5 ms·
> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android
by bogwog 11mo ago
> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.
1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of how Android security works, and it has been like this since the first Android phone ever release.
2. F-Droid compiles all APKs on its store, and signs them with its own keys. Apps on F-Droid are not signed by the developers of those apps. They're signed by F-Droid, and thus can only be updated through and by F-Droid. F-Droid does not just distribute APKs uploaded by random people, it distributes APKs that F-Droid compiled themselves.
So to answer your question, a developer transferring their accounts/keys to someone else doesn't matter. It won't affect the security of F-Droid users, because those keys/accounts aren't used by F-Droid. The worst that can happen is that the new owner tries injecting malware into the source code, but F-Droid builds apps from source and is thus positioned to catch those types of things (which is more than can be said about Google's ability to police Google Play)
And finally,
> How does Google know if someone has sold off their app?
Google should not know anything about the business dealings of potential competitors. Google is a monopoly[1], so there is real risk for developers and their businesses if Google is given access to this kind of information.
[1]: https://www.google.com/search?q=is+google+a+monopoly%3F&udm=50&mstk=AUtExfDLG5sfvIlKGBZeuTby2uBqPcLitjLPRlFfqQK1gbWckPsavj74yAa93s9aKsY6Twmk5I3Nxtaw257ul5CvoJZYLjwfR6GrqnnbDdVB8Oi4sKJh8Puh6PPzcyAwLovyzAXmjzpk54FMRs7MxdnN9ncAf_VXT6v0mOrN4DiRMrkm2uwoEzojS2ovDSH5RUlaG0k9Rtj9KafqRC4PNqDDG39_Uj93lCt534OfNEtUlJLEqk7nOkLtNK0Jjw&csuir=1 https://www.google.com/search?q=is+google+a+monopoly%3F&udm=...
- saturnite 11mo agoAndroid also has the feature of warning the user if an update is coming from a different source than what is installed. This will happen even if they have the same key. This reply isn't trying to argue against anything you've said. I am just adding to the list of how Android handles updates.
- nandomrumber 11mo agoYou have to trust somebody. Who is F-Droid? Why should I trust them? How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors. Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they are and are doing what they claim to be doing in my best interests? https://f-droid.org/en/about/ https://f-droid.org/en/about/
- botanical76 11mo agoI understand your concern, though your suspicion is a little shortsighted. It can be personally dangerous to volunteer for projects that directly circumvent the control of the establishment.
- AshamedCaptain 11mo agoBecause you can literally verify every single step of what they do. That's the reason you can trust them. You cannot apply this logic to almost anyone else. Apple, Google, etc. can only give you empty promises.
- bogwog 11mo agoI trust them, at least a lot more than I do Google, which is a known bad actor, and collaborator with "TLAs". F-Droid has been around for a very long time, if you didn't know. They've built and earned the trust people have in them today. > Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Idk what specific incident you're referring to, but since they build apks themselves in an automated way, if a security patch to an app breaks the build, that needs to be fixed before the update can go out (by F-Droid volunteers, usually). In that case, F-Droid will warn about the app having known unpatched vulnerabilities. Again, this is above and beyond what Google does in their store. Google Play probably has more malware apps than F-Droid has lines of code in its entire catalog.
- nandomrumber 11mo agoThis incident https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11496 https://gitlab.com/fdroid/fdroiddata/-/merge_requests/11496
- AshamedCaptain 11mo ago> F-Droid compiles all APKs on its store, and signs them with its own keys. Apps on F-Droid are not signed by the developers of those apps. They're signed by F-Droid, and thus can only be updated through and by F-Droid. F-Droid does not just distribute APKs uploaded by random people, it distributes APKs that F-Droid compiled themselves. For most programs I use, they just publishing the developer's built (and signed) APK. They do their own build in parallel and ensure that the result is the same as the developer's build (thanks to reproducible builds), but they still end up distributing the developer's APK.
- bogwog 11mo agoCan you give some examples? I've heard that's a thing, but I'm not familiar with any apps that actually pull it off (reproducible builds are difficult to achieve)
- AshamedCaptain 11mo agoReproducible builds may be hard to achieve, but that doesn't mean you don't have a list of such builds long enough to crash your browser: https://verification.f-droid.org/verified.html https://verification.f-droid.org/verified.html
- crumpled 11mo agoWeird to have a page like that if a human can't use it. Needs some pagination, f-droid! It's like we're supposed to save the page and grep it or something. Doesn't work in my Firefox.
- Someone 11mo ago>> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. > 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device You missed the and private keys part of the original claim.
- bogwog 11mo agoNo I didn't. Finish reading the rest of the comment.