WebOS Internals review of MyTether

rwhitby · 02/09/2010, 04:50 AM

In the interest of maintaining good homebrew application installation, non-interference, and security standards, I recently paid $14.95 to gain access to the commercial version of MyTether for the purpose of doing a review of it's installation practices, interference with other unrelated webOS functions, and overall security, and giving feedback on those aspects to the author with the hope that any discrepancies can be corrected before the next public release.

Please note that this is a review of the installation, non-interference, and security of MyTether only. I intentionally make no comment about any other aspects of the application itself or the way that it is distributed or sold, or it's relationship with cellular carriers, and would prefer that this thread is not used to discuss the various viewpoints held about those other aspects of MyTether. There are plenty of other threads where you can voice your opinion on those matters.

In my opinion, the importance of making sure that every homebrew application is using best practices for correct installation and safe removal, non-interference with unrelated webOS functionality, and general security, outweighs any other considerations about the functionality or distribution of the particular application itself. "First, do no harm".

As you may know, previous versions of MyTether up to and including 2.0.x installed a service directly using the Palm ipkg database in /usr/lib/ipkg (the same database that Palm uses to manage the built-in webOS operating system files during the initial installation and subsequent OTA updates).

This is not in line with best practices for homebrew installations, and is generally considered to be a contributing factor to the recurring OTA update syndrome.

I can report that Aonic has accepted my suggestions regarding the installation techniques and in version 2.1.0 of MyTether has changed his installation method to use the ipkg database in /media/cryptofs/apps/usr/lib/ipkg (the same ipkg database used by other homebrew installers), and to use standard post-install and pre-remove scripts to safely install and remove non-colliding filenames in the root partition.

This means that the underlying installation techniques used by MyTether are now done in the same manner as all the other services and plugins from various homebrew authors including WebOS Internals, Canuck Software, Vertigo Studios, TheBitGuru.com and others, according to best practices developed by WebOS Internals for homebrew packaging standards.

Aonic has also accepted my suggestions regarding the upstart script and java service filename, which also brings MyTether in line with the best practices for naming, starting and stopping services. This should remove the possibility of "service respawn storms" which are considered to be a contributing factor to device freezes in certain circumstances.

Previous versions of MyTether also interfered with unrelated webOS functions, such as the camera and SDL games.

I can now report that the version 2.1.0 of MyTether that I reviewed no longer interferes with other unrelated webOS functions. The camera and SDL games operate correctly when MyTether wifi operations are enabled.

I have also done an initial visual scan of the security of the MyTether service from the point of view of whether a rogue webOS application could use the service to gain root privileges on the device (this is a common mistake made by service authors trying to bridge the gap between webOS and the underlying Linux operating system).

On this matter, I was not 100% comfortable that the service is calling shell scripts without explicitly sanitising the input given to the service, but the author proved to me that trivial attacks on the service were not successful in the manner that I had suspected. More investigation is needed by some of our security experts in WebOS Internals before I will be 100% comfortable, but it's certainly not trivially vulnerable.

So, in summary, again with regard specifically to the installation, non-interference, and security aspects of MyTether, it seems that version 2.1.0 has now reached the point where it should safely install and uninstall in accordance with homebrew best practices, not interfere with other unrelated webOS functions, and not trivially compromise the security of the device.

Again, I intentionally make no comment about any other aspects of the application itself or the way that it is distributed or sold, or it's relationship with cellular carriers, and would prefer that this thread is not used to discuss the various viewpoints held about those other aspects of MyTether.

-- Rod

davidra · 02/09/2010, 05:01 AM

This is greatly appreciated. Last week I pretty much gave up on My Tether, uninstalled it and installed MHS with Jason's patch. It's nice to know I have an option if that doesn't quite work as I would like. However, one question: in the past, OTA OS updates have broken My Tether every time. Can you comment on the likelihood that the same will happen with the next one, in comparison to the MHS/freetetherd/patch approach? And secondly, although I do not have the new My Tether installed, would there be complications if both apps are installed at the same time?

rwhitby · 02/09/2010, 05:09 AM

Quote:

Originally Posted by davidra

This is greatly appreciated. Last week I pretty much gave up on My Tether, uninstalled it and installed MHS with Jason's patch. It's nice to know I have an option if that doesn't quite work as I would like. However, one question: in the past, OTA OS updates have broken My Tether every time. Can you comment on the likelihood that the same will happen with the next one, in comparison to the MHS/freetetherd/patch approach? And secondly, although I do not have the new My Tether installed, would there be complications if both apps are installed at the same time?

