3 ms·

On Android, the potential downside (companies stealing your app under alternate names, bundling adware/malware, and even issuing fraudulent takedowns) outweigh

On Android, the potential downside (companies stealing your app under alternate names, bundling adware/malware, and even issuing fraudulent takedowns) outweigh the upsides. Consider allowing some trusted users in your community audit/demo access? The developer of the AetherSX2 emulator for Android worked with the PCSX2 team (Open Source parent software) and YouTubers/other established media in the emulation community to verify their claimed improvements and reputation. https://pcsx2.net/301-aethersx2-pcsx2-mobile.html https://pcsx2.net/301-aethersx2-pcsx2-mobile.html

candiddevmike 5y ago
That seems like a good compromise. I thought about looking for third party attestation services, but it would be a point in time snapshot and probably prohibitively expensive. At the end of the day, the code is written in Go (highly reduced attack surface), doesn't need to be exposed to the internet (works fine locally or over a VPN), and functions perfectly fine with outbound internet access blocked (no phoning home or tracking). I built it the way I want self hosted software to work.
EMIRELADERO 5y ago
Somewhat of a hot take here, but why is this even a problem? Why would shitty clones with malware existing somehow damage the original app? Every open source app on Android has these problems, but they don't seem to affect the app's existance or reputation. And in the case of AetherSX2, the benefits of a transparent, community-driven mobile emulator certainly outweight any risks it may have. The point is not to prevent these things from happening, the point is to have enough people sbowing support and contributions for your software that the clones with malware become something just not worth it to even care about.
- oefrha 5y ago
  > Why would shitty clones with malware existing somehow damage the original app? Best case, you get angry emails. Hell, Daniel Stenberg of curl fame got “I will slaughter you” because someone bundled libcurl and included a copyright notice.[1] Worst case, certain scammers are very good at pretending to the the real thing. [1] https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/
ratww 5y ago
> On Android, the potential downside (companies stealing your app under alternate names, bundling adware/malware, and even issuing fraudulent takedowns) outweigh the upsides. I don't have/use Android, so no dog in this fight, but I can say these things happen in pretty much every other non-niche platform: iOS, Windows, Mac. I've even had people cloning a VS Code extension I did.

candiddevmike 5y ago

That seems like a good compromise. I thought about looking for third party attestation services, but it would be a point in time snapshot and probably prohibitively expensive. At the end of the day, the code is written in Go (highly reduced attack surface), doesn't need to be exposed to the internet (works fine locally or over a VPN), and functions perfectly fine with outbound internet access blocked (no phoning home or tracking). I built it the way I want self hosted software to work.

EMIRELADERO 5y ago

Somewhat of a hot take here, but why is this even a problem? Why would shitty clones with malware existing somehow damage the original app? Every open source app on Android has these problems, but they don't seem to affect the app's existance or reputation. And in the case of AetherSX2, the benefits of a transparent, community-driven mobile emulator certainly outweight any risks it may have. The point is not to prevent these things from happening, the point is to have enough people sbowing support and contributions for your software that the clones with malware become something just not worth it to even care about.

oefrha 5y ago
> Why would shitty clones with malware existing somehow damage the original app? Best case, you get angry emails. Hell, Daniel Stenberg of curl fame got “I will slaughter you” because someone bundled libcurl and included a copyright notice.[1] Worst case, certain scammers are very good at pretending to the the real thing. [1] https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

ratww 5y ago

> On Android, the potential downside (companies stealing your app under alternate names, bundling adware/malware, and even issuing fraudulent takedowns) outweigh the upsides. I don't have/use Android, so no dog in this fight, but I can say these things happen in pretty much every other non-niche platform: iOS, Windows, Mac. I've even had people cloning a VS Code extension I did.