Database Info

Marketplace "advanced" "copy protection" cracked

This is a continuation of this thread: http://forum.xda-developers.com/showthread.php?t=567870, which covered cracking the original "basic" copy protection of Marketplace.
---
I have now cracked the "advanced" copy protection used by Marketplace. As you may know, this is a "better" protection than the original "CAB copy protection" Marketplace offered. This "advanced" protection uses license keys that are verified when you run the application, and given out and controlled by Microsoft.
Several developers are annoyed that Microsoft does not allow us to use our own licensing schemes, and are forced to use "no protection" (the original CAB copy protection) or use Microsoft's scheme which is essentially a single point of failure for all Marketplace protected apps.
This new "advanced" protection was released today by Microsoft, and as far as I know no app available already uses it at the time of this writing.
So I got the code snippets you are supposed to put in your app and it was simply jawdroppingly WTF. While it was not exactly easy to beat, it took me less than two hours to devise a "generic" hack, without modifying any files on the device. (Well hey, at least it's better than the 5 minutes it took for the "basic" protection, right?)
A "generic" hack? Yes, by this I mean that this single hack (actually, running an EXE in the background) will completely bypass the entire code snippet provided by Microsoft that is supposed to check and validate your license code, for all Marketplace apps that use this "advanced" protection.
I will not publish the code that performs this hack, so don't ask. My goal is not to crack Marketplace apps, my goal is to get MS off their ass and allow us to use our own licensing systems, like the good little resellers they're supposed to be. I will tell you that it has to do with runtime patching the crypto API, but that's it. All in all, I don't think it will take long for the warez people to duplicate this hack.
---
Some further reasoning about anti-piracy, solutions, etc can be found in post 13 on page 2.

if there are no apps that use it yet, how do u know your hack works?

Because the Marketplace portal provides code ("code snippet") you have to compile in your EXE, and that takes care of the whole licensing thing.
So you look at that source, spot the weak points, devise a hack. Then compile a program using said "code snippet" and try the hack on it.
If developers simply copy/paste the snippet they are given by the Marketplace portal, this hack will work.

Chainfire said:
This is a continuation of this thread: http://forum.xda-developers.com/showthread.php?t=567870, which covered cracking the original "basic" copy protection of Marketplace.
---
I have now cracked the "advanced" copy protection used by Marketplace. As you may know, this is a "better" protection than the original "CAB copy protection" Marketplace offered. This "advanced" protection uses license keys that are verified when you run the application, and given out and controlled by Microsoft.
Several developers are annoyed that Microsoft does not allow us to use our own licensing schemes, and are forced to use "no protection" (the original CAB copy protection) or use Microsoft's scheme which is essentially a single point of failure for all Marketplace protected apps.
This new "advanced" protection was released today by Microsoft, and as far as I know no app available already uses it at the time of this writing.
So I got the code snippets you are supposed to put in your app and it was simply jawdroppingly WTF. While it was not exactly easy to beat, it took me less than two hours to devise a "generic" hack, without modifying any files on the device. (Well hey, at least it's better than the 5 minutes it took for the "basic" protection, right?)
A "generic" hack? Yes, by this I mean that this single hack (actually, running an EXE in the background) will completely bypass the entire code snippet provided by Microsoft that is supposed to check and validate your license code, for all Marketplace apps that use this "advanced" protection.
I will not publish the code that performs this hack, so don't ask. My goal is not to crack Marketplace apps, my goal is to get MS off their ass and allow us to use our own licensing systems, like the good little resellers they're supposed to be. I will tell you that it has to do with runtime patching the crypto API, but that's it. All in all, I don't think it will take long for the warez people to duplicate this hack.
Click to expand...
Click to collapse
amen
hallelujah
hit me now
YEAH

have given the issue some press : http://www.1800pocketpc.com/2009/11/13/marketplace-advanced-copy-protection-cracked-in-less-than-2-hours.html

anti-piracy protection is intended to stop ordinary users from transferring cabs between devices and it is successful at that. there is no protection that will stop apps from being pirated, certainly not for handheld devices. the new advanced protection is adequate and any further techniques are redundant and a waste of time, because no matter how 'strong' they are, they WILL be cracked.

