Download Manager is an Android component handling long-term HTTP(S) downloads for apps in the background. Apps with the INTERNET permission (GrapheneOS Network toggle) can offload their downloads to it. Download Manager doesn't trigger any connections itself.
Unlike regular apps with a unique uid/gid, DownloadManager shares a UID with several other OS media components. Components with a shared UID have shared permission toggles, data usage statistics, etc. Apps attributing connections to apps based on UID often attribute it to another app in the group.
Chromium uses Android's DownloadManager for a bunch of functionality including user downloads, saving and updating offline pages. Search the Chromium sources for DownloadManager to get an overview. DownloadManagerService is a Chromium service implemented on top of Android's DownloadManager.
By default, apps are limited in how much they can run in the background. Users can change the default Optimized to Restricted to delay tasks apps want to run in the background to the next time the app is started including being started by another app. Apps can run for a little bit after being run.
Download Manager exists to provide a way for apps to trigger a download for a large file while running and then get woken up when it completes. It avoids the app needing to continuously run to perform the download, which would require a foreground service to keep running when user switches away.
MTP Host and several other media components share a UID with Download Manager. Connection monitoring software attributing connections to those is incorrect and doesn't correctly handle shared UID apps. RethinkDNS properly attributes it to the UID group instead of picking an arbitrary app to blame.
DownloadManager is used by the OS, Vanadium and many user installed apps. The connections don't come from DownloadManager or the other media components such as MTP Host. Downloads can be set to require charging or idle, causing those to trigger it:
Android 16 added certificate transparency enforcement for apps. It checks Signed Certificate Timestamps proving certificates were logged in at least 2 logs for certificates with <= 180 day expiry or 3 logs for > 180 day. It was opt-in for targeting Android 16 but is opt-out for targeting Android 17.
Some users have reported seeing a connection to www.gstatic.com when the device starts charging which is due to certificate transparency logs being fetched. We've been planning to review certificate transparency log updates for a while but hadn't gotten to it yet. We'll have our own approach soon.
@navigatrix There was nothing in the OS opting into using it but there will be a lot using it now that it's based on Android 17. We'll write documentation for it to go along with the next release.
@navigatrix We already added our own service providing a cache of the 5 files at gstatic.grapheneos.org. We plan to integrate it into the OS for the next release. This wasn't really on our radar before because almost nothing was using certificate transparency enforcement including nothing in the base OS.
Android 17 makes it opt-out instead of opt-in for apps targeting Android 17 so it's more important now. We have to consider possible consequences of it for System Updater before it targets 17.
The OS has a list of pinned keys enforced for the public key, which we haven't looked into in detail yet. Those might be intermediates or roots with the actual key downloaded from the servers being a leaf key validated with those. We initially thought it was trusting the public key it downloads but it checks it.
Downloading a static set of certificate transparency log lists and a public key to verify those isn't an information leak. The only thing we're currently planning to change is hosting a service providing the static files ourselves.
@navigatrix @mmcblk0 It will stop enforcing certificate transparency after the log lists are outdated by more than 70 days resulting in reduced security for HTTPS and other TLS connections made by apps using enforced certificate transparency. Close to nothing used it in Android 16 but it's enforced by default for targeting Android 17 or later.
Why are you concerned about downloading these static files in the first place? The only thing us hosting it achieves is making people feel better anyway.
@mmcblk0 not overly concerned, but there might still be some fingerprinting or at least IP logging, right? In any case gstatic used to be on some block lists around here, so... be as it may, look forward to having that proxy of yours!
@navigatrix @mmcblk0 It's the standard Android HTTPS stack with a standard user agent. It's completely benign. The reason we replaced other similar static file download services with our own for cases like this is to make people happy. It's not really a privacy feature.
This was a new feature in Android 16 but not yet used by almost any apps in practice in Android 17. It's important for privacy/security so turning it off isn't an option for a privacy/security-focused OS so we have to host it.
@navigatrix why do we need to be open to google right now, it's not a way to inspect packets for the author of the private key and reverse proxies in applications?
@mmcblk0 @navigatrix Google created Certificate Transparency and are the ones maintaining these lists. The lists need to come from them since it's what the WebPKI Certificate Authorities and Android apps using those for their services are going to be using. The lists can be downloaded by our server and distributed to users rather than downloaded by devices, which is what we'll be doing.
These are static file downloads via HTTPS GET requests with a default User-Agent and no data or query.
@navigatrix How is as in this case, calls to the SSL_read() and SSL_write() functions are controlled and monitored, avoiding gaining access to cleartext packets a second before they are encapsulated in the TLS layer?
@mmcblk0 @navigatrix This is open source GrapheneOS code from the Android Open Source Project downloading lists of valid Certificate Transparency in order to perform verification of Signed Certificate Timestamps for apps enforcing Certificate Transparency. It's a privacy/security feature protecting against attacks by enforcing that the certificates are in 2-3 Certificate Transparency logs. It prevents attackers stealthily obaining malicious certificates which aren't discoverable via logs.
@astraluma It uses standard app communication via intents and Download Manager performs a check for the INTERNET permission similarly to other APIs requiring it.
It's not the only API requiring the INTERNET permission. It's why our Network toggle needs to be implemented on top of the INTERNET permission.
Firewall apps using the VPN service and controlling access based on UID can't properly handle connections done through APIs requiring the INTERNET permission which isn't limited to this.
