Hi gurus,
We, Company 100 Inc., is pleased to announce the availability of long-waited Dorothy Browser open beta for Windows Mobile 6.x!
Dorothy Browser, built upon WebKit engine, the best of breed browser engine, delivers the real Web experience to your mobile devices with unrivaled performance.
As an official contributor and maintainer of WebKit engine for Qualcomm BrewMP in the WebKit development community, we are dedicated to deliver the best performing mobile browsing experience to WM phone users, inheriting all the benefits from the open source WebKit community.
Please try out our latest beta version of our Dorothy Browser on your WM phones and experience yourself its flying performance.
The open beta can be downloaded from our Dorothy Browser website.
BTW, if you happen to be present at MWC in Barcelona, please swing by our booth, located in Hall1, 1F05, and check out our Dorothy Browser Emerald demo, an enhanced version of Dorothy Browser with advanced UI/UX leveraging OpenGL ES H/W acceleration.
Thanks for your interest in Dorothy Browser and hope you all enjoy it!!
Should you have any inquiry about our browser, please feel free to contact us at contact at company100 dot net any time.
I found this by doing a quick google search... But is there any particular reason why you do not share the url yourself??
Not really. The forum does not allow junior members to specify any external URL or email address inside the message.
mrcrowley666 said:
I found this by doing a quick google search... But is there any particular reason why you do not share the url yourself??
Click to expand...
Click to collapse
I see... http://www.dorothybrowser.com/
I have tried this on 3 different sites so far with very mixed results.
It locked up my phone completly while trying to access google.co.uk This happened on 2 seperate occasions.
I tried touch.facebook.com and it renders this site very nicely indeed. I was most impressed with this one.
I also tried the full facebook site facebook.com I found it was able to render this site completly just how my desktop computer would. Very impressive Text was readable after zooming just a few times, even though the text was still tiny. Very slick rendering. Its a tad jerky while moving around the page i suspect my device is struggling a bit with the requirments.
I noticed ram usage is very high. I only had 25 mb left when i checked. Haven't seen a program use this much ram before.
All in all it looks very promising.
BTW my device is Omnia i900 with wm6.5
Just downloaded and installed the WVGA version. Massive improvement over the closed beta! Pages seem to load pretty fast too. Installed on Storage Card.
Bugs noticed:
* Can't zoom in or out when a webpage is still loading - as soon as a I try to scroll the page resets to overview mode.
* Settings page doesn't always show current settings (ie. Enable/Disable buttons appear to be not selected)
Feature Requests:
* Zoom slider and/or pinch-to-zoom please.
* Option to set manually the browser cache location
* User agent customisation
* (Optional) Flash support
Eagerly awaiting the next beta release. Thanks
Looks promising to me.
I have one request... Flash!
Thus far the only browser I've found that supports flash is SkyFire .. and I suppose Mach5 but you gotta pay for that one. Anyway both of those are server based browsers.
FLASH FLASH FLASH.
Gawwd is it too much to ask to watch HULU on my PPC?
Hulu has even blocked Skyfire now....grrrr
Can't detect server on my Touch Pro 2 on metro pcs. I can use it (browser) via wifi...but no data connection.
So i will stick to Opera 9.7....
mrcrowley666 said:
I have tried this on 3 different sites so far with very mixed results.
It locked up my phone completly while trying to access google.co.uk This happened on 2 seperate occasions.
Click to expand...
Click to collapse
Hmm, I actually had a similar problem with another website - for some reason it loaded up really slowly / not properly either. Opening the same website in Opera Mobile 10 beta 3 had on the same phone with the same connection it had no issues.
Thanks! I've tried, and...it eats so much ram! I prefer Skyfire, who have flash support.
TechnoHippie said:
FLASH FLASH FLASH.
Click to expand...
Click to collapse
Opera Mobile 10 (now in beta 3) supports flash, YMMV. Plugins need to be enabled in advanced options.
Plugin support is a must for mobile browsers now - Dorothy needs it as well, to stand a chance.
this is starting to become pretty cool. Interface looks good and pages look great after they render. Please think about including flick scrolling cuz it would help make moving through pages easier. It also seems buggy when trying to pan around. I hope you continue updating good ol dorothy! Big improvement over recent upgrades! please update us frequently too
Company100, can u guys use like a newer build of the Webkit browsing engine or something? Would like to be able to use the HTML5-enabled versions of GMail and the Google Buzz mobile websites.
Thanks
Life Saver.. Sort of
My entire peer set uses Gowalla which is only available for iPhone, Android, BlackBerry... basically every platform but WinMo. This is the first mobile browser that works with that particular site for WinMo. I still use Skyfire as my main browser for my Pure, but I bet the Emerald release of Dorothy will change that. I also found it faster on the sites it could access VS. Skyfire. So if you can hear me Company100 PLEASE include me in the beta as soon as possible for Emerald.
Shalom,
SAB
WOOOOW, I'm very impressed. Really cool browser. Rendering is awesome.
But needs some improvements in cinetic scrolling! and the browser graphics. Looks like a 90-tech-underground-site-style. Keep it simple and clean. Less is more
What about longpress menus? Like press'n'hold on a link opens a menu where you can open in another tab. OHHH, just saw it now. No tabbed browsing...
If I remember correctly, Webkit is partly LGPL licensed, more specifically, webcore is, that I know. I am unable to find source code related to Dorothy's port of Webkit on Winmo.
I understand that LGPL can be linked to closed-source applications, but the library themselves must comply with the license, which states that the source code must be disclosed.
As Dorothy browser does dynamically links to webkit (webkit-ce.dll), they do not have to release the source code of the application itself, only the source code of their branch of webkit. I think it is generally considered okay to not release themselves the code if the same exact code is available from another project's website. Additionally, the source code has to be as easily accessible than the binaries.
This post may seem harsh, and I am sorry if my tone is mistaken. I simply am curious and am not thinking that they are deliberately making it hard to get the source code. I think it is not malice, but simply carelessness. Those license are not easy to abide to.
[EDIT]
I will contact them directly too, but I posted there because I may have been blind and didn't see the source elsewere...
samueldr said:
If I remember correctly, Webkit is partly LGPL licensed, more specifically, webcore is, that I know. I am unable to find source code related to Dorothy's port of Webkit on Winmo.
