Symbian Malware - Signed

February 20th, 2009

I saw some random references to something called Sexy View, malware aimed at Nokia devices. I was just going to ignore it, but then I realized it appears to be a signed application. Delicious. If nothing else that should allow the response folks to track down where it came from I would assume. The reports out there are vague so far at best, but I’m hoping at some point something will shed some light on how this came about. I’m assuming something happened like some company got careless (or went out of business and just ignored) their signing key for applications, and some malicious party got hold of it. Very curious about this I am.

Google Apps for Domains with G1

February 18th, 2009

After poking around for a while trying to add a second Google Apps for domains account to my G1, I finally just reset it and registered with my mike@theotherdomain.com address to activate the phone. Very cool that works directly, I have my email and calendar directly integrated into the phone. However, I would really like to have both my personal @gmail.com account and my @theotherdomain.com account both fully supported on the phone.

I can technically add my personal email as an external email account, and share my calendar so that I can add the ical feed to the Calendar app. Too hackish though, with lots of rough edges. Especially around calendaring. Is there an option floating around somewhere that I just haven’t found yet to add a second Google account to the phone setup?

Installing RC33 on a Dev G1

February 16th, 2009

A friend over at Google provided me with an unlocked Android phone, which I’ve been poking around with here and there doing some development. I hadn’t really poked around with the phone itself all that much, meaning looking at hacks and usage tricks and whatnot. Yesterday I decided I wanted to update to the latest firmware (RC33) however, so the journey began. I have my G1 running on the AT&T network, which is where some of the complexity comes from.

I started out with the normal instructions for manually installing the RC33 update, which are pretty actually slick and simple. However, I was getting a failed check when trying to install the firmware. I assume there’s some internal ID that identifies the phone as a TMobile phone or not, and my dev phone doesn’t have that, so the installer was throwing some assertion failure check. So I figured I would try out one of the jailbroken images if I’m going to have to muck around for a while anyway.

There is an alternative version of the RC33 update available, called the JF33 sometimes, and other times the JF RC33. The JF stands for Jesusfreak, the forum user who repacks the roms and has apparently provided test keys that can be used to downgrade a unit. Once you know what you’re looking for, there are tons of posts in forums and blogs all over the place. The problem is just figuring out what you need to search for.

The process goes something like this:

It was a bit of an involved process to get through. And at first when I installed the RC29 firmware and had to re-activate, I was afraid I wasn’t going to be able to do so without a TMobile SIM. Just a bit of APN hackery took care of that however. Phew! Now I have Latitude working in maps, and root access in the terminal. W00t! Back to developing now.

Omar’s Interview on All Things Digital

January 13th, 2009

Check out the interview that Omar did with Kara from All Things Digital. Kara’s a fantastic interviewer, and Omar always has interesting stuff to say. So even if you normally skip video tidbits (like I normally do) this one is still worth it.

The comments about Silicon Valley and Madison Avenue just starting to realize the potential in mobile advertising with the iPhone because it’s the first time they’ve actually seen it themselves, that rings really true. Lots of us thought the iPhone was going to take a long time to make a difference, if it made a difference at all. We were so very wrong about that. Just goes to show, being “in the industry” doesn’t really mean crap in terms of your ability to predict what’s going to happen when there’s a discontinuity. That discontinuity that happened in mobile is now working it’s way through complementary and adjacent markets. Should be an interesting few years coming up.

Palm WebOS

January 9th, 2009

The fact the Palm has taken a radical turn, redesigned their mobile platform around access to the web and development around web technologies, and is releasing a new device based on it in the first half of this year are all really non-news items for me. What’s going to be the deciding point is what happens when us developers get to see the Mojo SDK that goes along with the WebOS platform.

The message so far coming out of Palm is on target in that regard. They need to return to the kind of innovation and energy that went along with the initial Palm Pilot devices. The big deal there was that they had a relatively simple platform that encouraged developers to experiment, and at the time they were the only real game in town for someone who wanted to pick up a device off the shelf and be able to program for it. Basing the design of the OS around web interfaces and attempting to allow developers to use the same technologies for native apps as they’ve been using on the web, I like that actually. Just a few days ago I was fooling around with hooking into native services on Android from within a browser interface, and it provides a really powerful system for getting stuff together quickly with quite a bit of flexibility.

So overall, I got to say, my curiosity is somewhat piqued. I don’t think we have enough info at all yet to make any decisions. But for the first time in oh-so-long, I’m happy about what I’m hearing.

Shim Services

January 1st, 2009

I’ve been sick for the last few days. Perfect time to put a bit of a dent in that ever-growing pile of unread books next to my bed! Which I began doing without hesitation, until I kept running into cross-references to other books in Dreaming In Code. Some of the books I know I’ve read, others I know I should definitely pick up, others I’m not sure about. Have I read them? Do I own them? As I scan my bookshelves looking for my copy of The Soul of a New Machine I re-realize that I’ve already cleared the unread book stack a few times. Now there’s a bunch of still-very-interesting unread stuff mixed in with the filed-away-for-reference stuff. Maybe it was because I was reading Dreaming In Code that I began suffering from delusions of adequacy, but I thought “I must organize this!”. Maybe it was just the Nyquil talking.

