3 ms·
Is it as bad as they're making it out to be? The fdroidserver get_first_signer_certificate can give a different result to apksigner, but then fdroidserver calls
by mappu 2y ago
Is it as bad as they're making it out to be? The fdroidserver get_first_signer_certificate can give a different result to apksigner, but then fdroidserver calls apksigner anyway for verification, and F-Droid mitigates the issue in various other ways.
I think F-Droid were acting in the right up to that point; and then the latest update (regex newlines) is 0day? Has there been a response from F-Droid about the updates?
- KennyBlanken 2y agoWell, this is pretty concerning all on its own: > Instead of adopting the fixes we proposed, F-Droid wrote and merged their own patch [10], ignoring repeated warnings it had significant flaws (including an incorrect implementation of v1 signature verification and making it impossible to have APKs with rotated keys in a repository). This concerns me more than the vulnerabilities themselves. It's a pretty serious failure in leadership and shows that F-Droid is still driven by egos, not sound software engineering practices and a genuine interest in doing right for the community. F-Droid has numerous issues: * glacially slow to release updates even when security patches are released * not enforcing 2FA for developer accounts * no automatic vulnerability or malware scanning ...and more problems: https://privsec.dev/posts/android/f-droid-security-issues/ https://privsec.dev/posts/android/f-droid-security-issues/