4 ms·

This is a great news and an excellent addition to F-Droid. I hope this is a little nudge to Signal to reconsider inclusion. I believe they're mostly there, th

This is a great news and an excellent addition to F-Droid. I hope this is a little nudge to Signal to reconsider inclusion. I believe they're mostly there, they already have an APK built as a reproducible build (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/) with FOSS components (https://signal.org/android/apk/ https://signal.org/android/apk/)

DarylZero 5y ago
> https://signal.org/android/apk/ https://signal.org/android/apk/ Direct link for those without javascript: https://updates.signal.org/android/Signal-Android-website-prod-universal-release-5.28.10.apk https://updates.signal.org/android/Signal-Android-website-pr...
daptaq 5y ago
I think that Molly (https://molly.im/ https://molly.im/) is a good option if you want to manage "Signal" via F-Droid.
- gowld 5y ago
  Signal has a reputation that Molly lacks. If Signal team doesn't want to post to F-Droid, it would help if they at least made a statement of support or opposition to Molly.
  - dopu 5y ago
    I doubt they would ever endorse the use of a third party interface to Signal.
    - DarylZero 5y ago
      In fact they have publicly whined about it already
- riedel 5y ago
  Molly does not seem to be included in the official fdroid repo. You can also simply add the calyxos fdroid repo to get signal via fdroid https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fingerprint=C44D58B4547DE5096138CB0B34A1CC99DAB3B4274412ED753FCCBFC11DC1B7B6 https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...
  - daptaq 5y ago
    Yeah, that is why I said "manage via F-Droid". The implication is that F-Droid (the app) is responsible for updating your application, not some background service bundled in Signal itself.
- alephxyz 5y ago
  Their webpage claims both: > Molly, like Signal, uses Google’s proprietary code to support some features And >Fully FOSS >Contains no proprietary blobs, unlike Signal. It's also not clear if it can be used as a drop-in replacement to contact people using Signal
  - malermeister 5y ago
    They have two versions! Molly, like Signal, uses Google’s proprietary code to support some features. Molly-FOSS is the community effort to make it 100% free and open-source.
    - alephxyz 5y ago
      That explains my confusion. Thank you
  - crtasm 5y ago
    > if it can be used as a drop-in replacement I had to click through to their github to find: "Molly connects to the Signal server, so you can chat with your Signal contacts seamlessly. Molly and Signal apps can be installed on the same device. If you need a 2nd number to chat, you can use Molly along with Signal. However, you cannot use the same phone number on both apps at the same time."
- mickotron 5y ago
  I use Aurora Store to anonymously download and update apps on Google Play store, all without any Google Play services (I run GrapheneOS). Signal app on my phone is basically the same APK on Play store.
  - IYasha 5y ago
    Have you compared it to APKPure? Just wondering which "store"/repo is more trustworthy, because recently APKPure have shifted to apkx format, which is natively unusable without their own installer app.
    - inside_out_life 5y ago
      Aurora gets apks directly from Play Store via reverse engineered api
rhamzeh 5y ago
Unfortunately Signal devs seem dead-set against F-Droid (whether on F-Droid, or hosting their own F-Droid repository) for some reason. https://github.com/signalapp/Signal-Android/issues/9044#issuecomment-534340623 https://github.com/signalapp/Signal-Android/issues/9044#issu... https://community.signalusers.org/t/signal-f-droid-repository/2808/21 https://community.signalusers.org/t/signal-f-droid-repositor... [EDIT] Last response of theirs on this issue I could find: https://community.signalusers.org/t/wiki-signal-android-app-on-f-droid-store-f-droid-status/28581 https://community.signalusers.org/t/wiki-signal-android-app-...
- asddubs 5y ago
  >For the vast majority of people, installing apps from third-party app stores like F-Droid requires them to enable “unknown sources”. Signal’s developers feel that normalizing this kind of behavior would be “a reversion back to the desktop security model” and that endorsing it through participation would be harmful. The only reason they distribute an APK outside of the Play Store is to reduce the harm of non-technical people installing fake apps instead. I guess it somewhat makes sense that they're against the desktop model of app distribution, but IMO the phone model is not worth the added security. Signal may not have any problems as a messaging app, but both google and apple have some ridiculous rules that categories of apps have to comply with. In particular if you're an app for any sort of art community, prepare to tell your users to censor even mildly suggestive artwork, violent content, content dealing with drug use (even if not glorified), etc. That's not to speak of countless other limitations. The desktop mode of distribution ain't so bad. at least you're still in charge of your own device
- jfax 5y ago
  I find it extremely suspicious, and have pointed it out to others before, that the Signal developers refuse to distribute it without Google Play services (spyware). Coupled with its CIA funding background, I'm glad I've used it. https://yasha.substack.com/p/signal-is-a-government-op https://yasha.substack.com/p/signal-is-a-government-op
  - lucgommans 5y ago
tenuousemphasis 5y ago
What's the benefit to having Signal on F-Droid vs. downloading the APK?
- 0xedd 5y ago
  Manage your version. Trust your APK source.
- lucgommans 5y ago
  The same advantage as having 30 updaters run in the background versus running apt update Imagine every app you install, from your calculator to your chat applications, has to have its own updater. That's why I like F-Droid rather than downloading the Signal APK directly. Already have to do this for Threema unfortunately, as they're neither on F-Droid nor freely available on the Play store.
  - ancientsofmumu 5y ago
    To help clarify to GP (was going to help reply then saw yours) F-Droid is both the name of the core website hosting the APK repos and build infra, and the name of the Android client which can connect to any F-Droid compatible repo - there are a bunch of projects who host their APKs in their own F-Droid repo, all you have to do is go to their website and scan the QR code to add it or enter manually. Signal could run their own F-Droid repo and people just add to their F-Droid client without using or touching the F-Droid website or build infrastructure at all, which would allow folks to do as lucgommans explains - one phone client connected to many repos, no manual downloading. Example: https://www.bromite.org/fdroid https://www.bromite.org/fdroid
    - lucgommans 5y ago
      I hadn't even thought of this, that's a good point and (afaik) negates the entire excuse of Signal's not to be on F-Droid.
  - wolverine876 5y ago
    I think Signal's direct-download APK version (i.e., from signal.org, not from an app store) automatically prompts for updates (can someone verify?).