First thought was along the lines of “there must be some software out there that will do this for me already.” Lots of stuff for OS X, but I’m on a Linux system most of the time. And the the most promising of the Linux based cataloging software crashes immediately on window move or resize on my 64-bit desktop system. Maybe that’s not the way to go. I want something quick, easy, and hopefully composable into other usages.

How about something for Android? I’ve been fooling around with developing some Android stuff. And they have Zebra Crossing, a prepackaged lib for barcode scanning. I should be able to find something floating around out there that should make it easy to just scan a whole bunch of barcodes. I can use that to make a big list of ISBNs, and then feed the stuff into a combination of ISBNdb.com and Amazon lookups to make myself a database of my books.

In poking around looking for a simple barcode scanning notepad kind of app I saw the Oilcan app sitting on my Android desktop. Oilcan is a browser wrapper that lets you plugin Greasemonkey style extension scripts into the native Android browser. One of the examples that comes with Oilcan is an extension that allows you to scan barcodes directly into the input box on m.half.com.

It took about 5 minutes to turn that into something that would use a page on my own server to make me a database of scanned ISBN numbers. No native coding required, which I thought was pretty interesting. One thing to pay attention to is the supper aggro caching that the Android browser does, make sure you insert cache control headers and meta tags. Instead of ending up with a one time throw-away tool to create a list of ISBNs, I’ve ended up with an online service that I can use to toss other barcode based info up to my server.

And most importantly, I’ve found a way to use creative coding to procrastinate my way around actually getting done what I set out to accomplish. Happy 2009 everyone!

Continuing Symbian Signed Conversation

December 15th, 2008

One of the points I was harping on at and around the Symbian Partner conf were my perceived issued with the Symbian Signed effort. As a developer I get no benefit out of the initiative, but I’ve commonly felt some pained incurred by it. David Wood also just posted about the basic principles of software signing, so apparently it’s on his mind too.

I’ve already put down a bunch of my gripes about the current system. But if we want to break it down to basics, there are a few questions that I think we need to answer about a signing process. I was going to try to lay then down in some form of coherent order, but I have a rapidly evolving situation that needs some tending to. So here they are in jumbled rough form:

Signing is trusting. In the SSL world that’s trusting that the server at the end of the connection is owned by the people who are supposed to own it. Who are we trusting in signing a Symbian app? There’s trusting that the app provider isn’t going to do anything nefarious. There’s trusting that the OS will only allow the app to do things it was signed to do (nice bit of work there, I like this part of the signing process actually) There’s trusting that is something goes wrong with the app you can get help.. which is unaddressed. Part of what the carriers/operators really want is a reduction in support calls/cost. This doesn’t help that. Actually, there’s a mistaken perception on the part of users that their carrier/operator is the person to call when an app goes wrong. I don’t call Comcast when a virus screws up my PC Why are these things really important in the mobile world when they’re left to sort themselves out (internet style) in the PC realm? Is it constrained devices and bandwidth really? Or is carrier/operator cost the principal driver? If it’s really constrained devices and bandwidth, why can’t I - the user - manage rights outside of the signing infrastructure? Why doesn’t signing set default rights and let me choose what I want to grant or remove manually after the install? Signing shouldn’t be the only mechanism of trust extension. Look at the Maemo installer for an example of well done application installation process. Installing a package brings in a feed of updates, repository for apt installs actually, that brings in updates. Build the trust mechanism into that, I should be able to trust the people I want to trust. It’s great that the operating system can enforce some set of restrictions for a set of applications signed by an “official source”. But if I want to trust Google directly, let me trust Google.

Damnit, gotta run. Give David some feedback if you can, I think he’s headed in a good direction with this conversation.

Misleading Numbers

December 6th, 2008

I found the conclusions based on these numbers quite amusing. Anyone else spot the flaw in the logic that because folks on DeviceAnywhere spend more time testing on the Razr that means that developers are focusing their efforts more on the Razr then the iPhone? That’s not quite the conclusion I draw.

The tricky thing about “the Razr” is that it’s not one phone at all. Spend any time poking around with the phone on different carriers and you’ll find that every carrier and every minor release has different properties. Some carriers have chosen to include some options, others not, others have tweaked them slightly to make them fit into the guidelines for device behavior, etc. It’s a developer nightmare, cause you never know what to expect. And on such a constrained platform to begin with, things like available memory can be severely impacted by the carriers desire to do something as simple as swap out the images being used on the home screen.

On the other hand you have the iPhone. Write an app for the iPhone, it runs on the iPhone. Done.

Now imagine you’re an engineering manager looking at the amount of money you spend to support your application. The global economy is such that most folks are looking to cut costs, so to be responsible you’re trawling though your numbers. What’s your spreadsheet going to have when you look at your porting efforts? The number of users you have on a platform and the cost to maintain the port to that platform. What you’re going to be looking for are platforms where the dollar-per-user cost is high and/or increasing. The iPhone is linear, it costs X dollars to port to iPhone no matter how many users you have. However with the Razr you keep throwing more and more developer and QA time at issues because you need to hit every little variant of the firmware with it’s unique quirks. As your user base grows, the cost of supporting the Razr grows. And in my experience, most applications (social networking and casual games aside) probably don’t really see that many more Razr users then iPhone users despite it having vastly larger distribution numbers.

