@dos continues the Megapixels trials… Check out the latest:
5 Likes
It’s quite hard to get the focus, gain and exposure right (as they cannot be automatically set yet it seems).
This was my first attempt, didn’t try to fine tune the settings so doesn’t look great and the hardware is certainly capable of much better pictures than what I achieved.
But it’s pretty easy to get working, I am running Byzantium then I simply had to compile Dorotas Megapixels fork and then it “just works”.
Awesome works guys!
EDIT: The default resolution seems to be 640x480 which is pretty low as you can see in the picture above, I just realized however you can change it in the config file so I was now able to capture a picture with 2048x1536 resolution (at least that’s what’s in the config, when running the “file” command on the .tiff it’s 2104x1560 for some reason).
7 Likes
Btw, each commit has a ready-to-go .deb file attached in the pipeline.
8 Likes
Even 640x480 is a lie - supported modes are 4208x3120, 2104x1560 and 1052x780 at the moment.
On the currently released kernels the first two ones will have plenty of noise that you’ll have to subtract with dark frame (a photo taken with the sensor fully covered); the last one should be fine though. However, improvements for image quality at high-res are coming (as can be seen under the link posted by @amarok 
)
6 Likes
@dos, you could probably make millions if you published a storybook starring your cat with your clever captions. Very entertaining! 
1 Like
QR codes are a wild and woolly bunch. Your vanilla QR code will be an https: (or http:) URL.
For the purposes of associating with WiFi, the QR code may begin with WIFI:
For the purposes of sending an SMS, the QR code may begin with SMSTO: (and the full text in the QR code will be SMSTO:destination-mobile-number:text-of-message)
Let’s call them all URLs where the schemes in the latter cases are WIFI and SMSTO respectively.
I have two questions.
- Right now is there any command line to do anything with an SMSTO URL i.e. that would send the required SMS (or at least launch an SMS sending application in preparation for sending the SMS - since the user really ought to be given the opportunity not to go ahead and send the SMS)?
- Is there any official registry of these additional schemes or is it a free-for-all? (This question is really just for interest.)
I think in any case it must be shown to user what the QR wants to be done before any action gets performed. QR codes are a possible attack vector and even starting an app might be against the users will and possibly do harm.
Also I suggest to consider to name it commands instead of URLs. Or maybe we find out what’s the official name by some RFV or whatever.
edit:
German Wikipedia talks about “tags” but doesn’t express clearly if these commands / URLs are the tags or the QR-Code itself. The abuse of these commands / URLs for attacks is called attagging.
Are the specifications of the QR Code publicly available?
Specifications of the code were approved as a JIS standard (JIS X 0510) in November 2004. Therefore, they are publicly available.
Source: https://www.qrcode.com/en/faq.html
Edit:
I’m not sure. Seems to available for paying money only. Also only in Japanese.
https://infostore.saiglobal.com/en-gb/standards/jis-x-0510-2018-622812_saig_jsa_jsa_1430747/
An example of how to have a process like that, this app does just that (shows the QR code content first and asks permission - among other good features), https://secuso.aifb.kit.edu/english/QR_Scanner.php It seems like one good starting point for how to do an app that’s not horrible (GitHub: https://github.com/SecUSo/privacy-friendly-qr-scanner).
1 Like
Due to covid most probably EU and certainly the touristic countries such as Greece are preparing a certificate of vaccination (or pcr or of recovery from covid) using “digitally signed QR codes”. What is this? I have used digital signatures, I have used QR codes but not together. I found very little information on the web (wikipedia has nothing I think on this) and restricting the search to Linux returned nothing I could make any sense of.
Maybe this idea is of interest for L5…
I don’t know what it is, but “digitally signed QR code” doesn’t make sense. A QR code is a storage medium, but signing can be done to data. I’m guessing that what’s happening is some QR code carries some signed data, not unlike a QR code ticket.
