6 ms·

It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You ha

by leshow 8y ago

It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You have to root your device to run it, allow third party code. Those are all security concerns too. It was posted elsewhere but here's Moxie's take: https://github.com/signalapp/Signal-Android/issues/127#issuecomment-13335689 https://github.com/signalapp/Signal-Android/issues/127#issue...

abawany 8y ago
You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.
BubuIIC 8y ago
> You have to root your device to run it, allow third party code. Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid. Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.
Hello71 8y ago
> You have to root your device to run it wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions. > allow third party code that's called running apps. tl;dr nice FUD.
- angry_octet 8y ago
  'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.
  - ficklepickle 8y ago
    Then you "untick" it until the next time you need to install something. This is what I do on lineageOS. I don't regularly install new apps. Side rant: This marketer-driven "install an app for everything" is a threat to the open internet and privacy. Usually the only reason is to extract more personal info. Already, young people barely use a web browser. That appears to be the future. Now get off my lawn or I'll start talking about the war.
    - angry_octet 8y ago
      You might do it, but thousands wouldn't. Android could undoubtedly be stronger in this regard, and in permission control, firewall, ad blocking etc, but it's not going to happen. Apps wouldn't be so bad if they were actually sandboxed properly, but yeah, they suck. I was interested in Copperhead OS as an alternative, but it seems to have fallen into a greed induced mess.
      - cannonedhamster 8y ago
        You just shot your own argument against his point in the foot. Thousands of people doesn't even make up a percentage point of the users of Android. Most people on Android use Google Play because it's sufficient against the threats that they need to it be sufficient against. Most people are okay with the risk/reward ratios that come with using commercial software because they then don't have to think about it. Signal provides a nearly turnkey level of protection above and beyond standard messaging in an easy enough format for most people to use.
        angry_octet 8y ago
        IDK what you're going on about. What is your argument? I am arguing Play store is fine, and side loading is bad policy. I argued that for every person who will take the time to micromanage permissions, thousands wouldn't. So what are you talking about?
    - angry_octet 8y ago
- leshow 8y ago
  > that's called running apps. And you accuse me of making things up? "Allow third party code" is not called "running apps"
posterboy 8y ago
> It seems pretty odd to me to distrust someone because they ... ... are using a platform "you" don't trust. Really? That's not really odd. At least, it's not odd, if that usage and what it entails is the denominating part of the persona in this question.
- lordlimecat 8y ago
  Whats odd is calling a application "not secure" because it uses the platform's software distribution channel. Here's a thought. If you are so concerned about the NSA that you think Google's cloud is a problem, why are you running the OS developed by Google?
  - milcron 8y ago
    The open-source base OS is fine, the closed-source services layer and cloud platform are not.
    - lordlimecat 8y ago
      Sounds like you're confident you (or the FOSS community collective) can spot cleverly hidden backdoors. I'm not, and I find that position naieve. For the overwhelming majority of people who are not a cross between Bruce Schneier and Linus Torvalds, a threat model that tries to protect against the NSA and GRU and MSS pretty much requires avoiding anything with a network connection. If you have a smartphone, you should probably just use its default application store.
- leshow 8y ago
  The application uses google play, which almost every other android application in the world uses by default. And somehow that makes them untrustworthy?

by leshow 8y ago

abawany 8y ago

You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.

BubuIIC 8y ago

> You have to root your device to run it, allow third party code. Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid. Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.

Hello71 8y ago

> You have to root your device to run it wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions. > allow third party code that's called running apps. tl;dr nice FUD.

angry_octet 8y ago
'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.
- ficklepickle 8y ago
  Then you "untick" it until the next time you need to install something. This is what I do on lineageOS. I don't regularly install new apps. Side rant: This marketer-driven "install an app for everything" is a threat to the open internet and privacy. Usually the only reason is to extract more personal info. Already, young people barely use a web browser. That appears to be the future. Now get off my lawn or I'll start talking about the war.
  - angry_octet 8y ago
    You might do it, but thousands wouldn't. Android could undoubtedly be stronger in this regard, and in permission control, firewall, ad blocking etc, but it's not going to happen. Apps wouldn't be so bad if they were actually sandboxed properly, but yeah, they suck. I was interested in Copperhead OS as an alternative, but it seems to have fallen into a greed induced mess.
    - cannonedhamster 8y ago
      You just shot your own argument against his point in the foot. Thousands of people doesn't even make up a percentage point of the users of Android. Most people on Android use Google Play because it's sufficient against the threats that they need to it be sufficient against. Most people are okay with the risk/reward ratios that come with using commercial software because they then don't have to think about it. Signal provides a nearly turnkey level of protection above and beyond standard messaging in an easy enough format for most people to use.
      - angry_octet 8y ago
        IDK what you're going on about. What is your argument? I am arguing Play store is fine, and side loading is bad policy. I argued that for every person who will take the time to micromanage permissions, thousands wouldn't. So what are you talking about?
  - angry_octet 8y ago
leshow 8y ago
> that's called running apps. And you accuse me of making things up? "Allow third party code" is not called "running apps"

posterboy 8y ago

> It seems pretty odd to me to distrust someone because they ... ... are using a platform "you" don't trust. Really? That's not really odd. At least, it's not odd, if that usage and what it entails is the denominating part of the persona in this question.

lordlimecat 8y ago
Whats odd is calling a application "not secure" because it uses the platform's software distribution channel. Here's a thought. If you are so concerned about the NSA that you think Google's cloud is a problem, why are you running the OS developed by Google?
- milcron 8y ago
  The open-source base OS is fine, the closed-source services layer and cloud platform are not.
  - lordlimecat 8y ago
    Sounds like you're confident you (or the FOSS community collective) can spot cleverly hidden backdoors. I'm not, and I find that position naieve. For the overwhelming majority of people who are not a cross between Bruce Schneier and Linus Torvalds, a threat model that tries to protect against the NSA and GRU and MSS pretty much requires avoiding anything with a network connection. If you have a smartphone, you should probably just use its default application store.
leshow 8y ago
The application uses google play, which almost every other android application in the world uses by default. And somehow that makes them untrustworthy?