Hey everyone,

First off, a Merry Christmas to everyone who celebrates, happy holidays to everyone, and happy almost-new-year!

Tim and I are very happy with the year devRant has had, and thinking back, there are a lot of 2017 highlights to recap. Here are just a few of the ones that come to mind (this list is not exhaustive and I'm definitley forgetting stuff!):

- We introduced the devRant supporter program (devRant++)! (https://devrant.com/rants/638594/...). Thank you so much to everyone who has embraced devRant++! This program has helped us significantly and it's made it possible for us to mantain our current infrustructure and not have to cut down on servers/sacrifice app performance and stability.
- We added avatar pets (https://devrant.com/rants/455860/...)
- We finally got the domain devrant.com thanks to @wiardvanrij (https://devrant.com/rants/938509/...)
- The first international devRant meetup (Dutch) with organized by @linuxxx and was a huge success (https://devrant.com/rants/937319/... + https://devrant.com/rants/935713/...)
- We reached 50,000 downloads on Android (https://devrant.com/rants/728421/...)
- We introduced notif tabs (https://devrant.com/rants/1037456/...), which make it easy to filter your in-app notifications by type
- @AlexDeLarge became the first devRant user to hit 50,000++ (https://devrant.com/rants/885432/...), and @linuxxx became the first to hit 75,000++
- We made an April Fools joke that got a lot of people mad at us and hopefully got some laughs too (https://devrant.com/rants/506740/...)
- We launched devDucks!! (https://devducks.com)
- We got rid of the drawer menu in our mobile apps and switched to a tab layout
- We added the ability to subscribe to any user's rants (https://devrant.com/rants/538170/...)
- Introduced the post type selector (https://devrant.com/rants/850978/...) (which will be used for filtering - more details below)
- Started a bug/feature tracker GitHub repo (https://github.com/devRant/devRant)
- We did our first ever live stream (https://youtube.com/watch/...)
- Added an awesome all-black theme (devRant++) (https://devrant.com/rants/850978/...)
- We created an "active discussions" screen within the app so you can easily find rants with booming discussions!
- Thanks to the suggestion of many community members, we added "scroll to bottom" functionality to rants with long comment threads to make those rants more usable
- We improved our app stability and set our personal record for uptime, and we also cut request times in half with some database cluster upgrades
- Awesome new community projects: https://devrant.com/projects (more will be added to the list soon, sorry for the delay!)
- A new landing page for web (https://devrant.com), that was the first phase of our web overhaul coming soon (see below)

Even after all of this stuff, Tim and I both know there is a ton of work to do going forward and we want to continue to make devRant as good as it can be. We rely on your feedback to make that happen and we encourage everyone to keep submitting and discussing ideas in the bug/feature tracker (https://github.com/devRant/devRant).

We only have a little bit of the roadmap right now, but here's some things 2018 will bring:

- A brand new devRant web app: we've heard the feedback loud and clear. This is our top priority right now, and we're happy to say the completely redesigned/overhauled devRant web experience is almost done and will be released in early 2018. We think everyone will really like it.

- Functionality to filter rants by type: this feature was always planned since we introduced notif types, and it will soon be implemented. The notif type filter will allow you to select the types of rants you want to see for any of the sorting methods.

- App stability and usability: we want to dedicate a little time to making sure we don't forget to fix some long-standing bugs with our iOS/Android apps. This includes UI issues, push notification problems on Android, any many other small but annoying problems. We know the stability and usability of devRant is very important to the community, so it's important for us to give it the attention it deserves.

- Improved profiles/avatars: we can't reveal a ton here yet, but we've got some pretty cool ideas that we think everyone will enjoy.

- Private messaging: we think a PM system can add a lot to the app and make it much more intuitive to reach out to people privately. However, Tim and I believe in only launching carefully developed features, so rest assured that a lot of thought will be going into the system to maximize privacy, provide settings that make it easy to turn off, and provide security features that make it very difficult for abuse to take place. We're also open to any ideas here, so just let us know what you might be thinking.

There will be many more additions, but those are just a few we have in mind right now.

We've had a great year, and we really can't thank every member of the devRant community enough. We've always gotten amazingly positive feedback from the community, and we really do appreciate it. One of the most awesome things is when some compliments the kindness of the devRant community itself, which we hear a lot. It really is such a welcoming community and we love seeing devs of all kind and geographic locations welcomed with open arms.

2018 will be an important year for devRant as we continue to grow and we will need to continue the momentum. We think the ideas we have right now and the ones that will come from community feedback going forward will allow us to make this a big year and continue to improve the devRant community.

Thanks everyone, and thanks for your amazing contributions to the devRant community!

Looking forward to 2018,
- David and Tim

I am fucking dying of laughter right now. 😁

Today I got a push message of the invoicing app I use from time to time and the message literally just said "lol" (without even the usual pre-fix of the app name or anything).

So after not figuring out where that could have come from and obviously theres no private messaging etc. in that app, I contacted support and they reacted surprisingly good and at same time hilariously good; they pushed now a team towards investigating that, as apparently I wasn't the only one.

https://support.waveapps.com/hc/...

I wonder who fucked up and literally pushed "lol" to thousands of people. 😂

Finally finished the blog post and (nearly) the last bugs (few remaining, still gotta think about how to solve them) are fixed.

The new blog post is online! I've taken a look at the Telegram messaging app and basically burned it into the ground. (Provided sources as well)

Next to that, a new domain name! As this blog is about online security AND privacy, I decided to change the domain name. The new one:
https://much-security-such-privacy.info/...