DarylZero 5y ago

> https://signal.org/android/apk/ https://signal.org/android/apk/ Direct link for those without javascript: https://updates.signal.org/android/Signal-Android-website-prod-universal-release-5.28.10.apk https://updates.signal.org/android/Signal-Android-website-pr...

daptaq 5y ago

I think that Molly (https://molly.im/ https://molly.im/) is a good option if you want to manage "Signal" via F-Droid.

gowld 5y ago
Signal has a reputation that Molly lacks. If Signal team doesn't want to post to F-Droid, it would help if they at least made a statement of support or opposition to Molly.
- dopu 5y ago
  I doubt they would ever endorse the use of a third party interface to Signal.
  - DarylZero 5y ago
    In fact they have publicly whined about it already
riedel 5y ago
Molly does not seem to be included in the official fdroid repo. You can also simply add the calyxos fdroid repo to get signal via fdroid https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fingerprint=C44D58B4547DE5096138CB0B34A1CC99DAB3B4274412ED753FCCBFC11DC1B7B6 https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...
- daptaq 5y ago
  Yeah, that is why I said "manage via F-Droid". The implication is that F-Droid (the app) is responsible for updating your application, not some background service bundled in Signal itself.
alephxyz 5y ago
Their webpage claims both: > Molly, like Signal, uses Google’s proprietary code to support some features And >Fully FOSS >Contains no proprietary blobs, unlike Signal. It's also not clear if it can be used as a drop-in replacement to contact people using Signal
- malermeister 5y ago
  They have two versions! Molly, like Signal, uses Google’s proprietary code to support some features. Molly-FOSS is the community effort to make it 100% free and open-source.
  - alephxyz 5y ago
    That explains my confusion. Thank you
- crtasm 5y ago
  > if it can be used as a drop-in replacement I had to click through to their github to find: "Molly connects to the Signal server, so you can chat with your Signal contacts seamlessly. Molly and Signal apps can be installed on the same device. If you need a 2nd number to chat, you can use Molly along with Signal. However, you cannot use the same phone number on both apps at the same time."
mickotron 5y ago
I use Aurora Store to anonymously download and update apps on Google Play store, all without any Google Play services (I run GrapheneOS). Signal app on my phone is basically the same APK on Play store.
- IYasha 5y ago
  Have you compared it to APKPure? Just wondering which "store"/repo is more trustworthy, because recently APKPure have shifted to apkx format, which is natively unusable without their own installer app.
  - inside_out_life 5y ago
    Aurora gets apks directly from Play Store via reverse engineered api

