A OnePlus app is supposedly collecting user data without consent. Again. - OnePlus 5 Guides, News, & Discussion

http://bgr.com/2018/01/26/oneplus-data-collection-clipboard-app/
The offending apk is apparently called com.ted aka TeddyMobile, and it showed up on the Oreo OB2.
Oh, and it looks for & harvests bank info in particular. : https://mobile.twitter.com/fs0c131y/status/956649951056064513/photo/1
This is a good reminder...Please don't copy paste your bank account number...TeddyMobile has a dedicated method to recognize a bank account... pic.twitter.com/U21J2jrXcN
Click to expand...
Click to collapse
A OnePlus app is supposedly collecting user data without consent. Again.
Chris Smith @chris_writes
January 26th, 2018 at 2:27 PM
A few months ago, OnePlus’s extensive data collection practices came into the limelight, but the Chinese phone maker explained that it was using that data to improve its product and services. At the time, OnePlus promised an update that would allow users to opt-out of this unwanted user experience program, and the clamor eventually died down.
Well, a new report now says that there’s still a OnePlus app that can grab data from the phone and send it to servers in China without a user’s knowledge or express consent.
The French security researcher hiding behind the name Elliot Alderson on Twitter detailed OnePlus’s data collection practices back in October, and he has now discovered a strange file in the OnePlus clipboard app.
The @OnePlus #clipboard app contains a strange file called badword.txt ?
In these words, we can find: Chairman, Vice President, Deputy Director, Associate Professor, Deputy Heads, General, Private Message, shipping, Address, email, …https://t.co/ePQvD1citn pic.twitter.com/3dCh0joVkH
— Elliot Alderson (@fs0c131y) January 25, 2018
A Badword.txt file contains various keywords, including “Chairman, Vice President, Deputy Director, Associate Professor, Deputy Heads, General, Private Message, shipping, Address, email,” and others. The file is then duplicated in a zip file called pattern alongside six other .txt files. All these files are apparently used in “in an obfuscated package which seems to be an #Android library from teddymobile.”
All these files are used in a obfuscated package which seems to be an #Android library from teddymobile
— Elliot Alderson (@fs0c131y) January 25, 2018
Now, TeddyMobile is a Chinese company that works with plenty of smartphone makers from China. The company seems to be able to recognize words and numbers in text messages.
As far as I understand, teddymobile is making number identification in SMS
The picture below can be translated like this:
– Total number of SMS 20M+
– SMS identification accuracy 100%
– Identification number recognition rate of 70%
– recognition accuracy of 95% pic.twitter.com/KdQV4Zj1Xc
— Elliot Alderson (@fs0c131y) January 25, 2018
And OnePlus is apparently sending your phone’s IMEI number to a TeddyMobile server, too.
According to the code @OnePlus is sending your IMEI and the phone manufacturer to a Chinese server owned by teddymobile pic.twitter.com/Au0u1sdpNi
— Elliot Alderson (@fs0c131y) January 25, 2018
It looks like the TeddyMobile package might be able to grab all sorts of data from a phone.
In the TeddyMobile's package com.ted, they have a class called SysInfoUtil. This class contains the following methods:
– getAndroidID
– getCPUSerial
– getDeviceId
– getHardwareSerialNumber
– getIMEI
– getIPAddress
– getMacAddress
– getPhoneNumbe
– getScreenPixels pic.twitter.com/9A8UhsOXae
— Elliot Alderson (@fs0c131y) January 25, 2018
Except getIPAddress and getScreenPixels, all the other methods are used.
They also send JSON messages to their servers with a "telephone" and "messageText" fields… pic.twitter.com/vuteISH0Tj
— Elliot Alderson (@fs0c131y) January 25, 2018
Even bank numbers are apparently recognized.
This is a good reminder…Please don't copy paste your bank account number…TeddyMobile has a dedicated method to recognize a bank account… pic.twitter.com/U21J2jrXcN
— Elliot Alderson (@fs0c131y) January 25, 2018
Does that mean that a third party can get access to everything you copy and paste on OnePlus devices? We have no idea, and we won’t know for sure until OnePlus sheds some light on the situation. It’s also unclear why OnePlus clipboard data would be shared with any company to begin with, let alone a third party.
Click to expand...
Click to collapse
The solution is to use something like LineageOS or, say, the NoLimits ROM with all of the OOS stuff deleted out. That's what I do and I have few problems.

What you expected from a phone maker from a communist country? Im seriously considering to sell this phone because of this.

CaptShaft said:
http://bgr.com/2018/01/26/oneplus-data-collection-clipboard-app/
The offending apk is apparently called com.ted aka TeddyMobile, and it showed up on the Oreo OB2.
Oh, and it looks for & harvests bank info in particular. : https://mobile.twitter.com/fs0c131y/status/956649951056064513/photo/1
The solution is to use something like LineageOS or, say, the NoLimits ROM with all of the OOS stuff deleted out. That's what I do and I have few problems.
Click to expand...
Click to collapse
An even better solution is to not support such a sleazy company at all and buy a phone from a brand that at least understands the concept of ethical behavior.

dieselgate
jhs39 said:
An even better solution is to not support such a sleazy company at all and buy a phone from a brand that at least understands the concept of ethical behavior.
Click to expand...
Click to collapse
It's like the dieselgate, it is believed that it is a brand but all brands are involved!