What I can say is that irrespective of whether an OTA update affects the functionality of MyTether or not, it will now be able to be safely uninstalled due to it now using homebrew installation best practices.

I would not recommend using two different tethering solutions at the same time. They are likely to conflict.

-- Rod

Bazirker · 02/09/2010, 05:28 AM

Excellent write-up. I'm pleased to hear that mytether sounds like it has come a long way. Are there any efforts from the internals group on making their own tethering solution? Even with these improvements, I'd prefer to use more open software given the depth of the functionality of this code.

mdmogren · 02/09/2010, 05:39 AM

I'm glad somebody cares about this enough to do the vetting for us.

PiroAR · 02/09/2010, 06:49 AM

Thank you very much for the time you put into this. I had given up on the app as well. Now I see hope!

dianehelen · 02/09/2010, 07:05 AM

Thank you Rod, your review is thoughtful, balanced and once again represents the intelligence we have come to rely on you to provide, with maturity and professionalisme.

May I just say, once again, I for one am so glad you are a part of this community.

supercluver · 02/09/2010, 07:29 AM

Rod, thank you for this review. I had been using MyTether (I had donated, and it had worked quite well) when it first came out, but when it got to the point that it broke the camera and caused other problems, I had given up on it. Its good to know that I can go back to it should I ever have the need, especially since I have already "paid" for it, and not worry about things getting screwed up.

Honestly I don't know what the Palm community would do without webOS internals guys and especially Rod. I think the next time any user of any other smartphone asks what does the Pre have that my xyz doesn't, we all need to simply respond "Rod Whitby".

palmdoc2005 · 02/09/2010, 07:37 AM

Thank you for your efforts Rod. Much appreciated.

sudoer · 02/09/2010, 08:01 AM

Rod, thanks for taking the initiative to work with Raja and to set him on a more cooperative course with the remaining WebOS community.

Dieter Bohn · 02/09/2010, 08:32 AM

Rod, just putting in my explicit thanks because sometimes that 'thanks' button isn't enough.

Spader · 02/09/2010, 08:51 AM

Very nice to know... if (probably when) MHS is rendered inoperable by Sprint/Palm, it's good to know there is a stable alternative available.

Also very nice to see the different "branches" of the homebrew community setting aside differences to come together and ensure the products available are safe for all.

aonic · 02/09/2010, 09:41 AM

Rod, thank you again for helping me catch up to the latest best practices and testing my changes to the installation process. In the fast moving world of WebOS it can be difficult to stay updated on all the latest developments and findings.

As the name WebOS Internals might suggest, Rod not only did surface checks of the My Tether installation and code-base, but he also went deep into the internals to find any issues or conflicts with the recommended best practices.

And as a note to everyone else, I'll be continuing to mature My Tether, and do my best to keep it working as promised with new WebOS updates and any attempts to stop non-subscription tethering functionality. I've also started taking My Tether development and support more seriously by incorporating my own development practices and keeping better documentation of bugs, fixes, UI, and code revisions.

bakerja · 02/09/2010, 09:57 AM

Can you feel the love!!!

QuietStorm21A · 02/09/2010, 10:19 AM

This is why i love my pre & this community. Great work to Rod, Webos-Internals, & Aonic. Thank you.

cujoe · 02/09/2010, 10:26 AM

i can feel the love as well :P Thx Rob... i now feel super comfortable with installing the latest Beta of my Tether. I too gave up when it started breaking the camera. Having to install a patch to use wifi made me very uncomfortable, so your assurance means alot. Also wow, had no idea the donation price went up to 14.95. I wonder why he didn't ask for 15 bucks... like .. why would you want all that change .. haha. Thx again.

