an issue with vala. We decided to update vala also to reduce future maintenance work. This required the autoconf-archive package that we haven’t previously provided. Packaging the latest autoconf-archive then conflicted with gnome-common, which needed a small modification to make it compatible with autoconf-archive. After all the above, we finally got autoconf-archive installed and got back to vala and got all the pieces compiled together.

    After compiling these changes together we had to integrate everything in one go to prevent the development branch from breaking. This was just one example of the many changes we have provided with this release. With the toolchain it was much more time consuming to actually get all the build failures fixed.

    Binary compatibility with the Toolchain update

    The most difficult, and at the same time one of the most anticipated updates by the whole Sailfish OS development community is the update of the toolchain. This includes an update of GCC from version 4.9.4 to version 8.3. We did not update to version 9.x or 10.x, as the work was started when the latest release by linaro/ARM was 8.3. We wanted to finalize this version before taking the next step. As mentioned also in the Hossa blog post, it is better to take smaller steps when updating complex components. While we did not get the latest and greatest, the changes are still extensive. GCC 4.9.x series was released in 2014 while GCC 8.3 is from Feb 2019. Even though the change is significant, we managed to preserve binary compatibility. All the binaries and applications compiled with the old toolchain should work just as they did before.

    New code optimizations and support for the more recent C++ standard are a couple of the possibilities we gained with the update. The GCC update rebuilt the whole OS multiple times because of circular dependencies in the code, as expected. This process revealed dozens of packages that needed to be fixed. Some of the fixes were trivial, such as bluetooth-rfkill and buteo-mtp. At times we had to just take into use a fix that had already been available for the previous toolchain. This was the case for example with gst-plugins-base. There were tens of similar PR’s that had to be accomplished all over the stack to get everything built.

    Some of the problems do not become visible at compile or linking time, making them very hard to notice. For example, we ran into problems with the old perl. We considered first to update perl to a newer version, but decided to develop a small patch instead. The rationale for this decision was to reduce risk for the release, as the amount of changes all combined was already considerable. In addition it should be noted that perl by default is not installed on the devices, it is in the stack because it is needed for the builds. Nevertheless we’ll need to look into updating perl later.

    All things considered the toolchain update is a major step forward and with this change we will have development opportunities which we do not even know of yet. We invite you to comment and collaborate if you think of new ways or have additional ideas about how these changes will benefits us all.

    Python 2 support ended

    Python 2 support ended on 1st of January 2020. Python by default is not installed on Sailfish OS devices, it is used in our build environment. It also provides us the pyotherside bindings to Qt which allow developers to create Qt based applications using python. In this release python3 was updated to version 3.8.1 and python2 to the latest version 2.7.17. Having two Python versions in the stack means increased maintenance, and thus we have decided to start deprecating Python 2 and will focus exclusively on Python 3 in future.

    Removing Python 2 may cause extra work for our development community, as some may still be using it. Despite this, the decision to remove Python 2 and concentrate our efforts on upgrading the stack is necessary and evident. Python 2 packages will remain in our repositories with this release and partly also on the next release as well, as removing the dependencies will take time. Nevertheless please consider moving all your code to Python 3 as soon as possible.

    As a side effect of this work we were able to improve our build time, for example for dsme. Many of the dependencies on Python were not really needed, so removing them reduces the need for rebuilds.

    QEMU

    QEMU is an important part of our toolchain, used to compile our ARM and aarch64 binaries with x86 based machines. Over time we have experienced some problems with QEMU and it has become evident that we needed to update it to a newer version. Even though the release includes version 4.2.0 (update from the old 2.x branch), internally we conducted the upgrade in two steps, first to 4.0 and then to 4.2 release.

    The change required a notable amount of work and resulted in no visible improvements for Sailfish OS end-users as such. However, developers will now be able to enjoy the new capabilities.

    Library updates

    Some of the updates would not have been possible with the previous version of the toolchain, as was the case with glibc which we’ve now updated to version 2.30 from the previous version 2.28.

    We have also worked on different system components, such as expat, file, e2fsprogs, libgrypt, libsoup, augeas, wpa_supplicant, fribidi, glib2, nss and nspr as part of our normal maintenance work.

    Included are also updates to lower level components that improve the user experience. The updated Gstreamer 1.16.1 offers better support for selected video and audio codecs. We also switched gstreamer to use ffmpeg for all SW codecs on the devices.

    Technical debt installment

    As part of our move towards a more maintainable system we have also been switching to use busybox more widely. In this release we moved coreutils, tar and vi to busybox. An additional benefit of using busybox is that it reduces the memory footprint of our image. With the coreutils replacement we saved ~4.2MB and with tar ~1.4MB from all device images. The vim-minimal replacement saved ~1.6MB of space from images with developer mode.

