7 ms·

Fennec exists and its already on the F-Droid. Goals are different but probably close enough. The biggest thing I miss is full add-on support. Not having CleanU

Fennec exists and its already on the F-Droid. Goals are different but probably close enough. The biggest thing I miss is full add-on support. Not having CleanURLs and an AMP redirector suck despite add-ons existing for desktop that don't really need a mobile UI.

asimops 5y ago
For half of what CleanURLs does, you can use uBlock Origin. It has a filterlist that removes tracking parameters, etc. It will not however clean links on copy.
- gruez 5y ago
  >It has a filterlist that removes tracking parameters, etc. Which filter list is this? I didn't realize ublock has link rewriting functionality.
  - asimops 5y ago
    It's AdGuard URL Tracking Protection under privacy. This uses https://github.com/uBlockOrigin/uBlock-issues/issues/1356 https://github.com/uBlockOrigin/uBlock-issues/issues/1356
worble 5y ago
If you're on Fennec you can already use a custom addon collection where you can add anything you want.
- brnt 5y ago
  I use Fennec but have no idea what a 'custom addon collection' is. I'd like to install one particular addon thats currently not available.
  - input_sh 5y ago
    The way supported add-ons work right now is that there's a list (AKA a collection) of supported add-ons maintained by Mozilla that you see on a phone by default. You can create a custom collection on a desktop and then override that Mozilla's collection within mobile Firefox's settings: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio... You can install any add-on available on the desktop like that, but your mileage may vary of course.
    - brnt 5y ago
      Thanks. I don't wish to use a Firefox account however. It seems a bit arbitrary to not allow direct installs, but allow them through this workaround.
      - input_sh 5y ago
        They allow direct installs of add-ons that they know were tested properly and work fine on a phone, not those where they can't guarantee that level of stability (while still giving you that as an option if you feel like experimenting). I don't see how that's arbitrary, I see it as a well thought out process, even if I wish more add-ons were added to that collection.
        dblohm7 5y ago
        (Former Firefox for Android engineer here) I agree that there should be more allowed add-ons. Engineering didn't put in all the effort to implement the add-ons APIs on Mobile only for it to be restricted to such a small set. Unfortunately that's a product decision.
    - blibble 5y ago
      is there a way to do this with the official build of the stable version? I would assume running nightly is less than ideal for regular browsing
- donio 5y ago
  Yep, I use this to get vimium-FF on Fennec. It's a little fiddly to setup but it's just another item on the long list of tweaks to make Android tolerable.
mod50ack 5y ago
I use Fennec and both those extensions. https://blog.dbmiller.org/2021-08-19-using-fennec-or-mull-for-extensible-and-secure-browsing-on-android https://blog.dbmiller.org/2021-08-19-using-fennec-or-mull-fo... Fennec is also great because it doesn't include Mozilla's sponsored stuff as well.
ARandomerDude 5y ago
What are HN's thoughts about the security of F-Droid? I always see neat app ideas like the one in the parent comment, but I've been afraid of what I don't know security wise.
- causality0 5y ago
  It's a poor idea to blindly assume anything you're capable of installing must be fine. That's been true for thirty years, whether you're talking about F-Droid, the Play Store, or Windows 98 and a downloaded executable. I had no problem taking a few minutes to think about what I was doing back then and I still don't.
- dvdkon 5y ago
  Everything being built centrally and transparently by an established group puts it leagues ahead of any other app store in my mind. Installing other people's software will always be a potential security problem, but that is unavoidable now.
- dTal 5y ago
  As trustworthy as any Linux distro repository. Which is to say, everything built from public sources, and much of it patched and audited. I'm very grateful for F-Droid.
- NotPractical 5y ago
  One of the important Android security features is the signature enforcement model. All Android apps must be signed, and the OS will refuse to install updates to an app if the signature doesn't match the currently installed version. [1] On the Play Store, apps are signed by each individual developer. Consequently, as long as the APK file distributed by the Play Store was not compromised at the time of initial install, this security feature guarantees that any updates distributed through the Play Store are coming directly from the app developer and have not been modified by Google or any other party. (Play Store, Play Services and the other system-level Google apps have a wide array of scary permissions, so you should assume it's still possible through some convoluted "backdoor" method. That's a separate discussion, though.) You can also check the signature of any app on your phone manually using a tool like Checkey [2], or by extracting the APK file and using apksigner from the Android SDK. F-Droid sort of breaks the signature enforcement model because apps on F-Droid are signed by the F-Droid server, rather than the individual app developers. If you trust the app developer (as you should, especially with proprietary software, but also with complex/harder-to-audit open source software like web browsers), the "developers sign their own apps" model is probably ideal. Android's strict sandbox and permission model reduces the amount of trust you need to place in individual developers anyway. On the other hand, if you trust F-Droid, you can be reasonably confident that the APK file you receive from F-Droid corresponds to the source tarball from F-Droid, and you can inspect the source to verify that the APK doesn't contain malware. Additionally, the F-Droid team manually reviews the source code for each app before approving it. But keep in mind that if F-Droid were compromised, it would be easy to sneak malware into any app on the store. Overall, I would trust F-Droid for most purposes and think it's probably a better place to install apps than the Play Store. I still prefer APK files signed directly by the original developer for critical apps like Signal. In fact, one of the reasons Signal isn't on F-Droid is because the developer doesn't believe it provides enough security. [3] You can download the Signal APK from their website rather than from the Play Store, and it even has an auto-updater built in. [1] https://source.android.com/security/apksigning https://source.android.com/security/apksigning [2] https://guardianproject.info/apps/info.guardianproject.checkey https://guardianproject.info/apps/info.guardianproject.check... [3] https://github.com/signalapp/Signal-Android/issues/281#issuecomment-21762482 https://github.com/signalapp/Signal-Android/issues/281#issue...
NotPractical 5y ago
Indeed. I wonder why Mozilla insists on making it as difficult as possible to sideload extensions on Firefox for Android. I understand compatibility concerns, but surely requiring the user to enable a hidden menu option and click through a warning screen is adequate?