I understand that LGPL can be linked to closed-source applications, but the library themselves must comply with the license, which states that the source code must be disclosed.
As Dorothy browser does dynamically links to webkit (webkit-ce.dll), they do not have to release the source code of the application itself, only the source code of their branch of webkit. I think it is generally considered okay to not release themselves the code if the same exact code is available from another project's website. Additionally, the source code has to be as easily accessible than the binaries.
This post may seem harsh, and I am sorry if my tone is mistaken. I simply am curious and am not thinking that they are deliberately making it hard to get the source code. I think it is not malice, but simply carelessness. Those license are not easy to abide to.
[EDIT]
I will contact them directly too, but I posted there because I may have been blind and didn't see the source elsewere...
Click to expand...
Click to collapse
Does it exist something most updated or this project is "died"?
Is anti virus a waste or is it worth having it run on your phone?
waste......
MrGibbage said:
waste......
Click to expand...
Click to collapse
Why is that?
its a waste, when was the lest time u heard of someone getting a phone virus? lol, plus what are you downloading and running on your phone that might even pose a threat
I vote waste too, for current AV solutions. Like another poster said -- There really aren't any threats at the moment. It's real likely there will be at some point, but I see no reason to believe the current AV providers have any clue what these future hypothetical virii will look like. I'll trust an AV once it is written by a security researcher who has studied live Android virii. Until then they're just wasting resources.
I don't run AV software on my home computers or my phones. I am careful with the email that I open, and when I DL software, I try to be aware of where it is coming from. I am never the guy that that downloads something the day it comes out. If it is nefarious, I'll hear about it. Maybe I'm lucky, but I just don't see the need.
SMS Trojan for Android - http://www.theinquirer.net/inquirer/news/1727325/android-virus-spotted
They do exist just not on a Windows level lol. I'm sure they will jump in numbers as the popularity of the platform continues to explode. Currently, Lookout is one of the top rated AV apps, and its free.
BTW when you install the "SMS Trojan" it asks for permission to send text messages that may cost money.
TOTAL Waste.
Just read the permissions requests when installing apps.
Or go read up on how Android's app sandboxing works. Either way, nothing can harm your phone unless you explicitly allow it to. And if you allow a photo app to read all of your data, and send text messages and connect to the internet, you deserve what you get.
reuthermonkey said:
TOTAL Waste.
Just read the permissions requests when installing apps.
Or go read up on how Android's app sandboxing works. Either way, nothing can harm your phone unless you explicitly allow it to. And if you allow a photo app to read all of your data, and send text messages and connect to the internet, you deserve what you get.
Click to expand...
Click to collapse
Aint that the truth. Idiots need to pay attention to the Android Permissions screen and ask themselves "Why does this flashlight app need to read my contacts, google account and access my dialer, data connection and send SMS??"
Like others have mentioned, threat levels right now are so low that it doesn't warrant the use of money or system resources.
Some apps in the market that are labeled as such are just spam btw.
And also, we are far from a mass infection ala PCs. Just be very careful with what you download. Pay close attention to the permissions and use your very good judgement. If a music player asks permission to read/send/receive text messages and make phone calls, it's probably some type of malware.
jblade1000 said:
SMS Trojan for Android - http://www.theinquirer.net/inquirer/news/1727325/android-virus-spotted
They do exist just not on a Windows level lol. I'm sure they will jump in numbers as the popularity of the platform continues to explode. Currently, Lookout is one of the top rated AV apps, and its free.
Click to expand...
Click to collapse
WASTE ,..,.., hands down......
A virus that has to be manually installed by the user or creator on the host device ????? , and this is after all the warnings to the user before you press ok .,.,.,.,., never mind all the warnings telling you NOT TO DOWNLOAD outside of the market,unless you know what you are doing , download AT YOUR OWN RISK..... Not to mention the anti virus companies CREATING the need for you to install their app ... ever read some of the comments in the market about these "AV" apps ? > 'this app works great, protects my phone'<<<<<? protects it ? from what ???? WTF..
So yes I think it's a waste.....
People make viruses for a living so pretty soon someone will come out with a major one cause it being a phone means nothing its based off of linux and I know linux doesn't have any killer viruses but they do have some just not on a windows level. So ask it takes is one overseas a hole to create one just so he can get famous and then we will need an
Worth installing virus app.
O yea most people only read the permission when installing apps when they are new to android most people don't look at them.especially for apps they regularly use like handcent. Who know what they do with our info?
Sent from my Samsung Vibrant
hmmm lets see, would an app be able to slide in a permission without a warning? as in read contacts after installed but it never showed on the permission screen.
creglenn said:
People make viruses for a living so pretty soon someone will come out with a major one cause it being a phone means nothing its based off of linux and I know linux doesn't have any killer viruses but they do have some just not on a windows level. So ask it takes is one overseas a hole to create one just so he can get famous and then we will need an
Worth installing virus app.
O yea most people only read the permission when installing apps when they are new to android most people don't look at them.especially for apps they regularly use like handcent. Who know what they do with our info?
Sent from my Samsung Vibrant
Click to expand...
Click to collapse
None of that supports a need for an Anti-Virus. Android sandboxes each and every application on the system. It's not like any other Linux distro in how it handles security. It's MORE secure than linux. You can hack individual apps (and thus use their permissions - ie the browser), but that's quickly patched.
The biggest security threat to Android is the same as the biggest security threat for EVERY OS: Lazy users.
reuthermonkey said:
None of that supports a need for an Anti-Virus. Android sandboxes each and every application on the system. It's not like any other Linux distro in how it handles security. It's MORE secure than linux. You can hack individual apps (and thus use their permissions - ie the browser), but that's quickly patched.
The biggest security threat to Android is the same as the biggest security threat for EVERY OS: Lazy users.
Click to expand...
Click to collapse
Thats so true but im speaking on the basic users who dont need a dumbphone instead of a smartphone cause when/if a virus does come out those are the people who ill be flooding the forums. While we sit back and laugh.
everyone is talking **** about anti-virus for taking up resources, but i've found Lookout to be very unobtrusive. Also, besides virus scan, it will locate your phone, send a siren to your device, backup your info, all at schedules you determine.
jamesey10 said:
everyone is talking **** about anti-virus for taking up resources, but i've found Lookout to be very unobtrusive. Also, besides virus scan, it will locate your phone, send a siren to your device, backup your info, all at schedules you determine.
