diskOS installer: initial public beta

Flashes the diskOS custom UI onto the FiiO Snowsky Disc over Ingenic mask-ROM USB, building the image from your own stock firmware. Runs from source via install.sh.
2026-08-26 15:26:14 +10:00
commit e0bc4785e9
109 changed files with 12625 additions and 0 deletions
@@ -0,0 +1,61 @@
+# diskOS privacy and network disclosure
+
+This lists everything the installer and the diskOS UI (`mq_ui`) send over the network. The UI ships
+as a binary-only component (source not yet published), so this is a good-faith disclosure based on the
+code and observed behaviour, not a guarantee; it will be tightened when the UI source is published.
+
+## The installer (this repo)
+
+- **`./install.sh` uses `pip`** to upgrade `pip` itself and download two packages - `pyusb` and
+  `pycryptodome` - from **PyPI** into a local `.venv`. That `pip`/PyPI traffic is the only network
+  activity in setup. Point `pip` at your own mirror if you prefer, or pre-install the packages offline.
+- **The installer app itself makes no network requests.** Building the image, decrypting/extracting
+  your firmware, saving the recovery image, and flashing over USB are all fully local. It does not
+  phone home and sends no telemetry.
+
+## The diskOS UI (`mq_ui`) on the device
+
+diskOS is a local music player. The online features below reach out **only when you use them**; each
+request unavoidably reveals your device's public IP to the service it contacts.
+
+| Feature | Endpoint | Protocol | What is sent |
+|---|---|---|---|
+| **Weather** | `wttr.in` | **plain HTTP** | A location string if you set one, else nothing - wttr.in then **auto-geolocates you by IP** (approximate). Over HTTP, so treat it as visible on your network. |
+| **Lyrics** | `lrclib.net` | HTTPS | The current track's **title and artist**, to find matching lyrics. |
+| **Scrobbling (Last.fm)** | `ws.audioscrobbler.com` | HTTPS | If enabled and connected: the tracks you play (artist/title/album/timestamp) are reported to **your** Last.fm account. |
+| **Last.fm sign-in** | `www.last.fm/api/auth/` | HTTPS | Only a QR code containing the approval URL is shown; **your phone**, not the device, opens it. `www.last.fm/api/account/create` is shown as text so you know where to get an API key. |
+
+### Last.fm credential setup happens over your LOCAL network in plaintext
+
+To connect Last.fm, diskOS runs a **temporary web server on the device** at
+`http://<device-wifi-ip>:8080/<random-token>/`, shows a QR for it, and your phone posts your Last.fm
+**API key and shared secret** to it. Important properties:
+- It is **plain HTTP on your Wi-Fi LAN** - your API key/secret cross your local network unencrypted.
+  Do this on a network you trust.
+- The server is **transient** (runs only during setup), bound to the Wi-Fi interface, and gated by a
+  random URL token.
+- Your Last.fm **API key, secret, and session key are then stored on the device** under `/usr/data`
+  (device config); **offline scrobbles are queued** in `/usr/data/lastfm.queue` until they can be sent.
+  Nothing Last.fm-related is sent anywhere except your device, your phone (during setup), and Last.fm.
+
+> **Last.fm is BETA and unverified end-to-end** - see the README's Known Issues. The transport and
+> signing are tested, but a full connect-and-scrobble round-trip to a live account has not been.
+
+### The stock FiiO player still runs alongside diskOS
+
+diskOS replaces only the UI; FiiO's original player process still runs underneath it. That stock
+component - not diskOS - is responsible for any Bluetooth, firmware-update checks, and LAN media
+endpoints (DLNA/AirPlay/Roon/QPlay-style discovery) the device may present on your local network. Those
+behaviours are inherited from the stock firmware and are outside diskOS's code.
+
+## What diskOS does NOT do
+
+- No analytics, telemetry, or usage tracking.
+- It does not upload your music library, your listening history (beyond Last.fm scrobbles if you turn
+  them on), or any personal files.
+- If you never enable weather, lyrics, or Last.fm, diskOS itself makes no outbound requests.
+
+## Reporting
+
+Report anything that looks like unexpected data leaving the device via the process in
+[`SECURITY.md`](../SECURITY.md).