6 ms·

Will this, by any chance, increase the number of open-source apps available in f-droid? Every now and then, I spot a wonderful app that is only not available du

Will this, by any chance, increase the number of open-source apps available in f-droid? Every now and then, I spot a wonderful app that is only not available due to dependencies on one or two proprietary Google APIs or components. I'm trying to run a totally open-source android installation, and have opted-out of Google entirely. It's worked out fairly well so far, but the app choices are fairly limited, of course.

xchip 10y ago
Cool! Do you have any blog post explaining how to do it?
- dublinben 10y ago
  It's nothing complicated or special. Just install your AOSP-based ROM of choice, and only use software from F-Droid.
- bradyo 10y ago
  the Izzy on droid blog has a series of posts about it: https://android.izzysoft.de/articles/named/android-without-google-1 https://android.izzysoft.de/articles/named/android-without-g... Edit: The series is a little out of date, but should give you the general idea. ROMs that are probably new since that article was published that have no google dependencies are Replicant (entirely libre), OmniROM, Copperhead OS, and CyanagenMod w/ a no-gapps-script.
- adilparvez 10y ago
  This is not very detailed but it might help: https://blog.adilparvez.com/post/2016/10/31/1/cyanogenmustardrace/ https://blog.adilparvez.com/post/2016/10/31/1/cyanogenmustar...
  - bradyo 10y ago
    This is a very clean and straightforward article demonstrating how to do it! Nice work.
  - voltagex_ 10y ago
    >Signal: End-to-end encrypted messaging over the internet. (You can get it on APKMirror.) Isn't that a good way to get a modified / malware version of Signal? Anyone can upload to APKMirror, can't they?
    - cyphar 10y ago
      There's an fdroid repo[1] for it, but I'm not sure I trust the person running it. Because of the lovely conversations with moxie the main fdroid repo got taken down. Don't you just love free software projects that hate giving users freedom. [1]: https://fdroid.eutopia.cz/ https://fdroid.eutopia.cz/
    - adilparvez 10y ago
      That is a really good point, I actually got someone else to get it from the play store then copied it, the updates from apkmirror are then fine since the signatures match. I'll edit the post to say, get it from a trusted source. This is also useful: http://www.onyxbits.de/raccoon http://www.onyxbits.de/raccoon It's a dektop play store client. I tried it out a while back and it worked, don't know about now.
ex3ndr 10y ago
Only once f-droid stop being such big security hole.
- icebraining 10y ago
  What do you mean?
  - bradyo 10y ago
    See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#... The whole thread is a good read too haha
    - kuschku 10y ago
      Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
    - icebraining 10y ago
      Even without reproducible builds, that's as "insecure" as any Linux distro. Frankly, I can very well live with the F-Droid maintainers keeping the signing keys.
      - cyphar 10y ago
        And apparently f-droid has reproducible builds now.
- ptx 10y ago
  In which way is it a security hole?
  - bradyo 10y ago
    See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#...
bradyo 10y ago
I don't think f-droid will accept apps that have a requirement on the Google play services framework, even if you can somehow reproducibly compile against the microg version instead. But it does mean you can install apps on the play store that have a dependency on gsf but are otherwise open-source (e.g. maps.me, signal, tomahawk).

xchip 10y ago

Cool! Do you have any blog post explaining how to do it?

dublinben 10y ago
It's nothing complicated or special. Just install your AOSP-based ROM of choice, and only use software from F-Droid.
bradyo 10y ago
the Izzy on droid blog has a series of posts about it: https://android.izzysoft.de/articles/named/android-without-google-1 https://android.izzysoft.de/articles/named/android-without-g... Edit: The series is a little out of date, but should give you the general idea. ROMs that are probably new since that article was published that have no google dependencies are Replicant (entirely libre), OmniROM, Copperhead OS, and CyanagenMod w/ a no-gapps-script.
adilparvez 10y ago
This is not very detailed but it might help: https://blog.adilparvez.com/post/2016/10/31/1/cyanogenmustardrace/ https://blog.adilparvez.com/post/2016/10/31/1/cyanogenmustar...
- bradyo 10y ago
  This is a very clean and straightforward article demonstrating how to do it! Nice work.
- voltagex_ 10y ago
  >Signal: End-to-end encrypted messaging over the internet. (You can get it on APKMirror.) Isn't that a good way to get a modified / malware version of Signal? Anyone can upload to APKMirror, can't they?
  - cyphar 10y ago
    There's an fdroid repo[1] for it, but I'm not sure I trust the person running it. Because of the lovely conversations with moxie the main fdroid repo got taken down. Don't you just love free software projects that hate giving users freedom. [1]: https://fdroid.eutopia.cz/ https://fdroid.eutopia.cz/
  - adilparvez 10y ago
    That is a really good point, I actually got someone else to get it from the play store then copied it, the updates from apkmirror are then fine since the signatures match. I'll edit the post to say, get it from a trusted source. This is also useful: http://www.onyxbits.de/raccoon http://www.onyxbits.de/raccoon It's a dektop play store client. I tried it out a while back and it worked, don't know about now.

ex3ndr 10y ago

Only once f-droid stop being such big security hole.

icebraining 10y ago
What do you mean?
- bradyo 10y ago
  See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#... The whole thread is a good read too haha
  - kuschku 10y ago
    Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
  - icebraining 10y ago
    Even without reproducible builds, that's as "insecure" as any Linux distro. Frankly, I can very well live with the F-Droid maintainers keeping the signing keys.
    - cyphar 10y ago
      And apparently f-droid has reproducible builds now.
ptx 10y ago
In which way is it a security hole?
- bradyo 10y ago
  See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#...

bradyo 10y ago

I don't think f-droid will accept apps that have a requirement on the Google play services framework, even if you can somehow reproducibly compile against the microg version instead. But it does mean you can install apps on the play store that have a dependency on gsf but are otherwise open-source (e.g. maps.me, signal, tomahawk).