Click to expand...
Click to collapse
Sure, those are a few reasons to keep Lookout installed. But I don't need it scanning all my files for threats that don't exist yet and it probably wouldn't recognize anyway. Fortunately, the AV component is optional.
This is my first post to XDA.
I have been asking this question about various OS's in various forums, for past 18 months, and each time I ask it, the person who answers it spends a few iterations with me bending-over-backwards trying to avoid telling me what I want to know. I hope that this does not happen here.
I have a native C++ application. It currently runs on Linux desktop. It does many things that native C++ applications do, including sending raw Ethernet frames (mesh networking).
Obviously, if one of my customers tries to install this application on his/her Android device, there will be problems, and it won't work.
I am aware that a human being has the ability to root his/her phone.
I am aware that a human being has the ability to root his/her phone.
I am aware that a human being has the ability to root his/her phone.
Please do not send me a reply saying, "But your customer has the ability to root his/her phone!" :cyclops:
What I would like, is a smartphone, that is running Linux, that allows my customer to install a 100% Native C++ application, >>>WITHOUT<<< having to go through the process of rooting his/her phone. Ideally, the barrier-to-installation would be roughly equivalent to what s/he would experience on a desktop computer.
I am not concerned about the presence of X or any particular GUI subsystem, but I will definitely need access to all the normal system-level Linux primitives (multi-threading, asynchronous I/O, etc.)
Please do not send me a reply saying, You can ssh into the phone and install the app that way."
I would like to know if Ubuntu on smartphone allows a relatively naive user to install a 100% native C++ application that interfaces with the system-level primitives of Linux.
And finally, please note that I am not interested in finding a work-around to an engineering problem that I am having. I am trying to determine the maximum permissible degree of nativity of Ubuntu Touch applications when the application is to be installed by a naive user.
If Ubuntu touch does allow such native applications to be installed, I would be interested in getting an idea of the steps that a customer would take.
UT apps can be uploaded as a click app to the UbuntuOne store and then can be installed as easy as any Android app. You should be able to "sideload" click apps, but I never tried.
UT apps - that are not a web app - are written in native C++ using QT5/QML for UI.
UT apps are restricted by apparmour profiles, but that should not keep them from using multithreading or asynchronous I/O. You would have to test, if your specific requirements work.
There is only one way to answer all your questions: give it a try!
Sent from my TF300T using Tapatalk
f69m said:
UT apps can be uploaded as a click app to the UbuntuOne store and then can be installed as easy as any Android app. You should be able to "sideload" click apps, but I never tried.
UT apps - that are not a web app - are written in native C++ using QT5/QML for UI.
UT apps are restricted by apparmour profiles, but that should not keep them from using multithreading or asynchronous I/O. You would have to test, if your specific requirements work.
There is only one way to answer all your questions: give it a try!
Sent from my TF300T using Tapatalk
Click to expand...
Click to collapse
:good:
Yes, you would need to change the packaging system from debian archives to click packages but that shouldn't be too difficult. If you run into problems with the Ubuntu SDK in connection with C++, have a look at this bug report and the mentioned fixes: https://bugs.launchpad.net/ubuntu/+source/qtcreator/+bug/1215913
f69m said:
UT apps can be uploaded as a click app to the UbuntuOne store and then can be installed as easy as any Android app. You should be able to "sideload" click apps, but I never tried.
Click to expand...
Click to collapse
Any idea at all what the user would see when trying to sideload a click app. [I am trying to set my expectations before diving in.] Would the user download package to a directory, then click on it, or?
UT apps are restricted by apparmour profiles, but that should not keep them from using multithreading or asynchronous I/O. You would have to test, if your specific requirements work.
There is only one way to answer all your questions: give it a try!
Click to expand...
Click to collapse
OK, apparmour seems to be the focal point. I would be really interested (if any knows), how restrictive apparmour will be with a newly-purchased UT phone, and what control a naive user of that phone will have in allowing native C++ applications to run. I would check this myself, but I cannot do any significant coding (porting) until mid-March.
In particular, my app works with WiFi, and will need to interact with stock WiFi drivers (mac80211/etc.). I would like to know what I, and the user, can expect when s/he:
acquires my app from my web site
does something to install it (what would s/he do at this step?)
attempts to execute it (will apparmour block access to mac80211-like drivers)
RareHare said:
Any idea at all what the user would see when trying to sideload a click app. [I am trying to set my expectations before diving in.] Would the user download package to a directory, then click on it, or?
OK, apparmour seems to be the focal point. I would be really interested (if any knows), how restrictive apparmour will be with a newly-purchased UT phone, and what control a naive user of that phone will have in allowing native C++ applications to run. I would check this myself, but I cannot do any significant coding (porting) until mid-March.
In particular, my app works with WiFi, and will need to interact with stock WiFi drivers (mac80211/etc.). I would like to know what I, and the user, can expect when s/he:
acquires my app from my web site
does something to install it (what would s/he do at this step?)
attempts to execute it (will apparmour block access to mac80211-like drivers)
Click to expand...
Click to collapse
Applications should be installed from the Ubuntu app store. If you've just got the click package, you currently need to use the command line to install it:
Code:
sudo install <path to package>
sudo register --user=phablet <package name> <package version>
I hope that this will change though. (It's name is "click" package. )
RareHare said:
Any idea at all what the user would see when trying to sideload a click app. [I am trying to set my expectations before diving in.] Would the user download package to a directory, then click on it, or?
Click to expand...
Click to collapse
nikwen said:
Applications should be installed from the Ubuntu app store. If you've just got the click package, you currently need to use the command line to install it:
Click to expand...
Click to collapse
Technically it should be possible to install a click package just by clicking on a web link, if the web site serves a specific mime type, but this is not implemented.
Not sure about Canonical's policy on that, they might not like the idea. Otherwise they might implement it or at least accept a patch from a community developer.
