Prompting for Bluetooth permission on Big Sur (11.0.1) - security

Upon upgrading to Big Sur (macOS 11.0.1), our app is now asking the user to grant permission to use Bluetooth. However, we are not running any bluetooth code to my knowledge. We do link to CoreBluetooth, but it's been like that for a long time, and this prompt has not appeared.
When running in Xcode 12.2 it does crash with this message:
2020-11-13 13:21:58.685610-0800 Fuze[31049:200367] [access] This app has crashed because it attempted to access privacy-sensitive data without a usage description. The app's Info.plist must contain an NSBluetoothAlwaysUsageDescription key with a string value explaining to the user how the app uses this data.
But to my knowledge, NSBluetoothAlwaysUsageDescription is only applicable for iOS devices.
I suspect this is something new with Big Sur, because the System Preferences UI for Security & Privacy -> Privacy, did not have a Bluetooth section in Catalina, and it does in Bug Sur. But the Apple documentation does not make mention of this key being applicable for macOS.
https://developer.apple.com/documentation/bundleresources/information_property_list/nsbluetoothalwaysusagedescription
So my questions are:
Is this key now applicable for macOS and we should have it, even though the documentation says it's only for other platforms, or is there a different key for bluetooth for macOS? I haven't found one.
Is there a way to control this prompting or not, because we aren't actually using the bluetooth code. We need the framework for a particular feature, but it's not applicable for many users, so it's confusing to ask permission for it right when the app launches.
Thank you!

I'm not confident about this, but I've been running into some Bluetooth on Big Sur strangeness today as well. In my case, I run a Bluetooth peripheral from the Terminal, and I was also recently prompted to provide the Terminal with Bluetooth permission (which I'd never seen before).
For testing purposes, you can try the "Privacy — Bluetooth Peripheral Usage Description" or "Privacy - Bluetooth Always Usage Description" - and see whether that resolves the crash (I assume it would). It's strange, as I didn't think either of these were required in the past - but it looks like Big Sur is definitely cracking down on permissions.
When you go to "Signing and Capabilities", if there is an option to enable "Hardware -> Bluetooth" in the "App Sandbox" - I would try that out too (you may also need to enable Location, but I can't recall). I'm curious if modifying that flag would change anything regarding permissions.
When you link to CoreBluetooth, are you using the API at all? Because the permission check should happen on the first API call. But, Bluetooth is weird, so it might kick in as soon as the app launches...
In thinking about it, I've actually never optionally used Bluetooth in an app - it's always initialized from app start, so I can't say when the permission check occurs.

Related

Web-Bluetooth error "GATT operation not authorized" occurs on Windows only

I have been working with web-bluetooth for the past several months on iOS and ChromeOS without any problems. But today, I tried to run some of my examples on Windows for the first time, and to my surprise, most of the things I had implemented didn't work with Windows. I am able to successfully connect to my peripheral, but whenever I try reading or writing anything to a custom service with a custom characteristic, I get the error "GATT operation not authorized". I have tried looking around but there is no information anywhere about this.
I am including below the simplest example I have which is just for turning the LEDs on / off on an nrf52832 board. There is only one custom service and one custom characteristic implemented, the value of which controls the states of the LEDs. This works without any problems on Chromebooks and Macs but does not work on Windows. Here is the link to this simple project including the embedded code and the web-app.
https://github.com/shtarbanov/WebBluetooth-Feather-nRF52832/tree/master/LED%20Control
I have made two implementations of the same thing, one based on promises and another based on async-await located in the folders "WebApp (Async)" and "WebApp (Promises)", respectively. Both of those implementations work fine on Mac and Cromebook, but not on Windows.
It is a known issue that secure characteristics are not accessible using Web Bluetooth on Windows. On other platforms the pairing occurs automatically, but not on Windows. There is an issue tracking this:
https://bugs.chromium.org/p/chromium/issues/detail?id=960258
Stuck with this also and as for workaround i can recommend for windows platform to pair device firstly using windows itself and than to pair it via browser(as a workaround). Not much but hope this helps, at list a little.
P.S. it should be paired via windows only once, so PC will remember device, and than you can pair via browser as long as PC remembers device.

Installing own App on Rooted WebOS LG TV

I am trying to install my own web App to a ROOTED LG TV, ignoring Developer mode status. I have successfully run it with Devmode = On, but it expires after 48 hours, and I have to do it over. I want to use the TV as a menu display. I can install my App, using "ApplicationInstallerUtility -c install -p /tmp/com.xxx.xxx_1.0.0_all.ipk -u 0 -l /media/cryptofs -d", but when I try to start it with Developer Mode = Off , using ssh and luna://com.webos.applicationManager/launch, I get an error code 302, and a text "errorText": "Failed to identify a proper DRM file".
What can I do to solve this issue? How can I sign my app, without going to LG content store? Thanks in advance.
Many DRM implementations will have a check for rooted devices and will not work if they detect the device is rooted - the logic is that a rooted device may not have the same protection for the media path and the keys.
If for your use case you don't actually need DRM, which could be the case if the streams you want to play are not encrypted, then it may be worth looking at your application and removing any DRM configuration or libraries it includes.
Update
The term DRM can be used generally to describe Digital Rights Management for anything, e.g. software, book, media etc, or to refer to the common DRM solutions used to protect media such as Widevine, PlayReady, FairPlay etc.
Unfortunately, the LG WebOS documentation seems to use the term for both which makes it hard to interpret the type of error you are seeing.
The manual for the error code you are seeing simply suggests the error message should be "Failed to check DRM.'
http://webostv.developer.lge.com/api/webos-service-api/application-manager/?wos_flag=launch#launch.
This might be a reference to a media DRM, but it also could be talking about the DRM used to sign and protect apps themselves.
LG have a WebOS security solutions guide also that explains their app signing security which you may be able to find on the web.
I suspect that the error message you are seeing is related to this use of the term 'DRM'.
Assuming that is the case, then unfortunatly, you are either going to have to remove this security framework in your device, which I suspect will not be trivial, or submit the app to the LG content store.

How to detect running on a real device?

I am working on a universal application, and I am trying to detect whether it runs on a desktop computer or on a real IoT device (Raspberry PI 2). Following the recommendation, I am trying to use API contract checks, however this returns true even on the desktop machine:
ApiInformation.IsApiContractPresent( "Windows.Devices.DevicesLowLevelContract", 1, 0 );
Obviously when I try to call GpioController.GetDefault(), it fails on the desktop, but strangely with a FileNotFoundException: "The specified module could not be found."
So what is the right way to detect a real device?
Thanks for your help,
György
Edit:
On some desktops GpioController.GetDefault() returns null, while on other machines it fails with FileNotFoundException.
Edit:
My goal is to ensure that I can safely call any GPIO or IoT Core specific APIs without using try-catch blocks everywhere to handle exceptions when running on a non-IoT device.
You can find the type of device your app is running on by
Windows.System.Profile.AnalyticsInfo.VersionInfo.DeviceFamily
Source:
https://msdn.microsoft.com/en-us/library/windows/apps/windows.system.profile.analyticsversioninfo.aspx
Microsoft does suggest to maximise your reach with universal apps by checking for capabilities instead of just checking the device family.
There's an article about all that here:
https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx
It depends on what aspect of a "real device" you want to check. Using API Contract information is not a good proxy, as you have found (although it should return null, not crash, on desktop -- that's a bug). Using AnalyticsInfo can be a reasonable proxy but you have to be careful about receiving new values over time, plus it actually identifies the OS type rather than the physical hardware. Enumerating hardware devices is the best way to detect hardware, but they can come and go dynamically as the user plugs and unplugs them.
What is it you are looking to do differently based on the answer?

restart via code on windows 10 uwp

We've created a Windows 10 application that runs on tablets in Windows 10 kiosk mode. It works just fine, however, the wifi connection gets lost sometimes since the locations are very remote. We tried fixing the issue from the networking side, but when the devices lose and regain internet access the application will still hang as if it doesn't have internet access displaying a blank page. Where these devices are used, they are bolted into the wall to prevent theft. Which means if we want to reboot its very time consuming as we have to unscrew the cases off the wall and then open the cases to gain access to the power button, and the only way to get the application to run successfully again is to do a reboot on the device.
It was suggested that we have a way to perform a reboot from the application, however, every code example I've tried doesn't work in Windows 10 UWP. Here is the most common one I've found:
System.Diagnostics.Process.Start("restart", "/r");
I have access to the namespace
System.Diagnostics
but the Process class does not exist. Anyone have suggestions on rebooting via code on Win 10 UWP? Or a better solution to our issue? Thanks in advance.
It's also worth mentioning I tried execute a Powershell command too and the dll I need to reference for the Powershell class is not compatible with UWP.
What you require is not possible with the APIs available to UWP apps. This was a security decision. An app distributed through the store shouldn't be able to do things like restart machines.
Based on your scenario though you shouldn't need to go through the store. This means that you could PInvoke native code to do whatever you want. This would still need to be initiated on the actual device.
Yes you can do that!
You should add IoT System Administration in App capability declarations:
<Capabilities><iot:Capability Name="systemManagement"/></Capabilities>
and also You need to have "Windows IoT Extension for UWP" added to your project
using this for Shutdown
Windows.System.ShutdownManager.BeginShutdown(Windows.System.ShutdownKind.Shutdown, TimeSpan.FromSeconds(1)); //Delay is not relevant to shutdown
or for Restart
Windows.System.ShutdownManager.BeginShutdown(Windows.System.ShutdownKind.Restart, TimeSpan.FromSeconds(1)); //Delay before restart after shutdown
You can get more information in this Link

Intermittent Issue with SCAN_Enable error on app load

I acquired a batch of WT0490 wearable pdas with detachable scan head, so converted an application originally made for Windows Mobile (which has been running perfectly for several years) to run on the WT4090s. The devices use these versions:
Windows CE 5.0
EMDK 2.6
ASP.net CF 2.0
Since rollout I've seen some very frustrating behaviour, which seems to start happening after the devices have been operating a few days. Users are reporting the following error:
Unexpected error in application
SCAN_Enable
There doesnt seem to be any noticeable pattern, several devices will be working perfectly for a few days then suddenly this error will show. THen a few days and a few reboots later they work again.
All devices were taken right back to stock settings then our cabs deployed to them. All identical models. We've tried altering memory allocation, swapping scanner headers etc but there is no pattern.
The error seems to occur on load of the first form after login, the login screen displays a list of users in a dropdown with a password box so that part of the app works ok, it seems to be when the scanner is initialised that this failure happens.
I had 40 devices, now 30+ have gone down with this same issue so my gut is telling me its a software issue but as yet ive not been able to find out why.
We've tried warm boots, cold boots, complete reprovisionings as well. We have a couple of dev units that don't show the problem although they are not in regular use so maybe we just haven't seen the problem 'yet'.
I hope someone out there has had this issue and knows how to fix it.
Thanks in advance.
WT4090 was built by Motorola Solution enterprise business, now part of Zebra Technologies. The WT4090 is currently in EOS (End Of Sales) but is still supported by Zebra if you've a maintenance contract.
You can check if you've the latest OS version and fixes installed on the device looking on Zebra Technologies support website.
For question on how to develop for Zebra Technologies devices you can take a look at Launchpad, Zebra's developer community website.
It's Worth noting that these devices have detachable barcode scanners - so if the scanner is not correctly attached, you get a SCAN_Enable error.
If you don't release the scanner, you can also see this error as a previous form could have the scanner blocked.
You may also find you have the ScanWedge app running - this will also block the scanner so you cannot get it enabled. The EMDK needs exclusive access to the scanner to enable it.

Resources