yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
I wonder how that data gets from "Point A" to "Point B" where "A" is the device and "B" is the Microsoft analytics service. And I wonder what other data *could* be sucked up by an espionage agency who might be able to hack into the developers' environment and see the source code that we can't see, and who could exploit flaws that the innocent and well-intentioned developers might have overlooked.

Many apps and software packages offer users a way to opt out of debug-oriented telemetry. I wish that Alpha would also offer that option.

I acknowledge that these cases are relatively unlikely, but I still wonder about these issues.

Also, there are ways to make the source code viewable without doing so via a github-like project where people could contribute PR's with proposed software changes. And comments by most users could still be locked out.

And even in the relatively likely case that none of my stated concerns are taking place now, if the use of Alpha or its descendants becomes more widespread, the country in question might in the future decide to step in and try to extract real-time user information from the software.

And this is a country that currently is in the midst of an escalating Cold War with the "west", and it's a country that's known to hang threats over the heads of relatives of expats in order to motivate these expats to cooperate with the country's espionage efforts. In the future, the country could just as easily choose to do something similar to one or more Alpha developers.

Having access to the Alpha source code is a way to enhance potential Alpha users' level of protection against this sort of thing, by letting everyone see possible bugs and see what other things *could* be going on with the software.

Again, I still see these sorts of things as being unlikely, but I also still think and wonder about these possibilities.
[Magisk] pndwal:
Just use it or don't... Use your bank apps or don't...

Your bank *might* be trading your data for the Yuan since it *could* become the new international currency, and they *may* have assurances from 国家安全部 that all Alpha males will be emancipated upon the admission that they are actually conducting industrial espionage using root apps loaded surreptitiously on the phones of weapon developers... Actually, I've imagined a lot more, but I'd better stop before some telepathic spy reads my mind... 😜 PW
[Magisk] rodken:
I suppose that the collected data is formatted and organized into a structured format, such as JSON or XML, for efficient transmission and processing. This formatting may involve encoding sensitive info for privacy purposes.

Any data collected is supposed to be transmitted over a secure communication channel to encrypt the data and protect it from foolish stealth hackers.

What is not clear is how precise the data is routed through the internet infrastructure, potentially bouncing around multiple routers and servers, until it reaches the MSFT analytics service endpoint.
[Magisk] HippoMan:
Exactly.
[Magisk] zgfg:
Yeah

MSFT only provides a tool and service but developer collects the data

Hence developer defines which data (s)he wants to collect

Since Magisk (Alpha) runs with the su grant, any data from the phone could be collected (whatever developer wanted and included)

MSFT does not need to be compromised by the Big Brother agency, but developer's PC where (s)he analyzes the collected data

Hence, IMO, it's not important the route how the serialized and encrypted data flows from the user's phone to MSFT Analytics and from MSFT to developer's PC

The real concern is are there user's privacy data included into the collection (you would only know if/when you see the Magisk Alpha source code) and is the developer's PC/environment compromised by being watched by the BB agency (or other hackers)

Those tho make the risk:

If your privacy data are collected AND if 3rd pty can intrude to developer's environment to mine there the local copy of the collected data o to steal developer's credentials to suck the collected data directly from the MSFT Analytics service (in developer's name but without the developer being aware of)
[Magisk] HippoMan:
Agreed, and that's why being able to see the source code is important. We could then see what data is being collected and can be collected.
[Magisk] pndwal:
Well no, not really...

I've linked some MS documentation that covers this, if simply... (I think people are still making unnecessary assumptions however.)...

The SDK collects the data ("automatically captures session count and device properties like model, OS version, etc") according to MS, but the app/dev can configure it's own "custom events to measure things that matter to you... All the information captured is available in the App Center portal for you to analyze the data."

In fact "You can track your own custom events with up to 20 properties to understand the interaction between your users and the app..."

Absolutely NOT, at least according to MS...

The limitations I mentioned above (and vv linked) apply as defined in the Data Protection Addendum (DPA), namely:

https://learn.microsoft.com/en-us/appcenter/gdpr/faq#app-store-privacy-report

Addressed above... MS SDK collects the data... User configures this only... Otherwise MS couldn't make the assurances we're discussing...

Also, App Centre telemetry is of course used almost wholly by closed source proprietary apps so we can never see what they collect either... At least the MS SDK gives assurances/protection from abuse... Of course any bank *could* also be using telemetry tools developed and distributed by communist states for all we know... 😬

Running a modified/custom environment is in itself always a risk and it's our choice...

However the fact is that no "privacy data" is collected for MS App Center analytics purposes in the first place, at least not using the disclosed method employed unless we opine that MS may be breaking their own GDPR (General Data Protection Regulation) obligations... We don't need to see the Alpha code to know this any more than any proprietary bank or other app because Microsoft code is capturing the information and they set the limits and available endpoints that determine what calls can be made... Also you can see these in the OpenAPI spec/client page per:

https://learn.microsoft.com/en-us/appcenter/api-docs/

I do agree that the data transmission itself, using (Microsoft Azure) encryption and secret API tokens, is very secure, but the data itself is also innocuous...

------​

FWIW, I played around with the MS App Centre OpenAPI Swagger client today using the X-API-Token, app_name and owner_name vv supplied to test her statement that "All information and details can be queried through the API interface" and the public Telemetry data.

I'm attaching some generated JSONs as samples... Two attached show stats for some 8000 Alpha instances running over a 3 week period showing breakdown of numbers of devices per 'OSs' running, actually Android versions by API/SDK level, and per phone models, and one shows event logs collected over a few hours today for anyone who wants to see the kind of stuff collected... Of course you can use vv's published X-API-Token and test all available end points yourself too. 😜 PW
[Magisk] HippoMan:
This is good to know about the Alpha telemetry (at least that which we're aware of). Thank you.

I'm still concerned about the aspects of the Alpha code that we aren't (and can't be) aware of, because of it being closed source.

Having this increased understanding that you have presented here indeed puts me somewhat more at ease about Alpha, just like obtaining understanding about the software from being able to study its source code would bring some of us quite a bit more confidence about it.
[Magisk] solar666:
New version released on app center and over the air:

Version 577483fd-alpha (26401)

Nov 07, 2023 at 19:25

Magisk (577483fd-alpha)

[App] Delete backup files after restoring boot image

[General] Do not automatically unlock device blocks

[App] does not actively request permissions

[General] Keep ROOTOVL temporary files

[Zygisk] Uninstall and mount without skipping com.android.systemui

[App] Check and download updates via appcenter

[App] Add telemetry https://t.me/s/magiskalpha/473

[General] Rewrite MagiskHide and use logcat to implement it. Do not enable this function on devices with abnormal log systems.

[General] Remove addon.d support

[General] Hide and clean magiskd internal mount points

[General] Cancel the writable exception of /system/etc/hosts, please modify /data/adb/modules/hosts/system/etc/hosts

[Zygisk] Refactor the loading method, similar to riru

[MagiskSU] Support removal capabilities

[General] Support users to limit Root capabilities [Applications using older versions of libsu will be mistakenly identified as non-root]

[App] Add backup DoH server

[General] Safe mode no longer mounts su to /system/bin/su. Please use /debug_ramdisk/su for adb shell.

[Zygisk] Fix fd cleaning logic
[Magisk] pndwal:
It's all stuff I said above, but people don't seem to check even what's laid out plainly for them and continue to 'imagine' stuff and post the theories with some errata presented as fact... I'm doing my best to prevent unhelpful conspiracy theories from taking hold as they do damage...

Also, I've linked unreasonable opposition to MS telemetry (especially in PR for App Center) and other unnecessary and sometimes even hurtful comments made, to Devs closing ranks and making Alpha and other development less accessible to general mod users in these threads before. 😬 PW
[Magisk] Homeboy76:
Upstream Update Log

2023.11.5 Magisk v26.4

[MagiskBoot] Don't pad zeros if signed boot image is larger

[MagiskPolicy] Fix genfscon and filename_trans

[MagiskPolicy] Fix bug in libsepol

[Zygisk] Fix and simplify file descriptor sanitization logic

[App] Prevent OOM when patching AP tarfiles

[App] Fix bug in device configuration detection

[Daemon] Fix certificate parsing of APKs

[General] Fix logging errors from C++ code being ignored
[Magisk] pndwal:
Nb. This TJW fix is still broken:

• [Zygisk] Fix and simplify file descriptor sanitization logic

and users are having various app / UI issues...

It was already fixed in Alpha, but is improved further with Version 577483fd's

• [Zygisk] Fix fd cleaning logic

👀 PW
[Magisk] Homeboy76:
Thanks for the update, but the Upstream... is for Magisk Stable not Magisk Canary.
[Magisk] HippoMan:
IMO, closing ranks when people want to express fears and concerns and paranoia is the exact opposite of what the devs should do.

Openness is the cure for misinformation, while shutting down two-way communication just feeds the fears and paranoia.

Nowadays, software security is a large and growing concern, but development policies which enhance security of the developers' egos do not normally have a positive effect on the security offered by their produced software itself.

Source code could be made viewable without allowing PR's nor any kinds of changes to be submitted by outsiders.

However competent and experienced and well-intentioned that we might know the devs to be, they are not perfect, and outside input about the characteristics and structure of their code can help uncover otherwise overlooked bugs and flaws.

Of course, I'm well aware that it's unrealistic to expect anything different from the status quo from the Alpha developers ... so some of the frustrations and fears and paranoia are likely to continue.

PS: You provided detailed and verifiable information about MS analytics, and that helped to alleviate some expressed concerns. If only the Alpha devs would provide equally detailed and verifiable information about their own code.
[Magisk] zgfg:
Why not? Canary 26401 shares the same code as Stable and Beta 26400.

That's always, it was for Stable 26300/Canary 26301, Stable 25200/Canary 25201, etc

However, it's expected that Canary 26402 will be released earlier (with that fix and a new bugs😀) than the next Stable like 26500 or 27000

However, it's sad that Stable now becomes a testing polygon for Alpha - they introduce 'sanitized' bugs to the code, changes are not tested, Stable gets released and then (when bugs are observed) they fix and release the Alpha with fixes.

And the similar cases have been observed with the several past Stable releases (coming with untested changes merged from Alpha upstream development)
[Magisk] tyler19820201:
I am still on 26301. I think the source code being closed rather then public is a better solution. As banking app devs are also like browsing github pages of public version of magisk like canary and stable....So from one side getting the code unpublic is a good thing. However if we are talking about bugs and testing of course it is a big disadvantage. Not to mention about telemetry and a blind trust of the devs....:rolleyes:Also unable to contact the devs or opening a ticket on github is a downside. Not to mention the chinese tg group is the only -and for most of us unavailable- way to get contact with the devs.

By the way all my banking apps and AppManager is still works on 26301 so i will use until does...

Also an english based tg group would be nice but not that stream only channel which does already exists. That is useless.

Sent from KB2000 using ReLabs
[Magisk] pndwal:
Fair enough... Edited now... TJW fix was introduced in 26400 (public stable) first, and canyie's PR closed... Really just meant the TJW fix as opposed to the working fix built in Alpha however, and I said "Canary" as Alpha always syncs/builds on Canary builds...

FWIW, @canyie has just committed her improved fix in TJW Magisk master:

Prevent Zygisk from closing new fds created by Zygote itself

canyie committed 3 hours ago

This is good news... Other merges just in are more exciting however...

I'll be moving back to official Magisk very soon by the looks... Official Magisk + Shamiko will be the go again with NB-Zygisk merged...

And alternative ptrace+fuse loaded Zygisk in ZygiskNext may be another module to try/watch...

👀 PW
[Magisk] pndwal:
Mmm...

But in this case the Canyie fix/PR was closed and John committed his own which was broken (although he said it included canyie's changes)... Canyie's fix itself, while apparently needed additional charges, was working well in Alpha... Now @canyie's new fix is merged in TJW master branch anyway... PW
[Magisk] solar666:
There are big discussions ongoing about that fix done by tjw in the Chinese telegram alpha discussion group. But wasn't able to follow all the details ...
[Magisk] Homeboy76:
SafetyNet Fix

Google has made some changes that caused a SafetyNet Fix problem: Displax's SafetyNet Fix 2.4.0-MOD_1.3 is not passing Device Integrity.

Use chiteroman's

Play Integrity Fix - Latest
[Magisk] tyler19820201:
Use google translate

Sent from KB2000 using ReLabs
[Magisk] sawdoctor:
Don't think he was saying he couldn't translate but that the conversation was too technical to understand
[Magisk] solar666:
You can directly translate in telegram. You don't need to do that with Google, just fyi
[Magisk] tyler19820201:
Updated to 26401. So far so good. 👌 App Manager does work again. 👍

Sent from KB2000 using ReLabs
[Magisk] goldencore:
Updating to 26401 broke Google Wallet for me, although Safetynet Checker still passes. Should I use the Play Integrity Fix?
[Magisk] zgfg:
Testing with SafetyNet would not help you😁
[Magisk] pndwal:
Latest was fine w/ G Pay/Wallet for me...

Likely issue was not Alpha, but Google server end changes of 8 days ago... This broke DEVICE_INTEGRITY for everyone...

Yes... V12+ fixes the issue...

BTW, in case you didn't know, SafetyNet has been deprecated from a good while now; G Pay/Wallet required new Play Integrity API DEVICE_INTEGRITY immediately and banks have since followed suit so YASNAC etc results may now be misleading/irrelevant... And SafetyNet will be switched off fully at end of January 2025... You should now be checking with Play Integrity API Checker, Play Store internal (Developer options) check etc...

👀 PW
[Magisk] HippoMan:
Sadly, the Googlefrinchians have intervened once again to "fix" (ha ha!) their integrity checking so as to undo the latest PIF v12+ functionality.

Check in the PIF thread for more details.
[Magisk] HippoMan:
FYI: The "Magisk Alpha" download link shown here in the OP is broken ...

Could someone correct that info in the OP here? Thank you very much.
[Magisk] Homeboy76:
SafetyNet

A Google patch has rendered chiteroman's Play Integrity Fix inoperable.

chiteroman fix, V13.
[Magisk] Homeboy76:
What link are you referring to, this is what is in the OP:

Magisk alpha

App Center

TG App

TG link
[Magisk] Homeboy76:
<<Deleted>> :rolleyes:
[Magisk] HippoMan:
The link I'm referring to is on the line that I copied and pasted in my question above.

Here is more text from the OP to help identify that link ...

3. Patch the boot/init_boot.img

.

Download Magisk Alpha (app-release.apk)

Install the Magisk Alpha App

Open Magisk Alpha App

... etc. ...

The link that fails is the one above in blue in the item which says "Download Magisk Alpha (app-release.apk)". It's in the "Detailed Instructions for the first installation of Magisk Alpha on Google™ Pixel™ phones." section in the OP.

I know about those other links that you mentioned. I am only referring to this one, single link which fails.
[Magisk] Homeboy76:
You're right, I fixed it. Thanks!
[Magisk] tyler19820201:
It hashappend the same with me. google wallet nfc payment has broken. i was fixing it to add the wallet app on L

sposed modules's play integrity bypass applist.

Sent from KB2000 using ReLabs
[Magisk] Homeboy76:
@pndwal reproduce and embellished his description of changing or downgrading Magisk: The link to it is in the in OP.
[Magisk] tyler19820201:
UPDATE

Lsposed play integrity deprecated. Does not work anymore. So i was using https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v13 and Wallet does work flawlessly. 👌👍

Sent from KB2000 using ReLabs
[Magisk] tyler19820201:
Anybody has got issue with

github.com/ReVanced/revanced-manager/releases

latest revanced manager? i can not patch the apk. 🙄 It looks like root issue...🤔Alpha has got refuse revanced patch manager root access. i was reinstall the patch manager and grant again root access but patching still does not work...😬😒

UPDATE: Now does work if i change ISP....Weird...

Sent from KB2000 using ReLabs
[Magisk] TraderJack:
Looking for some assistance with Alpha here... @pndwal I'm here because of you :)

Tried Alpha here to get around the Bonvoy issue and it does appear to work, so was thinking of using it until the updated TJW comes out.

Anyway, I can get Alpha installed fine, but I use the custom Kirisakura kernel on my A11 Pixel 3XL:

[Kernel][10.06.2022][4.9.317][Android 12]Kirisakura_S 5.1.1 for Pixel 3/XL aka Bluecross

Kirisakura-Kernel for the Pixel 3 and Pixel 3 XL Hello everyone, To keep it short: Here is Kirisakura - Kernel for the Pixel 3 aka Blueline and the Pixel 3 XL aka Crosshatch, together Bluecross. I would appreciate if everybody that flashes the...

xdaforums.com

With TJW I have no problem flashing it with EXKM.

However when trying under Alpha I get the following:

mkdir: can't create directory '/tmp/anykernel/':
Read-only file system
Archive : /storage/emulated/0/Android/data/flar2.externalmanager/cache/Kirisakura_Bluecross_R_3.1.0.zip
unzip: can't open 'Image.lz4': Read-only file system
Unzip failed. Aborting...

Any ideas why this would be happening? I need the custom kernel due to:

Systemless hosts may result in system freezes (F2FS driver bug) · Issue #3171 · topjohnwu/Magisk

yujincheng08 EDIT: This should have been fixed by #6805 topjohnwu EDIT: This is caused by an F2FS driver issue that unfortunately Magisk is unable to fix. The only way around it is to use a custom ...

github.com

thanks

EDIT: I figured it out flashing with TWRP instead:

[Kernel][10.06.2022][4.9.317][Android 12]Kirisakura_S 5.1.1 for Pixel 3/XL aka Bluecross

Kirisakura-Kernel for the Pixel 3 and Pixel 3 XL Hello everyone, To keep it short: Here is Kirisakura - Kernel for the Pixel 3 aka Blueline and the Pixel 3 XL aka Crosshatch, together Bluecross. I would appreciate if everybody that flashes the...

xdaforums.com
[Magisk] whatsisnametake2:
I an trying to get santander and wallet working on my pixel 8 pro. magisk canary, along with various combinations of play integrity fix, unsf, shamiko, isn't working. will alpha offer me something where canary is failing?
[Magisk] rodken:
Are you referring to the Marriot Bonvoy app or something else?
[Magisk] TraderJack:
Yes Marriott.
[Magisk] rodken:
Give this release a whirl to see if you can bypass the issue.
[Magisk] TraderJack:
I'm on the latest and passing just fine with Alpha. No need for me to downgrade atm.
[Magisk] rodken:
At least you have your options available.
[Magisk] tyler19820201:
i have just updated to 14.1 play integrity fix module but wallet nfc payment still does not work....🤨 Any workaround? 🙄

Sent from KB2000 using ReLabs
[Magisk] sawdoctor:
Are you passing device and basic? If you are just wait for Google play services cache to update or follow one of the many guides on how to force clear it. If you are not passing device and basic then you need to change your fingerprint
[Magisk] google.15zk1:
I want to ask if I have used other magisk versions before (magisk official, magisk delta), and now want to install magisk alpha, do I just need to download its manager and patch the boot.img file, or will I need to patch it with AP file and then reflash them all with Odin?
[Magisk] HippoMan:
Somewhere among the hundreds of messages that I've read either in XDA or TG over the past few days was one which stated that Shamiko should be run in conjunction with Magisk Alpha.

I can't find that message now in order to re-read it and thereby understand it better, and so I'm asking here about that suggestion.

First of all, is that correct?

If so, why would I need Shamiko along with Alpha, and what harm would result if I don't use it with Alpha?

I'm running Alpha 26401 under A13 along with LSPosed-Zygisk 1.9.2.

Thank you in advance.
[Magisk] xcl1pse:
Nah, shamiko also work on OG magisk but since alpha is first using native bridge injection based zygisk, it really hidden very well on other hand OG magisk still using LINKER_PRELOAD or mounting zygote on /proc which is detectable if app implement maps/proc scanning in their isolatedprocess + bad oem implement on how procfs should be. Don't worry OG magisk will implement native bridge in v27 or you can taste it in magisk debug/CI
[Magisk] HippoMan:
Thank you for your reply, but unfortunately, I still don't understand. I'm sorry.

Given that I'm already using Alpha 26401 under A13, is there an advantage for me to also start using Shamiko with that, or is it a disadvantage to use Shamiko with my Alpha set-up?

Thank you very much!
[Magisk] xcl1pse:
TLDR: if some app using advanced zygisk mechanism, OG magisk will detected but on alpha isn't.

Using shamiko is really depends on you. If your happy with enforce denylist on and your app dont complain, go ahead. Shamiko is additional module to prevent leaks from bad oem implementation
[Magisk] HippoMan:
Oh, I see. Thank you for explaining.

What sorts of ill effects might my OS experience if there are leaks from a bad oem implementation?
[Magisk] xcl1pse:
From slow down processing, app crash, zygisk can't turned on or even bootloop but it need further investigation of what causing the problem
[Magisk] HippoMan:
Oh, I see. Thank you!

So far, I've experienced none of those things with enforced DenyList, and so I'll just stick with that for now.

But now I know to switch to Shamiko if any if those things start occurring.
[Magisk] zilan:
anyone know how to disable temporary or paused magisk alpha?

btw, this app works fine before updating today to new ver 1.7.0 and it begin failed to open.

Check out "Livin' by Mandiri"

Livin' by Mandiri - Apps on Google Play

Livin' by Mandiri is here with more features, for your lively life!

play.google.com

anyone has solution? my setup magisk alpha, lsposed, shamiko, hma.

strange is, i downgrade to previous ver 1.6.0 and failed too. before its normal and fine.
[Magisk] xcl1pse:
Working, no need hma...