It's not happening
Relax guys....... http://www.androidpolice.com/2018/01/26/no-oneplus-still-not-sending-clipboard-data-china/

Related

[APP] moBudget / Personal Finance - [Updated 1/10/2013] - [v3.26]

moBudget is a user friendly budgeting and expense tracking application. It will help you drive and organize both your personal income and outcome budgeting. By doing so, moBudget will also hint you about possible budgeting and money saving opportunities. Its main screen features a summarized dashboard with a set of intelligent indicators which will tell you how you are doing depending on your budgets and on the current date.
Forget about grabbing a calculator each time you need to get any numbers or if worried about making it to the end of the month or not; moBudget will tell you all: what you have, what you will have, what you owe and more. It will either inform, alert or advice you when needed so you don't need to worry.
By allowing stepping through months, allows you to whether look back to see how you did on previous months or how you will be doing in the upcoming months, so you can fine tune your budgets to the optimal.
Take it with you, record your data and you will see how money won’t cause you a headache anymore!
Key features
Live tile with indicators
Can pin quick transaction tiles to Start screen
Transaction/bill reminders integrated to the system
Charts
Transactions search & history
Today Hub featuring a main dashboard with intelligent indicators
Upcoming and overdue payments, incomes, bills
Color-based and snapshot styled budget bar graphs for easy reading
Easy and fast input for tracking either expenses, incomes or transfer between accounts
Budgets adjustment helper
Actual balance vs budget balance
Accounts and credit cards usage recording *
Cash flow bar graphs and out of funds predictions *
Goals for tracking achievements (debt pay or savings)
Credit card payment estimations and warnings
Credit card bill auto-generation on cut-off date
Can create future operations and schedule recurrent operations
Multi currency support
Account balances reconciliation
Security PIN for data protection
Encrypted backups to the cloud or email
Export your data to CSV/Excel
Transaction reminders
Integrated Handyscan engine to scan receipts
Store receipts in the cloud (Dropbox)
Easy month back and forth navigation
More...!
* Estimated. Will not pull your bank information, however you can sync balances up to a specific date and moBudget will estimate the current and future balance and cash flow according to the data you register day to day.
Download: http://moBudget.jdbpocketware.com/
Full version
Lite(free) version
Lite version limitations:
Max 5 expense categories
Max 2 accounts per account type
Can't export your data to CSV/Excel
Backups can't be sent directly to email
No system reminders integration
No auto-backups
No receipts scanning
You will see Ads
At any time you can upgrade to the full version preserving your data by using the backup and restore feature.
Regards
looks nice. I wonder how it will compare to the free pageonce personal finance.
I do like the paid with wallet thing though. pageonce cant do that.
Well, not sure if Pageonce focuses on budgeting, its more like a mobile interface of your bank info.
moBudget focuses on budgeting and in helping you to stick to it and optimize it through usage. moBudget does predictions and estimations. It will also alert, remind, set recurrings and etc, but all depends on the data you input.
Pageonce is a free app that connects to pageonce.com server, has it reasons to be free... (http://www.pageonce.com/advertisers)
moBudget stores all information on the device(will have password protection btw), no network transfering/sharing with any server, and of course no ads.
Another thing about Pageonce is that only works for US based banks if you want all the syncing options.
Any idea on ETA? This desperately needed and I will purchase immediately. If you need some feedback I can sideload it for you?
Currently have to keep my backflip around to use the check book I have on it.
Thanks
Talked to the dev guys and say it will be around Dec 15th.
A XAP for beta test side loading could be... I'll update on this.
pckshd said:
Talked to the dev guys and say it will be around Dec 15th.
A XAP for beta test side loading could be... I'll update on this.
Click to expand...
Click to collapse
That would be sweet! Thanks for checking..... Running a Samsung Focus
[email protected] said:
Any idea on ETA? This desperately needed and I will purchase immediately. If you need some feedback I can sideload it for you?
Currently have to keep my backflip around to use the check book I have on it.
Thanks
Click to expand...
Click to collapse
Yep what he said, I can also beta test I have a samsung focus.. Pm me if you need any help would love to test it.
pckshd said:
Talked to the dev guys and say it will be around Dec 15th.
A XAP for beta test side loading could be... I'll update on this.
Click to expand...
Click to collapse
Ok. A beta will be published soon, late this week could be...
Cool I look forward to it, if you end up posting the XAP I have no problem testing the app for a week or so then report back any bugs I find.
yea, definitely can run the crap out of it for a couple of days and let you know how its coming.
Don't suppose there's any hope of adding in the ability to import and export Quicken files?
I really miss Pocket Quicken for keeping track of my checking account balance and would be willing to purchase an application which I could import/export or (better yet) sync with Quicken...
Import/export might come in the future. The positive side is that we are on the last month of the year, so for those thinking on changing the way they track their finance could be worth to make a clean start on 2011
Beta testing --> http://jdbp.mobi/phorum/read.php?18,10775
Currently beta testing 1.0.0.5
I am loving it so far!
It's official!
Official site: http://jdbp.mobi/moBudget
pckshd said:
It's official!
Official site: http://jdbp.mobi/moBudget
Click to expand...
Click to collapse
I was going to ask yesterday when will it release and then today and in the morning, saw an google ad on wmpoweruser.com
using the trial atm.
Version 1.4 has been released and much more stable than 1.0
http://jdbp.mobi/mobudget/
MoBudget WM 6.5.X?
How far off do you suppose WM 6.5.X is? The WP7 site states that it's coming 'soon': is it still in the works?
Thanks!
The release of WM6 has been delayed due to some issues raised on the WP7 version. It is finally becoming stable and all improvements will come as well for WM6. Will be released ending February.
for WM6.x
Soon for WM http://jdbp.mobi/phorum/read.php?18,11035

