4 ms·

Free app stores like F-Droid are also great for stopping you from downloading crap software. Whenever I need "normal software" (music player, PDF reader, RSS fe

Free app stores like F-Droid are also great for stopping you from downloading crap software. Whenever I need "normal software" (music player, PDF reader, RSS feed, what have you) I search for it there and don't suffer through ads or microtransactions. It's like using Linux, free software is just what I default to now. Using stock iOS and Android today, it feels like both sides have lost the script. The entire pipeline of "consumption" dominates both platforms, and demands you pay money or accept a competitor's inferior product. Google didn't even let F-Droid auto-update apps until recently, it's a racket on either side. We need to bring the hammer down and enable people to stop supporting shit businesses. The current loop of consumption is going to kill everything we love about computing with a long and painful extortion process.

throwaway2037 2y ago
Real question: How does F-Droid police malware?
- talldayo 2y ago
  By disallowing all proprietary software, building each application themselves, and then signing it with their key before the end-user receives it.
  - throwaway2037 2y ago
    I was not aware. This is interesting to know. Let's go deeper about "malware". I'm sorry that I was not more specific. What about some dumb app that shows holiday calendars or "the weather", but actually uses your mobile to secretly mine Bitcoin? Does their process also stop that type of malware?
    - talldayo 2y ago
      That sort of attack would need to take one of two forms: 1) Hijacking an already-approved application 2) Creating a forked/new fraudulent application and submitting it to the store Option 1 requires you to fool the repository owner, first of all. That would mean submitting a pull-request with your malicious code, having that malicious code reviewed by the app author, and then getting it into a major release. In most apps with a significant userbase that's nigh-unimaginable; especially if there are testers or multiple contributors testing and debugging on recent builds. Option 2 requires you to fool the F-Droid admins. This means one of two things. Either creating a forked application with plausible yet distinct features that make it necessary to be forked from the main project. Alternatively, you get ChatGPT (or just copy boilerplate ffs) and make a calculator app or whatever, commit it all to Github and send it in for review. Both of these routes are horribly suspicious - a reviewer is going to want to see if you have multiple contributors, a long history on Github, linked social media accounts or websites, other repositories, binary blobs, that sort of stuff. Maybe they aren't the most cautious, but suffice to say anyone making an attack like this is going to be covered in red flags. So; it's a feasible attack. But it requires so much social manipulation for so little feasible gain (especially when F-Droid wasn't even auto-updating for most people) that it's not worth the effort. If you do manage such a daring attack, your reward is maybe 300-odd sideloading users that mistakenly clicked your install button instead of the other guy's.

throwaway2037 2y ago

Real question: How does F-Droid police malware?

talldayo 2y ago
By disallowing all proprietary software, building each application themselves, and then signing it with their key before the end-user receives it.
- throwaway2037 2y ago
  I was not aware. This is interesting to know. Let's go deeper about "malware". I'm sorry that I was not more specific. What about some dumb app that shows holiday calendars or "the weather", but actually uses your mobile to secretly mine Bitcoin? Does their process also stop that type of malware?
  - talldayo 2y ago
    That sort of attack would need to take one of two forms: 1) Hijacking an already-approved application 2) Creating a forked/new fraudulent application and submitting it to the store Option 1 requires you to fool the repository owner, first of all. That would mean submitting a pull-request with your malicious code, having that malicious code reviewed by the app author, and then getting it into a major release. In most apps with a significant userbase that's nigh-unimaginable; especially if there are testers or multiple contributors testing and debugging on recent builds. Option 2 requires you to fool the F-Droid admins. This means one of two things. Either creating a forked application with plausible yet distinct features that make it necessary to be forked from the main project. Alternatively, you get ChatGPT (or just copy boilerplate ffs) and make a calculator app or whatever, commit it all to Github and send it in for review. Both of these routes are horribly suspicious - a reviewer is going to want to see if you have multiple contributors, a long history on Github, linked social media accounts or websites, other repositories, binary blobs, that sort of stuff. Maybe they aren't the most cautious, but suffice to say anyone making an attack like this is going to be covered in red flags. So; it's a feasible attack. But it requires so much social manipulation for so little feasible gain (especially when F-Droid wasn't even auto-updating for most people) that it's not worth the effort. If you do manage such a daring attack, your reward is maybe 300-odd sideloading users that mistakenly clicked your install button instead of the other guy's.