Hacker Newsnew | past | comments | ask | show | jobs | submit | vader1's commentslogin

> This is because app stores do a lot of heavy lifting to provide security for the app ecosystem. Specifically, they provide integrity, ensuring that apps being delivered are not tampered with, consistency, ensuring all users get the same app, and transparency, ensuring that the record of versions of an app is truthful and publicly visible.

The Google Play Store does none of this, lol. All apps created since 2021 have to make use of Google Play App Signing, which means Google holds the keys used to sign the app. They leverage this to include stuff like their Play Integrity in the builds that are served. The Android App Bundle format means that completely different versions of the app are delivered depending on the type of device, locale, etc. There is 0 transparency about this for the end-user.


As a further addition, Google does this for show (it’s not their business model) and is not equipped to deal with the criminals at Meta, as recently became apparent from, among other things, this disclosure: https://archive.is/nWpDZ https://localmess.github.io


This sounds great! Does anyone know what this means for Google Pay and Apple Pay? In this country there's not a single bank anymore that offers contactless payments without going through Google or Apple...


I blame Apple, who hindered the adoption of alternative NFC payment apps by disallowing access to the hardware for developers.

Banks wanted to make their own payment solution but since they definitely couldn't on iOS it was pointless to come up with a separate solution for Android. So, they negotiated a contract with both tech firms and that was it.


Very fair. Doing anything with online advertising, either as an advertiser or as a publisher, without it involving any of Google's platforms is nearly impossible.


What's worse, doing anything at all without it involving any online advertising is nearly impossible, too.


The lack of a physical SIM tray is just one more way to lock users in Google's walled garden. eSIM support is not implemented in Android itself (AOSP), but part of the proprietary GMS package. This means Google-free Android forks like LineageOS will be unusable on the Pixel 10 series :-(


>The lack of a physical SIM tray is just one more way to lock users in Google's walled garden.

Seems to be US only? iPhone also has the same thing, so it's probably something that US carriers are pushing, not something from OEMs.

>eSIM support is not implemented in Android itself (AOSP), but part of the proprietary GMS package. This means Google-free Android forks like LineageOS will be unusable on the Pixel 10 series :-(

OpenEUICC works fine


If this is real then it is very unfortunate as multiple countries use crypto SIM cards as national identity, a popular more ergonomic alternative to a separate identity card that need a USB reader and computer. They play themselves out of markets.


better than what they did with pixel[6-9] where they shipped a dual injection crap to save 0.00001c on production and if you traveled 5x and swapped local SIMs, the tray just crumbled and you had to buy another for $20 on ebay because they don't stock it or replace under warranty.


Similar experience with my Pixel 5 but different outcome. My SIM tray crumbled and they sent me a new phone under warranty.


does this mean no GrapheneOS either?


GrapheneOS found a way to provide eSIM support, but it depends on installing a patched version of Google's proprietary LPA app. I don't know how future-proof that is..


you don't even need google's proprietary esim app. OpenEUICC works fine if you grant it priv-app permissions.

[1] https://gitea.angry.im/PeterCxy/OpenEUICC/




It supports eSIM. Two months ago, I bought a Pixel 9a, immediately put GrapheneOS on it, and registered an eSIM.


My Garmin (Vivosmart 4) band tracks "stress" and "body battery" metrics, which are based on your Heart Rate Variability. For the first couple of days after my first mRNA shot there were no anomalies at all, but then out of nowhere my stress levels went through the roof (and my body battery completely flatlined) in a way that I've never seen before. This lasted for 6 full days, now everything seems to have returned to baseline..

I didn't feel anything about the whole ordeal though, apart from some sore muscles in the first days. Crazy interesting to quantify the amount of stuff going on in the background without you being aware of it.

EDIT: Specifically, during these 5 nights my stress level was reportedly _unmeasurable_ for about 50% of the time. Unmeasurable is common when you are physically active (making the PPG data too noisy to properly calculate normalized RR intervals) but very rare during sleep, so this probably indicated a very high amount of irregular/ectopic heartbeats.


My wife has Garmin watch as well and had her Moderna shot yesterday. Even though obvious symptoms are very mild (muscle soreness), her "body battery" went all the way down to 0 during the night. It is the worst "body battery" result in her history. She is staying in bed today.

Interestingly, we both actually had mild Covid in December and her Garmin didn't show such a "body battery" dip back then.


I always wondered what the body does during the two weeks after the second vaccination. I mean, I'm aware of https://en.wikipedia.org/wiki/Somatic_hypermutation, but I guess there's a lot more going on in the body and immune system. Always fascinating.


I bought a Garmin the day Fitbit sold out and haven't touched the Fitbit since. I'm very happy with the switch, the Garmin (Vivosmart 4) app and device are actually better than Fitbit's on almost every account, so that's a double win :)

The only unfortunate consequence is that Garmin's import service only imports very coarse data from your Fitbit export, so all detailed historic records are lost unless you manually dig through your Fitbit export files. I hope Garmin will still provide a 100% complete importer in the future.


Any idea how data exporting is with the Vivosmart 4? I thought about getting one but one of my main use cases for getting a fitness tracker is exporting data and then creating custom visualizations from it. I haven't dug into this world much yet but curious what the best hardware would be for this use case.


If you sync to garmin connect its easy enough to manually download many different formats of activity recording for fitness activities. I don't have a vivosmart but I haven't had issues collecting data from my Fenix watch.

