Do you have a reference for that? From all the documentation I've seen elsewhere, that's not true. There's no exclusion for waterproof devices, and everything has to be possible with tools a normal person can buy (you might need to go to a local hardware store, but no unique specialist expensive kit).

The full law is here: https://www.europarl.europa.eu/RegData/docs_autres_institutions/commission_europeenne/com/2020/0798/COM_COM(2020)0798_EN.pdf. It only mentions 'water' 3 times and none of them relate to waterproof phones (they're talking about batteries of waterbourne transport & environmental impact of water use) so I don't know where that's coming from.

It's totally possible to make waterproof phones with removable batteries - Samsung did it with the Galaxy S5 (IP67 - 1 meter under water for 30 minutes) way back in 2014 and there's lots of other examples. It's just not quite as cheap as glueing everything together.

Fully managed corporate devices can do this, there's a separate mechanism for that: https://developers.google.com/android/work/requirements/fully-managed-device

This only works when the corporation fully manages the device though - not for normal work profiles. It's only possible to enable that setup when the device OS is initially installed, and the resulting device is controlled 100% by an IT administrator. It's not something you can do for your own device, and even for small companies it's quite complicated and expensive.

Previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing Magisk or any tools at all, just by writing to disk. Right now, that's widely used and included in the setup guides for lots & lots of tools. All of that will start breaking for users when Android 14 arrives.

I totally agree it is possible to work around this restriction, but it's going to be significantly more complicated, and those changes will only be required because the OS used to let you read & write these files all by yourself, and now it doesn't.

I don't think Android should move further in a direction where it's impossible to directly control anything unless you install a 3rd party modification to the root daemon. That's not a good result. These are important settings and the OS itself should allow you to control them (behind reasonable safeguards & warnings, but still).

Why?

This is modifying system CA certs on your own device, with root access. There's plenty of examples in the article, but most commonly you'd want to add your own CAs so that you can intercept and inspect your own network traffic. There's a wide world of developer/researcher/reverse engineering tools that do exactly that, there's a demo here: https://httptoolkit.com/android/

It could plausibly be malicious, but it requires direct root access on the device, and if somebody has root access there's already far more malicious options available to them so it's not a meaningful threat in any sense.

I'm the maintainer of HTTP Toolkit - it's not a Postman alternative (it's an open source project focused on intercepting & debugging traffic, not sending it) but I'm actually working on building a UI for exactly this right now, so this thread is perfectly timed!

Is there anything that any of you really love or hate about any of the tools suggested here?

What core features beyond just "edit method+URL+headers+body, send, view the response status+headers+body" are essential to you?

Anything you wish these tools could do better?

I'm planning on taking the client functionality live within a few weeks max, so if you want to help your perfect Postman alternative come to life now's the moment 😁

TypeScript has become my go-to general-purpose option. Between Node.js & the web you can build anything (and share code between all these different domains), the JS ecosystem is huge so there's existing libraries & examples for everything, it gives you a good balance between productivity & performance (much faster to run than Python, much faster to write than Rust), and proper typing solves the rough edges of JavaScript without being so strict that you have to fight it.

I work with Kotlin, Rust, and Bash for various other specific things (e.g. Android apps, very low-level/high-performance code, and widely-compatible scripting) but 9 times out of 10 I'd reach for TypeScript if there isn't a special reason.

Hahaha, that might be British-specific I guess? I always assumed it was universal. Just means "a long time".

https://www.merriam-webster.com/dictionary/donkey%27s%20years

To be clear - even in that world, not having WEI would make you much more suspicious than a 'normal' user, so you're effectively describing every Firefox and/or Linux (etc) user seeing captchas all the damn time. If Cloudflare used this as a signal, that'd be a captcha for 20% of websites.

Try using Tor today and see how inconvenient the web becomes. Just 'not blocked' doesn't mean you get a reasonable experience.

The only healthy route for the web is fair access and free competition between clients. WEI sets that on fire.

Unless it's a fully managed device (different to a work profile - this has to be configured when the device first boots, it's for phones that are fully corporately owned & managed) then I think that has to be acting as a user-level CA certificate (trusted only by apps who opt in to trust it, which notably includes Chrome) not a system-level CA certificate (trusted by all apps by default). That will keep working just fine.

We'll see! According to https://reddark.untone.uk/ more than 60% of the protesting subs are still shutdown now, well past the end of the official 2 day protest, including quite a few big ones (funny, art, science, gaming, pics, sport, DIY, food). Even if half of Reddit comes back, it's hard to avoid the sensation that it's broken right now, and surely that'll hit the user & traffic numbers.

Thanks! That's interesting to see, looks like this is an amendment? I'm not totally sure how that bit of the legal process works here.

I'd be surprised if this is intended to apply to mobile phones though - very few phones are used primarily in an environment of water immersion. They're designed for incidental protection, but the regular day-to-day use case is pretty dry! I'd read that as intended for things like watersports & diving equipment.

Here's 106 phones with at least IPx6 (full immersion for 30 minutes) waterproofing and removable batteries: https://www.gsmarena.com/results.php3?sIPCerts=5,6&idBatRemovable=1

They are mostly fairly old, because manufacturers have stopped making batteries removable (which is exactly why they're legislating it). Some new though, and in fact Samsung's current ultra-resilient rugged edition phones all have removable batteries: https://www.samsung.com/us/business/mobile/phones/galaxy-xcover-pro/. It's clearly possible!

Honestly, I'd be surprised. Fighting the EU on technicalities when the intention here is so clear is going to be hard work! To even get close to a good case, they'd have to change all the marketing for the device to show it's clearly being intended as a primarily water-use product. The words "primarily" and "regularly" in there aren't just decorative, they'd really have to demonstrate that to make it stick! Seems to have more downside than just making the battery removable in the first place.

The full quote also has this bit:

This derogation should only apply when it is not possible, by way of redesign of the appliance, to ensure the safety of the end-user and the safe continued use of the appliance after the end-user has correctly followed the instructions to remove and replace the battery.

Since real phones do already exist that are both waterproof and have removable batteries, I think it's very hard to plausibly say "it's impossible to design this in a way the user can safely remove the battery".

Of course, to know for sure we'll both just have to wait and see 😄