rhamzeh 5y ago

Unfortunately Signal devs seem dead-set against F-Droid (whether on F-Droid, or hosting their own F-Droid repository) for some reason. https://github.com/signalapp/Signal-Android/issues/9044#issuecomment-534340623 https://github.com/signalapp/Signal-Android/issues/9044#issu... https://community.signalusers.org/t/signal-f-droid-repository/2808/21 https://community.signalusers.org/t/signal-f-droid-repositor... [EDIT] Last response of theirs on this issue I could find: https://community.signalusers.org/t/wiki-signal-android-app-on-f-droid-store-f-droid-status/28581 https://community.signalusers.org/t/wiki-signal-android-app-...

asddubs 5y ago
>For the vast majority of people, installing apps from third-party app stores like F-Droid requires them to enable “unknown sources”. Signal’s developers feel that normalizing this kind of behavior would be “a reversion back to the desktop security model” and that endorsing it through participation would be harmful. The only reason they distribute an APK outside of the Play Store is to reduce the harm of non-technical people installing fake apps instead. I guess it somewhat makes sense that they're against the desktop model of app distribution, but IMO the phone model is not worth the added security. Signal may not have any problems as a messaging app, but both google and apple have some ridiculous rules that categories of apps have to comply with. In particular if you're an app for any sort of art community, prepare to tell your users to censor even mildly suggestive artwork, violent content, content dealing with drug use (even if not glorified), etc. That's not to speak of countless other limitations. The desktop mode of distribution ain't so bad. at least you're still in charge of your own device
jfax 5y ago
I find it extremely suspicious, and have pointed it out to others before, that the Signal developers refuse to distribute it without Google Play services (spyware). Coupled with its CIA funding background, I'm glad I've used it. https://yasha.substack.com/p/signal-is-a-government-op https://yasha.substack.com/p/signal-is-a-government-op
- lucgommans 5y ago

tenuousemphasis 5y ago

What's the benefit to having Signal on F-Droid vs. downloading the APK?

0xedd 5y ago
Manage your version. Trust your APK source.
lucgommans 5y ago
The same advantage as having 30 updaters run in the background versus running apt update Imagine every app you install, from your calculator to your chat applications, has to have its own updater. That's why I like F-Droid rather than downloading the Signal APK directly. Already have to do this for Threema unfortunately, as they're neither on F-Droid nor freely available on the Play store.
- ancientsofmumu 5y ago
  To help clarify to GP (was going to help reply then saw yours) F-Droid is both the name of the core website hosting the APK repos and build infra, and the name of the Android client which can connect to any F-Droid compatible repo - there are a bunch of projects who host their APKs in their own F-Droid repo, all you have to do is go to their website and scan the QR code to add it or enter manually. Signal could run their own F-Droid repo and people just add to their F-Droid client without using or touching the F-Droid website or build infrastructure at all, which would allow folks to do as lucgommans explains - one phone client connected to many repos, no manual downloading. Example: https://www.bromite.org/fdroid https://www.bromite.org/fdroid
  - lucgommans 5y ago
    I hadn't even thought of this, that's a good point and (afaik) negates the entire excuse of Signal's not to be on F-Droid.
- wolverine876 5y ago
  I think Signal's direct-download APK version (i.e., from signal.org, not from an app store) automatically prompts for updates (can someone verify?).