Hasty Briefsbeta

All tags

#android

123 stories total

Bilingual

What We Talk About When We Talk About Sideloading
6 months ago
- Google claims sideloading is not going away, but new policies effectively restrict it by requiring developer verification.
- The term 'sideloading' is criticized as misleading, implying something negative about installing software outside official stores.
- Google's new rules require developers to register, pay fees, and get approval, limiting user and developer freedoms.
- Consumers will lose the ability to freely choose what software to install on their Android devices.
- Creators can no longer share apps directly without Google's approval, undermining Android's 'open' promise.
- States risk ceding digital sovereignty to Google, which has complied with authoritarian regimes to remove apps.
- Google's claim of 50 times more malware from sideloading lacks evidence, while Play Store itself has had malware issues.
- Recent changes in Chrome and AOSP show Google's increasing control over software distribution.
- Developer verification threatens free software platforms like F-Droid and commercial competitors to the Play Store.
- Advocacy is encouraged to keep Android open, with resources provided for consumers and developers to take action.
Keep Android Open
6 months ago
- Google announced in August 2025 that starting next year, app development for Android will require central registration with Google.
- Registration requirements include paying a fee, agreeing to Google’s Terms and Conditions, providing government ID, uploading app signing keys, and listing all app identifiers.
- Actions to oppose the policy include signing an Open Letter in various countries like the EU, US, UK, and Brazil.
- References include overviews, press reactions, video responses, editorials, blogs, discussions, and official documentation.
Simple trick to increase coverage: Lying to users about signal strength
6 months ago
- Android's Carrier Config manager has a flag (KEY_INFLATE_SIGNAL_STRENGTH_BOOL) that reports signal strength as one bar higher than actual.
- AT&T and Verizon have this flag enabled, though its origin is unclear.
- This practice, along with fake 5G indicators, undermines trust in network operators.
- Suggests a hypothetical KEY_FIXED_NETWORK_SIGNAL_STRENGTH_INT to always show maximum reception.
- Criticizes the disconnect between displayed signal strength and actual network performance.
Show HN: DroidDock – A sleek macOS app for browsing Android device files via ADB
6 months ago
- DroidDock is a native macOS application for browsing and managing Android device files via ADB.
- Supports macOS 10.13+ and is free & open-source.
- Features include connecting multiple Android devices simultaneously, intuitive file navigation, and drag-and-drop file transfers.
- Allows viewing image thumbnails directly in the file browser and monitoring device storage with real-time statistics.
- Includes built-in search functionality, a beautiful dark theme, and automatic update notifications.
- Currently unsigned, requiring users to bypass macOS security warning on first launch.
- Recommendation to install ADB via Homebrew for optimal use.
Google will allow "power users" sideload apps from unverified developers
6 months ago
- Google announced a requirement for developers of apps not in the Play Store to register for sideloading, citing security reasons.
- This change would impact F-Droid and other repositories avoiding Google's rules.
- Google later backtracked, allowing 'power users' to sideload unverified apps with additional steps.
- Two methods for sideloading unverified apps: a limited developer account for small groups and an 'advanced flow' for experienced users.
- The 'advanced flow' will include warnings to prevent scams, similar to enabling developer options.
- Google is gathering feedback on the design of this feature, with details to come.
- Speculation suggests Google may require a Google account or ADB for sideloading in the future.
- The backtracking is seen as a strategy to make controversial changes more palatable.
Comparing Android Alternatives: Lineage OS, ∕E∕OS, and Graphene OS
6 months ago
- Lineage OS is a well-established alternative Android firmware, derived from Cyanogen, focusing on privacy and minimal bloat.
- Lineage OS does not include Google Play Services by default but allows for manual installation of alternatives like MicroG or F-Droid.
- Installation requires unlocking the bootloader and using a custom recovery, with support for a wide range of devices.
- Lineage OS includes basic apps like a camera, gallery, and calendar but lacks advanced security features like bootloader relocking.