[COMPETITION] Food Trucks - 1.0 on Pebble App Store

I am developing a new Pebble watch app to display which street food trucks are currently open for business and its current location for a given city.I will be using an API that currently collects this information for food trucks in 9 different cities.
I backed the Pebble kickstarter project and I have since written several watch apps, mostly in the transportation area, including one for various bus systems and the BART train. I wrote the apps for myself, but they have also been proven to be useful to thousands of other users.
I also wrote several watch face style apps that aggregated open sourced watch face apps, which enables users to have over 40 ACTIVE watch faces (not in the locker) that will only use up 3 of the 8 watch face slots.
Outside of Pebble, I have been working full time as a senior software engineer for many years and I am very into starting with a well-thought-out design and using the agile process and test first. Anyone monitoring my checkins will see how I will build and unit test each portion of the app. I've had several weeks to work out the design, so I'm ready to start the coding for tomorrow's official start.
Update: The API now supports 14 cities. I have enabled only the 13 cities that actually have trucks signed up for the service that are reporting their schedules. This is more than the 9 cities originally promised by my pitch.
iOS users can download the latest pbw from the downloads section of this project. See my reply below for instructions. Android users can download the latest app from the Pebble App Store.
source code link: http://github.com/mikebikemusic/FoodTrucks
XDA:DevDB Information
Food Trucks, ROM for the Pebble
Contributors
pebblemike
Version Information
Status: Stable
Current Stable Version: 1.0
Stable Release Date: 2014-09-03
Current Beta Version: 0.3
Beta Release Date: 2014-08-21
Created 2014-08-14
Last Updated 2014-09-04
What cities are you supporting? I just moved to Austin and could use a method for navigating the 10,000,000 trucks here.
mcongrove said:
What cities are you supporting? I just moved to Austin and could use a method for navigating the 10,000,000 trucks here.
Click to expand...
Click to collapse
Unfortunately, the API I will use does not yet support Austin or for that matter, the SF Bay Area where I live. The cities in the current API are Boston and Tallahassee in the US and Vancouver, Victoria, Ottawa, Edmonton, Halifax, Calgary and Toronto in Canada.
Like you, the first thing I asked the API developer when I contacted him was when he would cover Oakland. He is very interested in expanding. In fact, 3 of the cities on the above list are new. He said it takes some time to contact and get the truck drivers to buy into reporting their schedules into his app, but it's very easy, so once they start doing it, the information returned by the API is quite good. Better than the other APIs I considered.
Mike
UI Design
It's 10:01 Fri Aug 16 on my pebble as I start writing this...
Documenting and sorting out my mental design of the Food Trucks app UI. A lot of it is based on providing a similar UI to what I used for my BART app.
UI: On Pebble screen, 3 views:
1. Startup text to alert user if Pebble app is not responding, which, if responding gets replaced with
2. Menu of Food truck names and their locations, truncated, and when one is selected,
3. Scrolling text. Full details of the selected truck, including full name, location, ending time and other details such as phone #, type of food, etc.
Configuration screen: Shows list of supported cities. User picks one. Choice is remembered across Pebble runs and reboots.
Task Breakdown
Prototyping phase:
API example output is captured and JSON is analyzed. Use jsbin to write the necessary loops to iterate across trucks.
Filter out the unwanted data and extract the data needed for the menu and the details.
Decide on the format of the JSON to be sent to the Pebble watch.
Decide on the message sequencing between the watch and the javascript.
Code and debug the text layer in the main window to be used during startup.
Code the App Message interface in C. Use the text layer as a debugging screen.
Code the javascript so it sends mock menu data for a sunny day use case in the filtered format expected to be sent when the real data is connected.
Debug the C to Javascript interface.
Evaluate reliability and check for memory leaks.
Code the menu layer into the main window and display the received data in the menu.
Code the Scrolling Text Layer as a separate window pushed onto the main window.
Code the Javascript mock data for the details format.
Debug the interface and check for memory leaks.
Integration coding and testing:
Using Javascript prototype code from task 1 above, write the API call, analyze the incoming JSON and transform it to the expected data for the tested interface.
Debug using live data.
Write the configuration html and javascript.
Mock up edge and exception data cases and fix bugs.
Design icon and marketing materials.
If time permits, replace static arrays with malloc/free data.
Check and fix any memory leaks.
Release first version.
pebblemike said:
Prototyping phase:
API example output is captured and JSON is analyzed. Use jsbin to write the necessary loops to iterate across trucks.
Filter out the unwanted data and extract the data needed for the menu and the details.
Decide on the format of the JSON to be sent to the Pebble watch.
Decide on the message sequencing between the watch and the javascript.
Code and debug the text layer in the main window to be used during startup.
Code the App Message interface in C. Use the text layer as a debugging screen.
Code the javascript so it sends mock menu data for a sunny day use case in the filtered format expected to be sent when the real data is connected.
Debug the C to Javascript interface.
Evaluate reliability and check for memory leaks.
Code the menu layer into the main window and display the received data in the menu.
Code the Scrolling Text Layer as a separate window pushed onto the main window.
Code the Javascript mock data for the details format.
Debug the interface and check for memory leaks.
Integration coding and testing:
Using Javascript prototype code from task 1 above, write the API call, analyze the incoming JSON and transform it to the expected data for the tested interface.
Debug using live data.
Write the configuration html and javascript.
Mock up edge and exception data cases and fix bugs.
Design icon and marketing materials.
If time permits, replace static arrays with malloc/free data.
Check and fix any memory leaks.
Release first version.
Click to expand...
Click to collapse
In an ideal world, I would do the development in more or less the above order. But, as pointed out in the email sent to the 20 finalists there are early deadlines. I want to make this app available to all Pebble owners. This project won't need a companion app for Android or iOS, so I don't have to worry about Whitelisting. However, I will need to bundle the JS with a working API call by the end of next week. To that end, my goal is to start working on integration coding tasks 1, 2, 3, and 5 by Thursday, so I can post a beta on Friday.
This prompted me to consider what else I can accelerate. I decided to give the new CloudPebble Graphical UI Editor a try and see if it will build what I planned to do for prototyping tasks 5, 10 and 11. I may end up writing two applications. one that I can rapidly write and test code with, and the other where I assemble the tested code into the UI.
Update: I tried CloudPebble Graphical UI Editor, but it does not yet allow me to make either a SimpleMenuLayer or a ScrollLayer. It will be easier for me to build this myself.
bundle early, bundle often
FWIW - as I understand it, you don't need the javascript finalized (though that's certainly very good) - but you do need to have *a* bundled version of your javascript in place before they collect. It seems silly, but I've just published a barebones version of my app w/ javascript enabled that warns, specifically, that it's only published for javascript bundling. (Then again, the whole javascript pre-approval process in the walled garden that is IOS is pretty silly, IMO)
