{"action":"created","issue":{"url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/302","repository_url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge","labels_url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/302/labels{/name}","comments_url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/302/comments","events_url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/302/events","html_url":"https://github.com/Freeyourgadget/Gadgetbridge/issues/302","id":154647129,"number":302,"title":"Internet-enabled addon android app (WAS: Support for data requested by apps (e.g. weather))","user":{"login":"IzzySoft","id":6781438,"avatar_url":"https://avatars.githubusercontent.com/u/6781438?v=3","gravatar_id":"","url":"https://api.github.com/users/IzzySoft","html_url":"https://github.com/IzzySoft","followers_url":"https://api.github.com/users/IzzySoft/followers","following_url":"https://api.github.com/users/IzzySoft/following{/other_user}","gists_url":"https://api.github.com/users/IzzySoft/gists{/gist_id}","starred_url":"https://api.github.com/users/IzzySoft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IzzySoft/subscriptions","organizations_url":"https://api.github.com/users/IzzySoft/orgs","repos_url":"https://api.github.com/users/IzzySoft/repos","events_url":"https://api.github.com/users/IzzySoft/events{/privacy}","received_events_url":"https://api.github.com/users/IzzySoft/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/labels/help%20wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/labels/pebble","name":"pebble","color":"fef2c0"},{"url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":42,"created_at":"2016-05-13T07:06:53Z","updated_at":"2016-06-21T07:03:27Z","closed_at":null,"body":"I'm using a *Pebble Time Steel* initialized with the latest *Gadgetbridge* (on an LG P880 running CM11/Android 4.4.4) and just updated to FW 3.11.\r\n\r\nIt seems that several apps do not work correctly with *Gadgetbridge* – that is, they start normally but can't get data:\r\n\r\n* Watchfaces loading weather data never show weather data (e.g. [Digital and Weather](https://apps.getpebble.com/en_US/application/5647cc4151b2c3716c000023?dev_settings=true&section=watchfaces))\r\n* Apps loading other data either do so eternally ([TripAdvisor](https://apps.getpebble.com/de_DE/application/5509b04684ad023da7000030?dev_settings=true&hardware=basalt&is_browser=true&platform=android&query=&section=watchapps)) or display an error saying \"try again, or restart your Pebble app\" ([Get Me Out](https://apps.getpebble.com/de_DE/application/52e8f716ad615baba4000017?dev_settings=true&hardware=basalt&is_browser=true&native=false&platform=android&query=bahn&section=watchapps))\r\n\r\nIs that an error on my end, or is it just impossible to get that working without the official Pebble app? I wanted to avoid using that (got no wish to register and permanently send usage data etc. to some service – which is why I decided for Pebble & Gadgetbridge in the first place :)"},"comment":{"url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/comments/227357198","html_url":"https://github.com/Freeyourgadget/Gadgetbridge/issues/302#issuecomment-227357198","issue_url":"https://api.github.com/repos/Freeyourgadget/Gadgetbridge/issues/302","id":227357198,"user":{"login":"noctux","id":291559,"avatar_url":"https://avatars.githubusercontent.com/u/291559?v=3","gravatar_id":"","url":"https://api.github.com/users/noctux","html_url":"https://github.com/noctux","followers_url":"https://api.github.com/users/noctux/followers","following_url":"https://api.github.com/users/noctux/following{/other_user}","gists_url":"https://api.github.com/users/noctux/gists{/gist_id}","starred_url":"https://api.github.com/users/noctux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noctux/subscriptions","organizations_url":"https://api.github.com/users/noctux/orgs","repos_url":"https://api.github.com/users/noctux/repos","events_url":"https://api.github.com/users/noctux/events{/privacy}","received_events_url":"https://api.github.com/users/noctux/received_events","type":"User","site_admin":false},"created_at":"2016-06-21T07:03:27Z","updated_at":"2016-06-21T07:03:27Z","body":"> A further question about MAXS (just putting it here as a reminder, but answers welcome): is impersonation also a threat taken into account? In other words, are these additional permissions bound to the app package name or is it possible for the app com.rogue to declare a permission like org.project-maxs.my-permission?\r\n\r\n(Note: the answer is very opinionated)\r\n\r\nIs this really what we want? I mean, that would be an attempt to protect the User from its own stupidity... which will fail most of the time anyways. IMHO, people should read the permissions they grant. If they don't, it's their problem and nothing can save them there? On the other hand, it might be that I discover the one and only way to write gadgetbridge addons or to do better speech recognition in two years time and want to start my own variant, or use my own development version of the addon alongside the Release-version of the main app, etc.pp., a multitude of things that will be made more difficult with signature verification... :) So the permission is exactly what it should say on the tin: \"If you grant this permission to app xy, then it can use the following features of Gadgetbridge that are exposed GB-addons: [list here]\".\r\n\r\nA negativ example for context: Have you tried running Signal without the google play framework using microg for the GCM service? Signature pinning on signals part makes that really hard, without sacrificing a whole lot of security by turning of any kind of signature verification also in system-apks via an Xposed hook... On the other hand, a permission would grant the same level of security but allow for easy replacement....\r\n\r\nI mean, there are serveral ways to obtain a credible GB-release-version (last but not least the releases-category of this github-project), or even I decide to trust the fdroid maintainers, etc.pp.. If I start using shady apks from shady sources and grant them any permissions they ask for and as a result my device gets owned, then this is my private user-level problem. This is nothing that can be effectively solved at the technical layer. And lets face it. if I as malware vendor decide to socialengineer people into installing my completely legit software on their device that way, it is easier to ask for the bluetooth/calender/whatever permission and the user described above will simply grant it. Or I use a known exploit against the mass of older android handsets out there.... So I would argue to not fix something that isn't broken."}}
{"actor":{"display_login":"noctux"}}