Slightly if not totally off-topic: A mainstream consumer's view
mnet said:
anti-piracy protection is intended to stop ordinary users from transferring cabs between devices and it is successful at that. there is no protection that will stop apps from being pirated, certainly not for handheld devices. the new advanced protection is adequate and any further techniques are redundant and a waste of time, because no matter how 'strong' they are, they WILL be cracked.
Click to expand...
Click to collapse
I agree with you and your premise. Now a quick story.
I consider myself a mainstream consumer... but I have been a member of XDA for, what, i think 4 years, using 2 WM phones, first the T-Mobile MDA, then the Wing (HTC Herald), and I am about to switch to Android with the HTC Hero. I am reasonably savvy about tech, just not a coder. But I've done all the hard SPL, flashing ROMS, using beta software, and supporting developers here with pretty significant donations. I am also a User Experience / Usability designer for web as a profession. THAT'S MY BACKGROUND.
To date, my experience buying WM apps has been universally AWFUL. Whether it was, just recently, Resco Picture Viewer from PocketGear, or WM Defrag from Wizcode, or PocketPlayer from Conduits. I am more than happy to buy excellent software that works, and has a decent UI. But in each case, the process of buying the app and getting it onto my phone has been absurd, and frustrating beyond belief. Each provider makes all sorts of assumptions -- often wrong -- including "you must be downloading this from a PC, so we will download for you an executable that runs on a desktop PC then installs via active sync onto your device."
Whatever the percentage is, doesn't matter: A lot of people, like me, download all my cab files, and purchase apps, on my Mac... and either email myself the .cab file or .zip files, or place my microSD card from my phone into a USB reader. Thus, what a frikkin headache to end up getting PocketPlayer on my phone... but because i didn't download it from a Windows PC, I was screwed.
This stuff is archaic. This past week it has taken 5 days to get Resco Picture Viewer on my phone after purchasing from PocketGear.com . They have a completely retarded transactional process, a terrible UI, broken software in terms of user recognition and resetting username and password, and a completely phone-UNFRIENDLY site, with most sub-level menus not even accessible from browsers like Opera Mobile, Netfront, Iris ... They are dumbass pull downs using god knows what -- flash or javascript, whatever. But fact is: a simple navigation process to access the products on the phone itself can't even be achieved by these clowns -- yet everyone is in overdrive now trying to get their version of "THE" WindowsMobile app store online, while Microsoft stumbles.
The fact is: I would LIKE to see a uniform transaction process which is designed professionally, and supports great usability design, and once I buy the app, quit making me go through absurd backflips just to get access to the cab file. Stop requiring me to use a Windows PC. And stop all the "special OUR way" authentication processes. Because if they were so good, there wouldn't be the kind of problems I have described. I'll even grant anyone who wants to -- to say "well you're just a dumb**** user who doesn't understand their particular process"... I'll grant you that, and my answer would be:
If you plan to sell a lot of apps -- ie, make money via VOLUME transactions vs pricey apps -- a la iphone -- then it makes a hell of a lot of sense to make a uniform system of delivery if you're buying it through an app store, and for god's sake, cut the crap and figure it out. It's not so hard to send an authentication code via email or text message. But it's exactly WRONG to be having 1000 developers using 1000 special "our way" authentication processes, because the odds of 1000 app developers having a great, simple, effective UI and safe authentication system that prevents priacy of their app is pretty low, based on the experiences I have had to date with MAINSTREAM products for WM.
That's my view. But I see a whole lot of clumsiness from the Windows Mobile side of the fence pertaining to this whole new way of monetizing apps. There's a reason apple succeeds in that department -- even with their bloated catalog and draconian approval processes. They understand how to deliver products to consumers -- vs repelling them from a dumbass process, no matter how good that process may be in theory.

