4 ms·

Believe it or not, Joe public hasn't heard of f-droid. Google Play is the app store for most android users (at least in the west).

wy6psk 8y ago
This is KDE Connect, not Snapchat. Joe Linuxonthedesktop has definitely heard of F-Droid.
- Arnt 8y ago
  Speaking as a KDE Connect user who's heard of F-Droid, I installed F-Droid, then deinstalled it. It was too noisy and intrusive. When I told it I didn't want to replace an app with its version it kept asking again and again, every day at least. Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. That's as bad as the TLS inteceptors that insist on accepting an extra CA. Some people seem to think that F-Droid is obviously preferable to Googleplay. That is, at the very least, not obvious.
  - Iolaum 8y ago
    Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify code and control dependencies). This means that they can only use their own keys.
    - levosmetalo 8y ago
      Debian is also signing all Debian packages with in their own repositories with their own keys, and nobody takes this as an issue.
    - Arnt 8y ago
      No it doesn't. They could check the developer's signature against an APK built from source. It's not that difficult. BTW. In my case the app they urged me to replace the stock keyboard with a version that had been built without support for Norwegian. Is the language data in Android non-free?
      - kuschku 8y ago
        They can, and they offer that, if the developer supports reproducible builds. Most apps aren’t possible to be built reproducibly, though, as the Android developer toolkit was never designed for reproducible builds and relies on stuff like filesystem ordering of files (which differs between machines).
    - kuschku 8y ago
      You’re even able to ship your own builds signed with your own developer key on F-Droid if F-Droid is able to build the exact same APK themselves. Reproducible builds are the best option for such a store :)
  - 0815test 8y ago
    > Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. They do reproducible builds starting from publicly available source. Given the AOSP design where code signatures are mandatory and updates are only allowed if signed by the same key, they're taking the best feasible approach.
  - BubuIIC 8y ago
    > When I told it I didn't want to replace an app with its version it kept asking again and again, every day at least. F-Droid can't replace a version installed form GPlay with it's own version as they are (except a handful) signed with a different key. It also won't even show you these versions anymore unless you enable an expert settings options.
  - ForHackernews 8y ago
    I trust the F-Droid maintainers more than J. Random app developer, honestly.
    - Arnt 8y ago
      Care to elaborate? You're trusting the developer to write the source code and do all the debug builds, what's the problem with building the production build?
      - ubercow13 8y ago
        Assuming you trust F-Droid, it eliminates the possibility that the developer isn't using their published source code. eg. they might hide their tracking code from their public github repo but build it into their release apk.
- williamdclt 8y ago
  I'm a linux user, I've never heard of it and the friction would make me hesitate
  - icebraining 8y ago
    What friction? It's easier to use than the Play Store.
    - anowlcalledjosh 8y ago
      It also doesn't come preinstalled on any devices I'm aware of, which adds a significant amount of friction. Even once you've installed it, it can't auto-update apps.
      - jraph 8y ago
        Yes it can, though it needs to be installed as a privileged app.
      - beatgammit 8y ago
        So? Netflix didn't come preinstalled on my phone, but I still use it. Installing F-Droid is easy, and installing and managing apps through it is also easy. I prefer it when I can find a suitable app.
        anowlcalledjosh 8y ago
        > Installing F-Droid is easy but nevertheless harder than installing Netflix > installing and managing apps through it is also easy but updates are not automatic (unless you root) I don't dispute that F-Droid is not terribly difficult to use, but the original statement that "It's easier to use than the Play Store" is obviously false as soon as you take into account the mechanics of getting it installed.
    - williamdclt 8y ago
      I need to look up what it is, if it's serious, how to install it, how to use it
metildaa 8y ago
Unless you have a device from Amazon (Fire tablet/stick), which runs Google-free Android.
pfortuny 8y ago
Thank you, man.
caseymarquis 8y ago
I'm a software developer. I'm on HN daily, trying to keep tabs on new technology and such. I used to make android games as a hobby 8 years ago. I'm posting this from an android phone. I hadn't heard of f-droid until just now. As an aside, there must be a better way to keep track of new technologies. I hate not recognizing something important.

wy6psk 8y ago

This is KDE Connect, not Snapchat. Joe Linuxonthedesktop has definitely heard of F-Droid.