- ��e��OS is a Lineage OS derivative with added privacy fixes and includes MicroG for better compatibility with commercial apps.
- ��e��OS is closely associated with Murena, offering integrated services but comes with pre-installed apps that may not be removable without rooting.
- Graphene OS focuses heavily on security, supporting only Google Pixel devices and allowing bootloader relocking for enhanced security.
- Graphene OS runs Google Play Services in a sandboxed environment, providing control over permissions without compromising privacy.
- Graphene OS is less customizable and discourages modifications, targeting users needing high security, like journalists or activists.
- All three firmwares improve privacy over stock Android but require trade-offs between security, convenience, and app compatibility.
Android/Linux Dual Boot
6 months ago
- Dual booting pmOS requires a boot method and data storage solution.
- pmbootstrap is needed for many dual boot methods.
- Booting pmOS via computer is simple but requires a computer and fastboot mode.
- Flashing pmOS to the recovery partition overwrites Android recovery mode.
- A/B slots allow flashing pmOS to system partition B, keeping Android on slot A.
- U-boot provides OS selection on devices like Nokia N900 and MangoPi MQ-Pro.
- lk2nd/lk1st loads boot images from ext2 partitions on eMMC or SD cards.
- kexec is a potential but untested boot method for pmOS.
- Stowaway method uses a folder in a partition for pmOS root, useful for encrypted devices.
- SD cards can be used to store pmOS by flashing the filesystem directly.
- Custom partitioning can brick the phone if done incorrectly.
- Shrinking userdata is required for custom partitions but destroys phone data.
- Subpartitions scheme requires partitions labeled with 'system' prefix.
- Whole storage device scheme requires 'pmOS_boot' and 'pmOS_root' labels.
- UEFI/BIOS devices can use GRUB for dual booting with pmOS.
Surprisingly, Emacs on Android is pretty good
5 months ago
- Emacs on Android provides a surprisingly good mobile-PC workflow.
- Emacs on Android has limitations like small screen size and virtual keyboard usage.
- Installation can be done via F-droid or Termux for better CLI tool access.
- Android-specific configurations include modifying UI for touchscreens and using virtual keyboards.
- Customize interface is highly recommended for initial setup on mobile devices.
- Special virtual keyboards like Hacker’s Keyboard or Unexpected Keyboard improve typing experience.
- Fonts can be installed in the Emacs app container for better readability.
- Volume buttons can be remapped for navigation purposes.
- The setup is device-specific, with the author using a OnePlus 7 Pro on Android 12.
Unihertz Titan 2
5 months ago
- Titan 2 is a 5G smartphone with a QWERTY physical keyboard, running Android 15.
- Features a redesigned QWERTY keyboard with customizable keys, scroll assistant, and backlight.
- Supports global 5G frequencies and is in the process of AT&T network approval.
- Equipped with a 4.5-inch primary display and a secondary rear display.
- Powered by a 5050mAh battery with 33W fast charging.
- Includes a dual-lens camera setup (50MP main, 8MP telephoto) and a 32MP front camera.
- Retains classic shortcut buttons and supports dual SIM cards.
- Offers advanced wireless connectivity including Bluetooth 5.4, NFC, and dual-band GPS.
- Comes with a suite of productivity tools and utilities.
- Dimensions: 137.8 × 88.7 × 10.8 mm, weight: 235g.
Molly: An Improved Signal App
5 months ago
- Molly is an independent Signal fork for Android with improved features.
- Fully FOSS with no proprietary blobs, unlike Signal.
- Encrypted database protection with Passphrase Encryption.
- Multi-Device support allows pairing multiple devices to a single account.
- Material You theme that follows your device palette.
- Ungoogled notification system via UnifiedPush.
- Automatic Locking when you are gone for a set period of time.
- RAM Shredding securely wipes sensitive data.
- New and better features to come.
Jetpack Navigation 3
5 months ago
- Introduction of Jetpack Navigation 3 (Nav3), a new navigation library built specifically for Jetpack Compose.
- Nav3 addresses limitations of the original Jetpack Navigation library (Nav2), such as indirect back stack observation and single-destination display.
- Key principles of Nav3 include declarative programming and Compose state as fundamental building blocks.
- Nav3 allows for greater flexibility, such as implementing adaptive layouts with multiple panes.
- A code sample demonstrates defining routes, managing back stack, and displaying content with NavDisplay.
- Nav3 is currently in alpha, with plans for more documentation, code recipes, and blogs in the future.