quicksite said:
I agree with you and your premise. Now a quick story.
I consider myself a mainstream consumer... but I have been a member of XDA for, what, i think 4 years, using 2 WM phones, first the T-Mobile MDA, then the Wing (HTC Herald), and I am about to switch to Android with the HTC Hero. I am reasonably savvy about tech, just not a coder. But I've done all the hard SPL, flashing ROMS, using beta software, and supporting developers here with pretty significant donations. I am also a User Experience / Usability designer for web as a profession. THAT'S MY BACKGROUND.
To date, my experience buying WM apps has been universally AWFUL. Whether it was, just recently, Resco Picture Viewer from PocketGear, or WM Defrag from Wizcode, or PocketPlayer from Conduits. I am more than happy to buy excellent software that works, and has a decent UI. But in each case, the process of buying the app and getting it onto my phone has been absurd, and frustrating beyond belief. Each provider makes all sorts of assumptions -- often wrong -- including "you must be downloading this from a PC, so we will download for you an executable that runs on a desktop PC then installs via active sync onto your device."
Whatever the percentage is, doesn't matter: A lot of people, like me, download all my cab files, and purchase apps, on my Mac... and either email myself the .cab file or .zip files, or place my microSD card from my phone into a USB reader. Thus, what a frikkin headache to end up getting PocketPlayer on my phone... but because i didn't download it from a Windows PC, I was screwed.
This stuff is archaic. This past week it has taken 5 days to get Resco Picture Viewer on my phone after purchasing from PocketGear.com . They have a completely retarded transactional process, a terrible UI, broken software in terms of user recognition and resetting username and password, and a completely phone-UNFRIENDLY site, with most sub-level menus not even accessible from browsers like Opera Mobile, Netfront, Iris ... They are dumbass pull downs using god knows what -- flash or javascript, whatever. But fact is: a simple navigation process to access the products on the phone itself can't even be achieved by these clowns -- yet everyone is in overdrive now trying to get their version of "THE" WindowsMobile app store online, while Microsoft stumbles.
The fact is: I would LIKE to see a uniform transaction process which is designed professionally, and supports great usability design, and once I buy the app, quit making me go through absurd backflips just to get access to the cab file. Stop requiring me to use a Windows PC. And stop all the "special OUR way" authentication processes. Because if they were so good, there wouldn't be the kind of problems I have described. I'll even grant anyone who wants to -- to say "well you're just a dumb**** user who doesn't understand their particular process"... I'll grant you that, and my answer would be:
If you plan to sell a lot of apps -- ie, make money via VOLUME transactions vs pricey apps -- a la iphone -- then it makes a hell of a lot of sense to make a uniform system of delivery if you're buying it through an app store, and for god's sake, cut the crap and figure it out. It's not so hard to send an authentication code via email or text message. But it's exactly WRONG to be having 1000 developers using 1000 special "our way" authentication processes, because the odds of 1000 app developers having a great, simple, effective UI and safe authentication system that prevents priacy of their app is pretty low, based on the experiences I have had to date with MAINSTREAM products for WM.
That's my view. But I see a whole lot of clumsiness from the Windows Mobile side of the fence pertaining to this whole new way of monetizing apps. There's a reason apple succeeds in that department -- even with their bloated catalog and draconian approval processes. They understand how to deliver products to consumers -- vs repelling them from a dumbass process, no matter how good that process may be in theory.
Click to expand...
Click to collapse
Couldn't agree more!
I'll add one more reason I wrap my head in ductape every time I download/install an app.
Think it's bad with every developer having their own authentication method? How about when each developer has a DIFFERENT authentication scheme for every app they make?

I like a rant - thanks for doing it for me as I agree with you 100%.
The top of my annoyance list (which you did include) are sites selling mobile software which are NOT mobile browser friendly, WTF is that all about?

Big Up, I still don't think anyone else would have done it in two hours.
Hey you warned them didn't you.

Haha Chainfire is there anything you cant do?

More in the Dutch press:
http://tweakers.net/nieuws/63713/nederlander-kraakt-nieuwe-beveiliging-windows-marketplace.html

