5 ms·

Publishing an F-Droid Repo using a Hardware Security Module

97 points by app4soft 6y ago

black_puppydog 6y ago
F-droid is one of those projects that could really do with more recurring donations. They are extremely unobtrusive about their donations. One of the devs actually writes on his homepage [1] that he would like to work more on google free android, but is currently looking for funding. But apart from that there's just a few buttons on the homepage sidebar. I recently heard that these folks are running the entire operation mostly on goodwill, so I just took the time to look into it a bit. They have about $110 of monthy recurring revenue on OpenCollective [2] and about $750 monthly recurring on liberapay [3]. That's not even one minimum wage salary. That's nothing. They received big donation of 10K they got from Mozillas Opensource Speed dating session at FOSDEM this year [4] which is great. It's not recurring though from what I can see. BUT: for being the one project that people (me included) point to when the question of a more open mobile platform arises, having the entire infrastructure (build servers, hosting, code, not to mention someone supervising the whole thing) be done by a handful of volunteers on a shoestring budget doesn't seem right. Edit: I am aware there are many other open mobile projects and I love them to bits, but they are nowhere near as complete an experience as AOSP + f-droid. Personally, I don't really think of android (even without google and with f-droid) as a free platform, and I don't think that will ever change. So by all means, also donate to Mobian, UBports and all the others. :) [1]: https://bubu1.eu/ https://bubu1.eu/ [2]: https://opencollective.com/f-droid#section-budget https://opencollective.com/f-droid#section-budget [3]: https://liberapay.com/F-Droid-Data/donate https://liberapay.com/F-Droid-Data/donate ( €143.76/week * 52 / 12, converted to USD ) [4]: https://twitter.com/fdroidorg/status/1243499250551410688 https://twitter.com/fdroidorg/status/1243499250551410688
- enriquto 6y ago
  I'm surprised of these low numbers. How come the FSF does not aid this cornerstone project at all?
  - usr1106 6y ago
    Well, FSF is highly ideological; not every FOSS project would match. I have no idea, whether F-Droid would match, I try to keep out of the heavy ideological arguments... Does FSF sponsor any projects? (Honest question, never thought about it...)
    - gnufx 6y ago
      Fiscal sponsorship: https://www.fsf.org/working-together/fiscal-sponsorship https://www.fsf.org/working-together/fiscal-sponsorship F-Droid seems approved as a repo for Replicant, despite its "features you may not like" (but free software) apps.
      - usr1106 6y ago
        > Fiscal sponsorship Interesting. Unfortunately my first web search does not bring up a list of particpating projects, preferably with the amount in question, like e.g. https://spi-inc.org/corporate/annual-reports/2019.pdf https://spi-inc.org/corporate/annual-reports/2019.pdf
- swiley 6y ago
  F-droid is amazing for android. It's probably the one nice thing about the platform. lots of people have probably given up on android now though and there are multiple phones with support for a decent Linux distribution at this point.
  - jmnicolas 6y ago
    > support for a decent Linux distribution Last time I checked (admittedly a few months ago) the Librem 5 was the most promising Linux phone but had trouble reliably making calls! Is there a fluid and reliable (hardware and software) Linux phone? At work we're deploying some stock Android Samsung Xcover4s and despite having good enough hardware on paper they feel really sluggish when using them (before any apps installed, fully updated, most bloatware removed with ADB). So if a 250€ Samsung with stock Android doesn't manage to be pleasant to use, I have doubts that a Linux phone will succeed but I would be happy to be wrong. I'm trying to degoogle my e-life, I'm planning to install GrapheneOS on my Pixel 4 XL but if there's a Linux phone that matches the user experience I may consider switching to that instead.
    - corrund 6y ago
      You are making typical mistake: Linux is joy to develop. Well developed Linux distribution is joy to use for users, but boring for developers. Currently, if you are young developer, you can have lot of joy with Linux on phone.
  - Mediterraneo10 6y ago
    Those multiple phones with support for a decent Linux distribution, don't run certain important apps. OSMAnd beats any of the rudimentary map offerings on the Librem or the Pinephone, for instance. Consequently, in the short term Linux phone users are interested in running Android apps through emulation (Anbox, or Jolla's Android layer), and when you do that, you usually get the apps you need through F-Droid.
    - gnufx 6y ago
      > OSMAnd beats any of the rudimentary map offerings on the Librem or the Pinephone Not to knock OSMAnd, but Ubports' Pure Maps isn't bad, is it?
- ShorsHammer 6y ago
  And yet some people are pulling in $30k a month selling photos of themselves in bikinis on OnlyFans. I try to be an optimist but sometimes it's hard to picture a bright future.
  - myself248 6y ago
    So, perhaps OnlyFans as a platform makes it easy, both in a logistical sense and a psychological one, to support creators you like with a recurring commitment. Are there any open-source platforms that nail both of those factors? Conclusion: Maybe F-Droid should be on OF.
- m-p-3 6y ago
  Without them, we wouldn't have a reliable way of acquiring and updating apps that Google doesn't want on its platform like NewPipe.
- gnufx 6y ago
  > AOSP + f-droid It might or might not be considered significantly different from AOSP, and at least most of the free apps in their "store" must come from F-Droid, but there's /e/: https://e.foundation https://e.foundation Three cheers for F-Droid anyhow, and I'd have thought it should be mentioned under https://doc.e.foundation/projects-looking-for-contributors https://doc.e.foundation/projects-looking-for-contributors
octoberfranklin 6y ago
> once a key is generated inside a HSM it can never be extracted in plain text form. Wow, good thing it can only be extracted in Base64-encoded form! Those 3133+ h4x0rs will never figure out how to decode it!
StavrosK 6y ago
This is great, and I'd like to see generic hardware support for signing across OSes and programs. I guess FIDO2 is the closest we have to that right now, but that's rather application-specific. Still, that might be a strength rather than a weakness (I'm not readily sure if the keys transfer from, say, one computer to another), and I'd like to see it proliferate more.
- upofadown 6y ago
  FIDO2 is just for authentication, isn't it? This is for signing in the hardware enclave. For that there are standards like S/MIME and OpenPGP that can run in the enclave.
  - StavrosK 6y ago
    It lets you sign a token to authenticate (which is its primary purpose), I'm not sure off the top of my head if it can't also be used to sign arbitrary data...
zdw 6y ago
Any comments on Nitrokey as a HSM? The price seems reasonable, especially compared to other vendors, and the open-source development policies are attractive.