Maturin · 02/09/2010, 10:34 AM

Thanks Rod and aonic for working together on this. You guys put the good of the community ahead of your personal projects.

Jason Robitaille · 02/09/2010, 12:43 PM

Lol, if only you had accepted my multiple offers to help, rather than publicly ridiculing the idea, we might have had a proper installing MyTether months ago, lol.

In all seriousness, I am extremely glad MyTether is shaping up. It's obvious v2.1.0 is a large milestone from previous versions. And I must say it's a version I'm excited about and will probably buy one I get a Pre on a carrier.

Best of luck to Aonic and MyTether for the future.

cdjh · 02/09/2010, 01:22 PM

Rod,

can I just say, you are awesome. I've read many of your posts around this forum and I think you are one of the most professional and trustworthy people I've come across in an environment like this. The community is lucky to have you. Thanks for this and all you do for us. If you ever find yourself around wisconsin, your first beer is on me!

sorry for going off topic, but lets hear it for this guy, huh

edbbates11 · 02/09/2010, 01:54 PM

Thanks!

02/09/2010, 04:50 AM	#1 (permalink)
rwhitby Developer Join Date: Apr 2003 Location: Adelaide, Australia - follow @webosinternals on Twitter visit www.webos-internals.org and www.facebook.com/webosinternals Posts: 10,220 Likes Received: 546 Thanks: 90 Thanked 8,534 Times in 2,806 Posts	WebOS Internals review of MyTether In the interest of maintaining good homebrew application installation, non-interference, and security standards, I recently paid $14.95 to gain access to the commercial version of MyTether for the purpose of doing a review of it's installation practices, interference with other unrelated webOS functions, and overall security, and giving feedback on those aspects to the author with the hope that any discrepancies can be corrected before the next public release. Please note that this is a review of the installation, non-interference, and security of MyTether only. I intentionally make no comment about any other aspects of the application itself or the way that it is distributed or sold, or it's relationship with cellular carriers, and would prefer that this thread is not used to discuss the various viewpoints held about those other aspects of MyTether. There are plenty of other threads where you can voice your opinion on those matters. In my opinion, the importance of making sure that every homebrew application is using best practices for correct installation and safe removal, non-interference with unrelated webOS functionality, and general security, outweighs any other considerations about the functionality or distribution of the particular application itself. "First, do no harm". As you may know, previous versions of MyTether up to and including 2.0.x installed a service directly using the Palm ipkg database in /usr/lib/ipkg (the same database that Palm uses to manage the built-in webOS operating system files during the initial installation and subsequent OTA updates). This is not in line with best practices for homebrew installations, and is generally considered to be a contributing factor to the recurring OTA update syndrome. I can report that Aonic has accepted my suggestions regarding the installation techniques and in version 2.1.0 of MyTether has changed his installation method to use the ipkg database in /media/cryptofs/apps/usr/lib/ipkg (the same ipkg database used by other homebrew installers), and to use standard post-install and pre-remove scripts to safely install and remove non-colliding filenames in the root partition. This means that the underlying installation techniques used by MyTether are now done in the same manner as all the other services and plugins