Finally this is getting traction after leaving many of us out of pocket.
Both developers [1] are working in management at Microsoft and AWS while ignoring emails, leaving JuiceSSH to rot because they couldn't be bothered to wrap up cleanly (refund, release a final update with pro features enabled, release the source code etc.)
Paul Maddox [2]: Director - Cloud & AI Solutions Engineering @ Microsoft - last reposted a month ago
Tom Maddox [3]: Head of AWS Solutions Architecture for Local Markets - last commented two months ago
Don't bother going back to Google either. A Play store "support specialist" just told me:
I tried to create a refund request but its not allowing to create one since the date of the transaction is out of our refund policy as we can only process refunds for up to 120 days only after the transaction was charged.
[1]: https://juicessh.com/about or https://sonelli.com/about
I reactivated my license a few months ago using the in-app functionality but I'm not quite sure when I'm afraid.
In other words, any Google Play app is allowed to just pull the plug on features after four months and pocket the money. Wonderful...
I thought I already bought it years ago, but the app asked me to pay so I bought it again. It instantly locked me out of the whole app. Later I checked and I had bought pro already in 2014 (for 5€, and I paid 30€ this time). Absolutely no answer to my emails.
Thanks for the instructions.
https://support.google.com/googleplay/answer/15574897?hl=en
The policies are "up to 48 hrs after purchase" but I'm sure "purchase does not work at all" is an exception. (It is on iOS)
Now I just don't buy anything on the Play store that I can't afford to just be outright scammed on.
1. World of Goo. Bought by Netflix, sunsetted, can't install old versions anymore
2. Monopoly. Bought by EA. Sunsetted/renamed to zzzMonopoly. Can't install old versions anymore.
FDroid has my attention since these happened.
Nope, a Play store "support specialist" just told me: "I tried to create a refund request but its not allowing to create one since the date of the transaction is out of our refund policy as we can only process refunds for up to 120 days only after the transaction was charged."
termux via F-droid is far better now than JuiceSSH Pro. Termux:Widget let's you launch an SSH tunnel script with one click. I stopped using JuiceSSH Pro more than a year ago once I realized this.
I ended up setting it up through Termux as you suggested.
I am not contending truth here, but also I have never even tried / considered anything outside of termux + unexpected keyboard, and I can't imagine anything improving my experience.
what makes juicessh so good? I guess I'm asking for a "Convince me to try it" style review of juice.
ServerAliveInterval 120
ServerAliveCountMax 30
TCPKeepAlive yesFor my few emergencies ConnectBot worked quite well as an ssh client for me, including port forwarding (so i could use VNC sessions to unlock a boot issue in a VM using some VNC app)
(Android has full physical keyboard support, so with it you can use Ctrl+A/Ctrl+X/Ctrl+V in all input fields. Usually a lot faster than fumbling with the touch equivalents that keep randomly bugging out…)
Good option for Pixel owners or phones with MediaTek chips though.
They used to (mid-late 2000s) use an L4 derivative ("REX"?), with the more recent chips (including the 'X' series for PCs) using their homegrown "Gunyah" hypervisor (https://github.com/quic/gunyah-hypervisor)
Disclaimer, my memory on the exact terminology is extremely fuzzy. But pixels with tensor can run it just fine. And it's purely a software thing too, btw.
pKVM requires a) a compatible CPU (most CPUs will do, probably), b) compatible firmware/bootloader software, and c) a compatible Android build
The latter two parts are the most likely reason why not all phones have support for this.
The option to install the subsystem is present on both, but I have not attempted it.
I have loaded it onto a Pixel 6a running Graphene.
1. type some command, hit enter
2. hit up to edit it (because you typoed something)
3. can't backspace because the soft keyboard thinks there's nothing to delete
https://itsfoss.com/news/google-android-linux-terminal-rollo...
Could it be that it's just very flaky on all pixel devices? Or maybe something graphene is doing to harden the OS doesn't play nicely with how it's been implemented?
To be fair, the feature was still labeled as experimental in the dev settings when I enabled it.
https://social-cdn.vivaldi.net/system/media_attachments/file...
Termux is doing a container. The android terminal is doing a virtual machine. That's the difference.
Termux would definitely be the light weight option, but you will be pinned to whatever version of the kernel your device is shipped with (may be a bit old.)
That doesn't matter much for using SSH though.
For running more complex Linux programs or scripts Termux is indeed less comfortable (but it can still work).
Edit: found it: https://morphe.software/ - looks like it's sort of an offshoot of ReVanced that only supports Youtube at the moment.
And, for those who weren't aware of ReVanced, see https://revanced.app/ - it was originally just a tweaked version of the YouTube app called Vanced (an "advanced" YouTube app, but without the "ad"s ;) - but now it's a tool that can patch a bunch of different apps.