@fozzy It doesn't have any support for storing cookies itself. An application using it can add headers to the request including Set-Cookie so a cookie the application already has available can be set for the DownloadManager request. It will pass the headers added by the application for each HTTP(S) request it makes which can be more than one since it will automatically resume the download if the connection breaks. It's just a way to have the OS perform a download without the app needing to run.
the IBM ThinkPad 235, a cult classic subnotebook released in late 90s. IBM engineering made incredibly compact machines like this one, which was exclusive to the Japanese market. There was time when IBM and many consumer products were made with industrial design teams and user replaceable parts. Sadly that era is gone now. Anyway, i am sharing this for nostalgic reasons.
lenovo laptop ranges is much wider than what was available from IBM (and includes some shitty machines)
But they still have a very decent range of ThinkPad that are some of the most repairable of the market. Not as extensible as before (but it might be also a consequence of the deeper integration of components).
as a current macbook user and former thinkpad neckbeard, lenovo truly doesn't understand why people buy a macbook either. modern thinkpads are a compromise in all areas, and achieve nothing for it. I miss my X230.
thibk pa.d.. humor aside this specific model seems like something i'd buy immediately old thinkpads (and laptops in general) were just so cool but now they're all just the same generic laptop model but altered slightly
my father had a modular machine in the 90s, at least 3 ports that you could swap out, plus the battery was removable. I don't remember the manufacturer though.
You need a Panasonic Let's Note then. panasonic.jp/cns/pc/products/s… I saw. I laughed. Then, I needed so I tried and I'm converted. My model still has one but they only just stopped adding 15-pin D-Sub(VGA)…
> change the behavior of pressing the new Android 17 Wi-Fi quick tile to disabling Wi-Fi instead of only pausing it by disconnecting from the current network and not actively connecting to another automatically
I’ve already found the first bug in Android 17. If I leave the Wi-Fi range and then come back, the phone won't reconnect. I have to turn Wi-Fi off and back on again.
I've been building PRISM - a self-hosted OSINT toolkit you run yourself instead of pasting investigation targets into someone else's web service.
Give it a domain, IP, email, phone, or username and it runs 22+ modules in parallel into one dashboard: WHOIS, DNS, crt.sh subdomains, GeoIP, threat intel (Shodan/VirusTotal/AbuseIPDB/Censys), breach data, username search across 3000+ sites (Blackbird + Maigret), dark-web mirror checks, and more. Results come with an entity graph, a GeoIP map, an OPSEC exposure score (0–100), and HTML/PDF/CSV/Markdown exports.
Your targets never leave your PC, and 14 of the 22 modules work with zero API keys (missing keys degrade gracefully instead of erroring).
Stack: FastAPI + Next.js 14, runs with one docker compose up. MIT licensed.
Our community is helping us test the initial release of GrapheneOS based on Android 17. It's working very well for most people with very few issues. We've resolved the main regressions reported to us already. We'll start builds for a 2nd public release based on 17 later today after a few more fixes.
@gdmc It's not available in the Alpha channel yet. There's an ADB command required to use the hidden experimental channel to use it for now since it's highly experimental. It could likely go to Alpha for most of the devices other than the 10th gen Pixels (with the exception of the 10a which is really a 9th gen Pixel) but we're going to be building a new release soon so we may not bother moving it to Alpha until we release the next version with fixes for most of the reported issues.
The most serious issue we fixed is an upstream memory corruption bug in the Broadcom Wi-Fi driver for the Pixel 10, 10 Pro, 10 Pro XL and 10 Pro Fold. The invalid memory access is caught by our use of hardware memory tagging which causes a kernel panic instead of allowing it.
This entry was edited (Friday, June 19, 2026, 7:20 PM)
We already fixed this Broadcom Wi-Fi bcm4383 memory corruption bug in our 2026050900 release for the Pixel 8a, 9a and 10a. Pixel 6 through 9a share the same kernel source tree which the 10a is based on. Android 17 added the new code with this bug for real 10th gen Pixels which we missed initially.
Android 17 added a unified PIN interface to SystemUI for use outside of the lockscreen. Our PIN scrambling feature now works beyond the lockscreen too. We increase the DevicePolicyManager PIN and password length to 128 but Android's new PIN entry had it hard-wired to 16 which we've resolved now.
We add a feature making system quick tiles require unlocking by default and exclude tiles where it isn't needed which accidentally caused the new flashlight quick tile to require unlocking which is now fixed. Those are the main issues found so far other than minor UI quirks we're working on fixing.
@UninterestedNerd It's in a hidden experimental channel for now with instructions on using it in the testing chat room on the 3 chat platforms we use (Discord, Matrix and Telegram). It could go to Alpha for devices other than the real 10th gen Pixels for the reason explained the thread. We're going to be building a new release soon so we probably aren't going to bother moving it to Alpha just to mostly get duplicates of the same issue reports for what we already solved.
I had the pleasure of staying in Bora Bora twice, over several years ,just a few hours for a swim and to get a little tan , unfortunately I was not there for the holiday 😅 . I can say it was a wonderful experience. HD photo album
![Robert [KJ5ELX]](photo/contact/80/2288793?ts=1769795701)
#
Spytfyre 🏴🇪🇺
in reply to pinkittymarie.23 • • •"That's not rain. That's the sea. Turned on its side. And cut into strips."
-Terry Pratchett
pinkittymarie.23
in reply to Spytfyre 🏴🇪🇺 • • •Anomaly
in reply to pinkittymarie.23 • •pinkittymarie.23 likes this.
pinkittymarie.23
in reply to Anomaly • • •pinkittymarie.23
in reply to pinkittymarie.23 • • •Anomaly likes this.
GEDANKENTaenze
in reply to pinkittymarie.23 • • •pinkittymarie.23
in reply to GEDANKENTaenze • • •GEDANKENTaenze
in reply to pinkittymarie.23 • • •pinkittymarie.23
in reply to GEDANKENTaenze • • •GEDANKENTaenze
in reply to pinkittymarie.23 • • •In which country do you live?