from various homebrew authors including WebOS Internals, Canuck Software, Vertigo Studios, TheBitGuru.com and others, according to best practices developed by WebOS Internals for homebrew packaging standards. Aonic has also accepted my suggestions regarding the upstart script and java service filename, which also brings MyTether in line with the best practices for naming, starting and stopping services. This should remove the possibility of "service respawn storms" which are considered to be a contributing factor to device freezes in certain circumstances. Previous versions of MyTether also interfered with unrelated webOS functions, such as the camera and SDL games. I can now report that the version 2.1.0 of MyTether that I reviewed no longer interferes with other unrelated webOS functions. The camera and SDL games operate correctly when MyTether wifi operations are enabled. I have also done an initial visual scan of the security of the MyTether service from the point of view of whether a rogue webOS application could use the service to gain root privileges on the device (this is a common mistake made by service authors trying to bridge the gap between webOS and the underlying Linux operating system). On this matter, I was not 100% comfortable that the service is calling shell scripts without explicitly sanitising the input given to the service, but the author proved to me that trivial attacks on the service were not successful in the manner that I had suspected. More investigation is needed by some of our security experts in WebOS Internals before I will be 100% comfortable, but it's certainly not trivially vulnerable. So, in summary, again with regard specifically to the installation, non-interference, and security aspects of MyTether, it seems that version 2.1.0 has now reached the point where it should safely install and uninstall in accordance with homebrew best practices, not interfere with other unrelated webOS functions, and not trivially compromise the security of the device. Again, I intentionally make no comment about any other aspects of the application itself or the way that it is distributed or sold, or it's relationship with cellular carriers, and would prefer that this thread is not used to discuss the various viewpoints held about those other aspects of MyTether. -- Rod __________________ WebOS Internals and Preware Founder and Developer You may wish to donate by Paypal to donations @ webos-internals.org if you find our work useful. All donations go back into development. www.webos-internals.org twitter.com/webosinternals facebook.com/webosinternals
	Liked by Thanked by acaplinger, adambomb13, andidendel, AndrewRich, aonic, Audemars02, azkevman, Bazirker, bdubdrum, BillP3393, Blkthght06, bpdamas, BruceBradford, Butters3605, cajunlibra, cantstopengland, cashen, cdawg62184, cecemf, chi23us, cluefree, crholt, crocostimpy, cujoe, dagold, davez57, dianehelen, Dieter Bohn, DNic, dougster123, Dr.Grace, draven76, dreznicek, dsuycott, edhkim, Eguy, fgcchevy, Finally Pre, flare576, fredewins, Gaurav, gpfountz, havatampa, housetube, jaltman, jamiehs, jhoff80, Jonolee, JoshMend, lalorulz, lcaro, Loonytunes, macgyver1267, Maturin, maxima2k53, mdmogren, mflauer, Misaki Ki, mjburgos, mnbgibbs, mrloserpunk, MrMicroChip, NCZman, Nesta, omgitsjordan, peppergg, Phenoum, prediot, prefab, punzada, QuietStorm21A, Radvette, Raphy, richbarr, rimbaud5, rmdupont, rogerkang, roneyii, russellraff, ryleyinstl, sbanuelos, scheumanrj, sethron, Shadowcat, Shadowhawk, skidmark, slydog43, snorth87, Spader, spudland, spyderfry, STBXXL, sudoer, supercluver, superdog87, Technologic 2, teej51685, the.teejster, theguilfoyle, tjreisdorf, tjy724, tomscot2, UncleFester98, Vij, windzilla, xanthinealkaloid, xorg, Zyphlin

