Posts

Android has different types of lock states. This post summarizes what they are, what their purpose is, and how the interact.

I have been using KDE since 1998 and keep coming back to it even though I have tried Gnome in many versions and varients. A highly personal report why configurability is good for an expert work tool.

Sending bills or medical diagnosis through cleartext email has obvious security problems, but forcing users to log into every service provider webpage to download updates has major usability problems and doesn’t scale. I propose a third alternative.

The Flatpak package of the Zoom Linux client is better than installing native because of Flatpak sandboxing capabilites. This short post summarizes the settings I use to make it work.

Why For analysing what devices do on a network - specifically the shared medium of a wireless LAN - just packet tracing based on IP address is often not sufficient. There are multicasts, the initial DHCP requests, and potentially other types of traffic not captured by that.

Git commands that are not intuitive but that I found useful

GadgetBridge for Android allows syncing locally with various wearable devices such as wristbands and watches. As they are typically connected through Bluetooth (LE), migration to a new device - or after reinstalling GadgetBridge on the same device - often invalidates the connection. This is a summary of how previous database history can be migrated to such a new installation.

Responsible/coordinated/timed disclosure is continuously a topic of heated debate, even more so when PoC (proof of concept) exploit code is included in the release. This post gives arguments in favor of full PoC disclosure from a defender’s point of view.

Android security trade-offs: Rooting “Rooting” has been part of the Android ecosystem pretty much since its creation. Within the context of this blog post, I define rooting as a method to disable standard sandboxing mechanisms for particular processes, which is a superset of Nick Kralevich’s earlier definition because many posts mix up the intentional, user-driven root access with exploitation of vulnerabilities.

Android security trade-offs The Android ecosystem is highly diverse, complex, and has many different stakeholders typically not visible in the limelight. Consequently, making decisions about features in the platform itself — what we call AOSP (Android Open Source Project) — is hard, and often in surprising ways.