asimops 5y ago

For half of what CleanURLs does, you can use uBlock Origin. It has a filterlist that removes tracking parameters, etc. It will not however clean links on copy.

gruez 5y ago
>It has a filterlist that removes tracking parameters, etc. Which filter list is this? I didn't realize ublock has link rewriting functionality.
- asimops 5y ago
  It's AdGuard URL Tracking Protection under privacy. This uses https://github.com/uBlockOrigin/uBlock-issues/issues/1356 https://github.com/uBlockOrigin/uBlock-issues/issues/1356

worble 5y ago

If you're on Fennec you can already use a custom addon collection where you can add anything you want.

brnt 5y ago
I use Fennec but have no idea what a 'custom addon collection' is. I'd like to install one particular addon thats currently not available.
- input_sh 5y ago
  The way supported add-ons work right now is that there's a list (AKA a collection) of supported add-ons maintained by Mozilla that you see on a phone by default. You can create a custom collection on a desktop and then override that Mozilla's collection within mobile Firefox's settings: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio... You can install any add-on available on the desktop like that, but your mileage may vary of course.
  - brnt 5y ago
    Thanks. I don't wish to use a Firefox account however. It seems a bit arbitrary to not allow direct installs, but allow them through this workaround.
    - input_sh 5y ago
      They allow direct installs of add-ons that they know were tested properly and work fine on a phone, not those where they can't guarantee that level of stability (while still giving you that as an option if you feel like experimenting). I don't see how that's arbitrary, I see it as a well thought out process, even if I wish more add-ons were added to that collection.
      - dblohm7 5y ago
        (Former Firefox for Android engineer here) I agree that there should be more allowed add-ons. Engineering didn't put in all the effort to implement the add-ons APIs on Mobile only for it to be restricted to such a small set. Unfortunately that's a product decision.
  - blibble 5y ago
    is there a way to do this with the official build of the stable version? I would assume running nightly is less than ideal for regular browsing
donio 5y ago
Yep, I use this to get vimium-FF on Fennec. It's a little fiddly to setup but it's just another item on the long list of tweaks to make Android tolerable.

