When I was running the Windows, I set up Windows Subsystem for Linux version 2 with Arch Linux to get the benefits of a Unix system which I am more familiar with for historical reasons. The very first laptop that I owned was passed onto me by one of my elder brothers back in 2014. It was a HP laptop running Pentium III processor, not a laptop you should own in 2014. It used to be a work laptop and had 512 MB upgraded RAM, but the workplace decided to take back the RAM and it only had 256 MB RAM. It came with Windows XP installed, but it no longer performed well with the reduced available memory. In fact, I couldn’t run any sane applications on the laptop. So, after a brief investigation, I found out that Lubuntu (a lightweight version of Ubuntu that comes with LXDE desktop by default) is a suitable candidate for this laptop. This was effectively my very first experience with a Unix desktop. A year later, I got a more capable laptop from a government scholarship program. This was a Dell laptop with Haswell processor (much better than Pentium III!). The first thing I did was replaced Windows 8.1 (I think) with Ubuntu 14.04 LTS as I was more familiar with Unix systems than Windows (not to mention the ugly look of Windows 8.1). But before that I’ve also tried to install Windows 7 (the last good Windows), but it refused to install because it says the hardware is too new! Then, I was into all sorts of things like Hackintosh and Croissant projects and ended up having Hackintosh (OS X El Capitan, I think) as my main setup. Hackintosh continued to be my main set up until I bought the Thinkpad last year. I also had Artix Linux as my secondary set up, too, but never Windows.

After getting the new laptop, I’ve felt that Windows is not really a worthy operating system, and Microsoft knows it themselves: they offer a set of tools (basically an official collection of third-party tools) collectively known as PowerToys. Even then, PowerToys cannot fix all the problems of Windows, especially, Windows 11. The very first annoyance was the HUGE taskbar it has which absolutely no customizabilty. So, the first thing I did was installed ExplorerPatcher to revert back to the Window 10 version of the taskbar. Of course, for a computer programmer (and now a researcher) like me, good support for workspace is required which is virtually absent in Windows by default. PowerToys helped a little, but there are limits on what kind of shortcuts it can create or handle. Just think about it: I came from macOS which offers one of the best workspace experiences to Windows 11 where even basic window switching is absent and requires a third-party tool. I wonder how Microsoft is surviving in the desktop operating system business with this historic worse operating system!

Last week, I was looking for a good Unix alternative to Windows that is stable (sorry, Arch Linux!) enough to be used as an everyday operating system. There were several candidates: Ubuntu 24.04 LTS, Fedora Workstation 43, Pop!_OS 24.04. I was particularly looking for options with great support for Thinkpad laptops (you know, power management is a big issue) and NVIDIA graphics (especially the latter since I work in a field where I frequently need to utilize the graphics card) as well as disk encryption and secure boot. I personally hate Ubuntu (I have it in my lab computer already), so I basically had two choices: Fedora Workstation and Pop!_OS. I choose Fedora Workstation because it is more mature and time-tested (and also because Linus himself has promoted it).

Fedora Workstation comes with GNOME Shell by default which is suitable for me for many reasons. For example, it has concepts of workspace very similar to (or even better than) macOS, its keybindings and gestures are usable and very similar to macOS’, offers a distraction-free mission control experience, and offers plenty of extensions to extend those. KDE Plasma is nice, but it’s way too bloated in my experience. GNOME does have its problems, but I think over the years the team has done a very good job in improving usability of the desktop. You might think window managers like dwm and bspwm might be good for handling workspace, but they are only good if you have a desktop computer. You’ll run into all sorts of issues because these window managers are not really scalable and good luck connecting to a projector in presentation mode!

Atomic desktops have also become increasing popular, but they are not mainstream yet and therefore, not something I wanted to install as my daily driver.

Installing Fedora Workstation

[Obviously, I’m not writing a guide to install an operating system, rather I’m writing my impressions on installing an operating system.]

I went to the official website and followed instructions to download the ISO file, verify integrity and so on. But it lacked any information on how to make it bootable. So, I installed Rufus and used their dd method in UEFI mode. But it failed to boot with a message “Secure boot violation”. Then I realized that I needed to enable “Microsoft 3rd-party UEFI CA” in BIOS to boot the live desktop. After that it worked!