There is a service I do like from https://tapiriik.com/ that will sync all your fitness data across a bunch of common fitness apps (it helps when all your friends want to link up for activities but nobody agrees on a single tracking platform). One of the sync options is just to directly download all the raw datafiles to dropbox which is pretty convenient.

If none of those sound good you could roll your own from the source code to tapiriik which is available here: https://github.com/cpfair/tapiriik . It does use some hacks to get around garmin not making all their APIs easy for personal development.


Like the sibling comment mentions, there is a free Garmin Connect online service that lets you upload the data via bluetooth to your phone and then your phone transmits it to the Garmin server. From there the way I use it is to automatically send it to my Strava account (it's my only active social media account) and manually I download the raw data file from Garmin's Connect website to my PC so I can import it into Golden Cheetah for some analysis and personal backup. One could directly download the file from most devices to your laptop via wire or bluetooth, but that may not be as convenient as doing everything electronically. Also, I've actually worn out several USB connectors on fitness devices just from plugging/unplugging over the years so avoiding using physical ports for data transfers is a priority for me.


I haven't tried with a Vivosmart 4 but most Garmin devices can be directly mounted as a USB drive and then you can copy the FIT files. There is an SDK available for parsing the files.

https://www.thisisant.com/developer/


The exports from Garmin's Connect aren't always easy (though they improved at around the same time that GDPR came into force). At one time, it was necessary to download each day's dataset individually.

The FIT file format isn't fully documented (SDK has encumbrances and perhaps cost -- it's been a while since I checked).

Here are some of the tools I've used with Vivosmart HR and Fenix 3HR FIT files. They're not polished for easy usage, but they'll get a technically-skilled hacker started. The core is Kiyokazu Suto's 'fitdump' perl.

https://github.com/4kbt/ParseVivosmartHR


I'd buy a Garmin if they provided a FitBit importer.


They do: https://support.garmin.com/en-US/?faq=HfJ4xPchdD3cmZ2qtDpOR8...

But it currently only imports coarse data, e.g. your average heartrate on a given day. Not the granular minute-by-minute information.

Sleep statistics currently aren't imported at all.


I sold my Fitbit for a Garmin in the last month and the importer really didn't do much. Fitbit only gives 31 days of data.


open source and reverse engineers assemble


If only we could get a sense of how many people would actually use such a thing. I've got a feeling that 97% of FitBit users don't care, but if enough of them did then it could be a potentially profitable(albeit short-lived) piece of software.


This is terrible news. As if Google didn't know enough about you already - they will now be supplied with a 24/7 live feed of your most sensitive health statistics.

I'll be switching to a competitor and closing down my account there as soon as possible to hopefully prevent years of my historic data from being merged into the (ghost) profile Google has on me.

But at this rate it won't be long before there are simply no more competitors to FAANG left anymore. Actually enforcing antitrust laws, anyone, pretty please?


To be fair, Apple does this too to some extent. However, given their most recent commercial re privacy and all of their public statements on the topic, I don't expect them to exploit it for profit quite so shamelessly.

https://www.youtube.com/watch?v=Py0acqg1oKc


Privacy as current corporate strategy is better than nothing, but it's not really good enough when you're talking about health data or other personal data that will still be highly sensitive for many 30-40 years on from now, when the entire board and leadership of the company and market will have changed in unpredictable ways. There's no true solution to long term uncertainty other than confirmed zero knowledge software and/or regulation.


> they will now be supplied with a 24/7 live feed of your most sensitive health statistics.

In Apple land all health data stays on device, not in the cloud like Google/FitBit


In Apple-land, health data is synced to the cloud, but encrypted such that Apple doesn’t hold the keys in escrow; they’re peer-to-peer synced between your devices.

Similar impact from a privacy perspective (assuming crypto is unbreakable), but the data certainly is synced.


True, and to the extent they would exploit it, this basically amounts to providing a good customer experience (b/c Health information is useful) so that you continue to buy into the ecosystem.

Sounds like a solid sales pitch to me.



I see reddit mentioned by multiple people. I think the sub https://www.reddit.com/r/financialindependence/ might also be a nice fit, as it is about how to become financial independent (already achieved by OP) and then what to do after (retire early? how to manage the money? etc)


warning: high value individuals can expect a fair amount of abuse on that subreddit, it's for how to get to FI not how to manage being there


For those that fall into this abused category, a lot have moved to https://www.reddit.com/r/fatfire


I'll second this, all of the FIRE subreddits are not a great place to discuss your situation. Those subs are full of people saving about 40-50-60%+ of their take home and slowing building wealth overtime.

Edit: FIRE = Financial Independence, Retire Early


I tried to register for an account with N26 early this year. After uploading all my personal information and passport scans, I received a generic rejection notice almost immediately. Extensively talked to the customer service, but they couldn't possibly figure out the rejection reason and eventually just stopped replying.

N26 appears to be one of those modern companies built on automation and algorithms where human customer service is an afterthought. It'll work until it doesn't - and then you're on your own. Wouldn't recommend using them to handle significant amounts of money.


In many countries it's not (legally) possible to buy a SIM card without providing your ID.

Sure, you go ahead and buy an illegal burner number, then download Signal/Whatsapp from the Play Store and reverse engineer that binary to see if it "does what it says". Other people might find it useful to look at this comparison to discover alternatives that better fit the characteristics they find important.


I know; I lived in one. A burner number does not imply getting a SIM. That is not how journos in sensitive countries get a number.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: