4 ms·

Mobile app only and no source code? I appreciate the effort but I'll stick with Mastodon for now.

fourside 2y ago
> no source code? The way that some people on HN so casually demand someone to build something and then completely give it away never ceases to disappoint. Thankfully the fact that this community is growing tells me this is not how most people think.
- Diti 2y ago
  With the current politics, how do you expect minorities to trust a product with their identity and (sometimes) life, if you can’t inspect what’s being done with your data?
  - kenjackson 2y ago
    Real question : how do you verify that the source code matches the code of the service you’re using? Is there some service that builds and hosts and you can verify what it builds against the hosted location?
    - thrance 2y ago
      You can only ever really ensure the client you use wasn't tampererd with, by carefully reading all of its source code and then building it yourself. For every update. Realistically, you will always need a minimum amount of trust, just don't misplace it.
      - beeflet 2y ago
        The minimum amount of trust is clearly a lot less for open source software because anyone can view the source and whistleblow vulnerabilities (and many will regularly do so to contribute or modify it anyways). Also, compiling and verifying software updates is pretty easy for typical application programs. I do it for cryptocurrency software, you just look over diffs and make sure it matches up to the changelog.
    - beeflet 2y ago
      yes, this is exactly what open source "app stores" like f-droid do: reproducible builds. Also it is pretty trivial to compile it yourself to confirm.
      - kenjackson 2y ago
        Just because I can compile it doesn’t mean it’s the same as what’s being run on the service. The build and what’s hosted have to be the same.
      - _Algernon_ 2y ago
        Doesn't matter if the app is just an interface to a web server.
        beeflet 2y ago
        if it's just an interface to a web server, it should just be a web page not an app
- beeflet 2y ago
  it could have just been a website
- saagarjha 2y ago
  Many people here do not view providing source code as "completely giving it away".
t4t 2y ago
The source is actually freely available for both the app and the web: https://gitea.com/t4t https://gitea.com/t4t
- nyanpasu64 2y ago
  Took a quick look through the sources (I'm aware they're not officially intended for local builds) but haven't found anything interesting (yet). First impressions: - The API keys are obtained using flutter_dotenv, and omitted from the Git source but trivially extractable from the Play Store APK (using a rooted phone). - After installing the .env file and building t4t locally, I was unable to log into the Android app using a Gmail account; every attempt left the app in a not-logged-in state. The same thing happened after replacing my local app with the Play Store version? (EDIT: After restarting the app I was able to proceed?) - (nitpick/observation) When I tap a post, the app opens the user's post history, and I try scrolling the list, the view lags behind my finger. Can't tell if it's latency, dropped frames, or both together.
  - t4t 2y ago
    These are all public keys so I am not too worried, but I appreciate the heads up. I will make more effort to obfuscate them.

> no source code? The way that some people on HN so casually demand someone to build something and then completely give it away never ceases to disappoint. Thankfully the fact that this community is growing tells me this is not how most people think.

Diti 2y ago
With the current politics, how do you expect minorities to trust a product with their identity and (sometimes) life, if you can’t inspect what’s being done with your data?
- kenjackson 2y ago
  Real question : how do you verify that the source code matches the code of the service you’re using? Is there some service that builds and hosts and you can verify what it builds against the hosted location?
  - thrance 2y ago
    You can only ever really ensure the client you use wasn't tampererd with, by carefully reading all of its source code and then building it yourself. For every update. Realistically, you will always need a minimum amount of trust, just don't misplace it.
    - beeflet 2y ago
      The minimum amount of trust is clearly a lot less for open source software because anyone can view the source and whistleblow vulnerabilities (and many will regularly do so to contribute or modify it anyways). Also, compiling and verifying software updates is pretty easy for typical application programs. I do it for cryptocurrency software, you just look over diffs and make sure it matches up to the changelog.
  - beeflet 2y ago
    yes, this is exactly what open source "app stores" like f-droid do: reproducible builds. Also it is pretty trivial to compile it yourself to confirm.
    - kenjackson 2y ago
      Just because I can compile it doesn’t mean it’s the same as what’s being run on the service. The build and what’s hosted have to be the same.
    - _Algernon_ 2y ago
      Doesn't matter if the app is just an interface to a web server.
      - beeflet 2y ago
        if it's just an interface to a web server, it should just be a web page not an app
beeflet 2y ago
it could have just been a website
saagarjha 2y ago
Many people here do not view providing source code as "completely giving it away".

t4t 2y ago

The source is actually freely available for both the app and the web: https://gitea.com/t4t https://gitea.com/t4t

nyanpasu64 2y ago
Took a quick look through the sources (I'm aware they're not officially intended for local builds) but haven't found anything interesting (yet). First impressions: - The API keys are obtained using flutter_dotenv, and omitted from the Git source but trivially extractable from the Play Store APK (using a rooted phone). - After installing the .env file and building t4t locally, I was unable to log into the Android app using a Gmail account; every attempt left the app in a not-logged-in state. The same thing happened after replacing my local app with the Play Store version? (EDIT: After restarting the app I was able to proceed?) - (nitpick/observation) When I tap a post, the app opens the user's post history, and I try scrolling the list, the view lags behind my finger. Can't tell if it's latency, dropped frames, or both together.
- t4t 2y ago
  These are all public keys so I am not too worried, but I appreciate the heads up. I will make more effort to obfuscate them.