This is what I thought too. But then I found this:
It seems that some kind of combination between QR and GPG is possible so I can safely assume that the same could be possible with digital signatures issued by CA authorities.
Unless I have completely misunderstood the above link. Could you please explain what is this?
From the link:
This Python script generates a PDF file with an embedded QR code,
based on a message. This QR code contains the message signed
with your private gpg key. The purpose of this is to have a
printed signed document.
The idea is to build an Android application that verifies
signatures on these printed documents by scanning the text on
the document by for example OCR and verifies the text by checking
the QR code and verify the included signature.
So… it automatically checks that something is the same that was signed (and now in QR-container for machine reading). Just like @dcz described, in other words. I’d imagine that would make a huge code image if it’s a long text (pages), so, probably just a hash (which would be enough to verify there are no changes) would be more logical, maybe…? Unless it’s intended for short stuff like “final grade values”. The QR-code alone is not enough, it in any case needs to read the whole text to compare - either the file or OCR, which is very likely to have changes (likely to give a high rate of mis-matches on comparison). For short strings and values this seems more doable.
Edit: this QR-conversation should be forked or just moved to a new thread from camera development.
2 Likes
A valid point no doubt.
In this case, the QR code is part of the ongoing battle: Librem 5 v. my country’s COVID response and as such I am not too concerned about an attack vector, and keener that it “just works”.
I already have zbarimg installed on my phone. Let’s say that in the near foreseeable future the basic camera functionality is released - a script can get the camera to capture an image. So let’s say it is easy enough to capture an image and decode it as a QR code. Then it is easy enough to extract the scheme and show it to the user and ask the user whether to continue.
So my question then is … if I say “yes”, can a script send an SMS or launch Chatty to do so or … ?
A QR code just encodes arbitrary data. Interpretation of that data is outside the scope of the QR code. We don’t want the spec for QR codes as such.
It is certainly murky. There are URLs, URNs, URIs and it is unclear whether either of the two examples that I gave (WIFI:, SMSTO:) fit into one or more of those. The basic idea though is that they all start with “scheme:” where scheme has a limited character set, and what comes after the colon is scheme-specific. That is the general URL syntax. Some schemes further conform to the common internet scheme syntax. Some don’t. (Refer RFC 1738.)
SMSTO: more explicitly requests an action (send an SMS) - more like a command, as you say. (Like mailto: which is documented in RFC 1738.)
WIFI: provides the connectivity details for a Wireless Access Point - but does not necessarily request the action of associating with that WAP, although a client device might interpret the details as a request to associate.
OK, so here it is.
My EU digital Covid-19 certificate. I do not care about sharing it as long as I have the chance to learn something from it. So what is this QR code that it has? I scanned it and it gives a big hash-like string. But how does this make it possible to verify that the document is original and unmodified?
@antonis, I really think you should redact your personal info. You never know what mischief someone might want to do…
OK I did it, although I do not know what information the QR-code contains…
If it’s just a hashed string, it’s probably OK, I would guess.
Decodes as-
HC1<censored mumbo jumbo>
(if you can call that decoded)
(forum may have butchered the layout)
You have exactly zero chance of knowing what information you are leaking. It might be safe. It might not be safe. Unless you can find some documentation from your government / from the EU.
I recommend that you install the zbar-tools package for the zbarimg command.
I recommend that you never post QR codes publicly unless you are able to verify for yourself what you are leaking.
There are no barcodes or QR codes on the Australian certificate. Low tech. Plenty of useful information for identity theft however.
Looks like it is encoded anyway. 
1 Like
In France, the flash code is at 2D Doc format.
At the end, there is a field for base32 encoded signature. It’s 64 bytes long, with NIST P-256 (ECDSA) encryption.
I would not keep the file public forever. I have already removed it. I put it up so some people in here can check the QR and maybe explain what and how it is doing what it is doing. I have not yet understood its function. Can someone explain?