Also, Mosh shell support for sshing in degraded connection environments!
I think ed25519 would be both shorter sigs in authorised_keys and definitely NOT what I used "back then"
This is indeed best practice because it allows you to alert based on key: if you receive a login on a machine with your backup key, but you haven't lost your devices, then you know your backup was compromised. If you take backups of your regular key then it would be much more difficult to notice a problem.
Note that you would never need to go get the smart-card just to perform incremental registration between it and a new remote host/service. You just need its pubkey, which can live in your password manager or wherever.
And yet, if your house burns down, you can go get that smart-card, and use it to get back into all your services.
And yet also, unlike a backup of another of your keys, if you find out that someone broke into your house and stole your safe, or robbed your bank, etc, then you can separately revoke the access of the pubkey associated with the smart-card, without affecting / requiring the rolling of the keys associated with your other devices. (And the ideal additional layer of passphrase protection for the card, gives you a time window to realize your card has been taken, and perform this revocation step, before the card can be cracked and used.)
Indeed, as the sibling comment mentions, this is vaguely similar to a (symmetrically passphrase-encrypted) backup of a unique extra KPI keypair onto a USB stick or somesuch.
The major difference, though, is that because a backup of a key is truly "just data", an attacker can copy off the encrypted file (or image the raw bytes of the encrypted USB disk), and then spawn 10000 compute instances to attempt to crack that encrypted file / disk image.
Whereas, even when in possession of the smart-card, the attacker can't make 10000 copies of the data held in the smart-card. All they can do is attack the single smart-card they have — where doing so may in turn cause the smart-card to delete said data, or to apply exponential-backoff to failed attempts to activate/use the key material. The workflow becomes less like traditional password cracking, and more like interrogating a human (who has been explicitly trained in Resistance-to-Interrogation techniques.)
Instead, set up SSH certificates, MFA, Yubikey, or TPM/Enclave storage for your private keys.
No, use ssh-agent and decrypt once per boot.
> Instead, set up SSH certificates, MFA, Yubikey, or TPM/Enclave storage for your private keys.
Granted, I agree with this, too.
Do the OpenSSH authors not know about PKBDF2 or similar?
All it does is slow down the attempts, but for the average person's easy-to-remember password, it's probably increasing the effort from milliseconds to a few days.
Devs/support get overwhelmed, apps get buggy. A better course of action to me seems: reporting a broken app, requesting refund, waiting for the fix and switching to an alternative in the meantime.
I also dislike that this behavior could be a reason against sideloading, especially if made more popular.
Complete silence + taking money...
I paid for it in 2014, and it hasn't been updated in about half of that time, they removed the cloud key backup at some point without notification so I lost all of the keys I had stored, and last time I used it, it didn't even recognise I had paid for it.
I moved to a different app a while back.
Popular apps get away with more user hostility and price gouging. To me this effort seems misplaced.
Feature people PAID!!!! for suddenly stopped working.
You shouldn't go through that much effort for something you already paid and obviously malicious/unethical approach caused you problems. If there are things in favour of piracy, it is in cases like this.
If the community supported the dev, then both might get what they want, i.e. a maintained app and some income. With negative reviews a cheaper competitor might appear due to demand. But with piracy the app is even more likely to get abandoned and no alternative will show up either.
Then again if the ecosystem is indeed that bad, perhaps this is the way to torch it even more. Still, google plans to block sideloading and then I guess we’re at their mercy.
I don't, since it was a lifetime license.
Does patching out the license check not, in this case, fall under the "interoperability" or "abandonware" clauses of the DMCA?
Also, maybe dont rely on a poorly maintained app for making secure connections to your systems? Just me?
Really? I always gave that award to Termius, which is kind of my second best behind Servercat which I miss very dearly from the iOS environment.
I bought JuiceSSH too but I didn't use it that much. It's a shame they did what they did.
My Pro features still seem to be working for me. EDIT: No, I see now that Cloud Sync isn't a thing anymore. Looks like it's really lost its backend servers.
The article says "the purchase made in 2019 is not recognized anymore". The seller unilaterally taking back something you previously bought, especially without a refund, is a rug pull.
If it were advertised at the time as a 1-year rental/subscription then it wouldn't be a rug pull. But the fact that it was advertised as a permanent purchase means that it is, no matter how long you got to use it before it was involuntarily taken back from you.
To me this fulfills your criteria. [edit] typo
who knows what's coming next?
I bought JuiceSSH years ago on Android and it worked great, but I agree it's degraded, and I couldn't find an equivalent I liked.
iOS has multiple apps that beat JuiceSSH. I use Termix and it's really, really good.