Logan Magee

Logan Magee

@lberrymage.dev

Christian and software developer focused on application and OS security. Creator of Accrescent.

111 followers96 following79 posts

I've really been enjoying @astro.build for static site generation. No JS by default but easy to add incrementally as desired, very customizable, doesn't break as often as Hugo, components, TypeScript/HTML-based templating is so much nicer than DSLs, easy optimized images, etc.

Logan Magee reposted

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

Logan Magee reposted

Replying to @accrescent.app

We know it's been a long time since our last progress update, so to keep you more in the loop, we're switching to more frequent, smaller posts from now on. We're getting ever closer to opening up app submissions to everyone. Thank you all for your support and patience!

Logan Magee reposted

Progress update! We've been hard at work tackling Accrescent's most pressing development needs, and now we want to share what we've been working on. We'll post blog posts in the next few weeks detailing our security, stability, and feature progress along with what's next!

Apparently getting Claude to write \u-escaped versions of Unicode code points in Kotlin string literals (as opposed to the literal Unicode characters) is very difficult. It'll keep retrying with literal code points, and when it doesn't do that, it'll use extra backslashes

I'm reworking how Accrescent handles Android app versions, and it turns out that there's no consistent global ordering across all Android versions because of how Android composes longVersionCode and accepts negative versions 🫠. I don't think we need versionCodeMajor.

Logan Magee reposted

Today is the official release day for Android 17. We've already fully ported GrapheneOS to Android 17 and are in the process of pushing the code to our public repositories. We're building a final official release based on Android 16 QPR2 today and we'll do an initial Android 17 release tomorrow.

Logan Magee reposted

Replying to @grapheneos.org

GrapheneOS is the only Android-based OS providing the full security preview patches. Samsung ships a small subset of their flagship devices. Pixel stock OS gets a portion of it early but we aren't sure exactly how much since they don't follow their guidelines for listing patches.

Logan Magee reposted

Logan Magee reposted

Logan Magee reposted

Logan Magee reposted

Accrescent 0.27.0 is here! This is the most significant release we've made to date: - New, stable app store API - Complete installer rewrite, resolving all known bugs - Tons of new features - More snappy, correct, & informative UI Check it out! 👇 github.com/accrescent/a...

github.comRelease 0.27.0 · accrescent/accrescentHappy release day! This release is the most significant Accrescent release to date, marking our migration to a new, stable app store API; completely rewriting our core logic to resolve all known in...

For those curious, I actually came across this because Accrescent was using APK URLs as its APK names to uniquely identify them. Those URLs obviously aren't valid file names, so an exception is thrown (for no clear reason). I "fixed" it locally by hex-encoding the URLs since...

...I suspected it had to do with URLs not being valid paths. That worked locally, but failed in our testing environment which has longer APK URLs. The final fix was to hash the APK URL to ensure the APK name is a constant length and thus always a valid file name.

Logan Magee reposted

Development on our roadmap is progressing smoothly. Our next app and server releases are undergoing final testing before deployment. We hope to make an announcement soon about what Android's recently announced developer verification requirements mean for Accrescent. Stay tuned!

Logan Magee reposted

Since we published our blog post on the future of Accrescent, donations have increased dramatically. According to the rates in that post, we should now be able to fund full-time development through at least May 2026! Thank you to our community for your monumental support!

Logan Magee reposted

Logan Magee reposted

Keep an eye out for tomorrow's blog post! We'll be posting a development progress update for the past months and a roadmap for the next few.

This has been a long time in the making (including the follow-up to be posted next week). I'd appreciate you giving it a read.

Accrescent@accrescent.app

Accrescent depends completely on donations to run. Today we share a significant update in our new blog post on the future of Accrescent: blog.accrescent.app/posts/the-fu...

Logan Magee reposted

I'm part of the team that discovered the #TapTrap vulnerability. We confirmed that @grapheneos.org has properly fixed it, as detailed on our site taptrap.click Despite a small factual error, it's good to see #GrapheneOS getting some media attention.

taptrap.clickTapTrap: Animation‑Driven Tapjacking on Android
GrapheneOS@grapheneos.org

foxnews.com/tech/new-and... > GrapheneOS, a security-focused operating system based on Android, confirmed that its current version is also affected. However, it plans to release a fix in its next update. No, we said that on July 7 and then shipped grapheneos.org/releases#202... fixing it.

I don't think a lot of people will miss Amazon's Appstore (myself included), but it's nonetheless unfortunate to see one of the very few Google Play alternatives disappearing. There aren't many others left.

Accrescent@accrescent.app

With the Amazon Appstore shutting down, it's becoming even more important to invest in sustainable alternative stores you can trust. See how you can invest in Accrescent's future! A little help goes a long way: accrescent.app/faq#contribu...

For something so commonly used to parse complex, untrusted data (decompression), I wish we would seriously consider as an industry creating memory-safe implementations and sandboxing this code

This post is unavailable.
View full thread

My opinion is that unless memory safe implementations and sandboxing become defaults directly in consumer libraries, the overall issue won't significantly improve. Developers shouldn't need to know that "if this ZIP library has a bug, a bad file could hack my machine." It's not intuitive.

I have seriously considered writing a memory-safe Zstandard decompressor because otherwise a single bad upstream zstd bug could spell RCE for tens of thousands of my app users. Decompression libraries are the most significant reason I sandboxed Ina for Accrescent. lberrymage.dev/posts/ina-pa...

lberrymage.devIna, Part 1: Smaller, faster, and safer software updates for AccrescentIntroduction Well! It’s been a long time since I’ve shared an Accrescent update here (most development discussion takes place in our Matrix rooms), but today I have a big one: we’ve made significant p...

For something so commonly used to parse complex, untrusted data (decompression), I wish we would seriously consider as an industry creating memory-safe implementations and sandboxing this code

This post is unavailable.

Unfortunately, there are often tradeoffs of lower portability (Rust), less straightforward APIs (sandboxing), and/or lower performance (managed languages). But some of us are willing to make those tradeoffs.

Logan Magee reposted

With the release of Parcelo 0.11.0, we've made some significant changes to our server infrastructure. App developers can now find the developer console at console.accrescent.app. If you encounter any issues, please let us know ASAP through our socials or contacts on our site.

Logan Magee reposted

Accrescent 0.25.0 is out with Android 15 app archiving support, Private Space support, and settings UI improvements! We also forgot to announce that since 0.24.0, Accrescent supports in-app predictive back! Check out the release notes below 👇 github.com/accrescent/a...

github.comRelease 0.25.0 · accrescent/accrescentThis release adds initial app archiving support on Android 15, makes Accrescent show up as an installer in Private Space, and improves the settings UI! We also forgot to mention that since 0.24.0, ...