97 points by app4soft 6y ago

F-droid is one of those projects that could really do with more recurring donations. They are extremely unobtrusive about their donations. One of the devs actually writes on his homepage [1] that he would like to work more on google free android, but is currently looking for funding. But apart from that there's just a few buttons on the homepage sidebar. I recently heard that these folks are running the entire operation mostly on goodwill, so I just took the time to look into it a bit. They have about $110 of monthy recurring revenue on OpenCollective [2] and about $750 monthly recurring on liberapay [3]. That's not even one minimum wage salary. That's nothing. They received big donation of 10K they got from Mozillas Opensource Speed dating session at FOSDEM this year [4] which is great. It's not recurring though from what I can see. BUT: for being the one project that people (me included) point to when the question of a more open mobile platform arises, having the entire infrastructure (build servers, hosting, code, not to mention someone supervising the whole thing) be done by a handful of volunteers on a shoestring budget doesn't seem right. Edit: I am aware there are many other open mobile projects and I love them to bits, but they are nowhere near as complete an experience as AOSP + f-droid. Personally, I don't really think of android (even without google and with f-droid) as a free platform, and I don't think that will ever change. So by all means, also donate to Mobian, UBports and all the others. :) [1]: https://bubu1.eu/ https://bubu1.eu/ [2]: https://opencollective.com/f-droid#section-budget https://opencollective.com/f-droid#section-budget [3]: https://liberapay.com/F-Droid-Data/donate https://liberapay.com/F-Droid-Data/donate ( €143.76/week * 52 / 12, converted to USD ) [4]: https://twitter.com/fdroidorg/status/1243499250551410688 https://twitter.com/fdroidorg/status/1243499250551410688