RareHare said:
OK, apparmour seems to be the focal point. I would be really interested (if any knows), how restrictive apparmour will be with a newly-purchased UT phone, and what control a naive user of that phone will have in allowing native C++ applications to run. I would check this myself, but I cannot do any significant coding (porting) until mid-March.
Click to expand...
Click to collapse
Sorry, have not looked myself into the apparmour profiles too closely and don't have the time to do that right now.
However you can download a recent UT rootfs using the link below and have a look at the profiles yourself:
https://system-image.ubuntu.com/pool/ubuntu-cd4246419c888397c0d8debbd9f945219f40fc670220b7ac86753dc79eb73707.tar.xz
RareHare said:
In particular, my app works with WiFi, and will need to interact with stock WiFi drivers (mac80211/etc.).
Click to expand...
Click to collapse
I don't think this is possible with any current or future off-the-shelf phone. Any OS will provide an abstract API for WLAN and require root to talk to the drivers directly.
As you say requiring your customers to root the phone is not an option, this seems to leave only one way out: you need to split off the low-level code of your app into a generic and secure API and submit it to Ubuntu Touch. If it is accepted, your app can use the new API.
f69m said:
Technically it should be possible to install a click package just by clicking on a web link, if the web site serves a specific mime type, but this is not implemented.
Not sure about Canonical's policy on that, they might not like the idea. Otherwise they might implement it or at least accept a patch from a community developer.
Click to expand...
Click to collapse
Of course, it would technically be possible. Recently, I read a Google Plus post on that topic. Here's the link. (The interesting part is in the comments. Read all of them. )
They said that they'll offer those options in the future.
f69m said:
Technically it should be possible to install a click package just by clicking on a web link, if the web site serves a specific mime type, but this is not implemented.
Not sure about Canonical's policy on that, they might not like the idea. Otherwise they might implement it or at least accept a patch from a community developer.[
Sorry, have not looked myself into the apparmour profiles too closely and don't have the time to do that right now.
Click to expand...
Click to collapse
I am in the same situation myself - I do not have enough time to experiment with apparmour, so I'm asking Ubuntu so that I do not have to search/guess.:victory:
I don't think this is possible with any current or future off-the-shelf phone.
Click to expand...
Click to collapse
So it would seem.
Any OS will provide an abstract API for WLAN and require root to talk to the drivers directly.
As you say requiring your customers to root the phone is not an option, this seems to leave only one way out: you need to split off the low-level code of your app into a generic and secure API and submit it to Ubuntu Touch. If it is accepted, your app can use the new API.
Click to expand...
Click to collapse
Well, the low-level code, in my case, is the WiFi drivers. Also, I cannot imagine submitting a new API to Ubuntu Touch every-time a new model for accessing system-level primitives arrive. That would essentially loop Canonical into all of our engineering processes.
Your last comment actually is the crux of the issue. It points to a policy question, not a technical one, and one for which the answer is yes or no. I would imagine that, at this point, Canonical already knows the answer...
Principle:
There are numerous situations where it is good for a native application to not be sand-boxed, but have the same access to the Linux subsystems as a user would have on Ubuntu Desktop. There are situations where the owner of the phone would be sophisticated and comfortable enough that s/he can decide for himself/herself whether an application should be allowed root access to the phone. A fellow engineer called this the "welded-hood" principle:
Do people prefer buying cars that have the hoods welded-shut?
Many people might, but there are a significant number who would prefer not. As it turns out, an automobile can dangerous if the person opens the hood and starts working on things that s/he should not be touching (no pun intended). In the case of the fuel and braking system, it can even be lethal. But in the end, it was decided that, since we are all liberated adults, it is better to allow the customer freedom-of-choice.
What we have, right now, is a situation where the "hoods" on all mobile devices are essentially welded shut. I think that is unfortunate, because there is a huge latent demand for mobile devices that "still have their hoods", but if the user chooses to open the hood, with they key word here being easily, that would be his/her prerogative.
By the default, the system should be sand-boxed, but the user should have a facility that allows him/her access to install some native, system-level applications, easily, just as a user is allowed to tap-off her break fluid or bleed the fuel-line if she so desires, even though there are many warnings about what could happen if the application is installed. The "open-the-hood" operation would come with warnings that the user can choose to ignore, with resulting consequences.
Question:
Will Ubuntu Touch allow the owner of an Ubuntu Touch phone to side-load a native C++ application that interfaces with the various existing WiFi drivers in Linux, if the user decides for himself/herself, that it is OK for the application to interface with such drivers?
I have a feeling that the answer is no, but I am asking here to make sure.
RareHare said:
I am in the same situation myself - I do not have enough time to experiment with apparmour, so I'm asking Ubuntu so that I do not have to search/guess.:victory:
So it would seem.
Well, the low-level code, in my case, is the WiFi drivers. Also, I cannot imagine submitting a new API to Ubuntu Touch every-time a new model for accessing system-level primitives arrive. That would essentially loop Canonical into all of our engineering processes.
Your last comment actually is the crux of the issue. It points to a policy question, not a technical one, and one for which the answer is yes or no. I would imagine that, at this point, Canonical already knows the answer...
Principle:
There are numerous situations where it is good for a native application to not be sand-boxed, but have the same access to the Linux subsystems as a user would have on Ubuntu Desktop. There are situations where the owner of the phone would be sophisticated and comfortable enough that s/he can decide for himself/herself whether an application should be allowed root access to the phone. A fellow engineer called this the "welded-hood" principle:
Do people prefer buying cars that have the hoods welded-shut?
Many people might, but there are a significant number who would prefer not. As it turns out, an automobile can dangerous if the person opens the hood and starts working on things that s/he should not be touching (no pun intended). In the case of the fuel and braking system, it can even be lethal. But in the end, it was decided that, since we are all liberated adults, it is better to allow the customer freedom-of-choice.
What we have, right now, is a situation where the "hoods" on all mobile devices are essentially welded shut. I think that is unfortunate, because there is a huge latent demand for mobile devices that "still have their hoods", but if the user chooses to open the hood, with they key word here being easily, that would be his/her prerogative.
By the default, the system should be sand-boxed, but the user should have a facility that allows him/her access to install some native, system-level applications, easily, just as a user is allowed to tap-off her break fluid or bleed the fuel-line if she so desires, even though there are many warnings about what could happen if the application is installed. The "open-the-hood" operation would come with warnings that the user can choose to ignore, with resulting consequences.
Question:
Will Ubuntu Touch allow the owner of an Ubuntu Touch phone to side-load a native C++ application that interfaces with the various existing WiFi drivers in Linux, if the user decides for himself/herself, that it is OK for the application to interface with such drivers?
I have a feeling that the answer is no, but I am asking here to make sure.
Click to expand...
Click to collapse
Well, your comparison is not quite correct. On most phones, there is a way for an educated user to open the hood. This is usually referred to as rooting the phone. Some companies will give you a tool to unlock the bootloader and thus open the hood easily, for others it is a little harder. But any user has the freedom of choice to open the hood or leave it closed.
Now, what you are asking for is something completely different. You are asking for a closed-source "black box" app to get access to what is under the hood, without the user ever opening it. This would mean opening the door for all kinds of malware, and I sure hope this will not be allowed by Ubuntu Touch . Let an educated user open the hood and place the black box there, if he feels comfortable about it, but don't make it too easy. A user that is not willing or not able to open the hood himself should also not be required to understand the consequences of installing a black box app with root privileges.
And there is another thing to consider: Ubuntu is heading for convergence, meaning the same app runs fine on a phone, on a tablet and on a desktop. This means apps must be written against an abstract SDK and not have access to the actual hardware.
Well, I am afraid we have hit a dead end now, unless you are willing to disclose more details on the functionality of your app.
Sent from my TF300T using Tapatalk
83594455 676
And there is another thing to consider: Ubuntu is heading for convergence, meaning the same app runs fine on a phone, on a tablet and on a
desktop. This means apps must be written against an abstract SDK and not have access to the actual hardware.
Click to expand...
Click to collapse
I think my native, system-level app would not only run on all versions of Ubuntu, regardless of device, but most versions of Linux, on 100's of different hardware devices, without changes to my code. So actually, I would be accessing a standard Linux software interface.
Well, I am afraid we have hit a dead end now, unless you are willing to disclose more details on the functionality of your app.
Click to expand...
Click to collapse
Sure. I would like to send and receive raw 802.11 frames from user-space utilizing the various standard Linux 802.11 system-level API's for mesh networking. My application is entirely user-space, and would run on any stock Linux kernel. My field of work is wireless communication, so naturally, if someone were to offer me a mesh-networking packaging as an alternative, I could not use it - my goal is not to have a mesh network for mesh networking sake, but to create a mesh network using my own user-space algorithms. In other words, I really do need access to the 802.11 drivers.
You can run every system command from your app using C++: http://askubuntu.com/questions/288494/run-system-commands-from-qml-app
The sudo password is "phablet". You could also ask the user for it if it was changed. You can pass it like this:
Code:
echo phablet | sudo -S <my command>
That might help you.
You could also ask in the IRC channel for Ubuntu app development (search the internet and you'll find it). Some Canonical people as well as some awesome community members will surely answer your questions. (But tell us the result, please.)
nikwen said:
You can run every system command from your app using C++: http://askubuntu.com/questions/288494/run-system-commands-from-qml-app
The sudo password is "phablet". You could also ask the user for it if it was changed. You can pass it like this:
Code:
echo phablet | sudo -S <my command>
That might help you.
Click to expand...
Click to collapse
That works for the development images and community ports, but I am afraid if you buy a pre-configured UT phone (once they are available), sudo will not work. At least I would be surprised if a company would give full warranty for a device with working sudo.
Sent from my TF300T using Tapatalk
---------- Post added at 11:14 PM ---------- Previous post was at 11:02 PM ----------
RareHare said:
I think my native, system-level app would not only run on all versions of Ubuntu, regardless of device, but most versions of Linux, on 100's of different hardware devices, without changes to my code. So actually, I would be accessing a standard Linux software interface.
Sure. I would like to send and receive raw 802.11 frames from user-space utilizing the various standard Linux 802.11 system-level API's for mesh networking. My application is entirely user-space, and would run on any stock Linux kernel. My field of work is wireless communication, so naturally, if someone were to offer me a mesh-networking packaging as an alternative, I could not use it - my goal is not to have a mesh network for mesh networking sake, but to create a mesh network using my own user-space algorithms. In other words, I really do need access to the 802.11 drivers.
Click to expand...
Click to collapse
Hmm, never really used the user-space network link interface, but I believe it would be possible to grant the required capabilities to a click application.
You would have to figure out, exactly what capabilities your process needs to run this as a non-root user. Then the right place to ask for supporting this would be the Ubuntu Phone mailing list.
Just a Tip: You should present a very strong use case to get this kind of capabilities. The benefits of using your user-space algorithms should be plain, even to someone just scanning over your email.
Sent from my TF300T using Tapatalk
f69m said:
That works for the development images and community ports, but I am afraid if you buy a pre-configured UT phone (once they are available), sudo will not work. At least I would be surprised if a company would give full warranty for a device with working sudo.
Click to expand...
Click to collapse
When nikwen made the suggestion, I was happy for maybe 2-3 seconds, but then caught myself, because I suspected this.
[Notice how I am saving myself enormous amounts of time and frustration by avoiding downloading the SDK, opening my compiler tool-chain, and experimenting., and discovering all the things that you are telling me as we go along (especially about apparmour). Yes, I am very proud of myself for saving myself so much time by asking questions here. :angel:]
So my question still stands:
Under the assumption that my customers (doctors, scientists, etc.) are mature/sophisticated/responsible/whatever enough to know that the application that they are about to install on their smartphone (mine) is potentially very dangerous, but they are still interested in installing my app, and that they are uninterested in going through the manual process of rooting their phone or engaging in any other type of significant manual reconfiguration, what are my options?
Can Ubuntu Phone to be the OS-of-choice for this situation, or am I out-of-luck?
RareHare said:
Under the assumption that my customers (doctors, scientists, etc.) are mature/sophisticated/responsible/whatever enough to know that the application that they are about to install on their smartphone (mine) is potentially very dangerous, but they are still interested in installing my app, and that they are uninterested in going through the manual process of rooting their phone or engaging in any other type of significant manual reconfiguration, what are my options?
Can Ubuntu Phone to be the OS-of-choice for this situation, or am I out-of-luck?
Click to expand...
Click to collapse
Maybe my second answer and your post crossed? But anyhow, here are the steps you can take:
1) Figure out the minimum set of capabilities your process needs to run as a non-root user.
2) Write an email to the Ubuntu Phone mailing list, describing the required capabilities and a convincing use case that motivates the engineers to have a hard look into it.
Honestly, I think the chances are slim, given the kind of capabilities you probably need. But Ubuntu Touch is probably your best bet of all the OSs out there.
EDIT: Mind that Ubuntu Touch uses a read-only rootfs, with only some config files being writable (via bind mount) and apt/dpkg is not supported. Your app must be running as a click package as a non-root user, but I believe it is technically possible to elevate an app process with certain capabilities. It would be your job to convince Canonical to make the policy decision to support it and to make the effort of implementing it.
EDIT2 (you see, I am giving it some thought): Not sure, how your business plan looks like or if your app makes this approach feasible, but another option could be to open-source your basic algorithms and try to have them included into Ubuntu Touch. Then cash in on an app to make the features easily accessible.
f69m said:
That works for the development images and community ports, but I am afraid if you buy a pre-configured UT phone (once they are available), sudo will not work. At least I would be surprised if a company would give full warranty for a device with working sudo.
Sent from my TF300T using Tapatalk
---------- Post added at 11:14 PM ---------- Previous post was at 11:02 PM ----------
Hmm, never really used the user-space network link interface, but I believe it would be possible to grant the required capabilities to a click application.
You would have to figure out, exactly what capabilities your process needs to run this as a non-root user. Then the right place to ask for supporting this would be the Ubuntu Phone mailing list.
Just a Tip: You should present a very strong use case to get this kind of capabilities. The benefits of using your user-space algorithms should be plain, even to someone just scanning over your email.
Sent from my TF300T using Tapatalk
Click to expand...
Click to collapse
Hm...it would be a bit weird for me to justify the benefits my user-space algorithms to Canonical. My app is not an open-source app. I guess I should have mentioned that first. In any case, I can say that I am "experienced" in this field, and my colleagues, at least, are experts in the field, so if the question is whether I am mistaken in thinking I need this capability, the answer is probably no.
However, you do have me intrigued regarding the granting of capability for a click application. My guess is that this would have to happen within the context of Ubuntu Store and not any other way or?
I ask because it is not yet definite that we will choose Ubuntu Phone. That is what I am determining now. I would hate to get into a situation where we have to "work with" Canonical to get access to the Linux API that we need, which is why I was suggesting putting the decision into the hands of the user. I would also like to avoid "lobbying" Canonical for a feature. It would be more efficient for us if Canonical would simply tell us whether they are going to allow it or not, to what extent, and what would be involved.
Again, what we are asking for is pretty straightforward - access to the standard Linux WiFi drivers from user-space.
There's really not much more to it. I was hoping that, based upon the assumption that we actually need this, that Canonical would be able to give us an answer.
[P.S. Yes, our posts got crossed. ]
RareHare said:
Hm...it would be a bit weird for me to justify the benefits my user-space algorithms to Canonical. My app is not an open-source app. I guess I should have mentioned that first.
Click to expand...
Click to collapse
Well, I somehow guessed it would not be open source, and probably my EDIT2 to my last post (crossed again) is not an option. But make sure to read my first EDIT, it might have helpful information.
I think the question is not, if it is a benefit to Canonical directly, but if it is a benefit to potential users of Ubuntu Touch. The API support you need might be helpful for other applications too.
RareHare said:
However, you do have me intrigued regarding the granting of capability for a click application. My guess is that this would have to happen within the context of Ubuntu Store and not any other way or?
I ask because it is not yet definite that we will choose Ubuntu Phone. That is what I am determining now. I would hate to get into a situation where we have to "work with" Canonical to get access to the Linux API that we need, which is why I was suggesting putting the decision into the hands of the user. I would also like to avoid "lobbying" Canonical for a feature. It would be more efficient for us if Canonical would simply tell us whether they are going to allow it or not, to what extent, and what would be involved.
Click to expand...
Click to collapse
Any decision taken by the user must first be implemented by Canonical, or there is no way for the user to make that decision. Unfortunately, I am not an expert on UT app development and the UT SDK, working mostly on low-level things like porting UT to my own device. But, as an example, it should be possible to have an API that creates a sub-process with elevated capabilities (there might be a more elegant solution). Still Canonical will have to implement that and to do this, they need some kind of motivation. The motivation could be a good use case that shows potential for other applications or indeed "lobbying" them directly (which probably means to send them some money).
RareHare said:
Again, what we are asking for is pretty straightforward - access to the standard Linux WiFi drivers from user-space.
There's really not much more to it. I was hoping that, based upon the assumption that we actually need this, that Canonical would be able to give us an answer.
Click to expand...
Click to collapse
I have not really used those APIs, but I assume that the kernel capabilities needed for this are usually granted to the root user only. I am pretty certain that UT will not allow you to run a process as root, but as mentioned above, it should be possible to create a subprocess with certain elevated capabilities.
f69m said:
Well, I somehow guessed it would not be open source, and probably my EDIT2 to my last post (crossed again) is not an option. But make sure to read my first EDIT, it might have helpful information.
Click to expand...
Click to collapse
OK.
f69m said:
I think the question is not, if it is a benefit to Canonical directly, but if it is a benefit to potential users of Ubuntu Touch. The API support you need might be helpful for other applications too.
Click to expand...
Click to collapse
Well, the API that I need is definitely helpful for other applications. Namely, it is helpful to any application that already uses it. And there are many such applications that use the 802.11 WiFi drivers that come with Linux.
Any decision taken by the user must first be implemented by Canonical, or there is no way for the user to make that decision. Unfortunately, I am not an expert on UT app development and the UT SDK, working mostly on low-level things like porting UT to my own device. But, as an example, it should be possible to have an API that creates a sub-process with elevated capabilities (there might be a more elegant solution). Still Canonical will have to implement that and to do this, they need some kind of motivation. The motivation could be a good use case that shows potential for other applications or indeed "lobbying" them directly (which probably means to send them some money).
