iggldiggl

> Java apps are usually quite easy to decompile and check. Search for library versions in use, force upgrades on security vulnerabilities.

You don't even need to do that – for a while already, Google's toolchain has been adding dependency metadata to all apps by default (encrypted, though, so only Google can read it) and they've indeed been using that to warn about outdated or vulnerable dependencies. According to https://support.google.com/googleplay/android-developer/answ..., at most they'll only block you from releasing further updates including dependencies with critical vulnerabilities, though…

The problem is that there is a lot of grey area between pure document-style pages and full-on apps (take online shops for example) and even for the former category of pages a lot of UI niceties are only possible with scripting.

> It's disabled by default. You have to dig around in your phone's settings to enable APK installations

At least since the time that the "install apps from unknown sources" permission was migrated from a global toggle to an app-specific permission (maybe even before that?), the dialogue that pops up to tell you that installation has been blocked has a button for directly taking you to the correct settings screen for toggling the permission, so it's just two extra taps.

Sure, at scale even that will confuse/scare off some users, but it's not insurmountable and nowhere near as obscure as having "to dig around in your phone's settings" – just two extra taps and you're good to go (unless your phone manufacturer has made things more complicated there, which does remain a possibility).

Doesn't work if the SIM is pin-locked, too, though.

> Typing <word><space><hyphenminus><hyphenminus><space><word><space> yields an en dash.

More importantly, typing just a single hyphen minus in this constellation triggers the autoreplace, too. (Typing the double hyphen is only necessary without spaces in order to distinguish between an intentional hyphen and an em dash.)

Firefox has way more than 20 developers. Looking at https://firefox-source-docs.mozilla.org/mots/index.html, if I'm not mistaken in my count, there are currently 147 module owners and peers alone. Some of those might be volunteers, but I think the large majority of them are Mozilla staff. On top of that there are probably a number of further Mozilla staff developers who aren't owners or peers, QA staff, product managers, sysadmins and other support staff…

Time-travel debugging is something different – time-travel debugging means you can actually step backwards through the execution to try and see how you ended up with the bug.

Merely being able to inspect the state of (local) variables further up the stack frame is a much more limited proposition, even if it can still be useful.

> yet very often wished I had it (for […] javascript […] mostly)

Both Firefox's and Chrome/Edge's devtools allow you to do that, don't they? Click on an entry in the stack frame and it takes to the corresponding code line and shows you the state of the variables relevant at that point.

> Deezer and Apple Music have the latter, too.

All online music services seem to have borked up copies of Bob Dylan albums that for the Bootleg Series albums with live content are missing the between-tracks bits that on the CDs are stored in the pre-gap.

> I remember something like dex2jar also, which gave you a jar you could use in any java decompiler, like jdgui, procyon etc.

https://github.com/skylot/jadx is very handy for that nowadays. It also supports interactive variable/method/class name renaming to make the decomplied code easier to read. The decompiler isn't perfect, but I guess all available Java decompilers have their limitations with more complex bytecode…

> can be trivially attached to emails under the 10MB size limit, which other forms of media usually can't

The average pop song at average bitrates would fit that limit, though, too, even with less room to spare.

Otsuki might still be an booking-on/-off point for train drivers, with a number of drivers based there and regularly starting and ending their turns at that station and presumably living nearby. Or alternatively the train company finds it more convenient ferrying the driver with a taxi or company car to from the regular booking-on/-off point.

Trams running every two to three minutes on a few central sections is nothing out of the ordinary in a number of tram systems.

> Sony also apparently wipe a partition with a little DRM blob for the camera, which degrades some aspect of its post processing capabilities so image quality might be less.

I think they no longer do that since a while (a few years) ago, but don't ask me which phone model exactly was the last one affected.

> And then there's the peculiar grammar that puts the most important verb at the very end of a sentence

An American woman visiting Berlin - intent on hearing Bismarck speak - obtained two tickets for the Reichstag visitors' gallery and enlisted an interpreter to accompany her.

Soon after their arrival, Bismarck rose and began to speak. The interpreter, however, simply sat listening with intense concentration. The woman, anxious for him to begin translating, nudged and budged him, to no avail.

Finally, unable to control herself any longer, the woman burst out: "What is he saying!?" "Patience, madam," the interpreter replied. "I am waiting for the verb."

See also https://web.archive.org/web/20211003234131/http://bytepointe... and https://github.com/m417z/the-old-new-thing-userscript, because Microsoft managed to lose all the old comments during one of their many blog migrations.

> Now, video is done completely differently than it was.

Which is a thing that happened long before Firefox 126, too. (Browsers have simply requested the screen wakelock themselves when a video was playing. So this API is mainly for use cases that aren't playing a video.)

> The card is a physical representation of your account number, readable with a magstripe scanner.

Which is no longer true for EMV cards, though. There, the chip contains some additional data which cannot be easily copied and which helps identify the card as a bona fide real card issued by a bank.

https://www.emv-connection.com/contact-chip-card-online-auth... (there's also some alternative authentication method that would work offline, i.e. just between the card and the payment terminal)

> I started by reading their docs on how to add a new app.

Did you stumble across https://f-droid.org/docs/Inclusion_How-To/, or did you miss that page somehow? Because there it mentions the Submission Queue as the simpler, if somewhat slower route to adding an app. For the submission queue, you just need to fill out the pertinent data in an issue ticket and then follow along with any further instructions you might subsequently receive.

> I'd really like to know what's in the heads of people who come up with this sort of crap.

They probably think that geolocation always perfectly works based on the physical location and don't consider edge cases like people with roaming SIMs (which is what I think a lot of those cheap data-only eSIMs effectively are) geolocating to their home country even when abroad.

Though by now you'd think that people are aware the e.g. the Google/Apple app store region locking basically locks out all tourists, but it seems that even that isn't necessarily common knowledge…

> You can take as much time as you need to finish crossing.

Well, up to a certain extent at least. Behind the scenes, German traffic lights for example usually assume you continue walking at 1.2 m/s – if you start crossing at the last possible moment and are slower than that, you will still run into the case where crossing traffic will potentially get a green signal with you still on the road.

That'd only make sense if your pedestrian network is completely independent from the road network, so pedestrians only need to cross roads, but otherwise never interact with them.

However the usual case is that pedestrians have to walk along the road because there's no separate independent pedestrian network, and in that case not providing crosswalks at intersections forces detours on everybody wanting to walk straight on ahead.

Countdown signals don't work with adaptive signalling where phases are dynamically lengthened or shortened (or sometimes entirely skipped) in response to traffic flows. They especially don't work with public transport priority.

That doesn't excuse speeding up, though – if the yellow light is long enough, you will always be able to either a) safely stop with a certain given maximum deceleration, or else b) continue at your current speed and enter the intersection before the light turns red.

> And why can't I search for the title of a page I know is in my history

I sometimes use Edge as a fallback browser, and it suffers from this problem, too, and yeah, it is sooo annoying – much as I'm unhappy about various Firefox changes in the last years, I wouldn't switch to a different browser for that alone.

Interestingly, Edge (and probably Chrome, too, unless it's a strange Microsoft customisation) simultaneously suffers from the problem that on the rare occasion where an addressbar search actually delivers a locally history result, the autocomplete is often too precise, because it prefills the whole URL, not just the domain.

> The soundtrack was also incredible, and I wish it were available independently.

For a few euros (and less if you happen to catch a sale), the GOG version is worth it for the soundtrack alone. But yeah, 7-Zip doesn't seem to recognise the installer used by GOG, so you actually have to install the game to get at the soundtrack files.

> You're also racing against opponents to beat them to connecting to major cities.

Although the AI players have some interesting limitations – they'll never connect a city you've already connected to, and they'll never build a line that crosses one of your own lines. To be fair, I don't know how important those fudges are for balancing the game, and if so, how the playing strength of the AI players could be balanced in a more realistic fashion (plus considering that the game is from almost thirty years ago)…

At least historically, that wasn't always fool-proof :-) – I know at least some Motorolas from around ten years ago where the bootloader warning was simply an alternative boot animation, so you could suppress that message by overwriting the "bootloader unlocked" animation with the regular boot animation.

/sdcard is just the user-visible internal storage (the same thing that shows up via MTP if you connect via USB), and ADB can access that fine.

> Are you a lawyer in DACH/Germany?

Nope :-), just a normal citizen, but sometimes I am curious enough to look up a law, plus sometimes I need to refer to/look up some law in my day job as a civil engineer, too.

When you need to do that, it's not too hard to stumble upon the existence of that page through some web searches, plus the German Wikipedia often links to that page, too (as well as to some alternative platforms run by private entities, which sometimes provide some added value, e.g. buzer.de provides change history since 2006, too, other pages link relevant court decisions, etc. etc. – but gesetze-im-internet.de is the official page run by the federal government itself).

> According to the linked blog post, not anymore. Apparently, these days they serve the author's original APK, but after verifying that they can rebuild it (modulo the signature itself).

But obviously only for newly submitted apps that can be built reproducibly. Old apps, or even new apps that fail to build reproducibly, continue to be built to the old model with an F-Droid-provided signing key.

(Even if an older app can actually be built reproducibly these days, it'll still be stuck on having to continue using the F-Droid signing key – key rotation is only supported from Android 9 onwards, and for some reason Google only recommends its actual usage on Android 11 and newer, and then you still need to manage the transition period somehow where app updates need to be dual signed, and once you stop that dual-signing, everybody updating from an old signature needs to install one of those dual-signed versions first before being able to install a version only signed with the new key.)