enriquto 6y ago
I'm surprised of these low numbers. How come the FSF does not aid this cornerstone project at all?
- usr1106 6y ago
  Well, FSF is highly ideological; not every FOSS project would match. I have no idea, whether F-Droid would match, I try to keep out of the heavy ideological arguments... Does FSF sponsor any projects? (Honest question, never thought about it...)
  - gnufx 6y ago
    Fiscal sponsorship: https://www.fsf.org/working-together/fiscal-sponsorship https://www.fsf.org/working-together/fiscal-sponsorship F-Droid seems approved as a repo for Replicant, despite its "features you may not like" (but free software) apps.
    - usr1106 6y ago
      > Fiscal sponsorship Interesting. Unfortunately my first web search does not bring up a list of particpating projects, preferably with the amount in question, like e.g. https://spi-inc.org/corporate/annual-reports/2019.pdf https://spi-inc.org/corporate/annual-reports/2019.pdf
swiley 6y ago
F-droid is amazing for android. It's probably the one nice thing about the platform. lots of people have probably given up on android now though and there are multiple phones with support for a decent Linux distribution at this point.
- jmnicolas 6y ago
  > support for a decent Linux distribution Last time I checked (admittedly a few months ago) the Librem 5 was the most promising Linux phone but had trouble reliably making calls! Is there a fluid and reliable (hardware and software) Linux phone? At work we're deploying some stock Android Samsung Xcover4s and despite having good enough hardware on paper they feel really sluggish when using them (before any apps installed, fully updated, most bloatware removed with ADB). So if a 250€ Samsung with stock Android doesn't manage to be pleasant to use, I have doubts that a Linux phone will succeed but I would be happy to be wrong. I'm trying to degoogle my e-life, I'm planning to install GrapheneOS on my Pixel 4 XL but if there's a Linux phone that matches the user experience I may consider switching to that instead.
  - corrund 6y ago
    You are making typical mistake: Linux is joy to develop. Well developed Linux distribution is joy to use for users, but boring for developers. Currently, if you are young developer, you can have lot of joy with Linux on phone.
- Mediterraneo10 6y ago
  Those multiple phones with support for a decent Linux distribution, don't run certain important apps. OSMAnd beats any of the rudimentary map offerings on the Librem or the Pinephone, for instance. Consequently, in the short term Linux phone users are interested in running Android apps through emulation (Anbox, or Jolla's Android layer), and when you do that, you usually get the apps you need through F-Droid.
  - gnufx 6y ago
    > OSMAnd beats any of the rudimentary map offerings on the Librem or the Pinephone Not to knock OSMAnd, but Ubports' Pure Maps isn't bad, is it?
ShorsHammer 6y ago
And yet some people are pulling in $30k a month selling photos of themselves in bikinis on OnlyFans. I try to be an optimist but sometimes it's hard to picture a bright future.
- myself248 6y ago
  So, perhaps OnlyFans as a platform makes it easy, both in a logistical sense and a psychological one, to support creators you like with a recurring commitment. Are there any open-source platforms that nail both of those factors? Conclusion: Maybe F-Droid should be on OF.
m-p-3 6y ago
Without them, we wouldn't have a reliable way of acquiring and updating apps that Google doesn't want on its platform like NewPipe.
gnufx 6y ago
> AOSP + f-droid It might or might not be considered significantly different from AOSP, and at least most of the free apps in their "store" must come from F-Droid, but there's /e/: https://e.foundation https://e.foundation Three cheers for F-Droid anyhow, and I'd have thought it should be mentioned under https://doc.e.foundation/projects-looking-for-contributors https://doc.e.foundation/projects-looking-for-contributors

octoberfranklin 6y ago

> once a key is generated inside a HSM it can never be extracted in plain text form. Wow, good thing it can only be extracted in Base64-encoded form! Those 3133+ h4x0rs will never figure out how to decode it!

StavrosK 6y ago

This is great, and I'd like to see generic hardware support for signing across OSes and programs. I guess FIDO2 is the closest we have to that right now, but that's rather application-specific. Still, that might be a strength rather than a weakness (I'm not readily sure if the keys transfer from, say, one computer to another), and I'd like to see it proliferate more.

upofadown 6y ago
FIDO2 is just for authentication, isn't it? This is for signing in the hardware enclave. For that there are standards like S/MIME and OpenPGP that can run in the enclave.
- StavrosK 6y ago
  It lets you sign a token to authenticate (which is its primary purpose), I'm not sure off the top of my head if it can't also be used to sign arbitrary data...

zdw 6y ago

Any comments on Nitrokey as a HSM? The price seems reasonable, especially compared to other vendors, and the open-source development policies are attractive.