Stockholm's official app was a disaster. So annoyed parents built their own open source version -- ignoring warnings that it might be illegal. From a report: Commissioned in 2013, Skolplattform was intended to make the lives of up to 500,000 children, teachers, and parents in Stockholm easier -- acting as the technical backbone for all things education, from registering attendance to keeping a record of grades. The platform is a complex system that's made up of three different parts, containing 18 individual modules that are maintained by five external companies. The sprawling system is used by 600 preschools and 177 schools, with separate logins for every teacher, student, and parent. The only problem? It doesn't work. The Skolplattform, which has cost more than 1 billion Swedish Krona, SEK, ($117 million), has failed to match its initial ambition. Parents and teachers have complained about the complexity of the system -- its launch was delayed, there have been reports of project mismanagement, and it has been labelled an IT disaster. The Android version of the app has an average 1.2 star rating.

On October 23, 2020, Landgren, a developer and the CEO of Swedish innovation consulting firm Iteam, tweeted a hat design emblazoned with the words "Skrota Skolplattformen" -- loosely translated as "trash the school platform." He joked he should wear the hat when he picks his children up from school. Weeks later, wearing that very hat, he decided to take matters into his own hands. "From my own frustration, I just started to create my own app," Landgren says. He wrote to city officials asking to see the Skolplattform's API documents. While waiting for a response, he logged into his account and tried to work out whether the system could be reverse-engineered. In just a few hours, he had created something that worked. "I had information on my screen from the school platform," he says. "And then I started building an API on top of their lousy API." The work started at the end of November 2020, just days after Stockholm's Board of Education was hit with a 4 million SEK GDPR fine for "serious shortcomings" in the Skolplattform. Integritetsskyddsmyndigheten, Sweden's data regulator, had found serious flaws in the platform that had exposed the data of hundreds of thousands of parents, children, and teachers. In some cases, people's personal information could be accessed from Google searches. (The flaws have since been fixed and the fine reduced on appeal.) In the weeks that followed, Landgren teamed up with fellow developers and parents Johan Obrink and Erik Hellman, and the trio hatched a plan. They would create an open source version of the Skolplattform and release it as an app that could be used by frustrated parents across Stockholm. Building on Landgren's earlier work, the team opened Chrome's developer tools, logged into the Skolplattform, and wrote down all the URLs and payloads. They took the code, which called the platform's private API and built packages so it could run on a phone -- essentially creating a layer on top of the existing, glitchy Skolplattform.

The result was the Oppna Skolplattformen, or Open School Platform. The app was released on February 12, 2021, and all of its code is published under an open source license on GitHub. Anyone can take or use the code, with very few limitations on what they can do with it. If the city wanted to use any of the code, it could. But rather than welcome it with open arms, city officials reacted with indignation. Even before the app was released, the City of Stockholm warned Landgren that it might be illegal. In the eight months that followed, Stockholms Stad, or the City of Stockholm, attempted to derail and shut down the open source app. It warned parents to stop using the app and alleged that it might be illegally accessing people's personal information. Officials reported the app to data protection authorities and, Landgren claims, tweaked the official system's underlying code to stop the spin-off from operating at all.

Alphabet's Google said on Thursday it plans to allow third-party payment systems in South Korea to comply with a new law, marking the first time the U.S. tech giant has amended its payment policy for a specific country. From a report: Google's announcement comes after a Korea Communications Commission's (KCC) request for Google and Apple to come up with compliance plans for the new law, which bans major app store operators from forcing software developers to use their payments systems. Most of the new law went into effect in mid-September. The curb is the first such move by a major economy on the likes of Apple and Google, which face global criticism for requiring the use of proprietary payment systems that charge commissions of up to 30%.

In late August, parliament passed an amendment to South Korea's Telecommunications Business Act - dubbed the "anti-Google law" - banning big app store operators, such as Google and Apple from forcing developers to use their payment systems, effectively stopping them from charging commission on in-app purchases. "We respect the decision of the National Assembly, and we are sharing some changes to respond to this new law, including giving developers that sell in-app digital goods and services the option to add an alternative in-app billing system alongside Google Play's billing system for their users in South Korea," Google said in a statement.

Proposed European regulation that could force Apple to allow iPhone users to install software from the web would open '"Pandora's box" and could pose threats to entire networks of computers, Apple software senior vice president Craig Federighi said in a speech on Wednesday. From a report: The remarks at Web Summit in Lisbon, Portugal represent an escalation in Apple's rhetoric about what could go wrong if Apple is forced to change its App Store policies. [...] "European policymakers have often been ahead of the curve," Federighi said. "But requiring sideloading on iPhone would be a step backward. Instead of creating choice, it could open up a Pandora's Box of unreviewed malware and software."

The European Commission, the executive arm of the EU, presented the Digital Markets Act last December. The Act is designed to stop companies like Apple, Google and Meta, the company previously known as Facebook, from abusing their power. It contains a series of rules that would require them to open up their platforms to competitors. Failure to comply could result in fines as high as 10% of the companies' worldwide annual revenue. In a report filed with the U.S. SEC last month, Apple specifically named the Digital Markets Act and said that, if enacted, it could require changes to Apple's App Store that might harm the company's financial results. On Wednesday, Federighi didn't address the potential financial impact to Apple. Instead, he argued sideloading would cause users to be tricked into downloading malware. "Even if you have no intention of sideloading, people are routinely coerced or tricked into doing it," Federighi said, citing malware on Google's Android, which allows sideloading. Google warns users against doing so in system messages and pop-ups, however. Federighi argued that although technically skilled people might be able to identify malware on the internet, their parents or children might still be fooled, making everyone's iPhone data less secure.

The eNaira is supposed to live within a mobile wallet, have the same value and be interchangeable with the physical naira for everyday transactions. Nigerians believe the eNaira, which is governed by a centralized blockchain, is part of the central bank's drive to discourage cryptocurrencies' popularity among Nigeria's youth, just like China's effort with the digital yuan. From a report: And so last week, Nigeria's central bank made two types of eNaira wallets available on Google and Apple stores: one for individuals, and another for merchants. But some users say parts of the wallet for individuals have not worked properly. Fisayo Fosudo, a Nigerian YouTuber who reviews gadgets and apps, said he and three friends initially got error messages that the eNaira app could not match their emails to their bank verification numbers. He would later register successfully but found broken links that did not lead to helpful support pages on the central bank's website. "Was really looking forward to reviewing the eNaira app but it's been hard to get it to work seamlessly. We wait," Fosudo said. After many users left poor reviews for the Android version of the eNaira app for individuals, it was taken down. It had been downloaded 100,000 times before that. The Apple Store version remained available at press time.

Netflix, the video-streaming giant, began its expected foray into video games with the introduction of five mobile games to its users worldwide, playable initially on Android devices. From a report: The titles are included in a Netflix subscription, and there'll be no advertising or additional purchases required, Mike Verdu, Netflix's vice president of game development, said Tuesday. The streaming company has targeted video games as its next big thing -- it's an industry that's larger than the movie and TV businesses. Players logging in will see a dedicated games row and tab where they can choose which titles to play. Games for Apple's iPhone are also planned. The initial offering includes titles linked to Netflix shows, such as Stranger Things: 1984 and Stranger Things 3: The Game. Also included are Shooting Hoops, Card Blast and Teeter Up.

A year after releasing the first preview build of its Chromium-based Edge browser for Linux, Microsoft is announcing its general availability. From a report: The new release supports a variety of Linux distributions, including Ubuntu, Debian, Fedora and openSUSE. Microsoft announced Linux on Edge's availability milestone during the first day of its Ignite IT Pro conference. As of the release of Edge for Linux to the "stable" (mainstream user) channel, Edge is now available on Windows, Mac, iOS, Android and Linux. As it did when introducing the new Edge on macOS, Microsoft has been positioning Edge on Linux as more of an offering for IT pros and developers who want to test web sites than as a browser for "normal" users on those platforms. However, any user on any supported platform can use the new Edge.

