The Simple Beauty of Vietnamese Language

Thu, 13 Feb 2025 00:00:00 +0000

After studying Vietnamese language for five months, I think that it is a challenging language to learn for Westerners. Especially the vocabulary with different tones is extremely hard to master: Bạn bận bán bàn bẩn không?, if you want to ask if someone is busy selling dirty tables. All joking apart, other features of this language are way simpler than you might expect.

Saigon Central Post Office in Ho Chi Minh City

It is an isolating language

Isolating languages do not combine words. Vietnamese words can therefore not be broken up into different components with different meanings. Moreover, Vietnamese words are very short, as they mostly consist of only one syllable.

The longest word in Vietnamese language is seven letters long. It is “nghiêng” which means “inclined” or “to lean”, in case you are wondering.

The nature of an isolating language enables the Vietnamese to use multiple words in order to address things. This makes it easy to understand definitions of unfamiliar phrases and it is fun to guess their origin! Some examples I would like to share:

thang	ladder
thang bộ	ladder to walk on (stairs)
thang máy	ladder machine (elevator)
thang cuốn	rolling ladder (escalator)

xe	vehicle
xe máy	vehicle machine (motorbike)
xe đạp	vehicle to kick (bicycle)
xe hơi	vehicle with gas (car)
xe lưa	vehicle with fire (train)
xe khách	vehicle with customers (bus)

Forget about plural forms

There is no need to use plural forms of nouns. Ordering one or many beers, the Vietnamese like to keep things simple.

bia	beer
không bia	zero beer/no beer/without beer
một bia	one beer
hai bia	two beers
hai mươi bia	two ten (20) beers

However, in some situations, it might be desirable to clarify if you mean one or many. In these cases, you add các, which is a pluraliser.

chị	miss
chào chị	hello miss
chào các chị	hello multiple miss (hello ladies)

No grammatical conjugation

In Vietnamese grammar, it does not matter who did something at what point in time. Just add a word to indicate if it happened in the past or is going to happen in the future.

Tomorrow, I am going to the supermarket


Ngày mai Tomorrow	tội I	sẽ (future)	đị go	sieu thị supermarket

Yesterday, they went to the supermarket


Hom qua Yesterday	họ they	đã (past)	đị go	sieu thị supermarket

As you can see, the verb đị (to go) does not change at all. Maybe someone needs to show the Germans.

Numbers tell the tale

Names can be confusing. Especially in Dutch, where we have two sequential months named juni and juli. The Vietnamese must have been thinking: why would we come up with names if we can be using numbers anyway?

tháng	month
tháng một	month one (January)
tháng hai	month two (February)
tháng ba	month three (March)
…	…

thứ	indication of rank
thứ hai	the second (Monday)
thứ ba	the third (Tuesday)
…	…

Some interesting, but less convenient features

The fact that surprised me most is that there are some basic words missing in Vietnamese language. There is no separate word for the color green and the color blue. This got me into a weird situation when I hired a graphic designer that (apparently) used Google Translate to translate my requests. The Vietnamese just add more words to make their meaning clear.

xanh	blue/green
xanh da trời	blue/green like the sky (blue)
xanh lá	blue/green like a leaf (green)

On the other hand, I find it interesting that are phrases in Vietnamese that do not exist in English or other languages that I am familiar with. For example, they use different phrases for grandparents on each side of the familiy.

ông bà	grandparents
ông bà ngoại	grandparents outside (mother’s side)
ông bà nội	grandparents inside (father’s side)

The traditional idea in Vietnam is that if a couple gets married, the wife moves in to the family house of the husband. Therefore, the grandparents inside the house are always the parents of the husband. The outside grandparents are the parents of the wife.

Why Brussels is Probably the Worst Place to Live as a Diplomatic Spouse

Thu, 12 Oct 2023 00:00:00 +0000

It has been one year since I moved to Brussels as (first time) spouse of a diplomat. The experience as a +1 has been both fascinating and disappointing at the same time. I don’t seem to be the only one having difficulties adapting to this way of life. A couple of papers mention the challenges of Brussels in particular. Let me take you through the characteristics explaining why Brussels is not like every other expatriate location.

Belgian flag under the Cinquantenaire Arcade: 100^th birthday of the Military Museum

Lack of Representational Entertaining

Representational entertaining is about hosting events that provide guests the opportunity to experience the country’s culture: meetings, activities, as well as formal dinners and receptions.

The approach towards representational entertaining differs between multi- and bilateral representations, as they have different functions to fulfil. One of the main responsibilities of bilateral posts is to be an enabler of cultural exchange. At smaller and geographically focused embassies, promoting national culture is like being on a parade: regular events with all kinds of obligations¹.

At multilateral delegations, not so much. Most of Brussels diplomatic bubble is bound to EU institutions and other international organisations. All with a common goal that exceeds the national level. Especially, the EU is about promoting the European thought, resulting in the suppression of national differences².