I don't think you technically need to make it public, you just need a published/ready version, but I went ahead and did so because I'm a paranoid type, and my free time is too limited to chance it. Once any version of your javascript has been published, I gather the updates in the future are made available on the order of minutes not weeks.
cynorg said:
FWIW - as I understand it, you don't need the javascript finalized (though that's certainly very good) - but you do need to have *a* bundled version of your javascript in place before they collect. It seems silly, but I've just published a barebones version of my app w/ javascript enabled that warns, specifically, that it's only published for javascript bundling. (Then again, the whole javascript pre-approval process in the walled garden that is IOS is pretty silly, IMO)
I don't think you technically need to make it public, you just need a published/ready version, but I went ahead and did so because I'm a paranoid type, and my free time is too limited to chance it. Once any version of your javascript has been published, I gather the updates in the future are made available on the order of minutes not weeks.
Click to expand...
Click to collapse
That's good to know, John,
Since the first 3 tasks of my prototype will get me to usable JS code for my integrated app, I'm not too concerned, even if it gets bundled and distributed.
But I thought that published/ready meant that Android uses would be able to download it immediately. I wouldn't want to publish anything that didn't work.
Mike
UPDATE:
Hey, everybody. Cherie just posted: "Submit your JS changes before 8/19/2014 11:59AM PST"
Progress Updates
Aug 15 2pm - Prototype task 5 is done. Github repository created. Stub checked in.
Aug 15 2:20pm - Prototype task 1 is done. jsonanalysis.js checked in.
Aug 15 3:00pm - Prototype task 2 is done. jsonanalysis.js updated.
Aug 15 4:00pm - Prototype task 3 is done. jsonanalysis.js updated.
Aug 15 7:00pm - Prototype task 4 is done. 3 unit tests passed. main.c updated.
That's it for today.
Aug 16 8:00am - Added assertions to debug and exercise app message sequencing, refactored unit tests. main.c checked in. Unit test output:
​I realized that task 6 depends on task 7 so, I'm starting 7 first.
Aug 16 8:30am - Prototype task 7 is done.
Aug 16 10:30am - Prototype task 8 is coded, but has timing issue
Aug 16 4:00pm - Prototype task 9 is done. I decided that the memory leak "Still allocated <42949" is bogus because the only allocations were 1 window and 1 text layer and both got deallocated. (removing either destroy results in a reasonable 2 digit number leak). I then implemented and am satisfied with Prototype task 10 being done.
Aug 17 8:30am - Did task 12 before task 11. Both needed to work at the same time anyway. Code checked in.
I am declaring the Prototype phase complete and moving on to integration. Will change my status from Testing to Alpha.
Aug 17 9:30am - Integration tasks 1 and 2 went smoothly. Real data looks like I expected.
Aug 17 noon - Integration task 3 is working, but I have to go off to play music with friends. Will try to put together what I need to publish a beta on the Pebble App Store either tonight or tomorrow.
Aug 17 10:40pm - Put together enough of integration task 5 that I could publish the app as a beta. Because of the all the unit testing, there should not be too many bugs. However, I will continue to build a lot of edge tests, add one more icon that shows up on the watch, and fix any bugs I find through my additional tests or get reported. Your comments, suggestions and bug reports are welcome. I also need to update my website.
Aug 19 9:30am - Found and fixed several bugs. Published a more stable 0.2 beta. See release notes.
Aug 19 10:00pm - Started coding integration task 4. What I'm doing for that is expanding on the function testRequestSceduleFor(city) in the javascript. Since I don't want to ship all this test code with the app, I created a test branch where I will put the additional code. Fixes will merged into master. I'll be testing handling of very long string sizes and very large number of trucks. I already know the C program will fail because I'll be sending more data than the fixed sizes I put in. Since I have time, I will convert to malloc/free to fix these failures.
Aug 21 7:30am - Completed all tasks except for releasing a 1.0 version and updating my website. API now has Checked source code of 0.3 into github. I consider this a release candidate.
Aug 22 7:00am - Website is now updated with this app. Banner for the app store was updated to 10 cities. Here are screen shots of the food truck icon on the pebble, the startup screen and the no food trucks are open yet message.
Aug 27 7:00am - Updated configuration from 10 cities to 13 cities. More will be added as truck data becomes live.
Sept 3 9:30pm - Bumped version number to 1.0 after giving a number of iOS users a chance to download and use the app. Finalized the marketing materials to match the number of cities supported.
AppMessage timing issue
I've just implemented the AppMessage code for my app which requires a rapid sequence of requests and responses that is always kicked off from the javascript side. It's working fine when all my logging is in place, so I disabled the log messages and now it gets stuck after the first round-trip message. The message sequencing for the test is as follows:
JS: send count of 30 to C
C: request item 0 to JS
JS: returns item 0 to C
C: request item 1, then both sides go idle. JS does not get the message.
I found that if I add a psleep(100) before each request in the C code, it will get farther, but will eventually stop at a different item number, for example:
Not sure why yet. The send / receive code in the C program is a slight variant of the todo list demo app in the 2.0 sdk, also similar to what's in the weather and quotes apps in the 2.2 sdk.
Code as it stands is checked into github.com/mikebikemusic/FoodTrucks
I'll probably figure it out while out doing errands today.
====================================================
Update: Searching through the pebble forums, I found a few others who had similar problems. One of whom said his solution was in the todo list demo app, without explaining what his fix was, which didn't help me much. There was mention in several places about waiting for an ACK, but never an example. I updated my SDK to 2.4.1, but the demo apps all looked pretty much like mine. So, I re-read the app_message API looking for a way to set a callback for an ACK and noticed that app_message_outbox_begin can return,APP_MSG_BUSY. I then coded a retry/timeout using psleep, and lo and behold, the code is now working. Looking back at the 3 SDK samples they will all do the same dumb thing: throw away the request if it can't be sent immediately.
A little experimentation and measurement and I found that sometimes the wait between outgoing messages to the JS can be up to 1 second. I coded up a stress test that ran for a number of minutes and kept running even through an incoming phone call conversation. I caught this screenshot right before stopping it (over 20,000 round trips without stopping):
Bogus memory leak report
I started to see the following during testing of starting and stopping my app:
[PHONE] pebble-app.js:?: JS: starting app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: app is ready: 1
[INFO] ocess_manager.c:291: Heap Usage for App <Food Truck: Total Size <13348B> Used <5692B> Still allocated <0B>
[PHONE] pebble-app.js:?: JS: stopping app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: JS: starting app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: app is ready: 1
[INFO] ocess_manager.c:291: Heap Usage for App <Food Truck: Total Size <13348B> Used <5248B> Still allocated <42949