While I do appreciate the "rant", I think you're missing my point - or perhaps I just don't agree. (Edit: that is in response to this post http://forum.xda-developers.com/showpost.php?p=4936479&postcount=7)
When I say "use our own licensing schemes", I do not mean codes sent back and forth through websites, screen you have to type stuff in etc. This is exactly not needed because Marketplace is also the delivery mechanism. In other words, the license code can be installed by Marketplace directly without the user ever seeing or hearing about it.
This is partly how the new system works, actually. However, if Microsoft supported license codes you give them things would be more secure (though granted, for a large part by obscurity).
Some authors will not care and simply not use it all, for example with the cheap apps it may not be worth their while. Others may wish to track license key usage, so that if suddenly 10.000 users start using the same key instead of the 1 who bought it, that key can be disabled, etc. Some may want the app to call home, some will not. Imagine that developers that do employ such anti-piracy measures will write their own verification / communication code, this beats the single point of failure we currently have. The crackers are back to having to crack each app independently and even then have a much lower chance of success.
Marketplace is the perfect opportunity to implement such a system that does provide some piracy security for the authors while for once it does not unnecessarily annoy the user.
To make the obligatory bad car analogy that fails in many ways, take you car keys. Everyone thinks it's normal to have a car key, so people can't just take your car. Of course, in line with some of the arguments against anti-piracy measures, car keys aren't really that useful, as there's always a brick - the universal key, and a car thief that really wants your car will get it. (You also lock the doors on your house, right?)
Now, the current situation is pretty much that everyone has the same car key. How useful is a car key in that situation? They way I see it (and I'm sure I'm not alone in that), is more like the actual car key situation. Some car keys are laser etched, or have something RFID-like in them and a receive in the car, or simply use different shapes, etc. That's a lot more useful than everyone having the same car key.
Sure, no matter what you do, eventually things will get cracked and it is a cat and mouse game. One of the reasons this is easily doable is because of the open nature and the very few restrictions of Windows Mobile. This is a good thing. No developer in their right mind would want to get to a restrictive system like is the case on the iPhone or other mobile OS's. That is not the point. That doesn't mean anti-piracy measures are useless though, far from it. The longer you can keep a release from being warez'd, the less you lose.
There are two arguments I hear coming back in various places by various people:
(1) If the normal users can't just copy it, then that is enough (even MS says this)
(2) Piracy works as advertising, you get more eventual sales, etc. etc
Both of these, are from my own experience, completely untrue. The thing is if one person cracks it, it usually spreads on those warez sites pretty quickly.
The big thing here is, the average user is apparently tech-savvy enough to search the warez sites first before buying, and that is just how it is:
We have played the game with that one warez site, monitoring sales when (apparent) cracks were listed and when they weren't (they do remove releases on request). This made a 30-50% difference in sales (with the number being highest during the weekends, and lowest during weekdays). For me that is enough data to know that both (1) and (2) are complete nonsense in the case of mobile apps. No matter all the pretty reasons and perhaps seemingly logical reasons you may come up with for (1) and (2), the numbers don't lie.
So, how would you like to get a 30-50% paycut? It's not like us developers are getting rich here, you know. Can we be blamed for trying to prevent this?
Now, here we have the chance to implement a system that is completely transparent for the user and can be made reasonably safe (and updatable), an obvious win-win situation for everyone involved except the warez people. Why exactly shouldn't we be aiming for this?
What is also painfully apparent here, as Microsoft themselves claim reason (1), that they have no idea what they are talking about.

i am no programmer so excuse my ignorance but doesnt everything eventually get cracked. Is there any mobile platform which hasnt a non cracked market place or sites where you can download paid apps for free?

Well done Chainfire

Hello Chainfire,
I am the webmaster of the Tamoggemon Content network, and just covered you:
http://tamsppc.tamoggemon.com/2009/11/13/advanced-marketplace-drm-broken/
http://tamswms.tamoggemon.com/2009/11/13/advanced-marketplace-drm-broken/
Furthermore, an email went out to MSFT asking for a statement. but this is not the reason why I registered here (!!!) - I am instead here to vent a bit being a Symbian dev myself.
While I fully understand your frustration, I think that allowing every developer to run his own DRM is not gonna do the store good. The reason is that the store was made to make purchasing apps simple - and by allowing everyone to run his own DRM I dont see much of a venue to do this anymore.
Whenever some kind of backend gets involved, there is a single point of failure - the only trhing I can think off now would be a very complet system based on servers.
Or, of course, platform security like on S60. But trust me - we wont want that!

Thanks! However, if you read my other post carefully you'd see it wouldn't make any difference to the ease of using the store (it wouldn't make any difference for the user at all), just to a part of the backend. And of course, each DRM system has a single point of failure, but the difference is in my case there is a point of failure per app, while in the current case it's a single point of failure for everything. There is no perfect solution, but there are better solutions than the current one.
I've been contacted by a handful of big WM devs by now who are of somewhat the same opinion.

microsoft.... when it comes to security, they are clueless as usual.
only apple is worse.
I find they windows-7 VPN and "encryption" funny , is there anybody that would trust it ? - even if it was not for the backdoors ?

