4 ms·

I don't want to be an ass but: We've been told that too many times. If it's not open source I won't trust my private images to an app. Great idea though!

• sdan 7y ago
  Just turn off wifi/data while using the app (not sure, but I think you can also tweak this in your phone's settings for the app to not give permission to get data without being opened...)
  • Crinus 7y ago
    I do not agree with the comment above about the open source part (that is just plain old FUD), but disabling internet access wouldn't protect against transmitting metadata unless you never turned it on again - it could simply store the metadata locally and wait until it found internet.
    • OzzyB 7y ago
      I think the point the above is making is that you can turn off internet/tcp/http access at the application level, say like we do with Notifications. Surely this could be a welcomed thing.
      • cynix 7y ago
        iPhones sold in China allow you to do this. When an app is run for the first time, you’re asked if you permit it to access the Internet.
• ikurei 7y ago
  How are you gonna ensure the binary uploaded to the app store has the exact same code that is on the public repo? OSS is not the solution. The only solution is that your OS protects you, giving you tools to see what apps are doing what, and allowing you to finely adjust permissions and access. You could completely trust this app if you could ban it from accessing the internet.
  • jaster 7y ago
    I understand your point, but to add to the discussion: With android, you can use the F-Droid app store, which have "source builds". Source builds are apps built (and signed) by F-Droid, so you only need to trust the F-Droid team instead of each OSS app developer (and you can use alternative repositories if you don't). So OSS can be the solution. Sadly such solution is not available on the locked-down iOS ecosystem...
    • jbit 7y ago
      Adding to this: f-droid also encourages reproducible builds: https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/ This means you can verify the APK on the f-droid store matches what's in github by building it yourself and comparing the signatures. And if you want to do this, f-droid has an automated way: https://f-droid.org/en/docs/Verification_Server/ https://f-droid.org/en/docs/Verification_Server/ Of course, you still have to trust the verification server source code, but that runs locally on your hardware and is auditable.
  • vagab0nd 7y ago
    > You could completely trust this app if you could ban it from accessing the internet. Yes. I have a "no-internet" user group on my linux system. Whenever I want to run an untrusted app I run it under that group.
    • severine 7y ago
      That's interesting, care to share some details?
      • vagab0nd 7y ago
        Basically create a group and add an iptables rule to it. Something like: iptables -I OUTPUT 1 -m owner --gid-owner no-internet -j DROP And then when you launch the program: sg no-internet ./something_fishy