    As with any platform there are times when one needs to look back a bit in order to consider how to proceed in the future. We have had our fair share of issues with statefs and we have come to the conclusion that it is not worth maintaining anymore. As such we will deprecate statefs after the 3.3.0 release. Instead of using statefs we will be moving to our other APIs. For example in future status information will be moving to libqofono that is already available in the stack. Other examples that used to require statefs are maliit and the browser.

    We also started to deprecate qtaround. Qtaround is a small helper function library that is not used anymore and thus maintaining it in the stack does not make sense. We also removed other repositories and packages that are no longer used, such as cutes-js, cutes-qt5, meego-lsb, and libtalloc to name a few.

    Sandboxing system services

    There was also work done to further limit access to system services, which was mostly achieved using the systemd sandboxing feature. Surely this is just a small step, and we have the older systemd currently in use which does not include all of the latest features, but still provides a clear path forward for limiting our attack surface. Examples of how it was done can be seen in the mce and sensorfw repositories.

    While systemd sandboxing is a small thing and currently only used by the system services, we have also been looking to provide similar capabilities for applications as well. There are no updates on the matter within this release, but there is already firejail packaging available for those who want to do early experiments. Whether we will make it part of the official API remains to be seen, and any feedback would again be welcome at together.

    Changes for upcoming features

    As mentioned in our earlier blog post we are working on providing multi-user functionality. This is something that has been requested by our partners. Access for different users on the same device is something that’s needed particularly in corporate environments where, for example, devices may be mounted in cars. Some lower-level enablers are already included in this 3.3.0 release.

    We also noted that the community has been working on FlatPak. To help the community effort we merged libseccomp and json-glib into the Sailfish OS. We undertook internal research regarding FlatPak with our partners, and While FlatPak seems nice, the conclusion was that we do not see FlatPak as the selected Sailfish OS application bundling framework, mainly due to its high resource usage. Application sandboxing techniques need further research and we’re still looking in to the right approach.

    Visible changes

    Sailfish OS 3.3 is a major release including also visible changes. Here is a recap of some of them.

    Weather icons

    The new icon set is based on the current design language. We’ve highlighted key elements like the sun, moon, as well as rain so that they visually stand out from the symbol. Hence the sun will look ‘sunny’ on dark as well as on light Ambiences.

    Weather icons

    EAP-TLS Support

    In this release support for connecting to WPA-EAP(TTLS) and WPA-EAP(TLS) networks with certificates has been added.
    WPA-EAP certificates support

    Global Address List (GAL) support

    For all Exchange Active Sync users, you will now find support for searching contacts from the Global Address List (GAL) when adding recipients to an email. This support will be extended further in the future.
    Global Address list support

    Nextcloud account

    Nextcloud accounts can now be added directly. The support includes the most comprehensive collection of features available so far with any integrated account, including backups, contacts, calendar, images and notifications.
    Extended Nextcloud support

    Location stack

    For some time we have been offering Mozilla Location Services for our community. As explained on their blog, Mozilla will unfortunately be ending support for this. This is visible in positioning performance for the community releases. While our commercial partners have their own solutions for assisted location providers, we do not have an alternative for our community at this point in time.

    We have identified a few fixes in our location stack that improved the performance and we are looking for more. We are also checking alternative services we could take in to use.

    So quite a lot of things happened and more stuff to come, stay tuned 🙂

    To celebrate the new release we offer Sailfish X with special price. You can get the offer by entering voucher code VAPPU when checking out from Jolla Shop. The offer is valid only for a limited time.

    Br,
    Sage

    The post Sailfish OS Rokua is now available appeared first on Jolla Blog.

    by Jussi Maaniitty at April 29, 2020 05:00

    Tutanota

    Data protection advocates prevail: Germany builds a Covid-19 tracing app with decentralized storage.

    The original plan of the German government was to build a corona tracing app that should store data centrally. Due to heavy criticism, the German government changed course: The tracing app that will warn people about having been in contact with an infected person will only store contact data on mobile phones, just like data protectionists demanded.

    April 29, 2020 00:00

    This Week in F-Droid

    Big Website Update

    We have just completed a big overhaul of the website that makes it run smoother, handle translations better, and it much easier to build and customize. The whole process was updated to run in Debian/buster using only Debian packages, while keeping the standard Ruby methods working. That makes it easy for non-Ruby developers to jump in and improve this site. There is an overhaul of the Markdown translation workflow, so it should be a lot easier to translate the pages, docs, and posts. To hightlight that, the bottom right of each translatable page will now show “Translate on Weblate”, click on that to go directly to translating. Another big change is the new “Apps” section which is now organized by the same categories as the Android client app.