Therefore, the amount of representational entertaining is low in Brussels. Especially after the financial crisis of 2008, spouses are expected to participate in even fewer events. Meaning that they are being free most of the time. As this is an important part of the role of a diplomatic spouse, some feel excluded, diminished and isolated².

Low Esprit de Corps

Esprit de corps, or morale, is about the capacity of a group to believe in an institution or common goal. At smaller embassies, the relationships with others take on the pattern of a kind of extended family. As spouses rely on their environment for their identity³, this is especially important for subjects where spouses cooperate. Think of ensuring the well-being of other spouses and welcoming newcomers¹.

Representations in Brussels are mostly large and fragmented. The lack of a common goal, being scattered around the city in huge offices, makes it difficult to feel a strong esprit de corps. No camaraderie results in spouses feeling cast out on their own.

Some countries, such as the UK and the US, introduced the paid role of community liaison officer in Brussels to fill this gap¹. A position that is responsible for the welfare, well-being and morale of staff and dependents. A role that is generally fulfilled by a spouse.

Poor Work-life Balance

For diplomats, a role in Brussels is far from easy going. It is a stressful environment as capital cities keep a close eye on what happens in Brussels. With 60-hour work weeks not being uncommon, there is little room for a healthy work-life balance or quality time². On top of that, military representations work with classified material, which makes working from home hardly an option.

Such an environment attracts ambitious hard-working diplomats, often without an accompanying partner or family. This contributes to the effect of the lack of camaraderie for spouses even more.

Too easy to live

Living in Brussels is easy from a practical point of view. As it is so close to other capital cities (The Hague, London and Paris are all reachable within two hours), it keeps it possible to visit friends and family back home on a regular basis.

Moreover, for many diplomat families arriving in Brussels there is no severe culture shock or feeling really different, whatsoever¹. Nobody is really forced into building a new social life or finding your way in a new culture.

Final thoughts

But what’s good about being the spouse of a diplomat in Brussels? Apparently, there is something attractive, as a lot of diplomats tend to return to Brussels at some point in their career.

I think that Brussels is especially hard in the beginning if you start without a network and without a social circle. Some seasoned diplomatic spouses, however, refer to the points mentioned above as an advantage. Coming from a city where you were expected to join a party almost every day of the week, having some privacy and tranquillity in Brussels could be the right choice.

Feel free to reach out to me if you have comments or suggestions. I am open to discussions at daan@daanmiddendorp.com.

Black, A. (1995). The changing culture of diplomatic spouses: Some fieldnotes from Brussels. Diplomacy and Statecraft, 6(1), 196-222. ↩ ↩² ↩³ ↩⁴
Hendry, A. (1998). From Parallel to Dual Careers: Diplomatic Spouses in the European Context. ↩ ↩² ↩³
Gudmundsdottir, S., Gudlaugsson, T. O., & Adalsteinsson, G. D. (2019). The diplomatic spouse: Relationships between adjustment, social support and satisfaction with life. Journal of Global Mobility: The Home of Expatriate Management Research, 7(1), 103-122. ↩

Advanced Catch-All Mailboxes: Parsing (BCC) Recipient with Cloudflare Email Workers

Wed, 28 Jun 2023 00:00:00 +0000

I am a big fan of catch-all mailboxes. They enable me to use a unique email address for every service that demands my personal information. By doing so, I know exactly who is emailing me or who leaked my email address. Let’s explore how we can elevate this concept on a technical level with programmable email routing.

Update: As @uwolfer pointed out, it is possible to use the message.to directly to read out the BCC value. message.to contains the envelope value RFC5321.RcptTo, not RFC5322.To. This simplifies the neccesary code.

An offline Belgian mailbox

Catch-all Format

The format that I use for unique email addresses consist of the name of the company, a flag, and my custom domain name. E.g. ecorp-d@example.com tells me that ECorp emails me to my personal mailbox, which is set by -d.

In order to get this to work, I had different wonky solutions over the past few years. One of them was forwarding all emails to a Gmail account and setting up filters in order to make the emails end up in the right mailbox.

These solutions have one major drawback: you can only filter on the from and to header of the email. The actual receiving email address is not always present in those headers: when receiving a Blind Carbon Copy (BCC) or emails from a mailing list. Therefore, utilising filters and forwards is far from ideal for this goal.

Cloudflare Email Workers

Cloudflare offers a service called Email Routing. It basically enables you to create and manage email addresses and forwards for a domain name that is managed by Cloudflare.

Additionally, they started a public beta a couple of months ago with so-called Email Workers. Email Workers enable you to programmatically handle emails. A piece of JavaScript decides what should happen with an incoming email: forward somewhere or reject.

export default {
  async email(message, env, ctx) {
    const allowList = ["friend@example.com", "bob@example.com"];
    if (allowList.indexOf(message.headers.get("from")) == -1) {
      message.setReject("Address not allowed");
    } else {
      await message.forward("inbox@corp");
    }
  }
}

Example from Cloudflare on how to allow only certain senders

Parsing Received by … for

Now comes the tricky part. Cloudflare offers a nice EmailEvent API that can be called from JavaScript. However, this only allows for querying the from and to headers directly. In order to fetch more information, the raw email needs to be parsed manually.

The header that tells us the actual recipient looks like this:

 Received: by mail-vk1-f194.google.com with SMTP id 71f...
 for <ecorp-d@example.com>; Wed, 28 Jun 2023 04:30:15 -0700 (PDT)

Every mail server that processes the email adds such a header. message.headers.get("received") is, however, not capable of returning all of them. It only returns the last occurrence of Received, but the first one is needed. The entire source of the email must be parsed using the following regex.

function parseRecipient(source) {
  return source.match(/\b(?<=for <).+@example.com(?=>;)\b/g)[0];
}

(?<=for <): This is a positive lookbehind expression that checks if the pattern is preceded by “for <”.
.+@example.com: This pattern matches one or more characters followed by “@example.com”.
(?=>;): This is a positive lookahead expression that checks if the pattern is followed by “>;”.

Source code

I have brought it all together in a Gist, with blacklist functionality that can be hosted as a .txt file somewhere.

cloudflare-email-worker-recipient-flag-parser.js on Gist

Cycling Through Western Europe: A Scenic Journey to Rome - Photo Album included

Tue, 16 May 2023 00:00:00 +0000

Western Europe is very cyclable. With a high density of paved roads and accommodations, it is easy to travel long distances by bike. From May 1^st onwards, I gave it a shot and started cycling in the direction of Rome. This post enables me to keep track of the journey and maintain a photo album.

Me at the Switzerland / Liechtenstein / Austia tri-border area

Routing

There are multiple roads that lead to Rome. One of the routes is designed in 1991 by Cycling Europe. Another one is the Eurovelo5, which is co-funded by the COSME programme of the European Union. However, routing is not something that is fixed. You need to have available accommodation across the route, you might want to see specific things.

In my opinion, it is best to use these routes as a guideline, but plan the individual legs using cycle.travel. Cycle.travel is a very good bicycle route planner that takes a couple of things into account:

Existing cycling routes, for example: it takes the EV5 when convenient.
Traffic information: It uses traffic data to determine which roads are not busy.
Better scenery: It analyses landforms and prefers scenic roads.

My journey

Gear

For me, it is about the journey and not about sport. You won’t get better scenic views or better weather if you are riding a 3000+ euros bike. I am cycling on a 13-year-old city bike with an 8-speed internal gear, which has a packed weight of 40 kilos in total. Even climbing 1500 meters in one day in the Alps is doable.

Quality of roads

Belgium and Italy are the worst in terms of bicycle-friendliness. Even in Belgium, with their fully developed EV5, you will find “paved” roads with enormous holes in it that become dangerous if you oversee them. Italy it as you’d expect it. Dedicated bicycle lanes are rare. So it is either riding the main road together with trucks, or choosing an unpaved road. The latter roads are not recommended, as you don’t know their quality on beforehand. Multiple times, I had to cycle all the way back because the road was inaccessible due to mud or overgrown plants.

Accommodation

Most of the overnight stays were in hostels and bed-and-breakfasts. During national holidays or long weekends, it becomes a struggle to find a place to stay. Hotels and hostels tend to sell out or become heavily overpriced. I tried to stay within a total budget of 56 EUR per day, which is possible, but not very comfortable. It means that you have to stay at campsites when hostels are fully booked and go through Switzerland really quick. Due to the weather conditions, I only stayed at a campsite once. For the hostels, I paid between 25-35 EUR (50 in CH), mostly including breakfast.

Photo album

The following pictures give an impression of what to expect during this journey.

76 km - The Maas river near Namur, Belgium

204 km - Landscape in the Ardennes, Belgium

265 km - Luxembourg, Luxembourg

463 km - Vosges, Regional Park

590 km - Colmar, France

636 km - Mulhouse, France

788 km - Diessenhofen, Switzerland

950 km - Rhine at the Switzerland / Austria border

983 km - Swiss Alps

1104 km - Splügenpass at 1000 meters altitude

1127 km - Splügenpass at 2100 meters altitude

1153 km - Italian (sunny) side of the Splügenpass

1200 km - Como lake, Italy

1225 km - Courtyard in Colico, Italy

1232 km - Ferry in Menaggio, Italy

1380 km - Brescia, Italy

1437 km - Garda, Italy

1580 km - Ducal Palace, Mantua, Italy

1625 km - Rocchetta Mattei, Bologna, Italy

1637 km - Suviana Lake, Italy

1689 km - Tuscany, Italy

1809 km - Barberino di Mugello, Italy

1844 km - Florence, Italy

2014 km - Fabro, Italy

2317 km - Spanish steps, Rome, Italy

2317 km - Galleria nazionale d’arte moderna e contemporanea, Rome, Italy

2317 km - View from Villa Borghese, Rome, Italy

Final thoughts

The combination of having one greater goal, being active and performing a daily routine makes you feel extremely healthy. Both mentally and physically.