[PHONE] pebble-app.js:?: JS: stopping app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: JS: starting app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: app is ready: 1
[INFO] ocess_manager.c:291: Heap Usage for App <Food Truck: Total Size <13348B> Used <5692B> Still allocated <0B>
[PHONE] pebble-app.js:?: JS: stopping app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: JS: starting app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
[PHONE] pebble-app.js:?: app is ready: 1
[INFO] ocess_manager.c:291: Heap Usage for App <Food Truck: Total Size <13348B> Used <5692B> Still allocated <0B>
[PHONE] pebble-app.js:?: JS: stopping app: 19177E4B-72D9-4B0C-B9D3-497C77488971 Food Trucks
Since only 24kb is available, 42949 makes no sense. It reports no leaks if my code also creates/destroys the scrolling window. It's almost as if I need to do a minimum amount of memory allocation before the leak detector works properly.
Release Notes
0.1 Aug 17 10 pm Published first beta to allow a working pebble-js-app.js to be bundled and to solicit user beta testing.
0.2 Aug 19 9:30 am Watch icon added. Changed startup message. Pre-build scroll window and its layers at startup. Bug fixes: Prevent multiple scroll windows when repeating select button quickly. Reset scroll to top when selecting details. Clear prior city's list when switching cities.
0.3 Aug 21 7:30 am Built javascript driven testing of C app. Used it to debug malloc/free code. The Javascript tests exercise the app with unrealistically large strings and large numbers of trucks coming from the API. In examining the API, I found that the developer added 5 new cities, so I added them also to the configuration screen. I will be doing live testing for all the cities before publishing an official 1.0 release.
Update: Aug 21 7:30 pm Of the 5 new cities I tested, only 1 had active trucks, so I removed the other 4 from the drop down. Fortunately, this is a simple server-side fix to hide the others until they are ready.
malloc/free challenge/solution
I ran into a little snag (which I eventually solved) during the conversion from using a fixed size array for the menu titles and subtitles to allocating them on the fly with malloc/free. I wanted to change the pointer directly in the menu_items.title without having to allocate a separate array of pointers. Problem was that title and subtitle are declared const, so free(menu_items.title) gets a compiler error.
I discovered that reinterpret_cast<> and const_cast<> are not supported by the compiler. Eventually I tried a simple (void *) cast, which did the trick. Then I refactored the code so that one bottleneck method took care of the free function and updating the pointer. I'm pretty proud of that code change. It's aware of the two string pointers that are not malloc'ed and provides an interface that prevents accidental leaks when my code dynamically changes the menu list.
Comments about developing using cloudpebble.com
I started writing pebble apps using cloudpebble soon after it first came out. I didn't have to install a dev system at home and I could make a quick bug fix at work, if necessary. I've since installed the development tools at home and used that primarily. I decided to give cloudpebble a second look for this competition. It's progressed a lot, but there are still some things on my wish list.
I find it a bit inconvenient when I have compile errors that I cannot see unless I open a second browser window to view source and errors side by side. A single button to flip back and forth between the compile logs and the current source code would really help.
Cloudpebble does not allow me to check in files unrelated to compilation, such as the configuration html. At one point, I tried to commit new code and I got an error (with no error message, just the word error). I figured out it was because of updates I had done to files unrelated to the compilation, but the only choice I had might have replaced all the new code I wrote with the previous commit. So I made a backup of my changes, updated the project and pasted back the changes.
Finally, as I had mentioned at the start of the challenge, the new code generation feature did not help me because I needed layers that were not supported yet. I ended up creating those layers while I was trying to track down the false memory leak report. I like doing that because now, if the app runs out of memory due to too many trucks in the menu, it won't fail to create the scroll layer for those that made it into the menu. Hmm, I need to put together a test case for that...
Feedback Anyone?
Android users can download my app from the Pebble store.
iOS users can get an advance copy here. The easiest way to load on iOS is to put the pbw file on your dropbox and, from dropbox, select the file and Open In Pebble.
Use the Reviews, Feature Requests, and Bug Reports tabs at the top of this development page. Also, search for "Food" in the Pebble store to find my app and tap the heart button on it. I see 5 already!
Adding another city
Looks like several more city's data has come online. I've added Hamilton (Near Toronto), Surrey, and Kitchener-Waterloo to the configuration. The other new city, Columbus, Ohio just has a few trucks using streetfoodapp.com. Only 2 of the 20 trucks registered with streetfoodapp.com in Columbus are promoting themselves this way.
If you live in Columbus, Surrey, or Kitchener-Waterloo that list just a few trucks, go tell your favorite food truck vendors to start publishing their schedule on streetfoodapp.com. If you live in a city not supported, click here to request your city
Feature creep vs planned development
It may seem like I've stopped working on my app now that it's feature complete and stable, but that's not entirely true. Yes, I've requested and am awaiting feedback from users, and I'm especially interested in seeing what happens when iOS users can see the app on their app store. That should happen any day now, since I met the Aug 19 deadline for JS bundling. I needed to publish another bug fix 2 days later, and one of the fixes I planned would have required a minor change to my JS. That JS fix was for an edge case that could only occur with the artifical data I supplied as a unit test that had a string size much larger than any in real data. If I updated my JS, iOS users would be delayed getting the other C code fixes. So, I chose to ship 0.3 with the original JS. It is interesting to note that when I reverted my JS manually, and published it, the dev-portal considered it a different version, so I pulled that release and reverted the JS to what I checked in to github. It turned out to be a whitespace difference. So, word of caution, the JS is compared byte by byte (or maybe a checksum).
Meanwhile, I have considered a few improvements. And I've experimented with one of them, which required further JS changes. The change will eventually go to the master branch, but rather than providing an improvement that nobody really cares or needs, I'd rather wait for feedback and act on that first, rather than announce future planned improvements. As features creep in, it's easy for the app to become more complex to use.
I'll give you one example. I'm on the west coast and when I look at the times reported for the Boston food trucks, the times are off by 3 hours. Should I fix it? Some would say, of course. But think about it. Are the real users who use this app going to be in a different time zone when they need to go out to lunch and open my app? Extremely unlikely. Both JS and the pebble watch API fall flat on their face when it comes to determining time zone differences, both dealing only with local time. I know how to compute that offset by calling another TZ API like I did for my Any Time Zone app. What I chose to do instead was contact the Food Truck API developer suggesting he provide all API users with a TZ offset in the data response. He has agreed to do so in a future API version. This is how planned development should work.
Mike
1.0 released
I posted my 1.0 build last night. It is available in both the Android and iOS Pebble App Stores for download.

