4 ms·

So a journalist or whistle-blower should use Play Store instead? You can put any repository you want on F-Droid and it'll alert you when there's new updates, th

So a journalist or whistle-blower should use Play Store instead? You can put any repository you want on F-Droid and it'll alert you when there's new updates, that's much better than just having the apk. > Firefox klar(focus) was outdated for six months because they couldn't build it. A build that can't be reproduced is also a security threat.

bubblethink 7y ago
>So a journalist or whistle-blower should use Play Store instead? Of course. There is nothing wrong with the play store per se in this context other than it not being FOSS. >A build that can't be reproduced is also a security threat. No. That's not the issue. F-droid has its own requirements which basically boil down to building software in their own debian VM with no/limited external software. That's an orthogonal engineering issue unrelated to security outside this narrow scope. There is a lot of upstream software that cannot be 'built' by f-droid. It can demonstrably be built if you follow the upstream's README.
- southerntofu 7y ago
  > There is nothing wrong with the play store per se in this context other than it not being FOSS. Well, the store itself isn't free-software. But the software it distributes also isn't free software and is many times crapware/malware, without any human review. F-Droid has "AntiFeatures" tags on applications, and while these could be better, they're already more informational for end-users than blindly downloading/running programs : https://f-droid.org/wiki/page/Antifeatures https://f-droid.org/wiki/page/Antifeatures Then, there's also the problem that Google Play Store relies on Google Play Services. So if you don't want to install Google's universal backdoor on your phone (which Google used last year to push silent config updates on some phones, wtf?) you can't use that. Or you have to use F-Droid to setup a Play Store scrapper such as Yalp or Aurora.

bubblethink 7y ago

>So a journalist or whistle-blower should use Play Store instead? Of course. There is nothing wrong with the play store per se in this context other than it not being FOSS. >A build that can't be reproduced is also a security threat. No. That's not the issue. F-droid has its own requirements which basically boil down to building software in their own debian VM with no/limited external software. That's an orthogonal engineering issue unrelated to security outside this narrow scope. There is a lot of upstream software that cannot be 'built' by f-droid. It can demonstrably be built if you follow the upstream's README.

southerntofu 7y ago
> There is nothing wrong with the play store per se in this context other than it not being FOSS. Well, the store itself isn't free-software. But the software it distributes also isn't free software and is many times crapware/malware, without any human review. F-Droid has "AntiFeatures" tags on applications, and while these could be better, they're already more informational for end-users than blindly downloading/running programs : https://f-droid.org/wiki/page/Antifeatures https://f-droid.org/wiki/page/Antifeatures Then, there's also the problem that Google Play Store relies on Google Play Services. So if you don't want to install Google's universal backdoor on your phone (which Google used last year to push silent config updates on some phones, wtf?) you can't use that. Or you have to use F-Droid to setup a Play Store scrapper such as Yalp or Aurora.