Then I ran into another issue: the installer itself doesn’t offer any option to format your partitions in the installer window nor does it watch for changes in partition table. So, I needed to use the Disks app to create partitions as I was dual booting (I wanted to make sure I can still use Windows if something goes wrong). So, I created a LUKS encrypted Btrfs partition (to allow snapshots, useful for a parition where you are installing your operating system) and used the default EFI partition for /boot/efi. But the problem didn’t end here. Since the root partition was encrypted, the installer was complaining that it required another partition for /boot. So, I created another small unecrypted parition (~2GB) for /boot, and it proceeded to the actual installation.

Then it failed with the following message:

'NoneType' object has no attribute 'path'

Disappointing! But I tried rebooting anyway (you know after years of experience with installing operating systems), and it worked! I was successfully able to boot into my brand new operating system!

Post-installation

The very first thing I did was installing the NVIDIA drivers (after all, all efforts will be null and void if it doesn’t have proper support for NVIDIA). The set up was trivial (basically installing some non-free software and kernel extensions). However, since I have Secure boot enabled, I needed some extra steps to generate a MOK signing key to sign the kernel extensions.

After that, I set up the powermanagement for my laptop which means simply installing and setting up tlp and tlp-rdw.

That’s it. Post-installation is complete!

Migrating Away from Windows

As my Fedora set up is complete. Now, it’s time to move away from the vicious Windows. The partion consumed almost 450 GB for no reason. So, it’s a big gain for me as well and wanted to do this strategically: I wanted to remap the parition to /home. To do this, I needed to complete the migration first, and I wanted to do this without booting into Windows (I have tolerated that operating system far too long!).

The quickest way to achieve this is to see what software I installed there and which once I need to migrate. This is a little bit complicated for some software but easy for the most part.

The most problematic was migrating away from the browsers. I used Ungoogled Chromium (UGC) as my primary browser and Mullvad as a secondary. Both browsers have a lot of bookmarks that needs to be migrated. So, I looked online for guides on how to do this, and it appears to be fairly simple. But I had four profiles in UGC, it it took sometime to migrate them using this excellent tool.

Then, I had a few files stored in Documents, Downloads which I needed to copy to some place for later migration. I also had some configurations at ~/.ssh which I needed to migrate. Finally, I also had several projects stored in WSL2 Arch distro. For this, I needed to copy the VDIX file to mount it later for copying the essential files.

Once the migration is complete. I formatted the partition in ext4 with LUKS (since this is a data partition, I didn’t bother with Btrfs), copied contents of /home to the root of the parition, set up /etc/fstab to use this parition as /home and renamed /home to /home.bk in case something goes wrong. (I still had my pen drive bootable for this reason.)

I rebooted and the migration was a sucess!

I copied all data back to their respective folders in my Fedroa installation and cleaned up those files including the VDIX file.

Getting the Most Out of Fedora Workstation

Now that the setup is finished. I wanted to actually look into the GNOME Shell desktop to see how it compares with my requirements and expectations, and I have to say I’m very satisfied even with the default interface! GNOME team, it seems, have finally done a good job with their desktop!

As some of you know, I use disroot.org’s NextCloud for CalDAV and CardDAV syncing, and I was surprised to discover that GNOME desktop supports NextCloud specifically by default (including WebDAV, but it doesn’t have proper caching, needed to use rclone instead). Windows doesn’t even have support for CalDAV or CardDAV (actually they do not even have a calendar in first place).

Other essential software, such as Firefox, LibreOffice, Calendar, Calculator, Contacts, were already installed in the system. I only needed to install a few more that I use, such as BitWarden, FreeTube, Inkscape, nheko (Matrix client), Oracle VirtualBox (needed as an instructor for Computer Security course), Telegram, Thunderbird, UGC, VSCodium, Android Studio, and Ghidra.

Unfortunately, I didn’t find a single offline music player for my taste. So, I ended up installing Elisa and Recordbox. And I did all this using GNOME’s Software application. I’ve never thought this could be done in Linux (other than Ubuntu’s Snap, of course, which I detest). Somebody wrote a whole article on the usability of music players in Linux (TL;DR; not good).

The GNOME Shell desktop is good, but some extensions were required to make it more productive, especially, if you’re using a keyboard and a mouse or touchpad. I used Tiling Shell as a tiling manager instead of GNOME’s default (which is not very powerful), Window List for listing the windows at the bottom of the screen, and Auto Move Windows that allows assigning specific workspace for each application. There are a few other interesting extensions for window/workspace management that I have installed: Deja Window which is useful for restoring window states and Maximize Window Into New Workspace which creates a new workspace when you maximize a window (a very useful feature found in macOS).

I also wanted display the network speed in the status bar. So, I installed system-monitor-next extension and only enabled the network portion.

Finally, since I own an Android phone and mostly work on my laptop. I wanted to display the notifications to my laptop. For this, I used GSConnect with KDE Connect.

So, here at last, I found an operating system that balances features, customization, and usability together, in certain areas far better than macOS, and fully free and open source (well, mostly, since I still needed to install the NVIDIA drivers)! This is definitely my favorite operating system!

Last time I’ve announced that I was working on ADB-based backups, and last month, I was able to integrate it fully into the existing backup model. This required a major rewrite of the backup/restore feature, but I think it would be beneficial to the large number of ADB users that App Manager has.

Recently, somebody has created a feature request on GitHub regarding a ADB-based network firewall implementation. From Android 13, it is possible to utilize the Berkeley Packet Filter (BPF) to cut network connections from an application. You can also do this using ADB shell or terminal with root:

cmd connectivity set-package-networking-enabled [true|false] [package-name]

The underlying implementation fetches the UID of the package name and then add the UID and rule to a BPF map for filtering the packets for the UID (for shared applications, multiple applications packages may be blocked as they share the same UID). But the issue with BPF rules is that the rules do not persist across reboot. This means you’d need to reapply the rules after restarting your device which is inconvenient. A possible solution to the problem, of course, is reapplying the rules on reboot, which again, is not convenient since ADB mode is also lost after a reboot. So, to effectively implement this feature, we need to find a way to monitor Wi-Fi connections on reboot and connect to wireless debugging automatically once the device is connected to Wi-Fi. I’ve already implemented a prototype last night, and it’s working correctly on my test device (Pixel 9). On Android TV, ADB over TCP persists across reboots, so we may also able to do something similar on Android TVs too. After the feature becomes stable enough, I think it would be possible to implement BPF-based firewall for devices that support it that would persist across reboots.

IP tables based blocking and VPN-based packet filtering remain the most used filtering technology in Android due to the availability of many open source firewall tools (and closed source ones most of which are just clones of the former). However, these sort of blocking, as I’ve argued before, are not very effective, and from Android 12, their effectiveness has been further reduced. This has happened because Android 12 has integrated eBPF (extended BPF), and since then the internals of the AOSP has been modified to use eBPF instead of the traditional IP tables approach. If you don’t know about BPF, let me explain it in simple words: BPF is a kernel-level packet filtering mechanism that has the ability to decide which packet (any data transmitted from or to the internet has to go through a few layers, packet is one of them) goes to where or which packets it needs to drop. This allows a system whitelisted program in Android to directly send/receive packets without going through the typical route used by ip tables or VPNs. This means that the vendor can arbitrarily allow their vendor (and system) apps to bypass ip tables and VPNs which is not good thing for user privacy since for these applications, all the protections (for example, anti-censorship protections) become useless. This is where the BPF rules may help. The underlying implementation of the above mentioned command modifies the BFP map albeit temporarily overriding the existing UID rules if already present. This effectively allows us to temporarily override the rules even for the whitelisted apps. But in some cases, the rules may be refreshed even without a reboot. I’m still currently investing the implementation, so I don’t have the exact details.

Finally, for the APK updater, I’ve already created a backend for it. But there are still a lot of challenges, such as effective handling of extensions and errors, what to display to the user, implementing the update policies, and so on. This will take some time and probably available for testing at the first quarter of 2026.

Note: You may have to enable the chain3 first before you can block networking for an app. To enable chain3, run this command:

cmd connectivity set-chain3-enabled true

This is only an on/off switch. The configurations are in the BPF map regardless of this option. Therefore, they are applied immediately when you enable chain3.

At first, I’d like to talk about one of my concerns that has been in mind for a while. Despite what many politicians want you to believe, the world is in a grave financial crisis, and there is no easy way out of it. What we’re seeing at present seems to be a replay of the financial crises in the 1970s, except the world is more connected than before, thanks to the Internet, and this has its own set of disadvantages like we saw during the Covid period when the world ran into an absolute chaos. However, unlike the Covid period, people’s ability and motivation to continue hobbies are going to be challenged, especially if they are not financially productive, and this can have an adverse effect in the open source community where many projects (including App Manager and the related projects) are developed and maintained by hobbyists like me. Notice that App Manager costs me nothing other than time (which is still quite costly in the developed world), but there are many projects that are quite costly in terms of money and resources. Most concerning of all: some of them play a significant role in areas of utmost importance (like the Internet itself or defense, compared to App Manager which is not that important as a project) and are being developed by maintainers quite thanklessly without any form of compensation. This is going to be an acid test for the open source community, and I believe the landscape will see a significant alteration in the future.

Of late, I’ve been working on the backup/restore feature of App Manager. As some of you know, I’ve already created the framework for converting a App Manager backup to and from a regular ADB backup a long time ago, but handling ADB backup and restore itself is not that straightforward using the Android APIs, but it’s not impossible, and since a lot of the users are now using App Manager in ADB mode, I think I’ll give it one more shot. If I can implement this correctly, the feature will be available v4.1.0, otherwise we’ll continue to test it in the debug versions.

Lastly, I’m still looking for contributors for the ADL project. If you’re interested, please send me an email with your Matrix username. Thanks.

In order to provide a convenient option for non-Telegram users to follow the updates, they will also be posted on my personal blog. Past updates will also be gradually added there. You can subscribe to my blog posts via RSS or follow my personal Mastodon/X account. Transparency reports will also be posted to App Manager’s official Mastodon/X accounts. An archive of the reports will be maintained in a GitHub gist for now.

I think many testers already know this: I’ve implemented a new type of profile that allows filtering apps by the set of filters offered by the Finder feature. This feature is going to be very useful for recurrent activities like force-stopping all the user apps that are currently running. Again, the possibilities are endless. Although the regular apps-based profile is kind of a subset of this profile, I decided to implement them separately to keep the apps-based profile very simple and fast to execute (since filter-based profiles are inherently slower than apps-based profile). The feature will be available to stable users from v4.1.0 (release date not fixed yet). The filters in the main page are also being migrated to use the Finder-style filters so that the users can generate and use their own set of filters instead of the predefined ones. Finder itself along with this exclusive filtering options will be available to stable users in a future release.

I have done some progress on the updater implementation and can share some of the ideas to the readers for both transparency and scrutiny. But at first, let’s take a look at the issues that we need to handle in order to implement a unified updater:

1. App Manager app itself has limited internet features, and we intend to keep it this way
2. It’s necessary to enforce a static single source assignment, that is, once an installed app is assigned to a source, subsequent updates should also be sourced from that source
3. It’s also necessary to establish the levels of trust and the priority of sources should be assigned based on the trust
4. It’s crucial that the users can amend 2-3 depending on their threat model.

These are very challenging issues, and addressing them completely is nearly impossible. But I’ve designed a protocol and a framework to address those issues in an optimal way. In this protocol, App Manager effectively acts as an updater client that retrieves updates from the sources which are basically extensions to App Manager. The update process itself works in two independent steps. In the first step, App Manager queries the sources for new updates (based on the source assignment). Upon receiving such a query, the sources check for updates and return a list of updates to App Manager. In the second step, App Manager ask the sources to download some (or all) of those updates which the sources download (or retrieve from caches) and return a list of URIs that App Manager has access to. App Manager later retrieves those updates and installs them. This design has several advantages:

1. Each source remains separate and can be installed or removed independently
2. For each source, it’s possible to assign a trust level and handle per source security (HPKP, GPG, etc.)
3. Each source only uses the minimum number of permissions to function which reduces the attack surface even if some of the security mechanisms are bypassed
4. It’s easy to provide per extension updates compared to the monolithic approach where any simple changes to any sources requires a new update
5. Using modern Android platform features, it’s easy to persist single source assignments beyond App Manager.