- Developers are encouraged to provide feedback and file issues to help improve Nav3.
Bootloader Unlock Wall of Shame
5 months ago
- Companies increasingly restrict bootloader unlocking, limiting user control over devices.
- Carrier-locked devices often prevent bootloader unlocking, even after contract terms end.
- Some manufacturers allow bootloader unlocking under specific conditions or require online accounts.
- Custom Android Verified Boot (AVB) keys enable custom OS use on locked bootloaders, though rare.
- Workarounds exist for certain chipsets: Kirin (via testpoints and PotatoNV), MediaTek (mtkclient), Unisoc (specific CVEs).
- No universal Qualcomm method, but some exploits may work depending on the device.
- Resources and tools like EDLUnlock, Spectrum_UnlockBL_Tool, and XDA forums offer potential solutions.
The Surprisingly Complicated World of SMS: Emoji SMS Reactions
5 months ago
- Parents often use the thumbs up emoji in SMS messages.
- Android phones format message reactions with hidden metadata (Hair Space and Zero Width Space) to denote emoji reactions.
- Non-Android phones display the reaction as garbled text (e.g., �� to ” Test 123″).
- The reaction includes the original message, which can increase message size significantly if converted to UTF-16.
- Reacting to a long SMS (near the 160-character limit) can turn it into a multi-part message, drastically increasing its size.
Build Android apps using Rust and iced
4 months ago
- NativeActivity and GameActivity examples are available.
- Examples include na-mainloop and andagdk-mainloop from android-activity, na-winit-wgpu from rust-android-examples, and iced integration example.
- Most examples from iced can be run by omitting the scene rendering part and setting the background of the root container.
- Text input has unresolved issues: window resizing on soft keyboard show/hide, changing input language of soft keyboard, and lack of IME support.
- Copy/paste and show/hide soft keyboard functionality is implemented via Java calls.
- Detailed instructions are available in the android-activity crate.
- Setup involves setting ANDROID_NDK_HOME and ANDROID_HOME, adding the x86_64-linux-android target, and using cargo-ndk for building.
- Test setup includes Arch Linux 6.9.6, JDK-OpenJDK 22, and target API 35.
- android-activity enables building Android apps in Rust, with support from key crates like winit and wgpu.
- iced doesn't natively support Android but can be integrated with existing graphics pipelines, as demonstrated in an example.
Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices
4 months ago
- Kimwolf is a massive Android botnet with over 1.8 million infected devices, primarily targeting Android TV boxes.
- The botnet uses DNS over TLS (DoT) and elliptic curve digital signatures for C2 communication to evade detection.
- Kimwolf's infrastructure includes multiple C2 domains, some of which have been taken down multiple times, leading to the adoption of Ethereum Name Service (ENS) for resilience.
- The botnet is capable of launching DDoS attacks, with observed attack capabilities nearing 30Tbps.
- Kimwolf is linked to the Aisuru botnet, sharing code and infrastructure, indicating they are operated by the same group.
- Infected devices are globally distributed, with the highest concentrations in Brazil, India, and the USA.
- Kimwolf's operators use Rust-based Command Clients and ByteConnect SDK for monetization, earning significant revenue from compromised devices.
- The botnet's author has a notable fixation on cybersecurity journalist Brian Krebs, embedding references and taunts in the malware.
- Kimwolf's evolution includes adopting EtherHiding to harden its infrastructure against takedowns.
Clicks Communicator
4 months ago
- Clicks Communicator is a standalone smartphone running Android 16 with 5G, Wi-Fi, and global band support.
- It features a 4.03” AMOLED display, 50MP rear camera, 24MP front camera, and a 4,000 mAh silicon-carbon battery.
- The device will be sold unlocked, supporting multiple global bands for 5G, 4G LTE, 3G, and 2G.
- Communicator uses a QWERTY keyboard supporting Latin alphabet languages and runs on a MediaTek 4-nanometer SoC.
- Pre-orders are available with two options: a $199 deposit or a $399 full reservation (Early Bird Price).
- The warranty lasts one year, and the company commits to 2 years of Android updates and 5 years of security updates.
- Traditional phone calls require a second SIM/number, but VoIP calls (WhatsApp, Telegram, etc.) work without it.
- The device supports both physical nano-SIM and eSIM.
The Kimwolf Botnet Is Stalking Your Local Network
4 months ago
- Kimwolf botnet exploits residential proxy networks to infect over 2 million devices globally.