mod50ack 5y ago

I use Fennec and both those extensions. https://blog.dbmiller.org/2021-08-19-using-fennec-or-mull-for-extensible-and-secure-browsing-on-android https://blog.dbmiller.org/2021-08-19-using-fennec-or-mull-fo... Fennec is also great because it doesn't include Mozilla's sponsored stuff as well.

ARandomerDude 5y ago

What are HN's thoughts about the security of F-Droid? I always see neat app ideas like the one in the parent comment, but I've been afraid of what I don't know security wise.

causality0 5y ago
It's a poor idea to blindly assume anything you're capable of installing must be fine. That's been true for thirty years, whether you're talking about F-Droid, the Play Store, or Windows 98 and a downloaded executable. I had no problem taking a few minutes to think about what I was doing back then and I still don't.
dvdkon 5y ago
Everything being built centrally and transparently by an established group puts it leagues ahead of any other app store in my mind. Installing other people's software will always be a potential security problem, but that is unavoidable now.
dTal 5y ago
As trustworthy as any Linux distro repository. Which is to say, everything built from public sources, and much of it patched and audited. I'm very grateful for F-Droid.
NotPractical 5y ago
One of the important Android security features is the signature enforcement model. All Android apps must be signed, and the OS will refuse to install updates to an app if the signature doesn't match the currently installed version. [1] On the Play Store, apps are signed by each individual developer. Consequently, as long as the APK file distributed by the Play Store was not compromised at the time of initial install, this security feature guarantees that any updates distributed through the Play Store are coming directly from the app developer and have not been modified by Google or any other party. (Play Store, Play Services and the other system-level Google apps have a wide array of scary permissions, so you should assume it's still possible through some convoluted "backdoor" method. That's a separate discussion, though.) You can also check the signature of any app on your phone manually using a tool like Checkey [2], or by extracting the APK file and using apksigner from the Android SDK. F-Droid sort of breaks the signature enforcement model because apps on F-Droid are signed by the F-Droid server, rather than the individual app developers. If you trust the app developer (as you should, especially with proprietary software, but also with complex/harder-to-audit open source software like web browsers), the "developers sign their own apps" model is probably ideal. Android's strict sandbox and permission model reduces the amount of trust you need to place in individual developers anyway. On the other hand, if you trust F-Droid, you can be reasonably confident that the APK file you receive from F-Droid corresponds to the source tarball from F-Droid, and you can inspect the source to verify that the APK doesn't contain malware. Additionally, the F-Droid team manually reviews the source code for each app before approving it. But keep in mind that if F-Droid were compromised, it would be easy to sneak malware into any app on the store. Overall, I would trust F-Droid for most purposes and think it's probably a better place to install apps than the Play Store. I still prefer APK files signed directly by the original developer for critical apps like Signal. In fact, one of the reasons Signal isn't on F-Droid is because the developer doesn't believe it provides enough security. [3] You can download the Signal APK from their website rather than from the Play Store, and it even has an auto-updater built in. [1] https://source.android.com/security/apksigning https://source.android.com/security/apksigning [2] https://guardianproject.info/apps/info.guardianproject.checkey https://guardianproject.info/apps/info.guardianproject.check... [3] https://github.com/signalapp/Signal-Android/issues/281#issuecomment-21762482 https://github.com/signalapp/Signal-Android/issues/281#issue...

NotPractical 5y ago

Indeed. I wonder why Mozilla insists on making it as difficult as possible to sideload extensions on Firefox for Android. I understand compatibility concerns, but surely requiring the user to enable a hidden menu option and click through a warning screen is adequate?