Dark theme can be enabled but will only work on one domain, you have to enable it on the other one as well to get a dark theme there. It stores the value in a cookie so it will remain when you reload the page and don't remove the cookies.

The RSS feed generator has a bug right now which makes that the page doesn't get updated, will work on that one tomorrow.

Thanks!

Last but not least, you can email me suggestions and so on at linuxxx@much-security.nl :)

"A Single Line of Computer Code Put Thousands of Innocent Turks in Jail"

I'll leave the title as it was, but people were hunted down just for having been once logged by a tracking pixel inside a messaging app.

Simply terrifying, I hold that off for a while, since it sounded like the usual fakes, but it seems its not, as more and more keep confirming it.

"The government eventually exonerated 11,480 of the wrongly accused, but some had already spent months in prison, and reportedly some even committed suicide."

"Elif finished dressing her youngest and watched police search her family's home before they took her into custody — for using a messaging app the government deems seditious.

She knew the arrest was coming. She'd already lost her job, because traces of the app known as Bylock were found on her phone"

"The regime relies on logs from the country's ISPs to identify users of Bylock, fingerprinting them on the basis of their communications with Bylock's servers. These communications can be triggered without using Bylock, though: Bylock's tracking pixel was used for analytics for pop-up ads and in at least eight apps."

https://m.slashdot.org/story/336657

http://cbc.ca/beta/news/...

https://boingboing.net/2018/01/...

Well, the coolest thing that's public?

MultiCube! https://github.com/filthycoding/...

Non-public: I also once had a Raspberry Pi 2 placed on top of a bus station with a powerbank (and a little rain protecting covers) and a camera module, with a little piece of image analysing software that would notify me when my bus is coming.
This worked via Google Cloud Messaging. Initially I wanted to update that to Firebase Cloud Messaging, but I decided that I didn't need that system anymore and decided to give the Raspberry Pi 2 to a friend instead.

If you can be locked out of it remotely, you don't own it.

On May 3rd, 2019, the Microsoft-resembling extension signature system of Mozilla malfunctioned, which locked out all Firefox users out of their browsing extensions for that day, without an override option. Obviously, it is claimed to be "for our own protection". Pretext-o-meter over 9000!

BMW has locked heated seats, a physical interior feature of their vehicles, behind a subscription wall. This both means one has to routinely spend time and effort renewing it, and it can be terminated remotely. Even if BMW promises never to do it, it is a technical possibility. You are in effect a tenant in a car you paid for. Now imagine your BMW refused to drive unless you install a software update. You are one rage-quitting employee at BMW headquarters away from getting stuck on a side of a road. Then you're stuck in an expensive BMW while watching others in their decade-old VW Golf's driving past you. Or perhaps not, since other stuck BMWs would cause traffic jams.
Perhaps this horror scenario needs to happen once so people finally realize what it means if they can be locked out of their product whenever the vendor feels like it.

Some software becomes inaccessible and forces the user to update, even though they could work perfectly well. An example is the pre-installed Samsung QuickConnect app. It's a system app like the Wi-Fi (WLAN) and Bluetooth settings. There is a pop-up that reads "Update Quick connect", "A new version is available. Update now?"; when declining, the app closes. Updating requires having a Samsung account to access the Galaxy app store, and creating such requires providing personally identifiable details.

Imagine the Bluetooth and WiFi configuration locking out the user because an update is available, then ask for personal details. Ugh.

The WhatsApp messenger also routinely locks out users until they update. Perhaps messaging would cease to work due to API changes made by the service provider (Meta, inc.), however, that still does not excuse locking users out of their existing offline messages. Telegram does it the right way: it still lets the user access the messages.

"A retailer cannot decide that you were licensing your clothes and come knocking at your door to collect them. So, why is it that when a product is digital there is such a double standard? The money you spend on these products is no less real than the money you spend on clothes." – Android Authority ( https://androidauthority.com/digita... ).

A really bad scenario would be if your "smart" home refused to heat up in winter due to "a firmware update is available!" or "unable to verify your subscription". Then all you can do is hope that any "dumb" device like an oven heats up without asking itself whether it should or not. And if that is not available, one might have to fall back on a portable space heater, a hair dryer or a toaster. Sounds fun, huh? Not.

Cloud services (Google, Adobe Creative Cloud, etc.) can, by design, lock out the user, since they run on the computers of the service provider. However, remotely taking away things one paid for or has installed on ones own computer/smartphone violates a sacred consumer right.

This is yet another benefit of open-source software: someone with programming and compiling experience can free the code from locks.

I don't care for which "good purpose" these kill switches exist. The fact that something you paid for or installed locally on your device can be remotely disabled is dystopian and inexcuseable.

!rant

Bit of a shameless plug but...

I've been making Crypton.sh as my side project for the past couple of months and it's now ready for public consumption. Crypton.sh is a secure and encrypted SMS messaging solution in the cloud, with its original purpose to be a 2FA mobile number that cannot be stolen like a SIM card can be, the idea came about when someone I knew has their SIM card stolen via a SIM card swap scam (https://bbc.co.uk/news/...).

Originally it came about as that idea but grew into something bigger, now everything is encrypted and you can also have conversations with other people, but I'm testing things from time to time and more can follow. Crypton.sh makes sure that you can no longer worry about your SIM card being stolen by malicious hackers, or having a second account on Whatsapp, Telegram, Signal, Google and others.