At around 12pm on feb 22, we arrived at the parking lot of this hugely popular attraction, and to our surprise the parking lots are quite empty. But there are huge crowds walking around aimlessly in and around the tourist information center. After a while we notice that the last bit of the road leading up to the volcano rim is closed off, and at the information center there's a sign saying "Mount Aso closed due to sightseeing incident". Suddenly I remembered that on Google Maps when I checked the day before it said that the attraction was temporarily closed. Now I'm curious, so I "Google Mount Aso incident", and sure enough, up comes several news articles dated february 20, 2026 stating that a helicopter and its 3 passengers had been "recovered". Oh no, so they're still working on recovering the helicopter and that's why the crater is still closed, I thought. Then I scroll further and I find a Wikipedia article named "2026 Mount Aso helicopter crash". It says:

"On January 20, 2026, a Robinson R44 Raven II helicopter on a sightseeing tour crashed inside Mount Aso.".

Now I'm thinking, what? There were two helicopter incidents at the same mountain exactly 1 month apart? This cannot be possible. There must have been a mistake somewhere. I just conclude that february 20 must be the correct date, and that's why the crater is still closed, because it takes a few days to recover and cleanup the wreckage site, it makes sense.

I start looking around the parking, and it turns out that there is also a hiking trail to go up to the crater, but I see only one other person walking there. I start walking up the trail but I arrived at a gate with a Japanese official guarding it. She shows me a map, and to my surprise we're still allowed to continue hiking, as long as we don't go up to the crater rim (to he left). Cool! I'll just go for a short walk and look at the other trails/peaks in the area.

Meanwhile my curiosity starts to itch, and I start Googling again. Where exactly did this helicopter crash? I found an official video from the Japanese authorities showing the exact coordinates. I plot them into Google Maps and it shows the location right there, inside the crater rim. Yikes! It's not even a remote area, it's right here, in plain sight, 400m opposite the crater rim viewing platform (which is accessible by car but now closed off from tourists). I continue reading the Wikipedia article and I now see the whole timeline of events.

"On January 20 at 10:52 a.m. JST, the helicopter took off and was en route for the local sightseeing flights of Mount Aso. The 3 occupants included 2 Taiwanese tourists and the pilot. All three onboard, including two Taiwanese tourists and the pilot, remain missing (to this day)."

"On January 20, the Kumamoto police force succeeded in finding the crashed helicopter in the afternoon. However, the rescue was halted due to ground freezing, volcanic gases and strong winds on Mount Aso. As of February 11, rescue operations could not begin after the accident."

"On February 18, almost a month after the incident, the fire department and the police force announced that they had spotted what appeared to be three people on board a crashed sightseeing helicopter via drone."

That's when I realised, the helicopter wreckage is sitting there, with 3 dead people inside, and it's been sitting there for almost a month before the Japanese authorities decided to fly a drone to look for survivors. I'm now writing this on mar 12, the helicopter is still there and the crater is still closed.

When I asked about this in a Japanese subreddit, someone said that "there were news when the accident happened that the area has laws against flying drones because they won't be able to retrieve the drone if it went down - they probably have to wait to get permission before flying a drone". In other words: The authorities deem the area so dangerous that they don't allow flying a drone there in fear of not being able to recover a lost drone, yet they allow helicopters flying in the same area, every day with tourists. It doesn't make any sense. In an emergency we must have prioritizations. If they flew a drone as soon as they heard of the accident, they could have even had the chance to save lives! But after 1 month the chance of survivals is near 0. Is Japan really so crippled by bureaucracy that it takes a month to approve an emergency drone flight to potentially save human lives?

I feel very sad for the victims' families, and I'm shocked that this can happen in such a developed country like Japan. I think if an accident like this happened in any other country in the world, people would throw everything they have and do what it takes in hopes of saving lives. Yet here we are, almost 2 months later. No more news from Japanese authorities. What am I missing here?

Sources:

• https://www.reddit.com/r/japannews/comments/1r7za4k/aso_sightseeing_helicopter_accident_three_people/
• https://www.reddit.com/r/japannews/comments/1qhtj09/helicopter_with_2_passengers_from_taiwan_goes/
• https://en.wikipedia.org/wiki/2026_Mount_Aso_helicopter_crash
• https://earth.google.com/web/search/32%c2%b053%2708.0%22N+131%c2%b005%2715.0%22E/@32.88613981,131.08494281,1232.37526816a,1030.57823439d,35y,-13.84207642h,60.73807392t,0.00000119r/data=CmQaNhIwGRNlyuJZcUBAIc3MzMzMYmBAKhwzMsKwNTMnMDguMCJOIDEzMcKwMDUnMTUuMCJFGAEgASImCiQJnqb72s79NkARmqb72s79NsAZuLU2zP89SkAhWzAbPHiISsBCAggBOgMKATBCAggASg0I____________ARAA

Why use it?

• Type-safe options per service (good autocompletion and compile-time checks).
• Minimal: no runtime dependencies, small footprint.
• Programmatic: call share(...) from your UI code — no attribute bindings.

Example

import share from 'tinyshare'
share('https://example.com', 'twitter', { title: 'Hello', hashtags: 'news' })

See the repo: https://github.com/mifi/tinyshare — MIT licensed.

Credits: Forked from Sharer.js by Ellison Leao.

Konverter valuta på historisk dato basert på data fra Norges Banks API. Sjekk ut valutakalkulatoren.

I created a personal knowledge base. Inspired by @nikitavoloboev's "Everything I Know". Check it out!

For more info, see youtube-import-playlist.

See also this article.

It used to be so easy to connect to someone's computer using TeamViewer, because TeamViewer used to provide a Chrome app, however after 2022 they don't provide that anymore, and when downloading TeamViewer, we are presented with an Install TeamViewer.app that requires admin privileges to install.

There is a solution​

First, copy Install TeamViewer.app from inside the .dmg to your home folder. Now we can extract the .pkg file within:

pkgutil --expand-full Install\ TeamViewer.app/Contents/Resources/Install\ TeamViewer.pkg TeamViewer-extracted/

ls TeamViewer-extracted

Notice how the TeamViewer-extracted folder contains a lot of crap: 💩

AuthPluginPackage.pkg/ RemotePrintingPackage.pkg/ Distribution Resources/ FullEnforceUIVersionPackage.pkg/ TeamViewerApp.pkg/ FullSilentInstallerPackage.pkg/ UninstallerAppPackage.pkg/ PriviledgedHelperPackage.pkg/ UninstallerHelperPackage.pkg/ RemoteAudioDriverPackage.pkg/

We don't need any of those. Instead we will just grab the TeamViewer.app from inside TeamViewerApp.pkg:

mv TeamViewer-extracted/TeamViewerApp.pkg/Payload/TeamViewer.app ~/Desktop/

Then we can simply run our admin privilege-free TeamViewer.app without installing any of the other invasive stuff and we can flush the rest of it down the 🚽

rm -rf TeamViewer-extracted 

I would say Safari on iOS has become the new IE - they just have to do things a little bit different.

Isn't it nice to have a HTTP standard Cache-Control response header that lets us control how browsers cache our content? Well yes, until of course one of the most popular browsers doesn't follow that standard.

When building a website, e.g. single page application, we like to set Cache-Control no-cache or max-age=300, must-revalidate on the index page (/). That way, the browser will always revalidate with the server before considering using a cached version, and we can make sure that we're not serving old content to the user when pushing updates! 🙌 This seems to work nicely in most browsers. Even Safari on MacOS behaves like this. But not Safari on iOS 🤡

How to reproduce 🤔​

First start a HTTP server, e.g.:

import http from 'http';

http.createServer((req, res) => {
  console.log(req.method, req.url, req.headers['user-agent'])
  res.setHeader('Cache-Control', 'no-cache')
  res.write('Hello World!');
  res.end();
}).listen(8080);

node index.mjs

Now open Safari on iOS and open your computer's IP in Safari http://192.168.1.x:8080

Observe an expected log line from the server:

GET / Mozilla/5.0 (iPhone; CPU iPhone OS 17_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1

Now kill the Safari app and then repoen it. This will cause Safari to load the page from its local cache without revalidating.

Even adding no-cache, must-revalidate, max-age=0 doesn't help. Safari still doesn't revalidate.

Solution 🚀​

The only sensible thing that makes sure nobody dares cache index.html is to set Cache-Control: no-store. This is not optimal, because it doesn't let us cache the page even for a short duration, and the browser always has to fully fetch the whole file every time, but hey, at least it works!

Alternatively, some people use Vary: *, which also seems to work, however I'm not sure how safe that is.

Start with a fresh Raspberry Pi OS Bullseye Lite.

Setup WiFi​

https://wiki.archlinux.org/title/wpa_supplicant

First run raspi-config and enable WiFi.

wpa_cli -i wlan0

scan
scan_results
add_network
set_network 0 ssid "MYSSID"
set_network 0 psk "passphrase"
enable_network 0
save_config
quit

Install X11​

sudo apt-get install --no-install-recommends xserver-xorg xserver-xorg-legacy xinit x11-xserver-utils xinput libnss3

sudo usermod -a -G tty pi

sudo nano /etc/X11/Xwrapper.config and change it to:

allowed_users = anybody

Openbox​

Openbox is needed for fullscreen / scaling to work properly. Without a Window manager, the window will probably get cropped.

sudo apt install openbox

Install UxPlay​

Reference: https://github.com/FDH2/UxPlay

sudo apt install cmake build-essential pkg-config

# uxplay deps
sudo apt-get install libx11-dev libssl-dev libplist-dev libavahi-compat-libdnssd-dev libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev gstreamer1.0-plugins-base gstreamer1.0-libav gstreamer1.0-plugins-good gstreamer1.0-plugins-bad

Build UxPlay

git clone https://github.com/FDH2/UxPlay
cd UxPlay
cmake .
make

To test it:

# one terminal:
startx
# other terminal:
DISPLAY=:0 ./uxplay -bt709 -nh -n TV -fs

Setup audio​

sudo apt install gstreamer1.0-alsa

sudo usermod -a -G audio pi

Edit /home/pi/.asoundrc

pcm.!default {
  type asym
  playback.pcm {
    type plug
    slave.pcm "output"
  }
  capture.pcm {
    type plug
    slave.pcm "input"
  }
}

pcm.output "hdmi:CARD=vc4hdmi,DEV=0"

ctl.!default {
  type hw
  card 1
}

sudo raspi-config then choose: System -> Audio -> HDMI

Setup simple desktop (run on boot)​

We'll use LightDM to provide a desktop.

sudo apt install -y lightdm

sudo nano /etc/lightdm/lightdm.conf and change these under [Seat:*]:

autologin-user=pi

xserver-command=X -nocursor

Then nano ~/.xsession:

xset s off
xset -dpms
xset s noblank

openbox &

while true; do
  /home/pi/UxPlay/uxplay -bt709 -nh -n TV -fs -as alsasink -nohold
  sleep 5
done

sudo raspi-config then enable: System -> Boot -> Desktop GUI, automatically logged in as 'pi' user.

Reboot and test!

AWS CloudWatch and Winston to the rescue!

1. In your Electron main app, install and setup cloudwatch-winston.
2. Create a log group in CloudWatch Logs
3. In IAM, create a new user with only the following policy: (replace 123456789012 with your AWS account ID and my-cloudwatch-log-group with your desired log group name.)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:*:123456789012:log-group:my-cloudwatch-log-group",
                "arn:aws:logs:*:123456789012:log-group:my-cloudwatch-log-group:log-stream:*"
            ]
        }
    ]
}

4. Copy the Access Key ID and Secret Acces Key and put it in cloudwatch-winston, and start logging 🪵🔥

Now if only Winston would work in the browser we could also do this from the web and maybe even from React Native...

A workaround is to create an additional dummy video element, synchronously, when the user clicks the button, and then play it back immediately. Once that is done, the page is "whitelisted" by Safari and any other <video> tag can call play programmatically:

function handleMyButtonClick () {
  const video = document.createElement('video');
  video.muted = true;
  video.playsInline = true;
  // Generated by: ffmpeg -t 1 -f lavfi -i color=c=black:s=64x64 -c:v libx264 -tune stillimage -pix_fmt yuv420p -crf 51 -y out.mp4 && base64 < out.mp4
  video.src = 'data:video/mp4;base64,AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAAAIZnJlZQAAAtptZGF0AAACrwYF//+r3EXpvebZSLeWLNgg2SPu73gyNjQgLSBjb3JlIDE2NCByMzA5NSBiYWVlNDAwIC0gSC4yNjQvTVBFRy00IEFWQyBjb2RlYyAtIENvcHlsZWZ0IDIwMDMtMjAyMiAtIGh0dHA6Ly93d3cudmlkZW9sYW4ub3JnL3gyNjQuaHRtbCAtIG9wdGlvbnM6IGNhYmFjPTEgcmVmPTMgZGVibG9jaz0xOi0zOi0zIGFuYWx5c2U9MHgzOjB4MTEzIG1lPWhleCBzdWJtZT03IHBzeT0xIHBzeV9yZD0yLjAwOjAuNzAgbWl4ZWRfcmVmPTEgbWVfcmFuZ2U9MTYgY2hyb21hX21lPTEgdHJlbGxpcz0xIDh4OGRjdD0xIGNxbT0wIGRlYWR6b25lPTIxLDExIGZhc3RfcHNraXA9MSBjaHJvbWFfcXBfb2Zmc2V0PS00IHRocmVhZHM9MiBsb29rYWhlYWRfdGhyZWFkcz0xIHNsaWNlZF90aHJlYWRzPTAgbnI9MCBkZWNpbWF0ZT0xIGludGVybGFjZWQ9MCBibHVyYXlfY29tcGF0PTAgY29uc3RyYWluZWRfaW50cmE9MCBiZnJhbWVzPTMgYl9weXJhbWlkPTIgYl9hZGFwdD0xIGJfYmlhcz0wIGRpcmVjdD0xIHdlaWdodGI9MSBvcGVuX2dvcD0wIHdlaWdodHA9MiBrZXlpbnQ9MjUwIGtleWludF9taW49MSBzY2VuZWN1dD00MCBpbnRyYV9yZWZyZXNoPTAgcmNfbG9va2FoZWFkPTQwIHJjPWNyZiBtYnRyZWU9MSBjcmY9NTEuMCBxY29tcD0wLjYwIHFwbWluPTAgcXBtYXg9NjkgcXBzdGVwPTQgaXBfcmF0aW89MS40MCBhcT0xOjEuMjAAgAAAABtliIQAGM5//rXfMsVE8oN5hOAtnfPJtIztixMAAAMXbW9vdgAAAGxtdmhkAAAAAAAAAAAAAAAAAAAD6AAAA+gAAQAAAQAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAkF0cmFrAAAAXHRraGQAAAADAAAAAAAAAAAAAAABAAAAAAAAA+gAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAEAAAABAAAAAAAAkZWR0cwAAABxlbHN0AAAAAAAAAAEAAAPoAAAAAAABAAAAAAG5bWRpYQAAACBtZGhkAAAAAAAAAAAAAAAAAABAAAAAQABVxAAAAAAALWhkbHIAAAAAAAAAAHZpZGUAAAAAAAAAAAAAAABWaWRlb0hhbmRsZXIAAAABZG1pbmYAAAAUdm1oZAAAAAEAAAAAAAAAAAAAACRkaW5mAAAAHGRyZWYAAAAAAAAAAQAAAAx1cmwgAAAAAQAAASRzdGJsAAAAwHN0c2QAAAAAAAAAAQAAALBhdmMxAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAEAAQABIAAAASAAAAAAAAAABFUxhdmM1OS4zNy4xMDAgbGlieDI2NAAAAAAAAAAAAAAAGP//AAAANmF2Y0MBZAAK/+EAGGdkAAqs2UQmwEQAAAMABAAAAwAIPEiWWAEAB2jr4GUTITD9+PgAAAAAEHBhc3AAAAABAAAAAQAAABRidHJ0AAAAAAAAFpAAABaQAAAAGHN0dHMAAAAAAAAAAQAAAAEAAEAAAAAAHHN0c2MAAAAAAAAAAQAAAAEAAAABAAAAAQAAABRzdHN6AAAAAAAAAtIAAAABAAAAFHN0Y28AAAAAAAAAAQAAADAAAABidWR0YQAAAFptZXRhAAAAAAAAACFoZGxyAAAAAAAAAABtZGlyYXBwbAAAAAAAAAAAAAAAAC1pbHN0AAAAJal0b28AAAAdZGF0YQAAAAEAAAAATGF2ZjU5LjI3LjEwMA==';
  video.play().catch(console.warn);

  // Now continue doing async work before playing the *actual* video in a different <video> element
}

First install deps:

yarn add winston electron-is-dev

// logger.js

import winston from 'winston';
import util from 'util';
import isDev from 'electron-is-dev';
import { app } from 'electron';
import { join } from 'path';

// https://github.com/winstonjs/winston/issues/1427
const combineMessageAndSplat = () => ({
  transform(info) {
    const { [Symbol.for('splat')]: args = [], message } = info;
    // eslint-disable-next-line no-param-reassign
    info.message = util.format(message, ...args);
    return info;
  },
});

const createLogger = () => winston.createLogger({
  format: winston.format.combine(
    winston.format.timestamp(),
    combineMessageAndSplat(),
    winston.format.printf((info) => `${info.timestamp} ${info.level}: ${info.message}`),
  ),
});

const logDirPath = isDev ? '.' : app.getPath('userData');

const logger = createLogger();
logger.add(new winston.transports.File({ level: 'debug', filename: join(logDirPath, 'app.log'), options: { flags: 'a' } }));
if (isDev) logger.add(new winston.transports.Console());

export default logger;

⚠️ This assumes you're transpiling ESM, because Electron does not yet support ESM. Tip: You can use build-electron for this.

Then use your logger:

import logger from './logger.js';

logger.error('Some error happened', err);

This will make your app log to Library/Application\ Support/Your app/app.log (on MacOS, and accordingly on other platforms). When running in development it will still log to your console.

Example outputs:

logger.info({ someObj: 1 });

2022-09-04T14:28:09.278Z info: { someObj: 1 }

.

logger.info('test', 1, 'a', { b: 2, c: 3 });

2022-09-04T14:28:09.281Z info: test 1 a { b: 2, c: 3 }

.

logger.info('string');

2022-09-04T14:28:09.281Z info: string

.

logger.info({ a: 1, b: [{ c: [1] }] });

2022-09-04T14:28:09.281Z info: { a: 1, b: [ { c: [Array] } ] }

.

logger.info('1', '2', { a: 1 });

2022-09-04T14:28:09.281Z info: 1 2 { a: 1 }

.

logger.info([{}, '']);

2022-09-04T14:28:09.281Z info: [ {}, '' ]

.

logger.error(new Error('test1'), { additional: 'data' }, 'hmm');

2022-09-04T14:28:09.282Z error: Error: test1
    at Object.<anonymous> (app.js:39:14)
    at Module._compile (internal/modules/cjs/loader.js:968:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:986:10)
    at Module.load (internal/modules/cjs/loader.js:816:32)
    at Module._load (internal/modules/cjs/loader.js:728:14)
    at Function.Module._load (electron/js2c/asar.js:748:26)
    at Module.require (internal/modules/cjs/loader.js:853:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at Object.<anonymous> (electron.js:9:16)
    at Module._compile (internal/modules/cjs/loader.js:968:30) { additional: 'data' } hmm

.

logger.error('error occurred', new Error('test2'), { additional: 'data' }, 'hmm');

2022-09-04T14:28:09.283Z error: error occurred test2 Error: test2
    at Object.<anonymous> (app.js:40:32)
    at Module._compile (internal/modules/cjs/loader.js:968:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:986:10)
    at Module.load (internal/modules/cjs/loader.js:816:32)
    at Module._load (internal/modules/cjs/loader.js:728:14)
    at Function.Module._load (electron/js2c/asar.js:748:26)
    at Module.require (internal/modules/cjs/loader.js:853:19)
    at require (internal/modules/cjs/helpers.js:74:18)
    at Object.<anonymous> (electron.js:9:16)
    at Module._compile (internal/modules/cjs/loader.js:968:30) { additional: 'data' } hmm

Create an IAM user for GitHub Actions with a policy to allow deploying to the S3 bucket and invalidating the CloudFront distrubution:

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "AccessToGetBucketLocation",
          "Effect": "Allow",
          "Action": [
              "s3:GetBucketLocation"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket-name"
          ]
      },
      {
          "Sid": "AccessToWebsiteBuckets",
          "Effect": "Allow",
          "Action": [
              "s3:PutBucketWebsite",
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:GetObject",
              "s3:ListBucket",
              "s3:DeleteObject"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket-name",
              "arn:aws:s3:::my-bucket-name/*"
          ]
      },
      {
          "Sid": "AccessToCloudfront",
          "Effect": "Allow",
          "Action": [
              "cloudfront:GetInvalidation",
              "cloudfront:CreateInvalidation"
          ],
          "Resource": [
              "arn:aws:cloudfront::012345678901:distribution/DISTRIBUTIONID"
          ]
      }
  ]
}

Replace these variables:

• 012345678901 -> your AWS account ID
• DISTRIBUTIONID -> your CloudFront distribution ID
• my-bucket-name -> your S3 bucket's name

In GitHub Actions Secrets, set these environment variables:

AWS_INVALIDATE_DISTRIBUTION_ID=DISTRIBUTIONID
AWS_S3_BUCKET=name-of-bucket
AWS_ACCESS_KEY_ID=***
AWS_SECRET_ACCESS_KEY=***

In package.json add a deploy script:

"deploy": "aws s3 sync --delete build/ \"s3://${AWS_S3_BUCKET}/\" --cache-control max-age=600 && aws cloudfront create-invalidation --distribution-id \"${AWS_INVALIDATE_DISTRIBUTION_ID}\" --paths '/*'",

Create .github/workflows/deploy.yml:

name: Deploy

on:
  push:
    branches:
      - master

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
          cache: 'yarn'

      - uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - run: yarn install --frozen-lockfile
      - run: yarn build
      - run: yarn deploy
        env:
          AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
          AWS_INVALIDATE_DISTRIBUTION_ID: ${{ secrets.AWS_INVALIDATE_DISTRIBUTION_ID }}

This assumes that the script build creates a directory build with all the static assets.

Now push the code and let GitHub Actions do its magic.

Example repo: https://github.com/mifi/mifi.no

Inspired by:

• https://www.alexhyett.com/github-actions-deploy-to-s3

Check it out!

Use cases​

• Publish static (gatsby, jekyll etc.) site to separate GitHub repository
• Publish build results to a web endpoint
• Publish istanbul test coverage from unit/integration tests
• Publish a custom badge like shields.io (e.g a test coverage badge)

Why?​

• Free serving of public websites with git history (public repositories don't cost anything)
• Don't have to pay for services like codecov.io or coveralls.io
• Don't bloat your main repo with a long history of ever changing files.
• Don't risk exposing any personal github token from a github action (a leak which which could give someone access to your whole GitHub account).

This article shows how to send money using the Vipps apps to an arbitrary bank account number instead of a phone number.

1 - Tap Scan

2 - Choose Bill 3 - Take a picture of anything (not a bill)

4 - Choose Type in

5 - Manually enter the account number, message and amount and send the money

6 - Now you know how 😎

The process​

First download Vipps app on an Android phone, then connect it and copy the app over USB:

adb shell pm list packages | grep vipps
adb shell pm path no.dnb.vipps

adb pull /data/app/no.dnb.vipps-QLoJ4giHA8cXj7Pl6RI20A==/base.apk
adb pull /data/app/no.dnb.vipps-QLoJ4giHA8cXj7Pl6RI20A==/split_config.arm64_v8a.apk
adb pull /data/app/no.dnb.vipps-QLoJ4giHA8cXj7Pl6RI20A==/split_config.xxhdpi.apk

Note that app is split into 3 apk's. Now decompile the main APK:

apktool -r d base.apk

This will extract APK contents to base. I then used jaxd-gui to decompile and inspect the (obfuscated) Java/smali source code.

Now we need to remove the code that checks the SSL certificates inside the X509TrustManagers. These can be found in base/smali_classes3/util/h/bs/a.smali and base/smali_classes3/util/ma/c.smali. Just return void early:

.method public checkServerTrusted([Ljava/security/cert/X509Certificate;Ljava/lang/String;)V
+   return-void

Next, inside the file base/smali/com/dnb/vipps/android/common/networking/h.smali there is extra certificate pinning code, we need to remove that:

    public final l.h a() {
        h.a aVar = new h.a();
-       aVar.a("api.vipps.no", "sha256/nTNUIFsFUeN3c+hYZzlJfKRIwoRtRDyY6sVGPEauJWY=");
-       aVar.a("api.vipps.no", "sha256/O+qzlJSyoBSdYsSMceGYjjRqDxKVzUFjX0ymP+AC0f0=");
-       aVar.a("*.api.vipps.no", "sha256/nTNUIFsFUeN3c+hYZzlJfKRIwoRtRDyY6sVGPEauJWY=");
-       aVar.a("*.api.vipps.no", "sha256/O+qzlJSyoBSdYsSMceGYjjRqDxKVzUFjX0ymP+AC0f0=");
-       aVar.a("ece46ec4-6f9c-489b-8fe5-146a89e11635.tech-02.net", "sha256/Fig44L8aGm+MmceSD17e15lV7pWlsDvgViYUSaj/mqM=");
-       aVar.a("*.ece46ec4-6f9c-489b-8fe5-146a89e11635.tech-02.net", "sha256/Fig44L8aGm+MmceSD17e15lV7pWlsDvgViYUSaj/mqM=");
        return aVar.b();
    }

Next, the Android operating system provides an additional network security config. Add to application in base/AndroidManifest.xml:

<application ... android:networkSecurityConfig="@xml/network_security_config">

Then create a new file base/res/xml/network_security_config.xml with the contents:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <base-config cleartextTrafficPermitted="true">
        <trust-anchors>
            <certificates src="user" />
        </trust-anchors>
    </base-config>
</network-security-config>

Now recompile the modified APK:

apktool b base -o vipps-modified.apk

Now create a debug signing certificate for signing the APKs with:

echo y | keytool -genkey -v -keystore debug.keystore -storepass android -alias androiddebugkey -keypass android -keyalg RSA -keysize 2048 -validity 10000 -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US"

Re-sign all APKs using the same debug keystore just created:

echo android | apksigner sign --ks debug.keystore --out vipps-signed.apk vipps-modified.apk
echo android | apksigner sign --ks debug.keystore --out split_config.arm64_v8a-signed.apk split_config.arm64_v8a.apk
echo android | apksigner sign --ks debug.keystore --out split_config.xxhdpi-signed.apk split_config.xxhdpi.apk

Install all the new APKs to the Android phone

adb install-multiple vipps-signed.apk split_config.arm64_v8a-signed.apk split_config.xxhdpi-signed.apk

Run Charles proxy with SSL proxying and add the following domains to includes:

api.vipps.no
login.vipps.io
*.bankidnorge.no
*.bankidapis.no
*.bankid.no

From Charles, export the generated root certificate and download it to your Android phone and trust it for all apps/browser.

On the Android phone, launch

Start the app and start sniffing SSL traffic!

Next steps / observations​

All Vipps related requests from startup, OTP, BankID auth and setting PIN as well as logging in:

https://api.vipps.no/app/security/v1/register
https://api.vipps.no/vipps-1.8/u-security/v1/generateotp/
https://api.vipps.no/vipps-1.8/u-security/v1/validateotp/
https://api.vipps.no/app/security/v1/token
https://api.vipps.no/bankid-auth/v1/bankid/url?login_hint=BID
https://login.vipps.io/vinx?login_hint=BID&requestId=...&session=...&target=https%3A%2F%2Fvipps.no%2F
https://login.vipps.io/bid/oidc/callback?state=vinx%3A...&session_state=...&code=...
https://login.vipps.io/vinx/callback?state=vinx%3A...&session_state=...&code=...
https://oidc.bankidapis.no/auth/realms/prod/precheck/auth?client_id=Vipps-BankID-Prod&login_hint=BID&nonce=...&redirect_uri=https%3A%2F%2Flogin.vipps.io%2Fbid%2Foidc%2Fcallback&response_type=code&scope=openid+profile+nnin_altsub&state=vinx%3A...&ui_locales=en
https://api.vipps.no/app/security/v1/token
https://api.vipps.no/app/security/v1/passphrase/srp/pin
https://api.vipps.no/app/security/v1/login/srp/init
https://api.vipps.no/app/security/v1/login/srp/pin/verify
https://api.vipps.no/vipps-1.8/u-security/v1/vinxlogin
https://api.vipps.no/vipps-1.8/a-profile/v1/details
https://api.vipps.no/vipps-1.8/customer/fetchblockedusers
https://api.vipps.no/vipps-1.8/merchantTransaction/v1/dueList
https://api.vipps.no/vipps-1.8/utility/v1/configParams
https://api.vipps.no/vipps-1.8/oneclick/v1/pendingRequests
https://api.vipps.no/vipps-1.8/invoice/v2/invoices_v3
https://api.vipps.no/vipps-1.8/a-profile/v1/details
https://api.vipps.no/vipps-1.8/payment/api/v1/agreement?includeCharges=true&status=PENDING
https://api.vipps.no/vipps-1.8/a-profile/v1/details
https://api.vipps.no/vipps-1.8/a-profile/v1/consents/consentcard
https://api.vipps.no/vipps-1.8/vippslogin/v1/vippslogintoken

• I'm stuck at the salting/hashing algorith of the PIN when creating/authenticating with a PIN. Seems like the app uses the Secure Remote Password protocol (SRP)
• Seems like it uses JSON Web Key for the initial /app/security/v1/register deviceKeys call.
• SRP hashes and salt seems to be encoded using (base64url)[https://github.com/joaquimserafim/base64-url]

Other reverse engineering tips​

• Dump resources (strings/translations): aapt dump resources base.apk | less

References​

• https://developer.android.com/training/articles/security-config
• https://medium.com/@SwiftSafe/bypassing-and-disabling-ssl-pinning-on-android-to-perform-man-in-the-middle-attack-1ef18f5a453a
• https://medium.com/@hojat.sajadinia/bypass-okhttp-certificatepinner-on-android-9a45ad80a58b

There is a simple command line for quickly assembling a video from a set of clips or images, or you can use it from Javascript!

This GIF/youtube was created with this command: "editly commonFeatures.json5"

See more examples here

Stack trace looks like this? 😱

TypeError h is not a function. (In 'h()', 'h' is undefined) 
    main.jsbundle:954:5353 
    main.jsbundle:112:423 p
    main.jsbundle:112:1740 
    main.jsbundle:112:423 p
    main.jsbundle:112:898 n
    main.jsbundle:112:1273 
    main.jsbundle:50:205 c
    main.jsbundle:50:1623 b
    main.jsbundle:50:488 _
    [native code] value
    [native code] value

...perhaps from production from a minified web JS bundle or a React Native error report in a tool like Bugsnag, Sentry or Crashlytics

No source map yet uploaded to bugsnag? 😰

stacktracify takes a source map and a stack trace from your clipboard (or from a file) and outputs a readable stacktrace with proper line numbers for each line**

Example output:

TypeError h is not a function. (In 'h()', 'h' is undefined) 
    at getAuthToken (logic/api.js:67:20)
    at authRequest (logic/api.js:127:8)
    at data (logic/SaveQueue.js:30:20)
    at op (logic/SaveQueue.js:43:29)
    at __callImmediates (node_modules/react-native/Libraries/BatchedBridge/MessageQueue.js:143:11)

How to do this? 😰​

Copy the minified stack trace to clipboard, then run:

npm i -g stacktracify

react-native bundle --platform ios --entry-file index.js --dev false --bundle-output ios-release.bundle --sourcemap-output ios-release.bundle.map

stacktracify ios-release.bundle.map

Now sit back and relax, analyze the stack trace 😅 and fix the bug 😎💯

Read more: https://github.com/mifi/stacktracify