    This includes contributions from @uniqx, @eighthave, @redplanet, @webdev4, @moasda, @meskobalazs, and of course the tireless translators!

    by eighthave at April 29, 2020 00:00

    April 28, 2020

    Guardian Project

    "Features" for Finding Trackers

    One key component of the Tracking the Trackers project is building a machine learning (ML) tool to aide humans to find tracking in Android apps. One of the most important pieces of developing a machine learning tool is figuring out which “features” should be fed to the machine learning algorithms. In this context, features are constrained data sets derived from the whole data set. In our case, the whole data set is terabytes of APKs. This post is an outline of the features that we are focusing on in this current project.

    Confirmed Features

    These are features that we will definitely used, and already have good tooling to do the feature extraction.

    Permissions

    Android apps must request permissions from the Android OS to access sensitive user data as well as certain system features. This can naturally give big hints towards tracking attempts. Basically an app which does not request any permissions will have a much harder time of tracking its users, while an app aimed towards tracking will require a myriad of permissions depending on the properties it desires to track (e.g. location, contacts, phone IDs, Bluetooth IDs, WiFi IDs, camera/microphone-access, call-logs and many more)

    Tracking Libraries and SDKs

    Code re-use plays a big role in any software project, why write your own tracking functionality when someone else has already implemented a whole library geared towards tracking users. This functionality is provided by different SDKs, which are pre-configured bundles of functionality which in turn (for this use case) are provided by tracking companies. The app developer often has to choose the desired functionality. While importing a tracking library is no guarantee for tracking activities it is certainly a red flag. We compare the libraries imported by the app with a list of known tracking libraries.

    Domain Names

    Developers leave URLs in form of strings in the code to allow exchange of information with the world outside of the app. This can be used to transfer information about the user which in turn can be used for tracking. The domains often contain a hint about the purpose behind the data transfer (e.g. https://www.google-analytics.com). Domain names are data sinks for collecting data, which gives us a clear point to focus on analyzing since collecting tracking data does not matter if it never leaves the local device, while domain names are the point in the code where data leaves the device and is sent to be collected and analyzed on a remote server. Combined with other features like permissions and seeing tracking libraries being imported a human reviewer could get a pretty good idea of what type of information could be sent. This human “gut feeling” of recognizing fishy combinations of features is something a neural network can often learn to approximate by being trained on a sufficient amount of training data. Domain names known to be relevant to tracking are collected and maintaned by Exodus Privacy.

    New Experimental Features

    These are features that show a lot of promise, but there is not existing tooling to easily work with them. We are working to make it easier, and will cover that work in future posts.

    API Key ID

    The API Key ID is a string that identifies bit of authentication data for enabling access to an online service. Many online services require an API Key even if a library or SDK is not required to access it. Even when the SDK is detected, the presence of an API Key shows that the tracking function is actually enabled. For example, the Google Firebase SDK includes lots of functionality, not only tracking, each of which must be enabled with an API Key. So the presence of Firebase is not enough to confirm tracking. A current example of exactly this is the Austrian Red Cross’ Stopp Corona app to track the spread of covid-19 in Austria.

    Natural Language Processing (NLP)

    As mentioned under the section on domain names, domain names can already give a clear hint at intent. However since this property is well known, URLs might be obfuscated to hide this information. This domain name obfuscation is a well known technique in the world of malware, there is some evidence of use by tracking companies. In this case, a language model might learn that any URL that looks like random letters and numbers might be a sign to consider increasing the probability of classifying this app as tracking slightly, depending on other features like requested permissions, and imported tracking libraries.

    Broadcast Receivers

    Android provides a system for data to be broadcast to all apps on a device, this is known as a Broadcast Receiver. A wide range of data is available via this mechanism, both from the Android system as well as apps. The Android OS broadcasts detailed information about the battery level, health, and charging status, including details of how its charging. Many music apps will broadcast detailed information about the song being played, while also collecting those events from the system and other apps. The full extent of this activity is not well described, both what data is broadcasted, what apps are doing with it, and which apps are collecting. As a feature, Broadcast Receivers have a lot of promise since they fit the patterns of useful features for machine learning: small, globally unique, and easy to extract.

    Feature Extraction Process

    We are using tabular data to feed to the machine learning processes, so the process of extracting and pre-processing different features for classification includes similar steps for every feature. The number of features that can reasonably be processed this way is limited to probably tens of thousands of features, or perhaps even hundreds of thousands. Therefore we have collections of the top-n features where n is in the range of thousands: For example, the top thousand tracking libraries, or all built-in permissions. This way we extract the features out of the binary APK file, and source code when available, and loop over our collections of known features. If the feature was found in the APK/source the tabular data will be a 1, else a 0.

    April 28, 2020 00:00

    April 27, 2020

    Purism

    Automated testing with GNOME Web and Selenium on PureOS

    Early this year Carlos Campos from Igalia implemented an automation mode in GNOME Web (sometimes known as Epiphany). This is especially useful for automated web testing, a subset of GUI testing. I decided it was time to take it for a spin. Carlos has covered the details in his post, here I will focus on the practical requirements to get things running in PureOS.

    Minimum basic requirements

    • GNOME Web 3.31.4
    • Selenium 3.141.0

    We will use the version of GNOME Web included in PureOS (currently 3.32.1.2) and the Python-based Selenium driver.

    sudo apt install epiphany-browser # already installed, so not strictly neccessary
    sudo apt install webkit2gtk-driver # required for browser integration
    sudo apt install python3 pipenv # basic Python tools, don't leave home without 'em
    mkdir webtest
    cd webtest
    pipenv install selenium # get latest version from PyPI

    Using Pipenv

    You’ll note that we’re using Pipenv to isolate our Python packages. This helps when sharing the tests between developers and machines. The upshot is that to access the Python libraries we must:

    1. be in the project folder (cd webtest)
    2. start Python invocations with pipenv run python

    Basic implementation

    Now create a simple Python file called web.py. I really liked Carlos’ encapsulation of GNOME Web as a Selenium driver:

    from selenium import webdriver
    
    class Epiphany(webdriver.WebKitGTK):
        def __init__(self):
            options = webdriver.WebKitGTKOptions()
            options.binary_location = 'epiphany'
            options.add_argument('--automation-mode')
            options.set_capability('browserName', 'Epiphany')
            options.set_capability('version', '3.32')
    
            webdriver.WebKitGTK.__init__(self, options=options, desired_capabilities={})
    
    # Simple test
    ephy = Epiphany()
    ephy.get('https://pureos.net/')
    ephy.quit()

    Now invoke the code:

    pipenv run python web.py

    An orange-bordered web window will briefly appear, load the page and then close:

    Orange-bordered web window displaying the PureOS website

    Running tests

    We can now set up a testing skeleton. Let’s keep the Epiphany class, but remove everything from # Simple test onwards. Instead we’ll create a new file called test_web.py:

    from web import Epiphany
    
    def test_load():
        ephy = Epiphany()
        ephy.get('https://pureos.net/')
        ephy.quit()

    Before we can use this file we need to install a testing framework:

    pipenv install pytest

    And now we can run the tests:

    pipenv run pytest

    Web testing

    Finally we will perform a simple web test using the Selenium API. Expand test_web.py as follows:

    from web import Epiphany
    
    def test_load():
        ephy = Epiphany()
        ephy.get('https://pureos.net/')
        ephy.quit()
    
    def test_title():
        ephy = Epiphany()
        ephy.get('https://puri.sm/')
        assert 'Purism' in ephy.title
        ephy.quit()

    Now invoke pytest again. You should get a result with 2 passed.

    For more details on the Selenium API, see https://www.selenium.dev/selenium/docs/api/py/

    With that, you are ready to create web tests using the default PureOS browser.

    The post Automated testing with GNOME Web and Selenium on PureOS appeared first on Purism.

    by David Seaward at April 27, 2020 13:37

    The smartphone with convenience and control

    I often hear people saying that they have nothing to hide, and I usually reply that it is not about what you want to hide, it is about what you want to protect – your family’s privacy. Modern smartphones are convenience, always on and connected, but they come with a large attack surface to be exploited by hackers or even spying companies.

    Control the hardware

    At Purism, we believe that people should be in full control of their devices instead of their devices controlling them, and shouldn’t have to choose between convenience and privacy. The Librem 5 has been designed to give people convenient features and control of when they are enabled simply by switching them off using our “kill-switches”.

    On the Librem 5, the Wi-Fi/Bluetooth and cellular modules are independent and fully isolated from the main board. This way, the hardware kill-switches can directly sever the power to the hardware components.

    A unique, modular and ethical hardware design

    The Librem 5 has a unique hardware design, which makes it secure, private and the most modular and repairable phone out there. Along with the battery, both cameras the modules for Wifi/Bluetooth, cellular and USB can easily be disconnected and replaced.

    In the real world

    The following videos illustrate our kill-switches used to enable and disable the different features. I have shot those videos myself and, while they are edited for continuity, I made sure to record the real features on the phone.