My take-away from the DeviceAnywhere numbers is “Razr incurring dangerously high engineer and QA costs, if the iPhone base keeps growing existing handsets are in danger of getting dropped.” It’s a funny thing trying to interpret numbers. Assuming that time spent testing for a device means that a business really desires representation on that device is a mistake.

Converting to Open Source

December 5th, 2008

I went to the Symbian Partner Event yesterday, and then grabbed some dinner with a bunch of folks from Symbian and Nokia afterward. Most of what I was interested in hearing about was how they plan to convert to open source. There’s some info up already at the Symbian Foundation website, but that’s all very much marketing oriented material without too much detail about the major important factor - the code. Charles Davies gave a presentation toward the end of the day that laid out some additional details though.

The folks at Symbian and Nokia are just putting together the disparate code bases they work with and trying to unify the layout. They’ve been breaking up the code into sets of modules, it’s looking like there will be about 100 modules all told. The code roughly breaks down into operating system elements, middleware and API elements, application elements, and then some desktop packages. Not everything is going to be open sourced right off the bat, they’ve mentioned that before, due to encumbrances of existing licensed code in the base as it stands. Whole modules will be open sourced however, so that when you get some code it should represent the full set necessary to understand and debug a particular function. I was concerned initially that the open sourcing might follow some kind of horizontal stratification, which would be a lot less useful to anyone looking to dive in and understand how something works.

Which leads to the next question, if you’re a developer at least, can I compile the open source bits and run them somehow? I asked David Wood that later on in the evening, are the parts that aren’t open yet going to come in a binary form that I can use with my own compiled modules to link up a running system? Actually, that is the plan, but the details are still getting worked out it seems. Which would be awesome, I would love to be running a hacked version of my E71 firmware that adds a few functions to the standby screen. However, the partially open model is going to mean that porting to a new platform isn’t something that the standard basement hacker could undertake for a while.

The other interesting bit in his presentation was their approach to branding and ensuring a consistent platform across Symbian based devices. They’re actually putting together a software test suite to exercise the APIs and behavior of a base system and using that as the yardstick for compliance. And the test suite itself is part of what goes out as open source. If your product passes the test suite, you should be good to go. Very nice.

Overall though I think the foundation has some learning to do still about interacting with developers and really enabling a larger ecosystem. Lee Williams, the current Executive Director for the foundation, spent an awful lot of time bashing the Apple and Google store models because they’re old style thinking “control points.” And people need to get away from thinking in terms of control points and start thinking about enabling. So I asked a question about application binary signing, which is an excellent example of control point thinking and a common stumbling block for folks looking to do Symbian development. And his answer was pretty much “Well, that we need because this is telecommunications, and that’s the way telecom works, it’s actually a benefit not a hindrance” and went back to bashing Apple and Google. Booo. Bad form.

Fortunately David Wood and a few folks from Symbian where around later on to pick up the conversation that Lee tried to shut down. Although signing will probably exist going forward in Symbian, they are looking at reworking the mechanism and making things easier for developers. In particular I tend to use the example of getting GPS support into Python for S60. One of the benefits of Python on S60 is supposed to be that you can develop for it without having to get into the details of dealing with the standard SDK (great for me, I don’t use a Windows machine). You cut off that benefit if the developer needs to sign Python modules in order to get access to the interesting functions. In my mind Python is great to enable prototyping and experimentation. Exactly the areas where you would like to expose new and enhanced functionality. I think some of the folks heard the message, but it certainly wasn’t universally received.

Hopefully this is a learning process, and we’ll see the Symbian Foundation folks moving more and more toward genuine open thinking. Right now there seems to be a mix of marketing oriented open thinking together with some deeper understanding of the technical benefits of being open. That’s one of the nice things about being open however, it’s a model that tends to overtake other models.

Skyfire 0.85

November 26th, 2008

I’m not allowed to talk yet about what I’ve been working on for the last few months. Odd isn’t it? But information wants to be free fortunately, so here are a few other folks talking about what we’ve been up to:

There’s definitely some stuff we need to work on still. But the ball is steadily rolling, drum beating, people marching, etc. Also a lot going on behind the scenes as we prep for the really real world. We’re not quite there yet (thus the 0.85 version number instead of a 1.0 version number), but the recent release went quite well all things considered. It was one of those tremendous overhauls that touched pretty much everything, and still the system came back up just about on schedule (we ran about 45 minutes over on our 4 hour window) and in working order.

Definitely looking forward to the four days off starting tomorrow though. Thanksgiving break here in the US tomorrow, and then everyone has Friday off for shopping or something. Guess not everyone has their XMas presents drop shipped by Amazon. That’s how I do it though, and I have no issues at all with the technique.



You are viewing a mobilized version of this site...
View original page here

Mobilized by Mowser Mowser
Mobilytics