To clarify the level of trust a bit more, it’s necessary to support only the legitimate sources instead of arbitrary source and assign each a priority which are actually more challenging than the rests, because the definition of legitimate sources remains unclear to me, and without an exact definition, it’s almost impossible to assign priorities as well. I initially came up with a priority list for the app stores, but I didn’t explain why they were prioritized this way. Therefore, it is necessary to define leigitimate sources and factors that are needed to be taken into account to assign priorities. Again, this is a challenging problem, and for now, I’ll rely on my own instinct for it. For the same reason, App Manager will not support any third-party updater extensions. The updater will rely on a signature permission to interact with the sources, and therefore, the extensions must be signed using the same key used to sign App Manager.

The highly anticipated “Finder” feature is nearing completion, and I think, I can launch it at the end of this month or the next. This feature required some thorough planning in order to make it future-proof and usable for most users (and much more usable for advanced users). Initially, only a handful of features will be enabled for the stable releases, and gradually all the anticipated features will be released. The reason for this kind of rolling release is because we no longer have the beta testing system that we used to have, yet a certain level of confidence is required in order to release a feature like this. Similar to profiles, the possibilities with this feature is endless, some of which may remain unknown for some time. There are also a few small but exciting improvements that are coming up (which shall be revealed in due time) in the upcoming releases.

Regarding the app store functionality, I’ve given it a thought and concluded that rolling out an entire app store is time consuming and largely unnecessary for the time being. Instead, we can launch an update functionality instead. The update functionality, unlike F-Droid or Obtainium, will adhere to the Android principles at the same time offering a level of privacy and security that will be suitable for a wide range of individuals (as always, in developing App Manager, I’ve always focused on offering a diversified threat model so that it can accommodate most users). You can find some information regarding the design at this link: https://github.com/MuntashirAkon/AppManager/issues/464. However, there are a few changes to the original design which will be revealed as I begin working on it.

That’s all. Thanks for reading.

App Manager v4.0.3 had a terrible bug that caused App Manager to crash or freeze (depending on device/OS) if certain keywords are used during searching/filtering. The issue has been addressed in v4.0.4. Interestingly, this has resulted in the creation of 29 duplicate issues (so far). This demonstrates how important it is to look for similar issues before opening a new issue, or GitHub suggesting similar issue based on the title or issue content while the user is creating a new issue (similar to what we already have in many other websites). GitHub also has a terrible search option that tends to ignore older issues.

Shizuku has recently altered its license terms to make the project completely open source (as opposed to source available that it previously was). I absolutely welcome this change and thank vvb2060 for making this change. Some of you may now ask whether I’ve got any plan on supporting Shizuku. Let me explain this a bit.

Since v4.0.0, much of the compatibility layers in App Manager have been rewritten to allow a certain level of flexibility in terms of the mode of operations. From v4.0.1, it is also possible to alter the mode of operation to any UID of your choice provided they support reading and executing the start command. It is even possible albeit with certain modifications to run App Manager as a system app with permission whitelists or as a system level UID (latter is too risky). So, in a way, it is now possible to add Shizuku support in App Manager. At this point, I may need to spend some time with their API to understand how it works. My expectation would be a generic API (similar to Open KeyChain’s) that would allow connecting to any Shizuku-style applications, including any future Shizuku forks (since it is open source now) instead of Shizuku “official” app alone.

Lastly, Eid Mubarak to those who celebrate Eid-ul Adha.

A good news, though, is that the small amount of time I can manage for App Manager is largely spent on improving the user experience. This you may have already noticed if you have installed the latest version of App Manager.

Now and then, I receive requests for adding translations for docs in [placeholder] language. Please understand that translating docs is a very difficult task, and we do not approve such requests unless the existing translations for the language are very good and are backed by at least two person.

• Some of you are still sending email related to App Manager in the old email address. Those emails will be ignored, because those messages aren’t filtered. Also, please try to add a sane subject line (e.g., App Manager Crash Report, etc.) to your email. Otherwise, they will also not be filtered. I received thousands of emails per month from various sources (not just App Manager). So, unless the subject line looks important, most of them are ignored and deleted after some time. Finally, please use a sane email address as well. If you use lots of xs, for example, most spam filters will put it in the Spam folder ;)
• I have been making plans to improve the ADL project (which more-or-less follows UAD-NG project for now). Hopefully, the project will be more reliable in the future with verified and enhanced documentation. Android libraries project, on the other hand, still requires a lot of work on my end which I may be able to finish by this year.