• 1 Post
  • 371 Comments
Joined 3 years ago
cake
Cake day: June 16th, 2023

help-circle

  • People coming up with such rules that sound reasonable forget the reason why no rules like that will ever exist. It’s the slippery slope argument: If you start taking power from anyone because of their age, the question becomes who will decide at which age power is stripped? Who will be stripping and once the rule is established will someone change that rule to their benefit and start taking power from political opponents etc.? We strip power from those sick and unable to hold it… Usually. And on a case by case basis. Because you usually can argue for that person why they are unfit. Just reaching an age does not make you unfit by default. And there are tests to prove you are unfit…,… And then there is the U.S… They would not strip trumps power at any age. Even if there was a law… So yeah.










  • Commercial use is not the issue. That’s already allowed but incentives. If you don’t enforce payment it won’t happen, because that’s whats happening now. Paying companies are called sponsors and that’s fine. They pay in money or developer hours to contribute. If you enforce payment, companies get preferential treatment, because why would you not prioritize payed for changes over those for regular free tier users. And even then, there exists freemium software already with extra repositories for paying customers. So even that model already exists. Im really not looking forward to using jailbroken cracked open source software because someone broke the licensing mechanism again that should enforce some users paying. Also with payment comes automatically a lack of anonymous usage, so now you need to register with your clear name to prove you are not a company and entitled to free use of the packages. And while we are at it, let’s add age and sex verification to any free software to be sure we know all about your porn fetish as well… Free software works because it is free as in freedom. No hurdles no bullshit TOS, just download and use and not even any requirement to contribute.







  • It works by public key cryptography. They sign that your name bought a ticket with a secret key and everybody checking tickets has a public key to check it with which can’t be used to forge a signature.

    Yes I’m talking about 14 days, sorry. Just refund the ticket and now you have a valid signature under your name etc that you can show anybody checking tickets. They can’t take that piece of information from you. But that can publish on a public list which tickets were invalidated afterwards. Which nobody bothers checking, instead they rely on the apps checking that.

    Pkpass is just a formated version of what data is contained inside the qrcode. It should be possible to scan the code and save it as pkpass. But im not sure. My website allows importing into google wallet or downloading the pkpass for another wallet.

    Edit: the last part of the comment is wrong! The qrcode is enough data to allow checking the ticket but usually doesn’t contain more than the signed data for the ticket. That is enough to allow showing a valid qrcode, but not enough to display all related data. So you could in theory construct your own “thin” pkpass file or you might try reverse engineering the data inside the jwt token from the google wallet link to build a pkpass file from.

    Edit2: here you find a tool to do this. You can use the signature for the barcode to display a valid ticket code, but you won’t be able to create a valid container signature, so you need an app that will accept that anyways. (Apple wallet doesn’t) https://github.com/google-wallet/pass-converter/blob/main/README.md

    Maybe just try calling and telling them you have an iPhone and no google account. Or buy your ticket from another source.


  • So I questioned somebody checking my ticket and they explained that lots of people buy the ticket online, screenshot the qrcode and refund it afterwards (14 period online in Germany).

    The app checks regularly if the certificate (pkpass) has been revoked and displays that fact somehow. And that’s why they want to see it in an app.

    The qrcode certificate is signed and allows to check the validity of a ticket even if both phones are offline, which is a lot on German railway. The drawback is that once a certificate has been signed its valid for a given time and you need to check a certificate revoke list online to see certificates that have been marked invalid. Which none of the phones used by railway personnel does.

    Fair warning the workaround i use could also be used for fraud. But as the system has been designed by smart people and is being abused by monkeys, I will still share.

    Usually there is a way to download or scan the pkpass version of the ticket. And then you just import it into any app that doesn’t check the CRL. Like passandroid on fdroid.

    I travel daily on Deutschland ticket and have never had the case that anybody asked to see it it is a screenshot and complain that its not the right app. There are actually more valid apps than railway companies in Germany. Monkey get told “check is not screenshot”, monkey do. Nomad happy and not so mad after all.