I have not really used those APIs, but I assume that the kernel capabilities needed for this are usually granted to the root user only. I am pretty certain that UT will not allow you to run a process as root, but as mentioned above, it should be possible to create a sub-process with certain elevated capabilities.
Click to expand...
Click to collapse
OK.
I am going to send an email to Canonical asking if they could articulate, clearly, in a manner that a Linux C/C++ software engineer can understand, their policy on native application development. Here's what it currently says on their Wiki:
Which applications do run on Ubuntu Touch?
Ubuntu Touch is primarily designed to support web apps, and native apps programmed in qml and javascript or C++. As it is a real linux, of course all non graphical applications run equally as on any other linux system. You can ssh to Ubuntu Touch and run any console based application.
X11 is not supported (so far) so all GUI standard applications will not run.
This is slightly confusing, because it gives the impression that, with the exception of X11, the run-time environment on Ubuntu Touch is equal to the run-time environment on Ubuntu Desktop.
Obviously, that is not true. Native applications on Ubuntu Touch are sand-boxed. My customer can run a console app on Ubuntu Desktop just fine, but on Ubuntu Touch, she cannot not - I guess she could if she rooted or re-flashed her phone, but that is not practical.
I think Canonical should make it clear that native C/C++ applications on Ubuntu Touch will be sand-boxed. Then they should articulate, clearly on their web site, just how that works, at least the part that they know so far.
The reason I feel this is necessary is that there are a lot of developers who read the press releases and see the words open source native C/C++, more open than Android, etc...and they get the impression that it is basically Ubuntu Desktop for small form-factor, but that is not quite true.
Spelling-out, explicitly, Canonical's native C/C++ strategy would save such developers a lot of time and hacking trying to figure out what is feasible and what is not.
To be fair, I just received feedback from a competitor to Ubuntu Touch, giving me assurances that the competing OS will allow the user/owner of the phone to determine whether any software should have root access, etc - basically, like the desktop version of the OS. I will send them an email asking them if they could make public what they have assured me in private.
These are things that should be crystal clear to C/C++ software developers long in advance before committing to a platform. I can only imagine the time that would have been lost if I had misinterpreted what Canonical wrote above, only to find out that there is nothing practical that my customer can do to install my application as easily as they would on Ubuntu Desktop because of the sandbox that cannot be easily turned-off.
RareHare said:
I think Canonical should make it clear that native C/C++ applications on Ubuntu Touch will be sand-boxed. Then they should articulate, clearly on their web site, just how that works, at least the part that they know so far.
Click to expand...
Click to collapse
Of course I can't speak for Canonical and I might be wrong, but I would really be surprised, if it was possibly to run applications as root on an off-the-shelf Ubuntu Touch device.
RareHare said:
To be fair, I just received feedback from a competitor to Ubuntu Touch, giving me assurances that the competing OS will allow the user/owner of the phone to determine whether any software should have root access, etc - basically, like the desktop version of the OS. I will send them an email asking them if they could make public what they have assured me in private.
Click to expand...
Click to collapse
Interesting, but then it might be a difference between the "reference" implementation and what is being delivered on an out-of-the-shelf phone. I can't belive a device vendor to take the risk of allowing root access and still providing full warranty. Most likely the user will have to accept a "no warranty" waiver to get root access, if that feature is not completly disabled by the device vendor. The same kind of holds for UT, as sudo works on the development images as mentioned previously.
EDIT: Make sure the feedback you received does refer to an actual device that is/will be available for sale and not to a development platform. Marketing wording can be tricky about simple issues like that,
RareHare said:
These are things that should be crystal clear to C/C++ software developers long in advance before committing to a platform. I can only imagine the time that would have been lost if I had misinterpreted what Canonical wrote above, only to find out that there is nothing practical that my customer can do to install my application as easily as they would on Ubuntu Desktop because of the sandbox that cannot be easily turned-off.
Click to expand...
Click to collapse
Agreed, but the same holds for any other platform.
f69m said:
Of course I can't speak for Canonical and I might be wrong, but I would really be surprised, if it was possibly to run applications as root on an off-the-shelf Ubuntu Touch device.
Interesting, but then it might be a difference between the "reference" implementation and what is being delivered on an out-of-the-shelf phone. I can't belive a device vendor to take the risk of allowing root access and still providing full warranty. Most likely the user will have to accept a "no warranty" waiver to get root access, if that feature is not completly disabled by the device vendor. The same kind of holds for UT, as sudo works on the development images as mentioned previously.
Agreed, but the same holds for any other platform.
Click to expand...
Click to collapse
I was very careful in asking the UT-competitor what their policy would be with regard to the subject of this thread, and they assured me that, when they say open, they really do mean open, as in open-like-the-desktop. However, just now, I found clues on the Internet what they said might not be quite true. So I just sent a grab-me-by-the-ears-while-you-are-speaking email asking them to be clear.
However, they have committed to allowing the user to install my application. They know that my application will open a device driver, and they said that it should work fine, that they would allow the user to do it, and that they had already intended to create a feature where the user gets to decide, after a WARNING, though they are not yet certain what this feature will be called. Note that they are not doing this for me alone. They are doing it, in general. In other words, they are doing what I proposed earlier: give the user the choice of whether to "use metal chainsaw".
As far as voiding the warranty goes...honestly, I do not think that will be a problem. As you know, I can write software that will wipe my hard disk clean on Windows, right now, put it up on my web site, and anyone in the world can download that software, and the most that will happen before they install my application is that they will get a brief warning. So the model for allowing the user to do foolish things has been with us for a while, and companies are still very profitable with this model, and despite viruses (I developed anti-virus algorithm that some of you use, btw), most people are happy with the level-of-control they get with their desktop devices. When Windows Vista tried to remove some of it, even moderate users were very angry, as you know.
I think that, especially for cell-phone carriers in the USA (Verizon, AT&T, Sprint)...the reason is not so much to protect the consumer, but to make sure that the user is not able...for example...to remove the bloatware that they put on the phone. It is more about controlling the customer experience for profit than for protection or being liable for damages.