Just wondering, is anyone else having problems accessing the windows marketplace from the phone? I was able to download a couple of apps yesterday after I installed a custom ROM (TPC Pro Series V3.2), but today I get a message saying there is an update, it installs the update but then I get the following message:
"Windows Marketplace for Mobile cannot connect right now. Try again later."
Is this because of the custom ROM and the latest update to the marketplace, or is this something other people are experiencing?

Remember the days when purchased mp3s were DRM protected and some companies like Sony even put rootkits on music CDs? Did that stop piracy?
Hopefully Microsoft will not repeat these mistakes... There is no need for any further 'protection' for marketplace apps. If a developer isn't satisfied with this mechanism then he/she doesn't have to publish their apps on the marketplace. There's no point in having a centralized app store if every developer uses his/her own licensing scheme.

To you, what is the one most important feature of a smart-phone

Okay, let's gather some data. I want to know what the majority at XDA find that they rely on the most on a smart-phone?
Take the poll and look at the results.
To those of you who aren't sure what they find the most important feature for them, here is a short criteria list:
Personal Information Management
Calendar
Contacts
Notes
Tasks
To-do
Finances
Passwords
Reminders
Communication
Call Quality & Clearness
QWERTY Keyboard
Phone Log
Email and Messaging Compatibility
Travel and Assistant
Dictionary
Calculator
Unit Converter
Bar-code Scanner
GPS
Alarm Clock
Encyclopedia via Web
Multimedia
Music
Video
Picture
Entertainment via Web
Games
File management
Speaker Quality and Loudness
Camera & Audio Recorder
Sound Recordings
Captured Pictures
Recorded Videos
Productivity
Word documents
Spreadsheets
Presentations
Other Documents
Audio Editor
Video Editor
Image Editor
Computer Programming
I am also working on a personal project and I need help from anyone who is willing to participate. I would like to organize a list for smart phone criteria. I want to correctly categorize each feature and sub-feature to the correct and most APPROPRIATE parent category. I will take the suggestions of each new post. And I do hope that at least a few of you participate in the poll and also give me other features to add to the list and give me category advice.

If I had to pick just one then I suppose I'd say communication; but I think this poll kind of misses the point, to be honest: the reason I want a smartphone is precisely the fact that it is NOT limited to just one set of functions. If it only did one of those six things then I wouldn't buy it regardless of which of the six it is. The fact that it does all six is what's important.

Shasarak said:
If I had to pick just one then I suppose I'd say communication; but I think this poll kind of misses the point, to be honest: the reason I want a smartphone is precisely the fact that it is NOT limited to just one set of functions. If it only did one of those six things then I wouldn't buy it regardless of which of the six it is. The fact that it does all six is what's important.
Click to expand...
Click to collapse
The point of this thread is to see what users like the most, so people (the ones who make your phone) can decide what is trendy right now. If they know what is trendy, they can spend a bit more time on improving something that is currently in demand, and less time on the less desirable features. They can also look at the smallest probabilities and see why people do not like that feature. Maybe then, they would understand why people don't use the feature. Then they can make decisions on not what is most beneficial to improve, but on what NEEDS improvement. Keep in mind that time is always moving forward so distributing equal attention and work on all features is probably uneconomical. Of course, this is only a personal experiment. Sorry, people.
I didn't ask what makes a smart phone essential (as in necessary). I asked, what is the feature that is most essential (ahem... useful and most addicting) to you.
Ya know, I am fairly certain that I use PIM more than Communication. If a smart-phone specializes in every feature such as awesome communication capabilities, awesome recording capabilities, and awesome multimedia capability, but fails to implement useful PIM management buttons/software/capabilities, then I would look for another phone. But if it only had an awesome PIM implementation than I wouldn't buy it because a smart-phone is an all-in-one device. So your point is invalid to me, and would make sense on a topic talking about how useless every other feature--except communication--is.
Please, reconsider the fact that I said smart-phone. I said nothing about travel phones, basic phones, business phones, or multimedia/music phones, or camera phones. I mean okay, maybe there is a phone that you like and think that is a perfect 10 for each category. But considering that all features are really good, I WILL still ask you what do you like the most about it? It's so simple, that I am don't know why you have to deviate from the purpose of this poll.
Otherwise, you are saying that your preference on a phone is perfectly and equally distributed. That would mean you love PIM 16%, Communication 16%, Travel and Assistant 16%, Multimedia 16%, Camera & Recorder 16%, and Productivity 16%. This is impossible in the real world.
So my topic absolutely makes sense. I think YOU are missing the point.
Please vote people. Thanks.