Arnt 8y ago
Speaking as a KDE Connect user who's heard of F-Droid, I installed F-Droid, then deinstalled it. It was too noisy and intrusive. When I told it I didn't want to replace an app with its version it kept asking again and again, every day at least. Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. That's as bad as the TLS inteceptors that insist on accepting an extra CA. Some people seem to think that F-Droid is obviously preferable to Googleplay. That is, at the very least, not obvious.
- Iolaum 8y ago
  Fdroid maintainers require shipped apk's to have 0 non-free components. The only way to ensure that is to build the apps themselves (so that they can verify code and control dependencies). This means that they can only use their own keys.
  - levosmetalo 8y ago
    Debian is also signing all Debian packages with in their own repositories with their own keys, and nobody takes this as an issue.
  - Arnt 8y ago
    No it doesn't. They could check the developer's signature against an APK built from source. It's not that difficult. BTW. In my case the app they urged me to replace the stock keyboard with a version that had been built without support for Norwegian. Is the language data in Android non-free?
    - kuschku 8y ago
      They can, and they offer that, if the developer supports reproducible builds. Most apps aren’t possible to be built reproducibly, though, as the Android developer toolkit was never designed for reproducible builds and relies on stuff like filesystem ordering of files (which differs between machines).
  - kuschku 8y ago
    You’re even able to ship your own builds signed with your own developer key on F-Droid if F-Droid is able to build the exact same APK themselves. Reproducible builds are the best option for such a store :)
- 0815test 8y ago
  > Since then I've head that the F-Droid operators insist on signing all apps themselves, instead of the developers' signature. They do reproducible builds starting from publicly available source. Given the AOSP design where code signatures are mandatory and updates are only allowed if signed by the same key, they're taking the best feasible approach.
- BubuIIC 8y ago
  > When I told it I didn't want to replace an app with its version it kept asking again and again, every day at least. F-Droid can't replace a version installed form GPlay with it's own version as they are (except a handful) signed with a different key. It also won't even show you these versions anymore unless you enable an expert settings options.
- ForHackernews 8y ago
  I trust the F-Droid maintainers more than J. Random app developer, honestly.
  - Arnt 8y ago
    Care to elaborate? You're trusting the developer to write the source code and do all the debug builds, what's the problem with building the production build?
    - ubercow13 8y ago
      Assuming you trust F-Droid, it eliminates the possibility that the developer isn't using their published source code. eg. they might hide their tracking code from their public github repo but build it into their release apk.
williamdclt 8y ago
I'm a linux user, I've never heard of it and the friction would make me hesitate
- icebraining 8y ago
  What friction? It's easier to use than the Play Store.
  - anowlcalledjosh 8y ago
    It also doesn't come preinstalled on any devices I'm aware of, which adds a significant amount of friction. Even once you've installed it, it can't auto-update apps.
    - jraph 8y ago
      Yes it can, though it needs to be installed as a privileged app.
    - beatgammit 8y ago
      So? Netflix didn't come preinstalled on my phone, but I still use it. Installing F-Droid is easy, and installing and managing apps through it is also easy. I prefer it when I can find a suitable app.
      - anowlcalledjosh 8y ago
        > Installing F-Droid is easy but nevertheless harder than installing Netflix > installing and managing apps through it is also easy but updates are not automatic (unless you root) I don't dispute that F-Droid is not terribly difficult to use, but the original statement that "It's easier to use than the Play Store" is obviously false as soon as you take into account the mechanics of getting it installed.
  - williamdclt 8y ago
    I need to look up what it is, if it's serious, how to install it, how to use it

metildaa 8y ago

Unless you have a device from Amazon (Fire tablet/stick), which runs Google-free Android.

pfortuny 8y ago

Thank you, man.

caseymarquis 8y ago

I'm a software developer. I'm on HN daily, trying to keep tabs on new technology and such. I used to make android games as a hobby 8 years ago. I'm posting this from an android phone. I hadn't heard of f-droid until just now. As an aside, there must be a better way to keep track of new technologies. I hate not recognizing something important.