Joying Intel Sofia - Strange Web Traffic - Is the radio "phoning home"?

Folks:
I've been checking some recent partial web traffic logs for my Joying Intel SoFIA 3GR JY-UL135N2 and I've noticed the following web traffic:
Code:
Mon Jul 17 2017, morning (192.168.1.20) wxlink.sinaapp.com
Mon Jul 17 2017, morning (192.168.1.20) reg.carbit.com.cn
Mon Jul 17 2017, morning (192.168.1.20) wxlink.vipsinaapp.com
Mon Jul 17 2017, evening (192.168.1.20) apk.carsql.com
Anyone here notice the same? These are all chinese webpages, and SinaApp.com = a weibo webpage of some sort. Carbit seems to be related to Baidu.
Why does this keep coming up? Is this the android software "phoning home"?
wxlink could be a weather related service.
according to this post, the carsql one looks like a backdoor to me, with remote ability to add and remove apk files.
The guys who design the FYT/SYU based units (sofia and others) designed and sell a complete app ecosystem, including their own app store and account management system. Some rom's have left over files, like carui.apk or carmarket.apk, appupdate.apk etc, that still attempt to connect to the carsql server's. Although outside of their home market in china, all of these services are not functional. FYT/SYU are ODM's for these units, so as a customer of theirs, you license pieces of their software, which could include user tracking for data mining purposes among other things. Outside of china, I wouldn't worry about it. Use titanium to disable any other packages which you deem not useful. From decompiling the APK's, it doesn't seem like there are any backdoors. there is a ROM update, as well as a package update management system that they run. http://www.fyttek.com/series/service.html FYI.
Duly noted, thanks.
The best way forward is to block those URL's in AdAway, and the problem goes away. "Leaky" apps, apk's and firmware set the stage for data mining on the low end of the threat spectrum to enabling hacking and mass surveillance on the other side of the spectrum.
Best to cut it off at the knees wherever possible.

