prism

joined 11 months ago
[–] prism@lemmy.dbzer0.com 4 points 2 weeks ago (1 children)

Perhaps try Authnkey which is more recently updated. If that doesn't work then some details like which security key you are using and over which protocol (USB or NFC) would be good to know.

[–] prism@lemmy.dbzer0.com 10 points 2 weeks ago (4 children)

Maybe people don't care but some do. I am sure I am not alone in caring. I believe every user should have the right to know what is running on their system and where it came from. What they choose to do with that information is up to them.

 

For context, Haven is a fairly new open source (GPLv3) SSH client for Android.

At first when I saw this I was eager to explore it: there isn't much choice in terms of open source SSH clients for Android. Termius is proprietary, ConnectBot is unmaintained (but recently has had some new activity?) and JuiceSSH was never open source afaik. Currently I am using Termux + openssh but that's not great either (e.g. no FIDO ssh key support).

However upon further inspection I am a little suspicious that AI is used significantly for a few reasons:

  • Claude has contributed a few commits (but not many)
  • Some of the markdown files (like VISION.md) read like AI generated text
  • The way the author replies to issues and PRs also reads like AI generated text, with heavy use of em dashes and bold text unnecessarily
  • The rate of commits and new features seems rather high for a single person working by themselves

Are my suspicions founded? Even if the author uses AI to generate documentation and reply to issues, I'm not sure about the actual code itself. SSH access is quite a sensitive thing so I'd like to know whether the client I am using is built with AI or not. Would appreciate your thoughts.

[–] prism@lemmy.dbzer0.com 26 points 4 weeks ago

Sigh. I knew uv and ruff were too good to be true. Just hope the community can fork before it all goes to crap.

[–] prism@lemmy.dbzer0.com 4 points 4 months ago (4 children)

Ultimately that is your choice. I personally will not use researchxxl's version considering they appeared out of nowhere and there was 0 communication about the transition. For now I will continue to use Catfriend's version and perhaps switch to nel0x's in the future.

[–] prism@lemmy.dbzer0.com 12 points 4 months ago (16 children)

No, the maintainer of syncthing fork deleted their account and the repos out of the blue. There's a lengthy forum post about it here.

[–] prism@lemmy.dbzer0.com 8 points 4 months ago (3 children)

You don't have to compile GrapheneOS from source thanks to avbroot which can take a release zip, patch it with root and sign it using a custom avb key. This lets you root while keeping the bootloader locked.

The rooted-graphene project automates this completely using GitHub actions. It even lets you do OTA updates like normal GrapheneOS.

[–] prism@lemmy.dbzer0.com 13 points 5 months ago

Chat control and any sort of good are fundamentally incompatible.

[–] prism@lemmy.dbzer0.com 3 points 5 months ago

I am able to access the data folder which is located in Internal storage/Android/media/com.whatsapp. This is without root using the AOSP files app, not sure if that's what you meant.

[–] prism@lemmy.dbzer0.com 39 points 6 months ago

For a second I thought this was The Onion. This is so dark and invasive but I can't stop myself from laughing. It's like they don't even care to pretend anymore.

[–] prism@lemmy.dbzer0.com 12 points 6 months ago

Great!

I'm sick of this. We have to defeat it every time it comes up, and there is no doubt it'll come up again in 2-3 months. They only have to win once and when they do it'll be in our lives forever.

[–] prism@lemmy.dbzer0.com 1 points 6 months ago

KernelSU has something like this called app profiles where you can set the capabilities that each app gets when it uses su. And if you are a SELinux wizard you can also set a custom domain for each app which would give you the fine grained control you're looking for. I doubt the average KernelSU user wants to delve into SELinux details so some tool to automate this would be cool. Sadly doesn't look like Magisk supports this.

[–] prism@lemmy.dbzer0.com 2 points 6 months ago (2 children)

Rooting devices breaks the principle of sandboxing: one app shouldn't be able to access or modify another app or its data, or system files. If you give an app root, it can do whatever it wants to the system. It could install a keylogger to steal credentials, extract login tokens from another app's storage or just nuke system files to make your device unbootable.

Let's say you don't give any apps root. Even having a rooting platform on the phone (e.g. Magisk) is still a vulnerability. Most rooting platforms will ask the user whether an app should get root when the app requests it. But there could be code execution vulnerabilities (e.g. buffer overflows) in the rooting platform that let you add an app to the list of apps allowed to use root without user confirmation.

TLDR: Root gives an app full access to the device, it could do anything with that. Even if you're careful with what you give root to, it still adds a lot of attack surface that could be exploited.

view more: next ›