3 ms·
Functions != secure. You must turn on Untrusted Sources which disables meaningful signature verification. Now you must hope you don't get MITMed every time yo
by lrvick 6y ago
Functions != secure.
You must turn on Untrusted Sources which disables meaningful signature verification.
Now you must hope you don't get MITMed every time you update.
It is a joke they seriously expect people to sideload.
They need to provide a deterministic and easily auditable F-Deoid repo or let the F-Droid team compile/sign it for them.
Neither will happen though because moxie has been very open about the fact he wants the analytics that comes with google/apple tracked installs, user privacy be damned.
- KAMSPioneer 6y agoNot entirely true. On recent versions of Android, you are asked to give "install untrusted apps" permission on a per-source basis (e.g. I downloaded an apk from Chrome, now I have to allow Chrome to be a source of installable apks). Also, it doesn't disable signature verification at all -- it just changes to what is essentially a TOFU model. You can verify this by installing, say, NewPipe from vanilla Fdroid, then adding the NewPipe repo and installing a build from there. It will fail unless you completely remove the original app (from all the profiles on the device!) and install the new one afterwards. This is due to different signatures between repos. In any case, I agree with your wider point about Signal's rather concerning distribution strategy. I would like to see inclusion in Fdroid, or at least a custom third-party repository. Unlikely though.