"New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks," reports BleepingComputer.

Cybersecurity company Lookout said on its blog that they'd spotted the malware on Google Play "and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store.... To protect Android users, Google promptly removed the app as soon as we notified them of the malware." We named the malware "AbstractEmu" after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads...

This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors... By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps' sensitive data, something not possible under normal circumstances...

AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading... By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device.
"Apps bundling the malware included password managers and tools like data savers and app launchers," reports BleepingComputer, "all of them providing the functionality they promised to avoid raising suspicions..."

Lookout's blog post said they'd spotted people affected by the malware in 17 different countries.

A Microsoft software engineer working on open-source technologies recently wrote that "you can find an open-source implementation for (almost) anything.

"But the mobile landscape is a notable exception." While there are some open-source success stories, Android being a massive one, only a handful of major companies rule hardware and software innovation for the devices we carry in our pockets. Together, Apple and Samsung hold over 50 percent of the world's market share for mobile devices, a figure that underscores just how few dominant players exist in the space. Numbers like these might leave you feeling somber about the overall viability of mobile open source. But a growing demand for better security and privacy, among other factors, may be turning the tides, and a host of inspectable, open-source solutions with transparent life cycle processes are emerging as promising alternatives....

Along with the open-source messaging app Telegram, Signal has garnered attention as a more privacy-focused alternative to apps like Facebook Messenger. The browser Chromium and the mobile game 2048 are other noteworthy examples, as well as proof that although open-source apps aren't the norm, they can be widely adopted and popular. For example, over 65 percent of mobile traffic flows through Chromium-based browsers...

Despite the many open-source technologies available to help build mobile apps, there's plenty of room to grow in the user-facing space — especially as more people recognize the value of having open-source and open-governance applications that can better safeguard their personal information. That growth isn't likely to extend to the hardware space, where the cost of building open-source implementations isn't as rewarding for developers or users — though we may start to see more devices that allow people to choose individual hardware modules from a variety of providers.
The article does cite the open source mobile hardware company Purism. And there's plenty of interesting open source software for mobile app developers, including frameworks like Apache Cordova (which lets developers use CSS3, HTML5, and JavaScript) and a whole ecosystem of open source libraries. But it all does raise the question...

Why aren't there more open source solutions for mobile devices?

Google and top Indian telecom network Jio Platforms said on Friday that their much-anticipated budget smartphone, JioPhone Next, will go on sale in the world's second largest smartphone market on November 4. From a report: The firms said the JioPhone Next will cost 6,499 Indian rupees ($87), and can also be purchased in multiple instalments with an entry price as low as $27. The smartphone runs Pragati OS, which is powered by an "extremely optimized" Android mobile operating system with a range of customized feature. The two firms also revealed the specifications of the JioPhone Next. The smartphone features a 5.45-inch HD+ display with Corning Gorilla Glass 3 protection. It is powered by Qualcomm's quad-core QM-215 chipset that clocks up to 1.3GHz, coupled with 2GB of RAM and 32GB internal storage, which is expandable.

An anonymous reader quotes a report from Bloomberg: Meta, the company formerly known as Facebook, is developing a smartwatch with a front-facing camera and rounded screen, according to an image of the device found inside one of the tech giant's iPhone apps. The photo shows a watch with a screen and casing that's slightly curved at the edges. The front-facing camera -- similar to what you'd see on a smartphone -- appears at the bottom of the display, and there's a control button for the watch on the right side. The image was found inside of the company's app for controlling its new smart glasses launched in partnership with Ray-Ban. The picture was located by app developer Steve Moser and shared with Bloomberg News.