[Q] How to deal with user profiles on Android tablet?

An Android smartphone is personal (like your wallet). My Android phone goes where I go, it's mine, I don't pass it around or keep at least one eyeball locked on it if I do. It's like an expensive watch which I protect physically.
While I'm waiting for my Adam tablet I keep wondering: How will I manage it? A tablet really seems more of a family device. I'll pass it around, it may spend most of its time in the living room, like a magazine or a book, ready to be picked up by everyone: Kids, in-laws, visitors.
Chances are, I'll leave it at home to be torn apart by kids and wife, when I drive to work: I already carry my smartphone and my laptop. I might take it along for a business trip, just like a book or a DVD, but when I leave the hotel room for lunch, it will be left behind, while my smartphone will tag along, hopefully sync'ed with all the latest restaurant and sight-seeing info, street map data and e-mails I just collected on the tablet before leaving.
There are issues of personalization, privacy and data/application synchronisation and I wonder what the Android philosophy is in these cases:
1. Do they support the notion of user profiles, preferences, private data, credentials, so regular users of an Android device can have their "own" view on it? While I would want to show off my cool new gadget to just about everyone, I wouldn't want them to browse my e-mails or flip through my browser bookmarks.
2. Is there any idea on synchronizing more than just a minimal set of data manually between an Android smartphone and an Android tablet? Perhaps with a cloud as intermediary?
3. Can private data be encrypted and protected? Actually I'd want the tabelt to detect the presense of my smartphone and serve as a smartphone extender when it does. It could mean things like easy-lock up (unless somebody else is using the device), automatic sync'ing or auto-mounting smartphone storage/data/applications. It should still open up, when my smartphone is not present, using perhaps a somewhat more extensive authentication procedure. But without some kind of authentication all my personal data must be safe and encrypted from any prying eye.

there's a how to
There are instructions on how to set up encrypted user profiles. I'm using it on my Nook Color. xda-developers won't let me post the link because I'm a new member. Go to LTRConsulting dot com and click on the howto link.

try the app switchme

Apps My wife wants

Hi There!
My wife, a doctor who is still studying, is wondering if there is a way she can use her new android phone to take better quality notes at lectures. Previously she was using a WM65 with Word, and taking text notes, but it was not possible or very difficult to add diagrams, or highlight important words, or draw arrows to particular things. Is there a great quality app that handles taking notes easier? Happy to pay.
Secondly, she has a forerunner watch which won't download her running data such as the track she ran, average speed, etc. Can she use her phone for that data collection and find a nice app to transfer it to her PC to view in a usable format?
We are also lastly looking for a cross platform (Windows 7, Android) shopping list application. Happy to pay, but would prefer one off cost. Needs to be simple and able to be shared across 3 devices nicely.

I think Evernote could do the first and last thing, taking notes, with schemes (maybe, not sure) and make a shopping list, which is cross platform, since you make an account on Evernote's site, and you have the Windows' program and the Android application to keep track, and it's off cost up to a certain storage
Hope I've been of help, just look for Evernote on google!

How would I go about making an app like this? (Not Commercial)

For my school, I am planning to create an app that will allow people to be aware of upcoming events and general information about the school for new students and parents.
My IST (Information and Software Technology) teacher said that if it was successful, we will be able to publish it as the school's app and thus awarding be brownie points and overall a beneficiary. My school is not a dodgy one in terms of behavior etc and most people have smartphones, and not retards with iPhones with like #SWAG#YOLO#INSTAGRAM#FACEBOOK.'
Basically it's supposed to display stuff like a map of the school, things like upcoming exams and events like carnivals. I am hoping to add something that will allow you to put your grade as preference and thus only notify you of things that concern you. Basically like a news feed but for your school life.
Will it be able to be pulled off? If it is I will start with Android and move on from there.

I don't see why it would be impossible, but it seems you are taking the difficult road for something that could be done simply.
If there's planned events, you simply need to maintain a calendar/agenda one can sync to. With Google Agenda/Calendar, you can do just that. Share one or multiple agendas people can sync with. The upside is that people can use a multitude of apps, whether on their smartphone or computer to sync with that calendar instead of using a closed app.
The downside, is that its meant to manage a calendar/agenda, thus not really usable for the other part of your project, posts with general informations and news.