4 ms·

Only once f-droid stop being such big security hole.

by ex3ndr 10y ago

icebraining 10y ago
What do you mean?
- bradyo 10y ago
  See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#... The whole thread is a good read too haha
  - kuschku 10y ago
    Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
  - icebraining 10y ago
    Even without reproducible builds, that's as "insecure" as any Linux distro. Frankly, I can very well live with the F-Droid maintainers keeping the signing keys.
    - cyphar 10y ago
      And apparently f-droid has reproducible builds now.
ptx 10y ago
In which way is it a security hole?
- bradyo 10y ago
  See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#...
  - kuschku 10y ago
    Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
    - bradyo 10y ago
      To be fair, Moxie appears to have been right at the time of writing the linked comment according to the commit timestamp. Thanks to you (and the comment or above for the link) for pointing this out though. TIL. The documentation does say it is unlikely and other documentation has not been updated to point to this feature, such as the developer FAQ: https://f-droid.org/wiki/page/FAQ_-_App_Developers#Can_APKs_signed_by_my_key_be_included.3F https://f-droid.org/wiki/page/FAQ_-_App_Developers#Can_APKs_...
- codethief 10y ago
  I think what OP is referring to is that the apps on F-Droid are not signed by their respective developers but by the people behind F-Droid. This is the reason (or one of the reasons?) for instance why Moxie from OpenWhisperSystems doesn't want Signal to be available through F-Droid.
  - catdog 10y ago
    Thats not entirely correct, if the build is reproducible the upstream apk with the upstream signature can be published: https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...
    - codethief 10y ago
      Oops, I didn't know about that feature. Thanks for pointing that out!
  - jalami 10y ago
    Fdroid allows you to run your own repo and up your own builds. MicroG does this, so these are built by them. More devs should do this. Fdroid building everything isn't scalable nor is it a good trust paradigm. I agree with them that they should only build from source, but others should maintain their own. Email is federated, why not app stores? Edit: [0] https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo
    - zanny 10y ago
      Because adding a repo via some random online URL is the exact same reason why downloading random Windows executables creates tons of opportunities for malware to infect computers. The whole point of software stores is giving users the ability to trust the motives of the software they install, because the store and / or its users would never condone hostile software being hosted there. Once you start having everyone run their own F-Droid repos, you are having independent developers give you their own trust keys, but you have no one else who needed to verify those developers were legitimate. F-Droid itself is not particularly secure, given anyone can upload anything there, but in the same way the Archlinux AUR, OpenSUSE Build Service, Ubuntu Launchpad, etc work those third party software repositories are at least hosted by a trusted maintainer of the store / repo itself. If anyone ever uploaded malware there, once found out, it would be taken down and the responsible users banned. With distributed app stores under F-Droid, or the equivalent third party repos for Arch / Suse / Ubuntu, the host has absolutely no control over the behavior of third parties, and thus anyone can host all the hostile malware they want, and if users add those repos they give them absolute trust in doing so. That isn't a valid security model by any estimation.

Only once f-droid stop being such big security hole.

by ex3ndr 10y ago

Only once f-droid stop being such big security hole.

icebraining 10y ago

What do you mean?

bradyo 10y ago
See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#... The whole thread is a good read too haha
- kuschku 10y ago
  Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
- icebraining 10y ago
  Even without reproducible builds, that's as "insecure" as any Linux distro. Frankly, I can very well live with the F-Droid maintainers keeping the signing keys.
  - cyphar 10y ago
    And apparently f-droid has reproducible builds now.

ptx 10y ago

In which way is it a security hole?

bradyo 10y ago
See Moxie's explanation here: https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13447074 https://github.com/WhisperSystems/Signal-Android/issues/127#...
- kuschku 10y ago
  Which is not correct. If F-Droid’s reproducible build system can get the same result as your own build, you can distribute your own, self-signed version through F-Droid. In other words, moxie is wrong. Again.
  - bradyo 10y ago
    To be fair, Moxie appears to have been right at the time of writing the linked comment according to the commit timestamp. Thanks to you (and the comment or above for the link) for pointing this out though. TIL. The documentation does say it is unlikely and other documentation has not been updated to point to this feature, such as the developer FAQ: https://f-droid.org/wiki/page/FAQ_-_App_Developers#Can_APKs_signed_by_my_key_be_included.3F https://f-droid.org/wiki/page/FAQ_-_App_Developers#Can_APKs_...
codethief 10y ago
I think what OP is referring to is that the apps on F-Droid are not signed by their respective developers but by the people behind F-Droid. This is the reason (or one of the reasons?) for instance why Moxie from OpenWhisperSystems doesn't want Signal to be available through F-Droid.
- catdog 10y ago
  Thats not entirely correct, if the build is reproducible the upstream apk with the upstream signature can be published: https://f-droid.org/wiki/page/Deterministic,_Reproducible_Builds https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...
  - codethief 10y ago
    Oops, I didn't know about that feature. Thanks for pointing that out!
- jalami 10y ago
  Fdroid allows you to run your own repo and up your own builds. MicroG does this, so these are built by them. More devs should do this. Fdroid building everything isn't scalable nor is it a good trust paradigm. I agree with them that they should only build from source, but others should maintain their own. Email is federated, why not app stores? Edit: [0] https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo
  - zanny 10y ago
    Because adding a repo via some random online URL is the exact same reason why downloading random Windows executables creates tons of opportunities for malware to infect computers. The whole point of software stores is giving users the ability to trust the motives of the software they install, because the store and / or its users would never condone hostile software being hosted there. Once you start having everyone run their own F-Droid repos, you are having independent developers give you their own trust keys, but you have no one else who needed to verify those developers were legitimate. F-Droid itself is not particularly secure, given anyone can upload anything there, but in the same way the Archlinux AUR, OpenSUSE Build Service, Ubuntu Launchpad, etc work those third party software repositories are at least hosted by a trusted maintainer of the store / repo itself. If anyone ever uploaded malware there, once found out, it would be taken down and the responsible users banned. With distributed app stores under F-Droid, or the equivalent third party repos for Arch / Suse / Ubuntu, the host has absolutely no control over the behavior of third parties, and thus anyone can host all the hostile malware they want, and if users add those repos they give them absolute trust in doing so. That isn't a valid security model by any estimation.