The most relaxing part is that there is no negative sentiment against regular cyclists. You can both reach destinations that are in the middle of nowhere and park in a crowded historic city center. Something that is impossible with public transport or a car.

Exploring Greece's innovative fight against tax evasion: QR codes, snitching apps, and VAT lotteries

Mon, 03 Apr 2023 00:00:00 +0000

Macedonia, the northern part of Greece, offers a beautiful green landscape with a crystal clear Mediterranean Sea. But that is not the only thing that I find interesting. After spending a couple of days here and visiting some local restaurants and coffee shops, the QR code printed on every receipt got my curiosity. Let’s find out how the Greek are fighting tax evasion.

Example receipt with QR code

Tracking every transaction

Scanning the QR code points you to a URL (example from below) of the Independent Public Revenue Authority (AADE). Surprisingly, this page contains all the VAT details about that particular purchase, which is submitted electronically in real time by the merchant. The amount per tax rate and even the amount of liters and type of petrol if it is a fuel purchase. By scanning this QR code, the customer can therefore know for sure that VAT has been paid.

I have some mixed feelings about his type of control. From a taxpayer perspective, it is genius to have such a system in a country that suffers from tax evasion and corruption. You are 100% sure that the taxes you are paying will be received by the tax authority and do not end up in the pockets of the merchant. But it is no guarantee that it will be invested in the country itself.

Moreover, tracking every purchase that is being made in an entire country leads to extra data points that might violate privacy when combined with others. Known as the Background Knowledge Attack: “Oh, we saw you go to the hospital. We found only one cash payment with the amount of the price of an STD test at the moment you left.”

Miniature roadside chapel in Chalkidi region

Snitching app

Why would the average tax payer care about this QR code if he or she could also benefit from tax evasion? Agreeing on a cash deal might benefit the customer significantly, as the VAT rate in Greece is quite high compared to other European countries (24%).

The tax authority has run a campaign (even at airports aiming for tourists) to call for refusal to pay if no valid receipt is issued¹. Furthermore, they introduced an app called Appodixi, which can be used to verify receipts. But this app has one very interesting gimmick: if you scanned an invalid receipt, you can report it directly to the tax authority from within the app. If it turns out to be tax fraud and the merchant gets fined, you will get a reward up to 10 times the value of your receipt with a maximum of 2000 EUR².

The VAT lottery

But there is more! Apparently, there exists such a thing as a VAT lottery. Basically, every resident in Greece is taking part in a lottery when paying for goods and services by debit or credit card.

Every euro spent anywhere in the country is a ticket in the lottery. By the end of each month, 1000 residents will win the VAT lottery and receive a prize of 1000 EUR in their bank account, costing the government 1M EUR per month in prize money.

When I heard about this, I first thought it was a joke. But this is apparently something that is also implemented in Malta, Portugal and Slovakia³. It has a couple of benefits: you need to pay by card, which makes it harder to evade tax by the merchant. You won’t be taking part in the lottery if you spend your unreported cash. Moreover, spending more will increase your chance of winning, which might be a stimulus for the economy as a whole.

Final thoughts

It is interesting to see that these entertaining ideas are actually viable. Maybe it is also cultural difference, but I think that if someone comes up with the idea of a VAT lottery in a more economically stable country, there is no chance that this will get enough support. Why would you reward someone who is doing their duty by paying their taxes?

Furthermore, I have no idea about the effectiveness in terms of the whole economy. It could be the case that large scaled corruption still happens and this only affects simple merchants and everyday people.

Improve NPO Start Experience without Smart Devices: Kodi, Retrospect, and IPTV Manager

Sun, 19 Feb 2023 00:00:00 +0000

The Dutch public broadcast corporation (NPO) is quite good at offering digital solutions to watch publicly funded TV shows. It offers a wide variety of different apps for different platforms, such as smart TV’s, mobile devices and browser. For watching television, I am happily using a 2009 Samsung smart TV. And yes, you guessed it, the smart-component is completely useless in 2023. Let’s see what we can do to enhance the NPO Start Live TV experience, but without smart devices, cable TV providers and big tech.

Kodi

Formerly known as XBMC, Kodi is the open source entertainment system that runs on different platforms. By installing it on a Raspberry PI, you will have a great entertainment ecosystem that plays all types of video’s, can be controlled with the remote of your television and is able to run add-ons. Playing video’s is nice, but the add-ons will enable you to interact with all kinds of digital services.

Pick any video-on-demand provider or website, and the odds are high that someone wrote an add-on for that particular service. Just to give you an example: Youtube, Netflix, HBO, FOX sports, Dumpert and NPO Start are all available. NPO Start support is part of the Retrospect plugin

Retrospect

Retrospect did a very good job at implementing the streams of national broadcasting companies, such as The Netherlands, Belgium, Great Britain, Norway and Sweden. It offers an easy to navigate menu structure and the possibility to watch live channels.