02/09/2010, 05:01 AM	#2 (permalink)
davidra Member Join Date: Dec 2006 Posts: 1,020 Likes Received: 12 Thanks: 814 Thanked 353 Times in 273 Posts	This is greatly appreciated. Last week I pretty much gave up on My Tether, uninstalled it and installed MHS with Jason's patch. It's nice to know I have an option if that doesn't quite work as I would like. However, one question: in the past, OTA OS updates have broken My Tether every time. Can you comment on the likelihood that the same will happen with the next one, in comparison to the MHS/freetetherd/patch approach? And secondly, although I do not have the new My Tether installed, would there be complications if both apps are installed at the same time?
	Liked by Thanked By: teej51685

02/09/2010, 05:28 AM	#4 (permalink)
Bazirker Member Join Date: Sep 2009 Posts: 144 Likes Received: 3 Thanks: 98 Thanked 14 Times in 10 Posts	Excellent write-up. I'm pleased to hear that mytether sounds like it has come a long way. Are there any efforts from the internals group on making their own tethering solution? Even with these improvements, I'd prefer to use more open software given the depth of the functionality of this code.
	Liked by Thanked By: grndslm

02/09/2010, 05:39 AM	#5 (permalink)
mdmogren Member Join Date: Jun 2009 Posts: 519 Likes Received: 0 Thanks: 52 Thanked 65 Times in 43 Posts	I'm glad somebody cares about this enough to do the vetting for us.
	Liked by

02/09/2010, 06:49 AM	#6 (permalink)
PiroAR Member Join Date: Aug 2009 Posts: 9 Likes Received: 0 Thanks: 0 Thanked 1 Time in 1 Post	Thank you very much for the time you put into this. I had given up on the app as well. Now I see hope!
	Liked by

02/09/2010, 07:05 AM	#7 (permalink)
dianehelen Member Join Date: Jul 2009 Location: Orlando, FL by way of Brooklyn NY Posts: 1,145 Likes Received: 4 Thanks: 186 Thanked 308 Times in 211 Posts	Thank you Rod, your review is thoughtful, balanced and once again represents the intelligence we have come to rely on you to provide, with maturity and professionalisme. May I just say, once again, I for one am so glad you are a part of this community.
	Liked by

02/09/2010, 07:29 AM	#8 (permalink)
supercluver Member Join Date: Jun 2009 Location: Sugar Land, TX Posts: 309 Likes Received: 0 Thanks: 90 Thanked 85 Times in 56 Posts	Rod, thank you for this review. I had been using MyTether (I had donated, and it had worked quite well) when it first came out, but when it got to the point that it broke the camera and caused other problems, I had given up on it. Its good to know that I can go back to it should I ever have the need, especially since I have already "paid" for it, and not worry about things getting screwed up. Honestly I don't know what the Palm community would do without webOS internals guys and especially Rod. I think the next time any user of any other smartphone asks what does the Pre have that my xyz doesn't, we all need to simply respond "Rod Whitby".
	Liked by Thanked By: grndslm

02/09/2010, 07:37 AM	#9 (permalink)
palmdoc2005 Member Join Date: Sep 2005 Location: http://palmdoc.net Posts: 1,813 Likes Received: 20 Thanks: 295 Thanked 230 Times in 138 Posts	Thank you for your efforts Rod. Much appreciated.
	Liked by

02/09/2010, 08:01 AM	#10 (permalink)
sudoer Member Join Date: Nov 2002 Location: Boston, MA, USA (but in America's Dairyland for an extended visit) Posts: 1,727 Likes Received: 0 Thanks: 1,508 Thanked 369 Times in 302 Posts	Rod, thanks for taking the initiative to work with Raja and to set him on a more cooperative course with the remaining WebOS community. __________________ I'm both super! ... and a doer!
	Liked by

02/09/2010, 08:32 AM	#11 (permalink)
Dieter Bohn Editor Emeritus Join Date: Feb 2001 Location: Sunnyvale, CA Posts: 4,872 Likes Received: 6 Thanks: 290 Thanked 1,362 Times in 360 Posts	Rod, just putting in my explicit thanks because sometimes that 'thanks' button isn't enough. __________________ This is my next... website
	Liked by

02/09/2010, 08:51 AM	#12 (permalink)
Spader Member Join Date: Oct 2009 Location: Arizona, US Posts: 1,449 Likes Received: 1 Thanks: 144 Thanked 362 Times in 241 Posts	Very nice to know... if (probably when) MHS is rendered inoperable by Sprint/Palm, it's good to know there is a stable alternative available. Also very nice to see the different "branches" of the homebrew community setting aside differences to come together and ensure the products available are safe for all. __________________ Follow me on teh Twitterz
	Liked by

02/09/2010, 09:41 AM	#13 (permalink)
aonic Member Join Date: Jun 2009 Posts: 308 Likes Received: 0 Thanks: 18 Thanked 657 Times in 59 Posts	Rod, thank you again for helping me catch up to the latest best practices and testing my changes to the installation process. In the fast moving world of WebOS it can be difficult to stay updated on all the latest developments and findings. As the name WebOS Internals might suggest, Rod not only did surface checks of the My Tether installation and code-base, but he also went deep into the internals to find any issues or conflicts with the recommended best practices. And as a note to everyone else, I'll be continuing to mature My Tether, and do my best to keep it working as promised with new WebOS updates and any attempts to stop non-subscription tethering functionality. I've also started taking My Tether development and support more seriously by incorporating my own development practices and keeping better documentation of bugs, fixes, UI, and code revisions. __________________ My Tether - version 2.1.0 now live. No patching, no ad-hoc, more features!
	Liked by Thanked by AndrewRich, bakerja, BruceBradford, cdawg62184, craftsman, dsuycott, fgcchevy, Finally Pre, flare576, Gaurav, HebrewHammer, jaltman, Maturin, NCZman, qst4, QuarlesLT, QuietStorm21A, sethron, spudland, supercluver, superdog87, volcom45

02/09/2010, 09:57 AM	#14 (permalink)
bakerja Member Join Date: Jul 2009 Posts: 148 Likes Received: 0 Thanks: 12 Thanked 7 Times in 5 Posts	Can you feel the love!!!
	Liked by

02/09/2010, 10:19 AM	#15 (permalink)
QuietStorm21A Member Join Date: Feb 2009 Location: Spring Valley, NY Posts: 232 Likes Received: 0 Thanks: 79 Thanked 22 Times in 21 Posts	This is why i love my pre & this community. Great work to Rod, Webos-Internals, & Aonic. Thank you. __________________
	Liked by

02/09/2010, 10:26 AM	#16 (permalink)
cujoe Member Join Date: Jun 2009 Posts: 83 Likes Received: 0 Thanks: 5 Thanked 18 Times in 8 Posts	i can feel the love as well :P Thx Rob... i now feel super comfortable with installing the latest Beta of my Tether. I too gave up when it started breaking the camera. Having to install a patch to use wifi made me very uncomfortable, so your assurance means alot. Also wow, had no idea the donation price went up to 14.95. I wonder why he didn't ask for 15 bucks... like .. why would you want all that change .. haha. Thx again.
	Liked by

02/09/2010, 10:34 AM	#17 (permalink)
Maturin Member Join Date: Jul 2009 Posts: 165 Likes Received: 2 Thanks: 37 Thanked 20 Times in 17 Posts	Thanks Rod and aonic for working together on this. You guys put the good of the community ahead of your personal projects.
	Liked by

02/09/2010, 12:43 PM	#18 (permalink)
Jason Robitaille Legend Join Date: May 2005 Location: Winnipeg, MB, Canada Posts: 3,883 Likes Received: 496 Thanks: 801 Thanked 12,955 Times in 1,495 Posts	Lol, if only you had accepted my multiple offers to help, rather than publicly ridiculing the idea, we might have had a proper installing MyTether months ago, lol. In all seriousness, I am extremely glad MyTether is shaping up. It's obvious v2.1.0 is a large milestone from previous versions. And I must say it's a version I'm excited about and will probably buy one I get a Pre on a carrier. Best of luck to Aonic and MyTether for the future. __________________ If you've liked my software, please consider to towards future development. Developer of many apps such as: WebOS Quick Install, WebOS Theme Builder, Ipk Packager, Unified Diff Creator, Internalz Pro, ComicShelf HD, LED Torch, over 70 patches and more. @JayCanuck @CanuckCoding Facebook
	Liked by Thanked By: hdking08

02/09/2010, 01:22 PM	#19 (permalink)
cdjh Member Join Date: Apr 2006 Posts: 184 Likes Received: 10 Thanks: 33 Thanked 29 Times in 16 Posts	Rod, can I just say, you are awesome. I've read many of your posts around this forum and I think you are one of the most professional and trustworthy people I've come across in an environment like this. The community is lucky to have you. Thanks for this and all you do for us. If you ever find yourself around wisconsin, your first beer is on me! sorry for going off topic, but lets hear it for this guy, huh
	Liked by

02/09/2010, 01:54 PM	#20 (permalink)
edbbates11 Member Join Date: Nov 2009 Posts: 238 Likes Received: 0 Thanks: 19 Thanked 13 Times in 11 Posts	Thanks!
	Liked by

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode