yashsingh1/xdaforums huggingface dataset:
[OnePlus 3 & 3T Cross Device Development] lammpat:
He and all of us are using our phones/devices and users don't need to anything, hackers will do.lol

Anyway I am not in the favor of asking for eta or update.
[OnePlus 3 & 3T Cross Device Development] roadrunner4spd:
bug is arm based with scepter

---------- Post added at 04:51 PM ---------- Previous post was at 04:49 PM ----------

January 2018 fix ... not December. https://source.android.com/security/bulletin/2018-01-01
[OnePlus 3 & 3T Cross Device Development] Darkmasterhk:
the bug (spectre) is not generally arm based from my understanding it should only affect cpus using out-of-order-execution, which our phone does.

cpus based only on e.g. a53 cores should be immune to that.
[OnePlus 3 & 3T Cross Device Development] roadrunner4spd:
yes. you said what i should have. thank you. from what i know all apple and A57... so I have read so far.
[OnePlus 3 & 3T Cross Device Development] bunu:
I came across a weird bug. I wasn't able to get a logcat or anything since I had to get up and go to class but I'll explain it to the best of my ability.

My alarm went off in the morning but it wasn't the ring tone that I selected. This was the first time this happened in a while. When I went to dismiss the alarm, the Clock app crashed. After that, it was a black a screen. I was able to bring up the Power Off/Reboot menu so I rebooted the phone. It booted to the first stage (where it asks for your pin/pattern to decrypt the device). Then the alarm went off again. I dismissed it and the Clock app crashed. After that, the pattern screen didn't come up so I couldn't decrypt the device. I rebooted the device and tried to choose the "Snooze" option. The clock app didn't crash this time but the pattern screen didn't come up. I rebooted (hoping that since I snoozed it, it won't go off and I can put in the pattern), but the alarm went off immediately. Dismissing it would cause the app the crash and I couldn't put in the decrypt pattern. I then rebooted into the recovery. TWRP said something about letting /system be modifiable (this hasn't happened in a LONG time. idk why it came up this time. I haven't flashed a new recovery in like 2-3 months). I said to make it modifiable. I didn't wipe anything after that. I just rebooted into system and it booted up fine this time. Maybe the phone rebooted while I was sleeping and was sitting at the decrypt screen all night? (phone hasn't soft rebooted EVER and I"m using the same apps. No xposed. I have magisk and a few modules like the GC 60fps/slomo module, extended volume steps, and wifi channel bonding)

Really weird and stressful morning. I was thinking I had to do a fresh install on the way to class since my last TWRP backup was from the previous version of this ROM.
[OnePlus 3 & 3T Cross Device Development] Sam Nakamura:
...it's Cortex A57, A72 and A73 for spectre and A75 for meltdown, January security patches should fix it though...

-sorry for going further off topic :angel: (kind of)
[OnePlus 3 & 3T Cross Device Development] ciarpame:
Have you already tried with privacy guard?

System settings > privacy guard > pick your app and disable keep awake, run in background, start at boot
[OnePlus 3 & 3T Cross Device Development] costin85:
Is this normal?
[OnePlus 3 & 3T Cross Device Development] highdiver_2000:
Similar to this ?

https://jira.lineageos.org/projects/BUGBASH/issues/BUGBASH-1301?filter=allopenissues
[OnePlus 3 & 3T Cross Device Development] Marceline89:
Is there something like in oxygen os where you can select a few apps to require fingerprint at launch?

Also where do I select apt-x, is it there by default?
[OnePlus 3 & 3T Cross Device Development] Naudiz:
Isn't there anyone following this thread who would be able to merge the January security updates into the existing source of December 09 build and recompile?

Nobody is asking for any new features, but I guess a lot of people are nervous about the new Spectre CPU exploit.
[OnePlus 3 & 3T Cross Device Development] Alaan11:
Settings - Privacy - Protected Apps
[OnePlus 3 & 3T Cross Device Development] Marceline89:
Alright thanks, the app icons disappears so I just created an app folder
[OnePlus 3 & 3T Cross Device Development] digger16309:
Read back a few pages. The phone doesn't have an Intel chip.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
If you read a few pages back yourself, you'd know that spectre is not limited to Intel.
[OnePlus 3 & 3T Cross Device Development] digger16309:
OK, fair enough.

But, it's interesting that people are concerned about a security flaw that hasn't even been exploited, yet they walk around with an unlocked bootloader and custom recovery, and potentially other far more serious security risks, than spectre.

If someone gets a hold of my phone, it's painfully easy to download or wipe its contents, including the backups I make. And they don't need a password, facial unlock, or whatever.
[OnePlus 3 & 3T Cross Device Development] casual_kikoo:
I agree with you about the fact that we are most on this forum running phones with an unlocked bootloader / custom recovery / root.

But, that's why encryption exists.

Plus, you talked about no exploit about Spectre / Meltdown. Well, I don't know how you have this kind of information, but if you want to share with us, I want it: embargo has just been lifted, and medias start talking about it, so who knows if someone already made some malicious app which exploits this flaw..
[OnePlus 3 & 3T Cross Device Development] digger16309:
My comments are not aimed at you, they are just general comments...

Every time there is some announcement about a newly identified security flaw, people in these forums start hammering the developers about when they're going to update their ROMs with a patch, but they are walking around with a non-secure device.

I ran MM for months with a supposed Bluetooth security flaw. No one was going to initiate a bluetooth attack against me in my normal daily life.

Encryption is doing nothing for me while in recovery. And as I mentioned, everything on my device can be wiped in recovery by someone in possession of it. There is no password or pin to get into it.
[OnePlus 3 & 3T Cross Device Development] Xaeons:
Has anyone tried getting the %INTERRUPT value from the alert slider using this ROM? I'd like to launch custom tasks using Tasker and I get no value from %INTERRUPT variable

EDIT: NVM found an alternative solution here: https://xdaforums.com/oneplus-5/themes/tasker-alert-slider-enhancement-t3657510
[OnePlus 3 & 3T Cross Device Development] casual_kikoo:
Yes and? We can't talk about tech stuff on this site now with poeple interesting in it ?

Ok that's cool
[OnePlus 3 & 3T Cross Device Development] Naudiz:
Apples and pears.

If you encrypt your userdata, neither unlocked bootloader nor custom recovery is a severe security concern. Especially not compared to to any exploit that can attack remotely over the internet.

Are you suggesting that everyone should wait for security holes to be exploited, before fixing them? :D
[OnePlus 3 & 3T Cross Device Development] digger16309:
No, I'm suggesting people don't adequately assess the actual risk, and then compare it to the risk they already carry, before asking when a patch will be made available by Devs who are working for free.

Backups (like TiBackup) need to be encrypted as well.

I'm skeptical that the same people asking for patches have every other part of their device locked down.

Give me a rooted phone and I can wipe everything on it in about 30 seconds. I hope the user had their backups stored elsewhere and that they are updated.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
That's just nonsense. Wiping a phone you have physical access to does prove absolutely nothing.

I'm sorry, but you're wrong on so many levels:

1. An unlocked bootloader is no security-issue per-se.

2. An unrooted stock-recovery phone can be wiped just as easily as a rooted phone.

3. Encryption protects your data from unauthorized access and is not supposed to to prevent wiping.

4. A locked bootloader protects the phone against unofficial OSes, nothing more.

5. A locked bootloader does not protect your personal data whatsoever.

6. A local TI-Backup on an encryption phone is safe, as long as you keep it on your (encrypted) internal sdcard.

If you don't believe me, give me your phone with locked bootloader and I will prove it to you :D
[OnePlus 3 & 3T Cross Device Development] digger16309:
It is so easy to get into a phone with encrypted data, or at least this phone.

I'm not going to go find the link (it's in multiple OnePlus 3 posts), but multiple people, including me, have been stuck with encrypted backups where their PIN didn't work after upgrading the ROM. Delete two files in recovery, reboot, and you're in the phone. That's great security.

The idea that anyone walking around with a custom recovery and a custom ROM is also "secure", is what I think is nonsense. Security is a sliding scale.

People can chase after the latest patch for the far-flung theoretical security flaws if they want. My point is, it's far more likely they are carrying around greater security risks every single day. And yes, it's because they (we) are unlocked with a custom ROM.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
Yeah and I suppose by doing that you were able to wipe your encrypted data. I'm pretty sure you were NOT able to access it, especially not without the encryption password.

You are throwing everything together here and totally miss the point, what encryption is supposed to be and what it isn't.

You are continously claiming the possibility to wipe a phone is a security risk, which it totally isn't.
[OnePlus 3 & 3T Cross Device Development] digger16309:
No, by doing that, I was able to easily boot my phone and access it normally without any security whatsoever. That's what deleting those two files allows. Super easy, super non-secure.

Yes, I am throwing it altogether, because it's all related. Wiping my phone without any offline backup would be a serious issue for me, and I assume, many others. But as I've just written, that is not the only risk. There are many others.

If you think you've done everything possible to secure your device and its data, and your backups, and your ROM doesn't have any workaround hacks, great. I don't think everyone has, and I don't think everyone realizes the trade-offs in every day security, compared to the external "threats".
[OnePlus 3 & 3T Cross Device Development] Naudiz:
Nice job, how you avoided answering my question about ACTUALLY ACESSING YOUR ENCRYPTED DATA.

Booting your phone is not the same as accessing ENCRYPTED data. I too can easily boot any encrypted phone without entering a password by simply wiping /data, thus making it unencrypted again.

There's no way in hell that you circumvented encryption by deleting some files. Like I said, you are throwing everything together here.

I'm now going to stop this discussion, this is leading nowhere. You LITERALLY say that the biggest IT security flaw in recent history isn't all that bad, because you could wipe your phone with your hands-on. And you don't even realize how ridiculous this is.
[OnePlus 3 & 3T Cross Device Development] digger16309:
Sorry, I should have been more clear. Deleting the two files while in recovery, allows the person in possession of the device to boot the phone all the way through to the UI, which is then no longer protected by any kind of security whatsoever. Then the person in possession of the device, has full access to the then unencrypted data on that device.

Since you don't want to focus on physical security as an issue....Besides that, many people using custom ROMs are also using apps requiring root access, Xposed or Magisk, or side-loading apps. And every one of those apps and modules has outstanding and unbreakable security, right? Everything we're doing with our devices is unsecure in one way or another.
[OnePlus 3 & 3T Cross Device Development] finalista:
please stop OT and continue via PM. thanks.
[OnePlus 3 & 3T Cross Device Development] pahapoika91:
The thing is, you can't access/delete those files if you don't know the password used for decryption.
[OnePlus 3 & 3T Cross Device Development] lerkin:
It's been a month since...
[OnePlus 3 & 3T Cross Device Development] Jaizu:
so? :confused:
[OnePlus 3 & 3T Cross Device Development] felixchris:
I agree, that OT should stop. But a comment from my side on this topic. He has a point. I did that myself once. Not sure if it still works, but there was a time TWRP would **** up your fingerprint or pin, and you wouldn't get in after updating your ROM by entering your correct pattern or pin.

Booting into TWRP, in the file manager there deleting 2 files, one of them was called gatekeeper or something and then rebooting your device would leave it without any pattern or pin at unlock. You could then just go and use your phone and set a new pin or pattern. UI fully unblocked, all userdata there. Just head into file manager, SMS, WhatsApp, Email you name it. It was in fact possible. Not sure if it still applies though. And since you can't do that without a custom recovery with a file manager which in turn requires an unlocked bootloader in most cases he has a point.

In the end I agree, wait for the next update, if you care so much about it just set up a building environment yourself, merge the security patches and build yourself. There's great tutorials for it, all you need is a Linux environment, 8GB of RAM, some space on your hard drive and some time to spare. Great opportunity to learn something.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
The files you are talking about are residing in /data/system/, which in itself would be inaccessible had you used full partition encryption and lost/forgot your password.

You, just like digger, are confusing encryption with lockscreen-protection. Nobody will crack an encrypted partition by simply deleting some files. If he did I would like to see him as a speaker on a hacker-convention, because that would be pretty amazing.

I seriously hope that this discussion could end now. I find it kinda disturbing that all of this arose from the simple request if anyone could merge the fix for the most severe security risk of the past decade.
[OnePlus 3 & 3T Cross Device Development] lammpat:
After reading so much about the security concern, people who are skeptical about it shouldn't use any computing device/smartphone. Because security can be compromised sooner or later no matter how you have setup your device. So relax and enjoy the life until you are doing something illegal or Mischievous.

It made me go crazy too like a normal users when it comes to family photograph or something similar but what I can do to best of my experience is not storing any of my personal data into any device be it pc , mobile or cloud.

I remember a case of twitter when a user( A doctor/ surgeon) in my TL posted that he and his friend were discussing about the restaurant where they can order a good lunch and his phone was sitting idle in his office table, within a few minutes of discussion he received an SMS suggesting a nearby restaurant for the good food.

Do you want to read more scary thing than this?

Just chill ?
[OnePlus 3 & 3T Cross Device Development] costin85:
bump
[OnePlus 3 & 3T Cross Device Development] finalista:
try this instead YouTube: NewPipe (Lightweight YouTube frontend) - https://f-droid.org/app/org.schabi.newpipe
[OnePlus 3 & 3T Cross Device Development] Jaizu:
That doesn't solve his problem.
[OnePlus 3 & 3T Cross Device Development] highdiver_2000:
I don't see anything wrong with that
[OnePlus 3 & 3T Cross Device Development] derAndroidler:
Bugs

Are there some bugs in this build from 9th December?

With this build my phone is consuming more power than the other versions before? Do you have this problem, too?

When I press the volume keys the media volume is changed instead of the ringtone volume.
[OnePlus 3 & 3T Cross Device Development] digger16309:
Which, if you've been following it, some of the "fixes" have lead to significant performance slowdowns across numerous devices with these chips. Intel has gone so far as to recommending DELAY of patch application.

If this ROM is patched and that is the result, there will be plenty of complaining about lag, battery drops 2% more per hour from that build compared to the previous one, or clock speeds off by 1 Hz. :rolleyes:
[OnePlus 3 & 3T Cross Device Development] costin85:
EoL?
[OnePlus 3 & 3T Cross Device Development] Jaizu:
lol
[OnePlus 3 & 3T Cross Device Development] costin85:
Yes or no would have sufficed .
[OnePlus 3 & 3T Cross Device Development] Jaizu:
Not asking stupid questions would have been better. Dev will update whenever he feels to.
[OnePlus 3 & 3T Cross Device Development] costin85:
Sorry, master.

Didn't know I need your permission to ask a question.
[OnePlus 3 & 3T Cross Device Development] atroxxx:
Messaging app prevents phone from deep sleep with Airplane mode switched on.
[OnePlus 3 & 3T Cross Device Development] roadrunner4spd:
mine is using more battery than previous builds....
[OnePlus 3 & 3T Cross Device Development] bunu:
The latest build use the same amount of battery as the previous builds for me and I've been doing dirty flashes for a while (no xposed. stock kernel settings. not using any battery related magisk modules). Maybe it is a misbehaving app?
[OnePlus 3 & 3T Cross Device Development] roadrunner4spd:
dirty flashed and cleared cache & Dalvik. there have been updates on apps. It's definitely not severe. I seem to be using more battery with screen on. not scientific, but i still fell it's better than OOS 4.5.1 (that's the last official OS I ran on this 3T phone). I'm still stating put watching to see updates or of were moving to Oreo next.
[OnePlus 3 & 3T Cross Device Development] atroxxx:
I was wrong. It is not about Messaging app. It is about Airplane mode at all.

Phone doesn`t sleep with Airplane mode enabled.
[OnePlus 3 & 3T Cross Device Development] mexiro:
I bought an Amaze bip whatch (xiaomi). It has it's own app called MI fit. It's strange, bluetooth comes first on battery draining list. I did not know that it would consume so much battery. Should I uninstall the app?
[OnePlus 3 & 3T Cross Device Development] dcop7:
Do what do you want. That is a smartwhatch. Use bluetooth. If you want to pair with the phone, don't uninstall. If you want to pair with the phone, keep the app or find alternatives.

It is your personal choice and that doesn't have anything to do with the ROM.
[OnePlus 3 & 3T Cross Device Development] mexiro:
It has to do with the rom since on stock ROM didn't consume so much battery. Even bl speakers are consuming high battery in this ROM, so obviously there is smth wrong. Whatever.
[OnePlus 3 & 3T Cross Device Development] Sentinel999:
I have the same watch and app, and it runs normal. The mi fit app consume 6% over 24h.

You can test the app: amazfit notify .
[OnePlus 3 & 3T Cross Device Development] mexiro:
I have more than 12%

Do you use notifications from other apps on Mi fit?
[OnePlus 3 & 3T Cross Device Development] Sentinel999:
Yes
[OnePlus 3 & 3T Cross Device Development] BakaB:
just jumped on this ROM, is there a setting to add a clear all button to the recent app Page?
[OnePlus 3 & 3T Cross Device Development] BillGoss:
I use this app for just that: https://play.google.com/store/apps/details?id=eu.chainfire.recently
[OnePlus 3 & 3T Cross Device Development] freecity01:
If you do a quick scroll to the top there is a clear all option
[OnePlus 3 & 3T Cross Device Development] lammpat:
Let me make one thing very clear that my intention is not to insult or compare sultan with others but followings are findings

I have used sultans rom in OP 1 and used in OP3

Google play service was eating my battery like crazy in sultan rom 9 dec for so many days, then I gave a try to LOS with Franco kernel and google service is now behaving sane, roughly 3 to 5% use in 48hr , with sultan rom it was topping the chart.

My app uses pattern is same and have installed same set of apps with same configuration.

I guess sultan need to have deep look in his kernel. Just at guess.
[OnePlus 3 & 3T Cross Device Development] joakimbo:
I don't have any such problems. Currently play services at 3% in battery stats. Also sleep like a baby with 1-2% usage overnight
[OnePlus 3 & 3T Cross Device Development] ML_Outlaw:
Yep same here
[OnePlus 3 & 3T Cross Device Development] lammpat:
Don't know whats wrong with my app uses and installation. Trying to find out the answer by using LAOS and sultan with same GApps and same apps. My phone just don't want to sleep in sultan rom.
[OnePlus 3 & 3T Cross Device Development] goodoldie1996:
Is there a way to disable back-lit buttons while touching the screen and not the actual buttons?
[OnePlus 3 & 3T Cross Device Development] KlamKhowder:
This sometimes happens to me with different roms. The reason Franco kernel prevents google play services from wakelocking your phone is that Francisco Franco has some basic wakelock blockers built into his kernel. I wont speak for Sultan but i think a wakelock blocker might go against the philosophy he built this rom and kernel around, also he has no control over what google play services does. we install that over his work.

There is a fix for this though. I always flash this magisk module first thing when i flash a new rom and it prevents any Google play services wakelock.
[OnePlus 3 & 3T Cross Device Development] casual_kikoo:
Just installed this module, thanks for the link !

Do you apply any settings to WhatsApp or communication app which relies on Google Play Services in "Battery Optimization" ("Do not optimize") ? Or you flash the module and forget about it ?

Ask myself if there is any notification delay if you leave WhatsApp in "Optimizing battery use" state... :confused:
[OnePlus 3 & 3T Cross Device Development] felixchris:
Device certification

Quick question guys, has anyone running sultans ROM got device certification from Google working?

I know that unaltered lineage os is certified. Some Banking apps check for that rather than safety net, which my device passes.

Thanks :)
[OnePlus 3 & 3T Cross Device Development] noéDefalt:
Yes, mine is certified.
[OnePlus 3 & 3T Cross Device Development] lammpat:
I tried that too, magisk version and twrp version. Didn't help much. I am slowly learning to live with this ?
[OnePlus 3 & 3T Cross Device Development] felixchris:
Any rooting done, with magisk? Bootloader open? I'm trying to figure out why mine is not certified
[OnePlus 3 & 3T Cross Device Development] highdiver_2000:
I have found stock Lineageos fails that check. Even with Magisk hide.

Same for OOS 4.5
[OnePlus 3 & 3T Cross Device Development] RaEsAcademy:
Are you using xposed?If yes,that's the problem.
[OnePlus 3 & 3T Cross Device Development] lammpat:
Always, maybe a reboot will fix it, and funny part is OSS shows not certified.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
Where do you guys look this up?

It used to show up in Playstore's Settings, right at the bottom, but since several versions this info seems to be gone for good.
[OnePlus 3 & 3T Cross Device Development] casual_kikoo:
Yes for me it's in the Play Store Settings, at the bottom under "Device certification".
[OnePlus 3 & 3T Cross Device Development] Naudiz:
For me not. Even though I know it used to be there. Latest entry is "Playstore Version".
[OnePlus 3 & 3T Cross Device Development] felixchris:
Clearing data and a reboot fixed it for me.

Running latest magisk. No xposed, that'd break it.
[OnePlus 3 & 3T Cross Device Development] lammpat:
Reboot and it will be there for sure.
[OnePlus 3 & 3T Cross Device Development] Naudiz:
None of this works.

Deleting data just messed up my library, now I can't see my purchases anymore (however I think that will solve itself over time, as Playstore will sync in background).

Rebooting did nothing. Even rebooted to safe mode once. Nothing visible.
[OnePlus 3 & 3T Cross Device Development] noéDefalt:
Yea, my bootloader is open and I am using magisk.

If it shows uncertified wipe the data of the Playstore until it changes to certified. It might take several attempts. So be patient!