FELIX KRAUSEBLOGPRIVACYPROJECTSARCHIVEABOUTFASTLANE IS NOW PART OF FABRIC · FELIX KRAUSE Those requests (e.g. apple-touch-icon-precomposed.png) are being sent to get the app icon that are used when the user adds your website onto their home screen.All of this makes sense, however they are sent immediately when the user hits the share button, instead of later in the flow when the user actually chooses the Add to Home Screen option.. The proof of concept is available on GitHub at PROJECTS · FELIX KRAUSE fastlane.tools. 🚀 The easiest way to automate building and releasing your iOS and Android apps - this project consists of 25 subprojects. Open Source - 30,000 Stars - Founder. ABOUT FELIX KRAUSE · FELIX KRAUSE About Felix Krause. Felix Krause, creator of fastlane. Follow what I'm up to on Twitter and Instagram. I'm the founder of fastlane, an open source tool for iOS and Android developers focussed on making building and releasing apps easier. Just last year, fastlane has saved over 15,000,000 developer hours and is used by tens of thousands of IOS PRIVACY: STEAL.PASSWORD PRIVACY · FELIX KRAUSE trusting-sdks. Third-party SDKs can often easily be modified while you download them! Using a simple person-in-the-middle attack, anyone in the same network can insert malicious code into the SDK, and with that into your application, as a result running in your user’s pockets.A person-in-the-middle attack in this context works by interfering network traffic and insert malicious code into the IOS PRIVACY: TRACK WEBSITE ACTIVITIES, STEAL USER DATA It allows an app developer to use the built-in Safari with all its features, without making the user leave your application. It features all the Safari features, but from within your application. WHAT IS THE VALUE OF IOS CODE SIGNING? · FELIX KRAUSE Code signing is one of the most crucial security components of the iOS ecosystem: Code signing allows Apple to control what software can be installed on iOS devices. Code signing ensures your app doesn’t get modified by a third party on the way from your Mac to the end-users

iPhone.

CREATING PERFECT APP STORE SCREENSHOTS OF YOUR IOS APP Creating the Screenshots. Using snapshot you can take localized screenshots on all device types completely automatic. All you have to do is provide a JavaScript UI Automation file to tell snapshot how to navigate in your app and where to take the screenshots. MAC PRIVACY: SANDBOXED MAC APPS CAN RECORD YOUR SCREEN ATSEE MORE ON

KRAUSEFX.COM

IOS PRIVACY: WATCH.USER FELIX KRAUSEBLOGPRIVACYPROJECTSARCHIVEABOUTFASTLANE IS NOW PART OF FABRIC · FELIX KRAUSE Those requests (e.g. apple-touch-icon-precomposed.png) are being sent to get the app icon that are used when the user adds your website onto their home screen.All of this makes sense, however they are sent immediately when the user hits the share button, instead of later in the flow when the user actually chooses the Add to Home Screen option.. The proof of concept is available on GitHub at PROJECTS · FELIX KRAUSE fastlane.tools. 🚀 The easiest way to automate building and releasing your iOS and Android apps - this project consists of 25 subprojects. Open Source - 30,000 Stars - Founder. ABOUT FELIX KRAUSE · FELIX KRAUSE About Felix Krause. Felix Krause, creator of fastlane. Follow what I'm up to on Twitter and Instagram. I'm the founder of fastlane, an open source tool for iOS and Android developers focussed on making building and releasing apps easier. Just last year, fastlane has saved over 15,000,000 developer hours and is used by tens of thousands of IOS PRIVACY: STEAL.PASSWORD PRIVACY · FELIX KRAUSE trusting-sdks. Third-party SDKs can often easily be modified while you download them! Using a simple person-in-the-middle attack, anyone in the same network can insert malicious code into the SDK, and with that into your application, as a result running in your user’s pockets.A person-in-the-middle attack in this context works by interfering network traffic and insert malicious code into the IOS PRIVACY: TRACK WEBSITE ACTIVITIES, STEAL USER DATA It allows an app developer to use the built-in Safari with all its features, without making the user leave your application. It features all the Safari features, but from within your application. WHAT IS THE VALUE OF IOS CODE SIGNING? · FELIX KRAUSE Code signing is one of the most crucial security components of the iOS ecosystem: Code signing allows Apple to control what software can be installed on iOS devices. Code signing ensures your app doesn’t get modified by a third party on the way from your Mac to the end-users

iPhone.

CREATING PERFECT APP STORE SCREENSHOTS OF YOUR IOS APP Creating the Screenshots. Using snapshot you can take localized screenshots on all device types completely automatic. All you have to do is provide a JavaScript UI Automation file to tell snapshot how to navigate in your app and where to take the screenshots. MAC PRIVACY: SANDBOXED MAC APPS CAN RECORD YOUR SCREEN ATSEE MORE ON

KRAUSEFX.COM

IOS PRIVACY: WATCH.USER PROJECTS · FELIX KRAUSE fastlane.tools. 🚀 The easiest way to automate building and releasing your iOS and Android apps - this project consists of 25 subprojects. Open Source - 30,000 Stars - Founder. ABOUT FELIX KRAUSE · FELIX KRAUSE About Felix Krause. Felix Krause, creator of fastlane. Follow what I'm up to on Twitter and Instagram. I'm the founder of fastlane, an open source tool for iOS and Android developers focussed on making building and releasing apps easier. Just last year, fastlane has saved over 15,000,000 developer hours and is used by tens of thousands of ARCHIVE · FELIX KRAUSE 2015. December 10, 2015 - Introducing fastlane 'match': A new approach to code signing. October 21, 2015 - fastlane is now part of Fabric. August 11, 2015 - Thoughts on iOS build tools. July 28, 2015 - spaceship - now also supporting iTunes Connect. July 22, 2015 - FASTLANE IS JOINING GOOGLE · FELIX KRAUSE Launched the new docs.fastlane.tools page. Today it’s time for the next big step for fastlane: fastlane - along with the Fabric platform - is joining Google, working together with the Firebase team. The two teams are committed to building the best tools to help developers build better apps. fastlane will stay an open source project as part

of

GOING NOMAD · FELIX KRAUSE The idea. Ever since I first started reading @levelsio’s blog in 2014, about living out of just a backpack, and traveling across the world, while working on his own startups, I was fascinated by the idea.However I always assumed it doesn’t work if you have a JOINING GOOGLE · FELIX KRAUSE In 2010 we visited the Google campus on our family trip to California. Ever since then I knew I wanted to work here at one point in my life. Today, 7 years later, I had my first day at Google in Mountain View, joining via the acquisition of Fabric. IOS APPS SHOULD BE INSIDE A NETWORK SANDBOX · FELIX KRAUSE Apple should require every iOS app to define a list of web hosts that should be accessible, all other web requests will fail: - If an app gets compromised no data can leak. - It forces the use of SFSafariViewController. - Users should be able to see the host list.

— Felix Krause

INSTAPIPE.NET

Background. You want to share experiences as they are happening in your life. Instagram Stories is a great way to do so, thanks to cross-posting to Facebook, Messenger and Instagram itself, allowing most people to view your stories. INTRODUCING OVERKILL Runs silently in the background, and kills iTunes. Easily pause Overkill if you want to use iTunes. Support for both Dark and Light mode of the menu bar. Supports auto start. Supports any Mac app, e.g. add the Photos app to be killed also. No CPU usage, no polling, no analytics, just 300 lines of native Mac code. FASTLANE HAS SAVED OVER 1 MILLION DEVELOPER HOURS · FELIX During my internship at 6Wunderkinder,I was part of a team with three engineers, where we worked for a whole day on just uploading localized screenshots and metadata to iTunes Connect.Our goal was to release an update to our users, but we were blocked by this tedious and long process.. This marked the first time I experience the pain of the release process for mobile apps and started FELIX KRAUSEBLOGPRIVACYPROJECTSARCHIVEABOUTFASTLANE IS NOW PART OF FABRIC · FELIX KRAUSE Those requests (e.g. apple-touch-icon-precomposed.png) are being sent to get the app icon that are used when the user adds your website onto their home screen.All of this makes sense, however they are sent immediately when the user hits the share button, instead of later in the flow when the user actually chooses the Add to Home Screen option.. The proof of concept is available on GitHub at ABOUT FELIX KRAUSE · FELIX KRAUSE About Felix Krause. Felix Krause, creator of fastlane. Follow what I'm up to on Twitter and Instagram. I'm the founder of fastlane, an open source tool for iOS and Android developers focussed on making building and releasing apps easier. Just last year, fastlane has saved over 15,000,000 developer hours and is used by tens of thousands of PROJECTS · FELIX KRAUSE fastlane.tools. 🚀 The easiest way to automate building and releasing your iOS and Android apps - this project consists of 25 subprojects. Open Source - 30,000 Stars - Founder. IOS PRIVACY: STEAL.PASSWORD PRIVACY · FELIX KRAUSE trusting-sdks. Third-party SDKs can often easily be modified while you download them! Using a simple person-in-the-middle attack, anyone in the same network can insert malicious code into the SDK, and with that into your application, as a result running in your user’s pockets.A person-in-the-middle attack in this context works by interfering network traffic and insert malicious code into the RUN XCODE 7 UI TESTS FROM THE COMMAND LINE · FELIX KRAUSE First, you’ll have to create a new target for the UI Tests: Under the Test section, select the Cocoa Touch UI Testing Bundle: Now open the newly created Project_UI_Tests.swift file in your Project UI Tests folder. On the bottom you have an empty method called testExample. Focus the cursor there and click on the red record button on the

bottom.

IOS PRIVACY: TRACK WEBSITE ACTIVITIES, STEAL USER DATA It allows an app developer to use the built-in Safari with all its features, without making the user leave your application. It features all the Safari features, but from within your application. SCALING OPEN SOURCE COMMUNITIES · FELIX KRAUSE This is the story of some of the challenges I faced when scaling the project to where it is today: a OSS project stewarded by Twitter and now Google, with over 12k commits, 13k stars, 500+ contributors, and one of the top 25 most active open source projects on GitHub (spoiler

alert: I

WHAT IS THE VALUE OF IOS CODE SIGNING? · FELIX KRAUSE Code signing is one of the most crucial security components of the iOS ecosystem: Code signing allows Apple to control what software can be installed on iOS devices. Code signing ensures your app doesn’t get modified by a third party on the way from your Mac to the end-users

iPhone.

IOS PRIVACY: WATCH.USER FELIX KRAUSEBLOGPRIVACYPROJECTSARCHIVEABOUTFASTLANE IS NOW PART OF FABRIC · FELIX KRAUSE Those requests (e.g. apple-touch-icon-precomposed.png) are being sent to get the app icon that are used when the user adds your website onto their home screen.All of this makes sense, however they are sent immediately when the user hits the share button, instead of later in the flow when the user actually chooses the Add to Home Screen option.. The proof of concept is available on GitHub at ABOUT FELIX KRAUSE · FELIX KRAUSE About Felix Krause. Felix Krause, creator of fastlane. Follow what I'm up to on Twitter and Instagram. I'm the founder of fastlane, an open source tool for iOS and Android developers focussed on making building and releasing apps easier. Just last year, fastlane has saved over 15,000,000 developer hours and is used by tens of thousands of PROJECTS · FELIX KRAUSE fastlane.tools. 🚀 The easiest way to automate building and releasing your iOS and Android apps - this project consists of 25 subprojects. Open Source - 30,000 Stars - Founder. IOS PRIVACY: STEAL.PASSWORD PRIVACY · FELIX KRAUSE trusting-sdks. Third-party SDKs can often easily be modified while you download them! Using a simple person-in-the-middle attack, anyone in the same network can insert malicious code into the SDK, and with that into your application, as a result running in your user’s pockets.A person-in-the-middle attack in this context works by interfering network traffic and insert malicious code into the RUN XCODE 7 UI TESTS FROM THE COMMAND LINE · FELIX KRAUSE First, you’ll have to create a new target for the UI Tests: Under the Test section, select the Cocoa Touch UI Testing Bundle: Now open the newly created Project_UI_Tests.swift file in your Project UI Tests folder. On the bottom you have an empty method called testExample. Focus the cursor there and click on the red record button on the

bottom.

IOS PRIVACY: TRACK WEBSITE ACTIVITIES, STEAL USER DATA It allows an app developer to use the built-in Safari with all its features, without making the user leave your application. It features all the Safari features, but from within your application. SCALING OPEN SOURCE COMMUNITIES · FELIX KRAUSE This is the story of some of the challenges I faced when scaling the project to where it is today: a OSS project stewarded by Twitter and now Google, with over 12k commits, 13k stars, 500+ contributors, and one of the top 25 most active open source projects on GitHub (spoiler

alert: I

WHAT IS THE VALUE OF IOS CODE SIGNING? · FELIX KRAUSE Code signing is one of the most crucial security components of the iOS ecosystem: Code signing allows Apple to control what software can be installed on iOS devices. Code signing ensures your app doesn’t get modified by a third party on the way from your Mac to the end-users

iPhone.

IOS PRIVACY: WATCH.USER GOING NOMAD · FELIX KRAUSE The idea. Ever since I first started reading @levelsio’s blog in 2014, about living out of just a backpack, and traveling across the world, while working on his own startups, I was fascinated by the idea.However I always assumed it doesn’t work if you have a SCALING OPEN SOURCE COMMUNITIES · FELIX KRAUSE This is the story of some of the challenges I faced when scaling the project to where it is today: a OSS project stewarded by Twitter and now Google, with over 12k commits, 13k stars, 500+ contributors, and one of the top 25 most active open source projects on GitHub (spoiler

alert: I

FELIX KRAUSE

Background. With my recent publications, most importantly “Trusting SDKs” it became clear that hijacked or malicious iOS apps cause major security and privacy risks for users, and allow attackers to reach a high number of users through a single point of failure. Most of the times, the consequences of those attacks are about data: Usernames and passwords WRITING AUTOMATED TESTS FOR YOUR DOCUMENTATION · FELIX KRAUSE There are 2 points where you want to verify your docs are valid and up to date: When you push a new release of your software ( deploy script of your software) When you update your documentation ( CI test script of your docs) So whatever introduced a regression, the build will be failing and you can’t merge the change into master. IOS PRIVACY: DETECT WHEN AN IOS USER HITS THE SAFARI SHARE Those requests (e.g. apple-touch-icon-precomposed.png) are being sent to get the app icon that are used when the user adds your website onto their home screen.All of this makes sense, however they are sent immediately when the user hits the share button, instead of later in the flow when the user actually chooses the Add to Home Screen option.. The proof of concept is available on GitHub at ENDING MY FASTLANE CHAPTER · FELIX KRAUSE I’ve built and published iOS apps for over 8 years now. Back then the App Store review times were over 2 weeks, iTunes Connect would allow only uploads of a single screenshot at a time, there was no CocoaPods and code signing was pretty much the same as it is today.

INSTAPIPE.NET

Background. You want to share experiences as they are happening in your life. Instagram Stories is a great way to do so, thanks to cross-posting to Facebook, Messenger and Instagram itself, allowing most people to view your stories. MAC PRIVACY: SANDBOXED MAC APPS CAN RECORD YOUR SCREEN AT In my experiments, I piped the generated image over to a OCR library and was able to get all text that was rendered on the user’s machine.. Update 2019-06-04 Looks like Apple has fixed this issue with macOS Catalina. Similar projects I’ve worked on I published more posts on how to access the camera, the user’s location data, their Mac screen and their iCloud password, check out krausefx HOW I SILENTLY CHANGED MY PROFILE PICTURE EVERY OTHER YEAR How I silently changed my profile picture every other year. Ryan Hoover hasn’t changed his profile picture for about 10 years now. People recognize you by your avatar. Once changed, followers need to re-associate the new photo with your person. I very much agree: whenever someone changes their profile picture, it takes time to get

used to it

INTRODUCING OVERKILL Runs silently in the background, and kills iTunes. Easily pause Overkill if you want to use iTunes. Support for both Dark and Light mode of the menu bar. Supports auto start. Supports any Mac app, e.g. add the Photos app to be killed also. No CPU usage, no polling, no analytics, just 300 lines of native Mac code.

Felix Krause

Blog Privacy Projects Archive

About

FELIX KRAUSE

Founder of fastlane.tools

KrauseFx

instapipe.net

<

>

More about me

* KrauseFx

* KrauseFx

* KrauseFx

* KrauseFx

------------------------- ✈️ WhereIsFelix.today ------------------------- Want to be the first to hear about more privacy and mobile related

essays?

Subscribe

------------------------- INSTAPIPE.NET - DISTRIBUTE YOUR INSTAGRAM STORIES

May 22, 2019

BACKGROUND

You want to share experiences as they are happening in your life. Instagram Stories is a great way to do so, thanks to cross-posting to Facebook, Messenger and Instagram itself, allowing most people to view

your stories.

However just like Snapchat, the platforms try to lock you in, with the content YOU create. Many of my family members and close friends don’t use FB/IG daily, but still wanted to stay up to date on what

I’m up to.

Due to lack of an official API, and any kinds of integrations, the only way to access your stories is through the inofficial API the Instagram mobile- and web client use.

SOLUTION

A simple web service that automatically downloads and publishes your stories on various platforms. It’s open source and fully self hosted, check it out on GitHub

.

EMBED INTO WEBSITES

Showing what you’re up to on the websites you operate is an easy way to make your online presence more personal. * On whereisfelix.today * Integrated into krausefx.com (desktop only)

* Plain live demo

FEATURES

* Design similar to instagram.com web * Arrow keys to go back and forth between stories * Support for photos and videos * Support for desktop and mobile browsers * Dismiss stories using ESC key, and clicking the dimmed area * Pre-loading of the next story for instant rendering * Basic features like rendering of the progress bar, the relative time stamp, as well as linking to your profile * Zero dependencies, plain JavaScript, CSS and HTML in a single file

PROVIDE A JSON API

Of course it also provides you with a JSON API, that can be used to integrate your Instagram stories into any app or service. The API includes all relevant data, including the raw image, location and the exact resolution of the media assets. https://instapipe.herokuapp.com/stories.json?user_id=4409072 Make sure to manually copy & paste this in a new tab to avoid the cross-site scripting protection

TELEGRAM GROUP

Many of my friends don’t want to check Instagram every day, but still want to stay up to date with what I’m up to. Since they all use Telegram already, I set up a channel that automatically shows the

stories I post.

A Telegram group

containing all my latest stories. In particular nice to get an overview over all your most recent stories. Join it here

.

HOW IT WORKS

Instapipe is a simple server, that periodically fetches your most recent Instagram stories. As soon as a new story is available, it will * Download the highest resolution photo/video and store it on your personal Google Cloud Bucket * Store the associated metadata in a database you own, the data

includes

* 24 hours signed URL to the full-resolution photo/video of your Google Cloud Storage * The full path of the resource referencing your Google Cloud bucket * The user ID who published the asset * The height and width of the photo/video * The exact time stamp of publishing

* An is_video flag

* The location (if a location tag is attached) * Location Name (e.g. Das Gym) * lat and lng coordinates * Post the new story into a Telegram group (check it out here

)

-------------------------

OPEN INSTAPIPE.NET

Tags: open-source, instagram, telegram   |   Edit on GitHub WALKWITHFRIENDS.NET - STAY IN TOUCH WITH REMOTE FRIENDS

May 21, 2019

Staying in touch with close friends requires more effort when everybody lives somewhere else on the planet. Scheduling calls to catch up certainly works, but it requires time-commitment, and time zones make scheduling unnecessarily complicated. After living in NYC for a year, I ended up doing the following: If I walk somewhere for about 30 minutes, I’d text 2 friends or family members, asking if they’re available for a chat. Often one of them would end up calling me. This way, no prior planning was necessary, things felt more spontaneous and I was able to use my NYC walking time

to catch up.

THE PROBLEMS

* If I text a friend Hey X, are you free for a call?, chances are they’re at work, asleep, with friends or don’t look at their phone. They’d see my message 2 hours later and reply Yep, sure, calling you now. The problem here is that by that time I’m unavailable, as the message is from 2 hours ago. * If a friend doesn’t know about this setup, they’d think I want to discuss something specific or urgent, however those kinds of calls are just to catch up and stay in touch. * Often, either none of my friends were available, or multiple responded, so it was always a tricky balance on how many friends I’d text, with the risk of both of them replying Yep, I'm free now * If one friend is never available, you kind of “forget” to text them, as you already assume subconsciously that they won’t be

available

THE SOLUTION

A Telegram bot that manages the communication and revokes messages as soon as you’re unavailable again. 🔰 START USING THE BOT 🔰

WHY TELEGRAM?

* It works on every major platform, including iOS, Android and macOS * It supports revoking of messages and notifications, even from the

lock screen

* They have a solid bots API * Registration for new users is easy & fast MORE DETAILS ON WALKWITHFRIENDS.NET Tags: telegram   |   Edit on GitHub ENDING MY FASTLANE CHAPTER

Feb 13, 2019

I’ve built and published iOS apps for over 8 years now. Back then the App Store review times were over 2 weeks, iTunes Connect would allow only uploads of a single screenshot at a time, there was no CocoaPods… and code signing was pretty much the same as it is today. In 2014, I sat in my dorm room and started working on a tool to solve some of the challenges I faced as an iOS developer. It started out by just automating the upload of screenshots and binaries to iTunes Connect. After publishing the initial version in November 2014, the iOS community seemed excited about it. It slowly went from just _deliver_, to more tools like _snapshot_ to generate the screenshots and _pem_ to automate iOS push notifications. Fast-forward to today, I’m so humbled by what _fastlane_ has grown to be. It has changed the way large iOS teams work every day, how they release their app updates, and how code signing works. It even enabled founders to start new businesses using _fastlane_ as their core

foundation.

I’m so proud to see how the community has grown around it. When _fastlane_ initially launched, it supported only 10 integrations. Today there are over 570 different integrations, from code coverage reports, beta testing services to build version management. All of this wouldn’t have been possible without the all the 922 contributors of the _fastlane_ main code base

, all the

authors of the 355 third party plugins

, as well as

the fastlane core contributor team

.

It was great to see _fastlane_ evolving from a small side project, into a stable, self-sustainable open source project with a strong community of contributors around it. I have no doubts that _fastlane_ will continue growing stronger in the next years, with the support of Google, as well as other companies and individual contributors. 📯 AFTER 4.5 YEARS IT’S TIME FOR ME TO STEP AWAY FROM _FASTLANE_, AND WITH THAT LEAVE GOOGLE. As for what’s next, I don’t have any specific plans yet. I’ll be taking a vacation and then figuring out what problem I’m excited to

solve next :)

As always, you can stay in touch on Twitter

and Instagram

.

WHAT DOES IT MEAN FOR _FASTLANE_? Google will keep investing in _fastlane_. There will be no changes to _fastlane_ and its support system. To get help with _fastlane_, submit

an issue on GitHub

. At the same

time, we will continue accepting new fastlane core contributors

,

meaning you can get full push access to the _fastlane_ code base.

THANK YOU

I’d like to thank everyone from the Twitter Fabric, Firebase and Google Cloud teams for taking _fastlane_ where it is today. I’d like to specifically call out all the contributors and the iOS community for welcoming _fastlane_ and continuing to support it. In particular Hemal who believed in my vision and helped me grow personally and professionally. Tags: fastlane   |   Edit on GitHub HOW I SILENTLY CHANGED MY PROFILE PICTURE EVERY OTHER YEAR

Dec 30, 2018

Ryan Hoover hasn’t changed his profile picture for about 10 years now. He talks about it on his blog “Why I Never Change My Profile Pic”

:

> PEOPLE RECOGNIZE YOU BY YOUR AVATAR. Once changed, followers need to > re-associate the new photo with your person. I very much agree: whenever someone changes their profile picture, it takes time to get used to it, and start recognizing their avatar in

timelines again.

Back in 2014 I took a photo at the local photo studio Die Fotogräfin

:

2014

After a while, I didn’t like the fact that the profile picture isn’t updated at all, but also I wanted to follow Ryan’s advice.

The solution?

LET’S TAKE THE EXACT SAME PICTURE AGAIN, same t-shirt, same light, same background, and same pose:

2016

I silently changed the profile picture on Twitter and GitHub, and almost no one noticed, with just a few tweets

calling me out.

It even went that far, that Peter Steinberger covered my profile picture story in his conference talk about personal branding

.

Using this approach, you can keep the recognition value, while making sure your current profile picture reflects on how you currently look

like.

Following the “Continuous Delivery for your profile picture” approach, I took another one this year.

2018

Again, almost no one noticed, with only one tweet

mentioning

it.

So here are the last 6 years in profile pictures - I plan on continuing this strategy and take a new photo every second year: Tags: profile, picture, personal, brand   |   Edit on GitHub

Newer / Older

* KrauseFx

* KrauseFx

Want to be the first to hear about more privacy and mobile related

essays?

Subscribe