However, Retrospect is currently not integrated with the IPTV-component in Kodi. Therefore, the experience of zapping through channels and browsing the EPG could be improved.

IPTV Manager

Kodi also offers linear TV functionality, this enables you to plug in a USB DVB receiver and watch live television. However, in the current era of streaming services, DVB is not that relevant any more. Some countries, such as Belgium, have already phased out DVB-T.

Fortunately, there is also an add-on available that enables us to watch IPTV-streams on Kodi. This add-on, which is called IPTV Simple, allows us to open a m3u8 playlist file containing video streams and zap through them. But for using this add-on, you need to have a static file containing these stream URL’s. It is not that convenient if you need to create those files yourself.

This is where IPTV Manager jumps in, IPTV Manager does exactly what you might expect. It controls the streams and EPG of IPTV Simple programmatically. It can even query existing video add-ons for support and fetch the streams and EPG.

This is exactly what we need. We have already an add-on that allows us to stream live NPO channels, and we do have add-ons that allow us to integrate it with the IPTV functionality. So basically, we meet all the criteria to make it work, but we need to make the add-ons talk to each other.

graph TD; id1[IPTV Simple]-->Kodi; id2[IPTV Manager]-->id1[IPTV Simple]; Retrospect-->Kodi; Retrospect-.->id2[IPTV Manager]; id2[IPTV Manager]-.->Retrospect;

The dotted lines are the parts that are still missing in Retrospect.

Building the thing

It took me a couple of hours to dive into the Kodi ecosystem, as I had never worked on an Kodi or an add-on before. I was really surprised that it is all just Python that is being executed. You can modify the source code of any installed add-on by just editing the source files under .kodi/addons/.

Luckily, I could cheat by looking at the implementation of a similar add-on. By browsing around, I figured out that the hardest part would probably to integrate the functionality nicely into Retrospect. For example, in Retrospect it is not as straight forwarded to start a livestream by a URI. You need to mark a certain MediaItem as favourite first, before you can start it immediately.

Before starting working on the PR, I contacted Bas to ask him if he would be open to such functionality. He is really nice and helpful and gave me some advice on the actual implementation.

After some struggling with existing web scrapers, I found out that there is an actual API that we can make use of. After a couple of hours, I got the basic functionality working.

Final thoughts

I am still busy finishing up the functionality, but what I think is great is that I am already using it on a daily basis. The experience of watching linear television is more polished right now and the possibility of browsing the EPG just like when using a television receiver is very convenient. Moreover, I think it is nice to make yourself familiar with different types of (open source) software projects. It helps you to get better at understanding something that someone else built.

Maximising privacy and control: Rooting and Installing Valetudo on Roborock Vacuum Cleaners

Sun, 08 Jan 2023 00:00:00 +0000

I am not a fan of “smart” devices; they try to bring some upper class luxury to the middle class using technology. For example, vacuum cleaners: those who cannot afford a cleaning lady, can probably afford a robot vacuum cleaner that does some vacuuming for you. However, these devices come with the cost of privacy as everything it does do is sent back to the vendor. Is it possible to have both the privacy and cheap comfort?

Roborock

Somewhere around 2020, I dived into the world of robot vacuum cleaners, because someone in the family was interested in buying one. On internet forums, several brands and types were discussed. Back then there was one clear winner: the Roborock S5 Max. Capable of vacuuming, mopping and able to create a map of your home using LIDAR technology. After buying such a vacuum cleaner, it did everything that it promised extremely well.

Now that I have moved to a larger single floor apartment, I was also in the market for a vacuum cleaner. So why not buy a robot cleaner as well? Without much research, I bought the exact same model, which worked like expected.

Privacy

The vacuum cleaner does a great job at cleaning. Unfortunately, you need to install an app and be connected to the internet at all times to control it.

All the communications with the robot goes through the Roborock servers, which might become useful if you want to control your robot when you are away. For me, this rarely happens. The rest of the time, it takes a long time to connect to the robot, which is quite frustrating.

Is there a way to get around this data gathering, unstable and privacy violating ecosystem?

Official app

Valetudo

Back in 2020, I was not aware about some work going on to reverse engineer and modify those vacuum cleaners. Sören Beye, an engineer from Germany, created a “cloud replacement” named Valetudo¹.

What it basically does, it redirects the requests that the robot sends to vendor, to a local service on the device instead. This makes it possible to control the robot within your local network without being dependent on some web service hosted abroad out of your control.

Control the robot from the browser

Rooting

Valetudo supports a range of vacuum cleaners, but you need to gain root access to the robot first in order to install it. Root access makes it possible to run arbitrairy software.

In the past, there have been several ways to get root access to those Roborock vacuum cleaners. However, most of them have been patched by the vendor and everything is based on the connection with the cloud right now.

One of the rooting methods that still works is by tricking the motherboard into a low-level subroutine called FEL, which is intended for device recovery. It allows the device to boot any operating system from USB and bypassing the NAND memory. Dennis Giese, a PhD-student, created a service to build images that can root devices using the FEL-method². These images basically boot up the board, enable SSH-access and some other configuration changes.

The hardest part is getting your vacuum cleaner into this FEL-method. In order to do so, you need to get access to the motherboard and connect a pin (TPA17) with the ground while booting it. This means that you basically need to tear it apart completely, which is not without risk. This video helped me a lot, but it will take you about an afternoon to screw it apart and together again.

Installing cloud replacement

Once you have rooted the device, the installing procedure of the cloud replacement is pretty straight forwarded. Valetudo is packed as one single binary containing everything, which you need to download to the internal storage (you might need to clear some logs to free up space, as the robot logs everything). After rebooting you can control the robot by browsing to its IP-address.

Conclusion

It is a great feeling that the device is mine now. I can do anything with it now and even talk to the API directly. Moreover, tearing the device apart and putting it together gives me the confidence to repair it myself, if that would be necessary. The spare parts of this vacuum cleaner are widely available.

Detailed instructions on how to root those devices and install valetudo can be found here.

Unlocking a Public Parking Garage with Android Auto: Reverse Engineering Official App

Thu, 13 Oct 2022 00:00:00 +0000

The gate of the public parking garage that I am renting can be opened with an app. However, unlocking a phone, searching the app, choosing the particular parking and pressing “enter by car”. Isn’t that convenient while driving. Let’s see if we can upgrade this user experience.

A couple of weeks ago, I got inspired by greenluigi1’s article¹ about getting root access to the infotainment system of Hyundai vehicles. This made me want to find a fun and useful project with some reverse engineering again. As I started renting a parking lot last week, I stumbled upon this opportunity to create something cool.

The parking app

The app that is being provided by the parking company works by simply logging in and pressing a button, which opens the gate for you. There is a validation built in that checks whether you are within a certain distance to the parking garage. I am not sure why they have built in this check, as they are also offering a fallback option by calling a phone number and typing in a code.

With my background as a software engineer, I expected it to be quite a basic app that does some authentication and makes an API-request. Luckily, it turned out to be exactly that. After decompiling the app using javadecompiles, I found a service interface which had all the possible API endpoints listed, including a GET method /api/v3/gate/{gate}/open.

The next step is finding out where that web server is located. Running a search query with the domain name of the company brought me to a BuildConfig.java that had a BASE_URL like https://api-v3.parking-company.com/. Bingo! Let’s see what we have over there.

That looks like a standard Laravel project, nothing too exciting here. Let’s try one of our previously found API-endpoints. As expected, they result in an error, which is obvious, as there had to be some authentication mechanism. One of the endpoints is oauth/token, which indicates that oauth is being used. As this is a standard method, it is built in into Postman. The CLIENT_ID and CLIENT_SECRET were both also in the BuildConfig.java which makes it super easy. Filling in my account details got me an access token immediately, which is also automatically applied to the API requests Postman makes. Let’s see if we can fetch some account information from the API!

Postman fetching user details by access token.

That returns all my account data, including license plate and phone number. However, it does not tell my anything about my subscription or the gates that I am allowed to open. Let’s give /api/v3/user/{user}/access a try. This lists my subscription nicely, including the gates that are available.

Postman fetching access details.

These are the numbers we need, so let’s see if we can open the gate programmatically. By looking at the service interface, we need to provide a couple of other details, such as: user id, purchase id, coordinates and way. The coordinates are needed to check if we are not too far away from the garage. So we will give the parking company a peace of mind and reassure that we are allowed to open the gate by passing the exact location that got from the garage details. I am not able to find what the way parameter should be from the code. However, I guessed in and that seems to be working.

Postman opening the gate.

Active, that seems like a success. I didn’t check if the gate actually opened, but I was pretty certain that it would work so I started immediately with the next step: more convenience.

Android auto

Every car with an In-Vehicle Infotainment (IVI) system that is being produced right now, even a Fiat 500, seems to support Android Auto. What I really like about Android Auto, is that it does not matter how crappy the infotainment system is, you will always get the same experience.

So, now we are able to make an API-request programmatically, it should be easy to create an Android Auto app that makes this request once you open it, right?

Full of enthusiasm, I cloned an Android Auto hello-world example. A nice feature of Postman is that you can copy the request into multiple programming languages, including Java OkHttp. That makes life even easier. The access token within the request is valid for 365 days, so I didn’t bother about implementing authentication logic.

Spend one or two hours fine-tuning the app, so that it closes the activity automatically after opening. Tested it in the emulator, where it was working!

The pitfall

On my next trip, I stepped into my car full of excitement and drove to the exit of the garage. However… the app was nowhere to be seen. Reboot, restart car. Other device. No app.

It turns out that Google is fighting the 3rd party app community, as they think it is insecure to have any type of app to run on your car’s head unit. As a developer, you cannot test an Android Auto app on a real car². The only way to test it, according to Google, is to upload it to the play store in an Alpha channel. Using this method, Google wil test if your app does not distract during driving and fits the Android Auto ecosystem before releasing it.

I am not confident that Google will accept my app. Moreover, my account details are now hard-coded into the app, so I don’t want to upload it somewhere.

Fooling Google

When Google prevents you from doing something, the general answer is rooting. Rooting a device gives you back all the freedom to do whatever you want with your own hardware. As I rooted and flashed many devices in the past, I am certainly familiar with the pros and cons of doing so. Nowadays, I think the need for rooting is minimal, as the standard Android ecosystem has improved heavily over the last decade. Moreover, rooting my device (and also other devices that I want to run the app on) would require a lot of work, not be convenient and introduce security risks.

Luckily, the good old XDA developers forum is also active around creating modifications for the Android Auto ecosystem³. The information around there is a little bit fragmented. However, one app called Fermata Media Player⁴, which enables you to watch YouTube on an Android Auto headunit, had some interesting information. As this application is not available on the Play Store, they list a couple of methods to install this third-party software.

One of the methods to get third-party applications working without root is using an app called KingInstaller. This app simply lets you select and install an untrusted APK-file, which magically shows up on Android Auto. How does this particular app work if it does not need root? Let’s take a look at the source code.

Intent intent = new Intent("android.intent.action.INSTALL_PACKAGE");
intent.setData(fileUri);    
...
intent.putExtra("android.intent.extra.NOT_UNKNOWN_SOURCE", true);        intent.putExtra("android.intent.extra.INSTALLER_PACKAGE_NAME", "com.android.vending");

In Android terms, an Intent is simply an action that is being performed. So as you can see, the android package installer is being called with the APK as data.

Moreover, it adds two extra parameters NOT_UNKNOWN_SOURCE and INSTALLER_PACKAGE_NAME. The first parameter specifies that the application should be treated as coming from the app invoking the intent ⁵, which is KingInstaller in this case. Secondly, the installer package name is set to com.android.vending. This package is also known as the Google Play store.

It turns out that this is the general way to find out which app store installed the app, from within the app itself ⁶. This is being used by apps that are available in multiple app stores, to keep track on where they were downloaded from.

Apparently, Google is also using this method to check if an app comes from their app store, which should assure that they have verified and reviewed it. But what surprises me most, is that this mechanism can be fooled by just adding an extra parameter to the intent.

The Android Auto solution that I built by reverse engineering the official app.

Conclusion

I think it is fun to have the ability to find out the inner working of everyday products, especially if you can benefit from these findings. I had expected that most of the time would go into reverse engineering the parking company app, but due to the simplicity of the app and the use of standard authentication, this was fairly easy.

Most time went into setting up an Android Auto development environment and getting the hello-world app to compile after struggling with different Gradle and SDK versions. The restrictions with Android Auto required research, but the actual solution could not be easier.

All in all, I am happy that it is working now, and it actually makes my life easier.

Understanding the Shifting Stockbroker Market: Exploring No-Fee Trading and the Impact on Investors

Fri, 18 Feb 2022 12:00:00 +0000

The market of stockbrokers has been shifting since a couple of years. Several newcomers are offering so-called no-fee trading: free stock trading on designated exchanges or particular stocks. What is driving these new business models?

A brief introduction into exchanges

Stockbrokers are executing orders to buy and sell stock for their clients on an exchange. Traditionally, their business model is based on fees that are paid for every order that is being executed successfully. For example, buying 200 shares of Shell might cost you 6 euros in fees.

However, not all exchanges are created equal. Sending the same order to multiple exchanges might result in different prices. This has to do with the fact that exchanges are matching buyers and sellers on the exchange itself, not on the market as whole.

Market makers

The matching of buyers and sellers isn’t really about matching two individuals. This would make the stock market illiquid, as you need to wait till someone else is willing to do the opposite trade. For example, you would have to wait for some other party who is willing to sell at least 200 shares of Shell.

Instead of trading with another individual, you are mostly trading with a market maker. A market maker is a party that has both a permanent buy and sell order with a large quantity open on an exchange. There is a small difference between the buy and sell prices that are being quoted, which is known as the spread. If an individual trader sends an order to the exchange, there is a big chance that it is being fulfilled by the market maker. The spread enables the market maker to make money, because it is continuously selling the stock at a slightly higher price than it is buying it.

Payment for order flow

As you can imagine, it really matters on which exchange your order is being executed. Different exchanges might have different agreements with market markers or act as a market maker themselves.

For an exchange that also acts as a market maker, the execution of orders are profitable in itself due to the difference in buy and sell prices. This has evolved in such a way that exchanges are compensating stockbrokers that are routing the orders to their exchange. This phenomenon is called payment for order flow, or PFOF for short.

In the Netherlands, a stockbroker is obliged to always act in the favor of the client. This makes it illegal to route orders to other, more expensive exchanges. However, in Germany, brokers are regulated under the Bundesanstalt für Finanzdienstleistungsaufsicht. Which does not have this condition.

Now Flatex has acquired DeGiro, basically all De Giro customers are not protected by Dutch regulation anymore, which also allows them to route orders to less favorable exchanges.

In practice, you are free to choose the exchange that is being used, but you can see that they are pushing towards certain exchanges. Moreover, they are promoting trading outside the regular trading hours, which is only possible at their preferred exchange.

Final thoughts

All in all, I think it is important to know how a stock trade comes into being, as I am not a fan of obscure business models. A retail investor that is buying some shares with a limit price is probably not that much affected by this structure. However, with low volume products, such as options and high quantities, it might cost you serious money.

Transforming broken Kindle into an E Ink Photo Frame with Synology Photos Integration

Mon, 14 Feb 2022 12:00:00 +0000

A couple of months ago, I accidentally stepped on my Kindle Voyage E-reader and cracked the screen on the edge. The E ink display itself was working fine, but the touchscreen stopped functioning, which made it impossible to control. What can we do with such a device before adding it to the pile of E-waste?

Repurpose a broken Kindle as a photo frame, showing a picture of the village Spakenburg.

Jailbreak

Fortunately, there is a jailbreak community around Amazon Kindle devices which allows you to run any type of arbitrary software. This enables us for example to play chess on a Kindle or add EPUB support. Jailbreaks are currently only possible if you are using an older, vulnerable version of the Kindle operating system. As I had never connected my Kindle to Wi-Fi (it is a book, why should it be connected?), it was still running a version that was possible to jailbreak. So on a spare evening, I connected the digitizer of another working Kindle to the broken one, jailbroke it and connected it to my Wi-Fi. This enabled me to SSH into the broken Kindle and interact with it again!

So far, so good. Owning a nice low power device with high resolution E ink display that runs any software. Some projects for jailbroken Kindles are very interesting, such as repurposing a Kindle as a dashboard that shows the weather report and the latest news. However, as I would wish to have fewer distractions in my life, I thought it would be really cool to use it as a digital photo frame. Stumbled upon this project that loads a PNG from an external server and shows it on the display on predefined intervals.

Fetching Synology Photos

Just showing photos on a Kindle is not that user-friendly, as the images need to be processed, uploaded and opened manually. Since I am already storing all my photos on a Synology NAS, I wanted it to be a set-and-forget solution and automatically pick photos from a designated album.

I created an album especially for this project and shared it publically with a link. Then I wrote a shell script that parses the internal API from Synology Photos and downloads a random image from that particular album. This image is processed on the device, converted to grayscale with dithering using the convert binary and rendered on the display. A simple cache makes sure that images that already have been displayed, are not downloaded and processed again.

Battery life

What I really like about pascalw’s implementation is that it is suspending the device to RAM and using the Real Time Clock Alarm to wake it on a predefined moment. Therefore, it is able to get to sleep and disconnect from the Wi-Fi completely, which should keep it running for eight weeks on a single charge, according to Amazon.

Now that I have been using it for a couple of months, I can say that by updating the picture every morning at 6 AM, the battery life seems to last over a month easily.

Conclusion

I was really surprised to see what such an old (2014) and low power device is capable of doing, even the wget library seems up-to-date with the latest SSL standards. When I started this project, I expected to do all the processing on an external server in order to work around the limiting capabilities of the Kindle. I planned to write some Python to retrieve the image and parse the API from Synology, but I managed to do all that was needed in pure Bash.

Secondly, I am surprised by the power efficiency of these devices. Keeping it in standby and connecting it to the Wi-Fi once in a while would drain the battery much quicker. Due to the possibility of suspending it to RAM combined with the RTC wake is perfect. I can even refresh the picture manually by pressing the power button, which generates an interrupt, wakes the devices, fetches a new photo and puts it back to sleep again!

The image quality, however, is mediocre. It really depends on the image. In my experience, images with high contrast and non-detailed scenes are best suited for E ink displays. As I am manually selecting images for the photo frame, I am also taking this into account. This also accounts for the orientation, so that it is only showing photos that are taken in landscape.

Refresh of the photo, which happens every morning at 6 AM.

All in all, I think it is a really nice use case for of a broken Amazon Kindle, that would be worthless otherwise. Waking up with the surprise of a forgotten photo from a holiday two years ago is much more fun than an old-fashioned printed photo that never amazes you again.

Part list

Part	Price	Origin
Jailbreakable Kindle	€35,-	Ebay Kleinanzeigen
Mat	€10,-	At my local picture frame shop
Photo frame	€3,-	Jysk
90-degrees micro-USB connector	€3,-	AliExpress

The code can be found at github.com/landgenoot/kindle-synology-photos-photoframe.

Construction adhesive is used to glue it all together. Could look nicer, but I am lacking a workspace and proper tools at the moment.

The 90-degrees connector from AliExpress to charge it without taking it out of the frame.