The watch has a detachable wrist strap and what appears to be a button at the top of the watch case. Its large display mimics the style of Apple's watch -- rather than the more basic fitness trackers sold by Google's Fitbit and Garmin. The camera suggests the product will likely be used for videoconferencing, a feature that would make Meta's device stand out. Apple's smartwatch doesn't have a camera, nor do rival products from companies such as Samsung. Facebook has been planning to launch its first watch as early as 2022, but a final decision on timing hasn't been made yet and the debut could be later, according to a person with knowledge of the matter. The company is working on three generations of the product aimed at different release time frames, the person said. The device in the image could ultimately represent a version that is never released, but it's the first evidence of the company's work on the project. Not only does the code inside the software of the watch indicate it'll work with iOS and Android devices, but it may also be used as an input device or accessory for the company's VR and AR headsets.

Huq, an established data vendor that obtains granular location information from ordinary apps installed on people's phones and then sells that data, has been receiving GPS coordinates even when people explicitly opted-out of such collection inside individual Android apps, researchers and Motherboard have found. From a report: The news highlights a stark problem for smartphone users: that they can't actually be sure if some apps are respecting their explicit preferences around data sharing. The data transfer also presents an issue for the location data companies themselves. Many claim to be collecting data with consent, and by extension, in line with privacy regulations. But Huq was seemingly not aware of the issue when contacted by Motherboard for comment, showing that location data firms harvesting and selling his data may not even know whether they are actually getting this data with consent or not.

"This shows an urgent need for regulatory action," Joel Reardon, assistant professor at the University of Calgary and the forensics lead and co-founder of AppCensus, a company that analyzes apps, and who first flagged some of the issues around Huq to Motherboard, said in an email. "I feel that there's plenty wrong with the idea that -- as long as you say it in your privacy policy -- then it's fine to do things like track millions of people's every moment and sell it to private companies to do what they want with it. But how do we even start fixing problems like this when it's going to happen regardless of whether you agree, regardless of any consent whatsoever."

At this year's Android Dev Summit, Google announced an upcoming update for devices with larger screens, which includes tablets, foldables, and devices that run ChromeOS. From a report: Google is calling the update 12L, and it's supposed to make Android 12 run smoother on big screens. We first heard the possibility of a "12.1" update in late September, and it looks like many of the rumored features are true. 12L optimizes the layout of a device's UI, adjusting the placement of the home screen, lock screen, notifications, Quick Settings, and more. Google notes that any screen 600 density-independent pixels (dp) and above will display a two-column layout that makes use of the entire screen. In the example Google shows, the Quick Settings menu is pushed towards the left side of the screen, while the notifications panel is locked to the right, giving you the ability to access both simultaneously -- all without opening one app and closing another. 12L also introduces a new taskbar that makes it easier for users to quickly switch between different apps. Dragging and dropping an app from the taskbar opens it up in split-screen mode, which Google notes it has enabled for all apps, whether they're resizable or not.

"Facebook has filed a lawsuit on Friday against a Ukrainian national for allegedly scraping its website and selling the personal data of more than 178 million users on an underground cybercrime forum," reports the Record. According to court documents filed Friday, the man was identified as Alexander Alexandrovich Solonchenko, a resident of Kirovograd, Ukraine. Facebook alleges that Solonchenko abused a feature part of the Facebook Messenger service called Contact Importer. The feature allowed users to synchronize their phone address books and see which contacts had a Facebook account in order to allow users to reach out to their friends via Facebook Messenger. Between January 2018 and September 2019, Facebook said that Solonchenko used an automated tool to pose as Android devices in order to feed Facebook servers with millions of random phone numbers. As Facebook servers returned information for which phone numbers had an account on the site, Solonchenko collected the data, which he later collected and offered for sale on December 1, 2020, in a post on RaidForums, a notorious cybercrime forum and marketplace for stolen data.
The article also notes that Facebook's court documents say Solonchenko scraped data from some of the largest companies in the Ukraine, including its largest commercial bank and largest private delivery service.

And the Record points out that he's not the only person known to have this hole to scrape Facebook's user data and then sell it on the forum.) Days after another incident in April involving 533 leaked phone numbers of Facebook user, Facebook "revealed that it retired the Messenger Contact Importer feature back in September 2019 after it discovered Solonchenko and other threat actors abusing it."

An anonymous reader quotes a report from Ars Technica: Oculus may have officially discontinued its low-end Oculus Go headset last year, but the company has one more "official" update to help future-proof the hardware. On Thursday, Oculus released an unlocked build of the Oculus Go operating system, allowing for "full root access" on more than 2 million existing units. Oculus "Consulting CTO" (and former id Software co-founder) John Carmack announced his plans for this update last month, saying it was something he had "been pushing on for years." In part, the unlocking is an attempt to guarantee that Go hardware will continue to be fully functional well into the future, allowing for "a randomly discovered shrink wrapped headset twenty years from now [to] be able to update to the final software version, long after over-the-air update servers have been shut down," Carmack wrote.

Before that, though, the update will allow tinkerers to "repurpose the hardware for more things today," as Carmack puts it. Go hardware running the unlocked OS will no longer check for a Facebook signature at the kernel level, meaning developers can create new versions of low-level system software for the entire Android-based OS. That could allow for custom versions of low-level features like the app launcher and the removal of otherwise locked system apps. The update also allows for easy sideloading of apps outside of Go's store interface, though this was already possible on older OS versions.

Google is lowering commissions on all subscription-based businesses on the Google Play Store, the company announced today. From a report: Previously, the company had followed Apple's move by reducing commissions from 30% to 15% on the first $1 million of developer earnings. Now, it will lower the fees specifically for app makers who generate revenue through recurring subscriptions. Instead of charging them 30% in the first year, which lowers to 15% in year two and beyond, Google says developers will only be charged 15% from day one. The company says 99% of developers will qualify for a service fee of 15% or less, as Google is also further reducing fees for specific vertical apps in the Play Media Experience Program. These will be adjusted to as low as 10%, it says.

Nvidia's new RTX 3080 plan for GeForce Now is probably the biggest upgrade for its cloud-streaming service since it turned on RTX ray tracing for subscribers over two years ago. From a report: The new plan is targeted at more traditional gamers for whom 60fps simply doesn't cut it, and it'll cost $100 for every six months you're signed up. In addition to the RTX ray tracing of the Priority plan, it offers 8-hour sessions, up to 1440p and 120fps gaming on PC and Mac (1600p on MacBooks), 4K HDR 60fps with 7.1 surround audio on Nvidia Shield (using DLSS) and up to 120fps on select Android devices. On iOS, GeForce Now has to use Safari rather than a dedicated app, which likely either can't handle or is too locked down to hit the higher frame rates.) According to the company, MacBooks are the second most popular device it sees used by the service, which isn't surprising given how poor the Mac's gaming is compared to PCs. The new MacBook Pro models, with their 120Hz displays, will be able to take advantage of the higher resolution and frame rates.

As Paul Thurrott reports, Brave is removing Google Search as its default search engine. From the report: Going forward, the Brave web browser will default to Brave Search. "Brave Search has grown significantly since its release last June, with nearly 80 million queries per month," Brave CEO and co-founder Brendan Eich says. "Our users are pleased with the comprehensive privacy solution that Brave Search provides against Big Tech by being integrated into our browser. As we know from experience in many browsers, the default setting is crucial for adoption, and Brave Search has reached the quality and critical mass needed to become our default search option, and to offer our users a seamless privacy-by-default online experience."

Brave Search is built on top of an independent index, and doesn't track users, their searches, or their clicks, the firm says. And starting with Brave 1.3 on desktop and Android, and Brave 1.32 on iOS, it will be the default search engine in the browser, instead of Google, in the United States, Canada, and the United Kingdom. It is also replacing Qwant in France and DuckDuckGo in Germany, and Brave says that more locales will be added in the next several months. Existing users can keep their chosen search engine default, of course, and new users who prefer other search engines can configure as needed. Brave Search doesn't display ads today, but the free version of the service will soon be ad-supported. An ad-free Premium version is coming "in the near future," Brave says. Along with this search engine news, Brave announced the Web Discovery Project (WDP), "which it describes as a privacy-preserving system for users to anonymously contribute data to improve Brave Search results," writes Thurrott. "The WDP is an opt-in feature that protects user privacy and anonymity by ensuring that contributed data is not linked to individuals, their devices, or any set of users." It has a GitHub repo available to help you learn more about this system.

Today, Google has officially launched Android 12 for select Pixel devices. The Verge reports: It's available to install right now on Pixel 3 and up, including the Pixel 3A, Pixel 4, Pixel 4A, Pixel 4A 5G, the Pixel 5, and the Pixel 5A. It'll launch on the Pixel 6 and Pixel 6 Pro, as well. Android 12 will be coming later this year to Samsung Galaxy, OnePlus, Oppo, Realme, Tecno, Vivo, and Xiaomi devices.

The most noticeable feature in Android 12 is the new Material You design, which lets you go a little deeper to tweak the look of the homescreen to your liking. It's more expressive than previous versions of Android, with tools to let you coordinate colors that can extend across app icons, pull-down menus, widgets, and more. Speaking of widgets, many of those have been updated to match the new look, and Google shared today that by the end of October, it plans to have over a dozen new or refreshed widgets available for its first-party apps. Google has published a blog post detailing more features available in this release, including the "Pixel-first" features like Material You.

This morning, at the company's virtual hardware event, Google is finally showing us what it means to pick up and start over again. From a report: In many ways, the Pixel 6 marks the most radical departure in the history of Google's flagship devices -- and its most serious attempt to take the fight to Samsung and Apple. The company gave us our first glimpse of the device back in August. It was a surprisingly complete look at a device it would take another three and a half months to announce. Hardware head Rick Osterloh primarily focused on chips, design and the fact that Google was becoming the latest company to buck its reliance on Qualcomm by building its own in-house chip, Tensor. And now it is. The Tensor had landed, alongside the Pixel 6 and 6 Pro it powers. I have the latter in my possession, and it's immediately clear that this is a radically new direction for the Pixel line. Google's clearly gone in a premium direction with the new device, which shares more common DNA with the likes of Samsung's devices than any of the Pixels we've seen to date.

The Pixel 6 sports a 6.4-inch FHD+ OLED at 411 ppi -- that bit, at least, is keeping with mid-range specs. The Pro bumps it up to a 6.7-inch QHD+ at 512 ppi. Those displays have refresh rates of 90 and 120 Hz, respectively, protected by a Gorilla Glass Victus cover, which curves on the edges. [...] The 6 supports two lenses: a 50-megapixel wide-angle camera and 12-megapixel on the 6, plus a 48 megapixel telephoto on the 6 Pro. That last one does 4x optical or up to 20x Super Res, though even with computational photography, things are going to degrade pretty quickly. The front-facing camera, meanwhile, is eight megapixels on the 6 and 11 megapixels on the 6 Pro, with 84- and 94-degree fields of view, respectively. [...] The company has addressed some of the battery issues that plagued earlier models. The 6 and 6 Pro feature 4,614 and 5,003mAh batteries, respectively -- that's a nice jump from the Pixel 5's 4,080mAh (which, in turn, was a nice jump from the Pixel 4). The Pixel 6 starts at $599 and the Pixel 6 Pro starts at $899.

For its 60th anniversary, Fisher-Price announced a special edition Chatter telephone that can make and receive real phone calls. Engadget reports: Before you start planning on where to display it at your home, know that it doesn't work as a landline unit. It connects to your iOS or Android phone via Bluetooth instead and has to be within 15 feet of your mobile device to work. You'll get nine hours of talk time on the Chatter phone on a single charge, and it comes with a speakerphone button. Other than the features that make it a working device, this Chatter for grown-ups looks just like its toy counterpart with its rotary dial, red handset and wheels. [...] You can get the fully functional Chatter for $60 exclusively from Best Buy's website, starting today until supplies last.