3 ms·

i've been using this app and i honestly prefer it this way. Lets not forget that certificates are created and checked for github.com, so unlikely for a middlem

i've been using this app and i honestly prefer it this way. Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. I trust github much more than google right now. Especially since the object being fetched is generic as opposed to a appstore. Google's app store has only shown to hinder publishing. Take syncthing for instance. The only thing I wish was better was the .apk selection process. It would be nice if a database existed with filename formats or a little extra metadata to match the correct asset.

g-b-r 2y ago
> Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. What? Don't assume that the APKs are generated by GitHub's CI, anyhow, anything can be uploaded as a release
- rcMgD2BwE72F 2y ago
  Github should provide a certificate when binaries are built from source with their tools.
  - g-b-r 2y ago
    They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case, there's for sure no GitHub certificate added to the APKs
    - porridgeraisin 2y ago
      NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
      - g-b-r 2y ago
        I saw, nice It seems to not check it automatically, though?
        porridgeraisin 2y ago
        Yeah, you have to set provenance flag to true. - uses: JS-DevTools/npm-publish@v2 with: token: ${{ secrets.NPM_TOKEN }} access: public provenance: true For example
- yonatan8070 2y ago
  A great example of this would be the XZ backdoor, which never got commited to the source tree, but got implanted in the release tarballs, which were built on the attacker's systems
ap-andersson 2y ago
Do you mean https://apps.obtainium.imranr.dev/ https://apps.obtainium.imranr.dev/ or something else? That seems to be a crowdsources list of configurations for different apps.

g-b-r 2y ago

> Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. What? Don't assume that the APKs are generated by GitHub's CI, anyhow, anything can be uploaded as a release

rcMgD2BwE72F 2y ago
Github should provide a certificate when binaries are built from source with their tools.
- g-b-r 2y ago
  They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case, there's for sure no GitHub certificate added to the APKs
  - porridgeraisin 2y ago
    NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
    - g-b-r 2y ago
      I saw, nice It seems to not check it automatically, though?
      - porridgeraisin 2y ago
        Yeah, you have to set provenance flag to true. - uses: JS-DevTools/npm-publish@v2 with: token: ${{ secrets.NPM_TOKEN }} access: public provenance: true For example
yonatan8070 2y ago
A great example of this would be the XZ backdoor, which never got commited to the source tree, but got implanted in the release tarballs, which were built on the attacker's systems

ap-andersson 2y ago

Do you mean https://apps.obtainium.imranr.dev/ https://apps.obtainium.imranr.dev/ or something else? That seems to be a crowdsources list of configurations for different apps.