Privacy Agreement Grants Board Access

I received my much anticipated OnePlus 6T yesterday. Unboxed it, tapped "Start" button. Scanned through both "Agreements," turned it off, boxed it up, got an RMA and shipped it back. I'm no attorney, I'm a broadcast engineer, but in my job I have to navigate the whole alphabet soup of government agencies red tape so I've learned some "legalese." I' returned the 6T because of the language in the "Agreements". When you tap "I agree" to both, then activate and use the device, your granting OnePlus access to anything on the device or networks on which it connects (condensed Reader's Digest version). Like everybody in the broadcast business I have "a lot of irons in the fire," I make notes about projects and ideas on my phone. There's no way I'm giving anyone permission to cherry pick my creativity or access to my company & networks proprietary information. I'm offering this as my personal observation on this forum and suggest anyone who is just receiving theirs new, read the legalese very carefully before you tap "I Agree."
Who the **** reads those? ?
Still why I don't buy any device that doesn't have Lineage support... However what are you going to replace it with? Going to go buy another flagship? Have you glanced through other's privacy policies? This stuff is pretty boiler plate at this point, it's CYA. Not that I'm defending it, because it shouldn't be like that, but in today's "sue happy world", and "everything needs to be connected", guess what? The solution would be just to remove this these services, there are tons of posts of which OnePlus services to remove if you want to stay on OOS and protect your privacy.
So back to the replacement, lets take a Samsung, those are popular....., have you glanced at their privacy policy, because it's similar link
I didn't go over entirely, and I'm sure there's more details, but I'm guessing OnePlus's blurb, looked something similar to this (From Samsung's Website):
In addition to the information you provide, we may collect information about your use of our Services through software on your device and other means. For example, we may collect:
Device information - such as your hardware model, IMEI number and other unique device identifiers, MAC address, IP address, operating system versions, and settings of the device you use to access the Services.
Log information - such as the time and duration of your use of the Service, search query terms you enter through the Services, and any information stored in cookies that we have set on your device.
Location information - such as your device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use certain Services.
Voice information - such as recordings of your voice that we make (and may store on our servers) when you use voice commands to control a Service. (Note that if we work with a third-party service provider that provides speech-to-text conversion services on our behalf. This provider may receive and store certain voice commands.)
Other information about your use of the Services, such as the apps you use, the websites you visit, and how you interact with content offered through a Service.
Information from third-party sources
We may receive information about you from publicly and commercially available sources (as permitted by law), which we may combine with other information we receive from or about you. We also may receive information about you from third-party social networking services when you choose to connect with those services.
I'm not new to android or privacy by any means.
This kind of obscure language is no mistake or ctrl c/v standard.
All of these are poored over by lawyers on mass.
.
It is for this reason I exclusively run custom rims & mods and a majority of my devices are root/xposed with multiple layers of privacy in mind.
.
There used to be a much bigger crowd of developers and possibilities...
But we seem to be a dying breed.
.
I'm deeply saddened at the lack of true device level privacy or the concern for it.
And no
You'll not catch me trusting Google or an oem.
I barely trust open source.
.
Any links to further improve safety security and privacy on an Android device would be appreciated
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
OhioYJ said:
Still why I don't buy any device that doesn't have Lineage support... However what are you going to replace it with? Going to go buy another flagship? Have you glanced through other's privacy policies? This stuff is pretty boiler plate at this point, it's CYA. Not that I'm defending it, because it shouldn't be like that, but in today's "sue happy world", and "everything needs to be connected", guess what? The solution would be just to remove this these services, there are tons of posts of which OnePlus services to remove if you want to stay on OOS and protect your privacy.
So back to the replacement, lets take a Samsung, those are popular....., have you glanced at their privacy policy, because it's similar link
I didn't go over entirely, and I'm sure there's more details, but I'm guessing OnePlus's blurb, looked something similar to this (From Samsung's Website):
In addition to the information you provide, we may collect information about your use of our Services through software on your device and other means. For example, we may collect:
Device information - such as your hardware model, IMEI number and other unique device identifiers, MAC address, IP address, operating system versions, and settings of the device you use to access the Services.
Log information - such as the time and duration of your use of the Service, search query terms you enter through the Services, and any information stored in cookies that we have set on your device.
Location information - such as your device’s GPS signal or information about nearby WiFi access points and cell towers that may be transmitted to us when you use certain Services.
Voice information - such as recordings of your voice that we make (and may store on our servers) when you use voice commands to control a Service. (Note that if we work with a third-party service provider that provides speech-to-text conversion services on our behalf. This provider may receive and store certain voice commands.)
Other information about your use of the Services, such as the apps you use, the websites you visit, and how you interact with content offered through a Service.
Information from third-party sources
We may receive information about you from publicly and commercially available sources (as permitted by law), which we may combine with other information we receive from or about you. We also may receive information about you from third-party social networking services when you choose to connect with those services.
Click to expand...
Click to collapse
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
nima0003 said:
Who the **** reads those?
Click to expand...
Click to collapse
people who can read
Lebrun213 said:
people who can read
Click to expand...
Click to collapse
Did you return yours?
liam_davenport said:
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
So they can get an idea of which devices to develop for and their user base.
liam_davenport said:
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
As soon as you install Lineage it asks if you want to share / participate in this program? You don't have to share this information. If you overlooked it the user can disable this sharing in the settings. They don't try and hide it at all.
I also don't know of any Lineage builds / trees that are hidden unlike other ROMs that are popular. So everything is out in the open.
Lineage has always been my first choice, so maybe I'm biased?
Caltinpla said:
Did you return yours?
Click to expand...
Click to collapse
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Lebrun213 said:
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Click to expand...
Click to collapse
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Caltinpla said:
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Click to expand...
Click to collapse
If you think custom roms (AOSP) are spying on you you're on the wrong website
Intrusive TOS suck big time, but, unfortunately, if you have a email address or cell phone, use the internet in any way shape or form, forget about any sense of privacy..
I make sure I dont do anything "iffy" on my cell phone; never use it for banking or bill paying, so I feel a little less paranoid, but there is really NO WAY, aside from not having an email address/cell phone/internet connection to keep your life from some prying eyes..
Lebrun213 said:
custom OS and MicroG
got rid of oneplus & google spyware without loosing fonctionality (except fingerprint reader obviously)
Click to expand...
Click to collapse
Root and block everything.
Caltinpla said:
So, you really believe custom roms and other phone makers don't spy on you? Good luck with that!!!
Click to expand...
Click to collapse
i trust open source, if there is a doubt with the code, anyone can check (not saying everyone does that).
Google service, oneplus, etc ... on the other hand are completely locked and you have no way to see what it really does.
Btw, i switched because of the much better battery and performance i get without these spyware constantly running, not much about privacy... Still use google.com everyday so they aren't missing anything :laugh:
The only one you have to agree to is the first one. The rest you can decline and still setup your phone. I agree with Micro G but, if go a step further and install NanoDroid. It comes with replacement Google apps and GPS and all sorts of things to disconnect you from Google but have a functioning phone.
Sent from my OnePlus6T using XDA Labs
liam_davenport said:
If you think what the 6T collects is bad wait till you hear about Google.. Android is just a glorified data collection OS.. All they care about is profiling from us and learning everything to target ads and sell to 3rd parties after all Google is an Ad company.. If you want privacy compile AOSP and use MicroG avoid all Google services and use as much FOSS apps as possible.
---------- Post added at 10:35 PM ---------- Previous post was at 10:32 PM ----------
Lineage also collects weird data like what device you installed on, Carrier etc.. Not sure why it needs this but I don't run it for that reason.
Click to expand...
Click to collapse
False. Google does not sell user data to third parties, or to anyone. It's never even been considered. Unfortunately due to a mix of people not understanding how technology works and assuming that every "tech company" operates in exactly the same way this particular piece of fake news just won't die. There are plenty of terrible things they actually do nowadays, better to focus on those anyway
tech_head said:
Root and block everything.
Click to expand...
Click to collapse
so much this
every manufacturer has some sort of logging / reading data.
root, and monitor everything that leaves your phone - block apk's that shouldnt be running - or create firewall rules in the iptables to block applications from accessing certain sites / internet.
partcyborg said:
False. Google does not sell user data to third parties, or to anyone. It's never even been considered. Unfortunately due to a mix of people not understanding how technology works and assuming that every "tech company" operates in exactly the same way this particular piece of fake news just won't die. There are plenty of terrible things they actually do nowadays, better to focus on those anyway
Click to expand...
Click to collapse
This argument would make Kellyanne Conway proud. Yes, Google does not sell user data directly. But it does so indirectly every day it is in business. By allowing advertisers to target ever smaller slices of the population and track them across websites they ARE providing advertisers with user data.
GroovyGeek said:
This argument would make Kellyanne Conway proud. Yes, Google does not sell user data directly. But it does so indirectly every day it is in business. By allowing advertisers to target ever smaller slices of the population and track them across websites they ARE providing advertisers with user data.
Click to expand...
Click to collapse
A truly moronic reply that shows you have no idea what you are talking about. Have your even seen the advertising interface to Google's ad products? Obviously not because you just described Facebook's, not Google's! ?????