- Devices like unofficial Android TV boxes and digital photo frames are primary targets due to pre-installed malware or weak security.
- Android Debug Bridge (ADB) mode left enabled by default in many devices allows unauthorized remote access.
- IPIDEA, a major residential proxy service, was heavily abused by Kimwolf for spreading infections.
- Security researchers like Benjamin Brundage and firms like Synthient played key roles in identifying and mitigating the threat.
- Consumers are advised to avoid unofficial Android TV boxes and stick to known brands to prevent infections.
- Guest Wi-Fi networks are recommended to isolate potentially infected devices from the main network.
- Google and the FBI have taken actions against similar botnets like BADBOX, highlighting the ongoing threat.
- The entertainment industry's lack of pressure on e-commerce vendors to stop selling malicious hardware is noted.
- Future articles will explore more about the creators and beneficiaries of the Kimwolf botnet.
Using Hinge as a Command and Control Server
4 months ago
- Using Hinge as a Command & Control (C2) server is demonstrated, requiring patching the app and MITM techniques.
- Account setup on Hinge requires a phone number, with Mint Mobile 7-day trial SIMs suggested for research purposes.
- A payload is created using a Python script to encode binary data into an image, leveraging Hinge's photo upload feature.
- Hinge's photos and user data are publicly accessible via its undocumented API, allowing retrieval of user IDs and content.
- The post details steps to patch the Hinge app to bypass certificate pinning, enabling MITM attacks on non-rooted Android devices.
- A network security config XML file is modified to trust user certificates, facilitating the MITM attack.
- The process involves pulling APKs from the device, modifying them, and reinstalling the patched versions.
- Mitmproxy is used to intercept and analyze traffic from the Hinge app, revealing sensitive headers and user data.
- The technique showcases how Hinge can be repurposed for distributing data covertly through its platform.
Google will now only release Android source code twice a year
4 months ago
- Google will now release Android source code (AOSP) only twice a year, starting in 2026.
- The new release schedule will be in Q2 and Q4 to align with Android’s trunk-stable development model.
- This change aims to ensure platform stability and simplify development by reducing complexity.
- Google’s commitment to AOSP remains unchanged, with continued focus on security patches.
- Developers are advised to use `android-latest-release` instead of `aosp-main` for building and contributing.
Changes to Android Open Source Project
4 months ago
- Android 16 QPR2 is now available with new features.
- Feature launch flags in AOSP ensure stable development by executing only tested code.
- AOSP allows for development, customization, and testing of Android devices.
- Setup guides are available for environment setup, building Android, and contributing to AOSP.
- Android includes industry-leading security features to protect the platform and ecosystem.
- Android fundamentals cover basic to advanced customization of the OS.
- Compatibility ensures a coherent user experience across different Android devices.
- Android Automotive platform development and customization is supported.
- Configurable virtual Android devices and corporate device management are discussed.
- Security bulletins provide updates for protecting devices across various platforms.
- Android development tutorials guide setting up environments and contributing to AOSP.
- Android architecture explained from kernel to updatable system components.
- Connectivity features ensure devices work together via Bluetooth, NFC, Wi-Fi, and telephony.

first prev4next

About|Login

#android

What We Talk About When We Talk About Sideloading

Keep Android Open

Simple trick to increase coverage: Lying to users about signal strength

Show HN: DroidDock – A sleek macOS app for browsing Android device files via ADB

Google will allow "power users" sideload apps from unverified developers

Comparing Android Alternatives: Lineage OS, ∕E∕OS, and Graphene OS

Android/Linux Dual Boot

Surprisingly, Emacs on Android is pretty good

Unihertz Titan 2

Molly: An Improved Signal App

Jetpack Navigation 3

Bootloader Unlock Wall of Shame

The Surprisingly Complicated World of SMS: Emoji SMS Reactions

Build Android apps using Rust and iced

Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices

Clicks Communicator

The Kimwolf Botnet Is Stalking Your Local Network

Using Hinge as a Command and Control Server

Google will now only release Android source code twice a year

Changes to Android Open Source Project