The UT-competitor has probably figured out that there is a market for a truly open mobile platform, one where the decision of what happens to the device reverts to the owner of the device. They are probably counting on all the pent-up demand of C/C++/etc. native software developers who have been trying to escape the Android/Java iOS/* Sandbox, and not only that, the developers who are able to create revolutionary innovations if they had more access to the Linux API. My guess is that, once one OEM takes this path, the others will not have any choice but to follow, because there will be a free-for-all (no pun intended) in the development market. It will be messy, perhaps, but there will no longer be any restrictions on getting the most out of the device.
It will definitely be more efficient to decouple development from deliverance.
Well, sounds good, just hope that they will find an OEM that shares their views. I think Desktop/Windows is not a relevant reference, as nobody will send their PC back to Microsoft, if it is not working. And if you want to use official MS support you are paying dearly. On the other hand support/warranty is a huge concern for phone and tablet vendors.
Again, not being able to run a process as root on a UT device is my personal opinion and I am not speaking for Canonical or their partners.
EDIT: Do the "bad" operations you mentioned work on Windows 8 phone? I suppose not.
Sent from my TF300T using Tapatalk
Hi all,
I'd like to share great news. Sicher, our free secure messenger finally comes to Windows Phone.
Sicher features true end-to-end encryption of both text messages and file attachments. With anonymous push notifications and the ability to set a timer for when messages will self-destruct, Sicher also includes password protection for the app itself.
Please try Sicher and share your feedback in this post.
FairyMary
Sicher Team
App is free, store link is here: EDIT: Removed because this thing looks like a scam and its description is a lie
I haven't been able to find a lot of info about how the app works (I'm talking about at a very technical level). My general advice regarding crypto code is to open it up for review, either publicly or by a professional security assessment firm (disclaimer: I work at one of those). If the code is already open for review somewhere, that would be awesome; if not, I recommend getting in touch with some external security experts (same disclaimer, but I can provide contact info if you want). The Internet is full of things that the developer claimed (and often even sincerely believed) were secure.
Aaaand just for fun, I decided to take a look at the app and see if there was anything obviously wrong. Let's start with the presence of no fewer than *three* advertisement networks, shall we? Begun Advertising is Russian and Google-owned, Google AdMob is self-explanatory, as is Microsoft Advertising Mobile. Your store description claims you
don’t use any advertising engines
Click to expand...
Click to collapse
. Did you really think nobody would check this?
WTF are you trying to pull here?!? I can't think of any way to faster burn trust in a "secure" app than to make a claim that is trivially disprovable in a way that benefits nobody except you.
I'll come right out and say it: Sicher looks like a scam!
Oh look, a Facebook library as well. Totally expected to see that, given that you
don’t integrate social network SDKs
Click to expand...
Click to collapse
Oh, and before anybody asks about responsible disclosure, that's for when there's an unintentional bug in somebody's code. This just looks like pure exploitation of your users! (I say "looks like" because I haven't actually decompiled the code to see if those libraries are being used, but it's hard to imagine why you'd have them otherwise...). The only responsible way to disclose malware is to do it publicly, and this looks malicious.
EDIT: I'll give you 24 hours to give me a good argument why I shouldn't report my findings to the stores themselves.
Time's up. You actually got over 48 hours because I was busy yesterday. Hope not too many people got scammed and tracked by your "secure" and "private" app...
Hey @GoodDayToDie, unfortunately I don't know where else to ask this, since you seem to be really interested (and skilled) in this topic, what messengers do you consider secure? WhatsApp is obvious, the only ones on Windows Phone I know of that come to my mind are Telegram and (soon) Threema.
What do you think about the two? I have basically no knowledge, but what seems odd to me about Threema is their faqs answer to "what about MITM?" they just say they use certs, hardcoded in the app. Aren't they with their servers in control then? How I understand this, the Threema servers could perfectly perform a MITM attack.
And Telegram has a completely confusing protocol.. So please share your thoughts!
I have no personal knowledge of one, sadly. Take anything I say here with a huge grain of salt (including the fact that Sicher looks like a scam; I haven't actually verified that it *uses* all those ad networks + Facebook that it integrates, just that it has them) as I'm not spending the time & effort for a full security review of these apps at this time.
Threema actually looks quite good.
Pros:
They don't try to implement the crypto themselves (they use NaCl, which is both written by people who know what they're doing, and well-reviewed).
The design of their end-to-end solution makes sense (it connects through the server since phone networks won't allow incoming/direct connections, but the messages are encrypted to only the recipient and doesn't require that the recipient be online to receive the message).
They are relatively open about how things work (although those *could* be lies; I haven't pulled the app apart).
It is possible for the user to verify the key of another user.
Cons:
They don't have Perfect Forward Secrecy on messages. PFS would require that the intended recipient be online at the start of any given conversation (to negotiate the ephemeral keys) so this isn't terribly surprising, but it is disappointing. An attacker (including a government agency) who gets access to your private key could decrypt historical traffic to you if they'd recorded it.
The app is proprietary; there's nothing stopping them from pushing a malicious update.
The server supplies the public keys of users; until such time as the user validates the other party's key (which is difficult to do except in person) the server could have sent a public key that the server has the private key for (instead of the user's own public key) and then MitM the user's traffic. This would break down when verified though, unless the app lied about the result of the verification process (you don't actually see the key itself).
To address your concern about MitM, the app says they use certificate pinning (a standard and very smart security measure, assuming they did it right) for app-to-server communication, so nobody (including third-party security engineers) can MitM the app traffic. They also claim to use PFS. However, if the server itself is untrusted (i.e. some government thugs show up to demand access, although bear in mind that apparently the servers are all in Switzerland) then the server could give you the wrong public key for a user you try and add, allowing the server to MitM you. Also, the company could push an update that is malicious.
The only protection against the server-sends-wrong-key threat is to either require that the user manually import all keys (think PGP minus keyservers and assuming trustworthy key exchanges) or exactly verify the key (i.e. personally ensure that it matches the other user's key by actually checking the bytes or at least the hash). The only protection against the malicious update is to make the source code available and have a method by which users can either compile it themselves (though see "Reflections on Trusting Trust") and/or have a way to verify the application binaries.
I'll look at Telegram later. For the moment, though, I would loosely recommend Threema once it's available. There's also Skype, of course, but while it was decompiled once long ago (and found to use secure encryption, although some non-crypto vulns were found) that was many versions ago (and, in particular, was before Microsoft bought them).