Google Play Store physical address requirement: Options for independent developers to protect their privacy

Since Google in 2014 introduced the requirement of providing a physical address that is displayed publicly on Google Play (for developers selling paid apps or in-app products), there has been some discussion about this.
I'm thinking about solutions to this for independent developers who are uncomfortable with making their (full) name and home address public.
Examining apps on Google Play (paid / with in-app products, updated in 2022) I find that developers have provided different things as their address, all apparently without Google suspending their accounts or sale of apps:
no information at all ("Address" does not appear under "Developer Contact")
just the country
just city and country
a PO box address
full address but no name
Actually there are few app where the name and full address of the developer is displayed.
So it seems that Google doesn't really care about it. Still I'm not comfortable with doing something against the law.
So I wonder about the following:
Is it even against the law or against the agreement with Google? - in the developer distribution agreement I can find nothing about it, and from what I read here only the consumer protection laws of the European Union require it, so if I only distribute the app outside the EU, is the address still required?
Did some developer have his account / app suspended because of this?
Did Google (or someone else for that matter) contact a developer with the physical address?
Would it be better to provide city and country or to provide no information at all (it seems a bit fraudulent to me to declare something as address which is not an address)?
As a solo dev, I looked into this quite a bit and from other places it seems they don't actually check.
I provided my local post office address rather than my own.
It's been over a year and still good so far but my apps don't have many downloads yet.
The thing I don't understand is you have this law clearly saying someone selling something needs to provide a physical address.
On the other hand you have GDPR which states that personal data should not be disclosed unless the user wants to do so - I should be able to tell Google, no this is my home address, I do NOT want it disclosed.
So these two laws are in direct conflict, I can't find anywhere that addresses that conflict.
Just wanted to report that I solved this problem by registering a company (US LLC) and getting a virtual address for it.
While this is of course time consuming and will cost you at least a few hundred dollars, I was easier and cheaper than I initially thought. And you can register a US company also if you don't live in the US, you don't even have to travel there.

Categories

Resources