    At Purism, we believe electronics should respect users interest and security while still being simple to use.

    Discover the Librem 5

    Purism believes building the Librem 5 is just one step on the road to launching a digital rights movement, where we—the-people stand up for our digital rights, where we place the control of your data and your family’s data back where it belongs: in your own hands.

    Preorder now

    The post The smartphone with convenience and control appeared first on Purism.

    by François Téchené at April 27, 2020 13:26

    Tutanota

    Green email is the future: Tutanota uses 100% renewable energy.

    The privacy-friendly encrypted email service Tutanota relies entirely on green electricity. You can now use your Tutanota mailbox, knowing that all your secure emails are also green!

    April 27, 2020 00:00

    April 24, 2020

    Handy News Reader

    Customize In-Article Buttons.

    One of the things You’ll find in the upcoming official release (or on our GitHub page - look for the ver. 0.13.2 and above), is the ability to customize in-article buttons (e.g., “Reload full text”, “Show original text”, etc.) a little bit further. Now You can rearrange their layout from vertical into horizontal (settings › Article’s text › Button layout › Horizontal):

    img1

    or You can hide them completely, if You prefer :) (settings › Article’s text › Button layout › Do not show the buttons).

    As a little reminder, You can also change the buttons’ color via settings › Theme › Tool bar color.

    by Thomas Leigh (noreply@blogger.com) at April 24, 2020 18:03

    /e/ foundation

    eFoundation Site Maintenance

    eFoundation Site Maintenance

    Dear friends, supporters, and valued customers,

    Last night we did some maintenance testing on our website in view of a migration of our “e-commerce” platform from https://e.foundation to a new domain.

    There was an issue with a few IDs that didn’t transfer correctly to the new domain, and were associated with the wrong email addresses.

    Some of you have already received an email notification about this information update (proof the system works correctly on this aspect).
    We have erased all data transferred to the new domain following this test to avoid any future authentication and login issues.

    Your current login information on https://e.foundation, username and contact email remain unchanged.

    We would like to take this opportunity to remind you that we do not keep any payment information on https://e.foundation. If you have a recurrent payment set-up at e.foundation, your payment details are kept by our payment partners (Stripe or Paypal depending of your selection).

    Please accept our apologies for any inconvenience caused and we would like to take this opportunity to remind you that our first priority is the safety and respect of your personal data.

    Best Regards and stay safe,

    The eFoundation team

    by Brittny Mendoza at April 24, 2020 14:43

    Purism

    Librem 5 March 2020 Software Update

    Let’s take a look at what the Librem 5 software team were busy with in March 2020 (weeks 10-13). Some items are covered in more detail in separate blog posts at https://puri.sm/news. The idea is to summarize the coding and design efforts for the month and showcase how we’re standing on the shoulders of giants. Reusing existing free software allows contributions to flow back and forth between communities. These reports are usually rather link heavy pointing to individual merge requests on https://source.puri.sm/ or upstream (e.g. GNOME’s gitlab).

    Adaptive Apps

    This section features improvements on adaptive apps and the underlying GTK based widget library libhandy:

    Phone Calls

    Calls, our phone calls app, saw some visual improvements and internal rework:

    Short and instant messaging

    Chats (aka Chatty) handles SMS and instant messaging via XMPP. It has experimental support for various other formats via libpurple. The team spent a lot of time refactoring the internal and user facing parts of Chats:

    Compositor and Shell

    This section highlights progress in the graphical shell (phosh) and its wlroots based compositor phoc:

    Phosh

    Phoc

    Releases

    On-Screen Keyboard

    Gnome Control Center (Settings) / GNOME Settings daemon

    System-Level integration

    Linux Kernel

    The process of upstreaming our Linux kernel work is covered in a separate report. The current one is for Linux 5.5 and 5.6 so this is about downstream improvements:

    Documentation

    The developer documentation saw several updates:

    Visual Design

    The visual design section shows progress on mockups that might get implemented eventually but it also has news on new and updated icons and other related artwork:

    Lambda

    If you made it down here and want to start contributing join us on matrix. We certainly welcome patches and issue comments on https://source.puri.sm/. If you want to grab an issue and can’t think of a particular problem check the easy and helpwanted tags in our GitLab instance. See you next month.

    Discover the Librem 5

    Purism believes building the Librem 5 is just one step on the road to launching a digital rights movement, where we—the-people stand up for our digital rights, where we place the control of your data and your family’s data back where it belongs: in your own hands.

    Preorder now

    The post Librem 5 March 2020 Software Update appeared first on Purism.

    by Guido Günther at April 24, 2020 14:36