11 ms·

A faster heart for F-Droid

536 points by kasabali 10mo ago

kasabali 10mo ago
Context: "F-Droid build servers can't build modern Android apps due to outdated CPUs" (https://news.ycombinator.com/item?id=44884709 https://news.ycombinator.com/item?id=44884709)
NoiseBert69 10mo ago
So.. what kind of hardware did they buy?
- IshKebab 10mo ago
  Yeah kind of conspicuously absent! They said > The previous server was 12 year old hardware which is pretty mad. You can buy a second hand system with tons of ram and a 16-core Ryzen for like $400. 12-year old hardware is only marginally faster than a RPi 5.
  - cvwright 10mo ago
    Unfortunately you can’t even get the RAM for $400 anymore.
    - neogodless 10mo ago
      I was able to find 2 x 16GB DDR4 for $150... Building a budget AM4 system for roughly $500 would be within the realm of reason. ($150 mobo, $100 cpu, $150 RAM, that leaves $100 for storage, still likely need power and case.) https://www.amazon.com/Timetec-Premium-PC4-19200-Unbuffered-Computer/dp/B0FZTN2381 https://www.amazon.com/Timetec-Premium-PC4-19200-Unbuffered-... https://www.amazon.com/MSI-MAG-B550-TOMAHAWK-Motherboard/dp/B089CWDHFZ https://www.amazon.com/MSI-MAG-B550-TOMAHAWK-Motherboard/dp/... For a server that's replacing a 12 year old system, you don't need DDR5 and other bleeding edge hardware.
      - kiddico 10mo ago
        I don't think 32GB is going to be enough lol
        calgoo 10mo ago
        Also, you would want ECC for something this important.
        krautsauer 10mo ago
        I seriously wonder if doing the same build twice by two people in two locations wouldn't provide the same benefit and others for less money. (I might be spoiled by sane reproducible build systems. Maybe F-droid isn't.)
  - DaSHacka 10mo ago
    > 12-year old hardware is only marginally faster than a RPi 5. A Dell R620 is over 12 years old and WAY faster than a RPi 5 though... Sure, it'll be way less power efficient, but I'd definitely trust it to serve more concurrent users than a RPi.
  - phantom784 10mo ago
    Plus the fact that it's been running for 5 years. Does that mean they bought 7 year old hardware back then? Or is that just when it was last restarted?
  - lucb1e 10mo ago
    > 12-year old hardware is only marginally faster than a RPi 5 My 14yo laptop-used-as-server disagrees. Also keep in mind that CPU speeds barely improved between about 2012 and 2017, and 2025 is again a lull https://www.cpubenchmark.net/year-on-year.html https://www.cpubenchmark.net/year-on-year.html I'm also factoring in the ability to use battery bypass in phones I buy now because they are so powerful, I might want to use them as free noiseless server in the future. You can do a heck of a lot on phone hardware nowadays, paying next to nothing for power and no additional cost on your existing internet connection. A RPi 5 is that same ballpark
valgaze 10mo ago
Hmm: “F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.”
- IshKebab 10mo ago
  "F-Droid is not hosted in a data centre with proper procedures, access controls, and people whose jobs are on the line. Instead it's in some guy's bedroom." Not reassuring.
  - ugh123 10mo ago
    The 'cloud' has come full circle
  - TomatoCo 10mo ago
    In some respects, having your entire reputation on the line matters just as much. And sure, someone might have a server cage in their residence, or maybe they run their own small business and it's there. But the vagueness is troubling, I agree. A picture of the "living conditions" for the server would go a long way.
  - gpm 10mo ago
    Eh... The set of people who can maliciously modify it is the people who run f-droid, instead of the cloud provider and the people who run f-droid. It'd be nice if we didn't have to trust the people who run f-droid, but given we do I see an argument that it's better for them to run the hardware so we only have to trust them and not someone else as well.
    - lrvick 10mo ago
      You actually do not have to trust the people who run f-droid for those apps whose maintainers enroll in reproducible builds and multi-party signing, which only f-droid supports unlike any alternatives.
mcsniff 10mo ago
Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I understand this is a volunteer effort, but it's not a good look.
- lrvick 10mo ago
  As someone that has run many volunteer open source communities and projects for more than 2 decades, I totally get how big "small" wins like this are. The internet is run on binaries compiled in servers in random basements and you should be thankful for those basements because the corpos are never going to actually help fund any of it.
  - deleted 10mo ago
    [deleted]
  - pydry 10mo ago
    It's a shame mozilla wont step up to fund it. They've spunked way more money on way dumber things.
    - quantummagic 10mo ago
      Imagine the good they could do if they didn't pay their CEO 6 million a year.
      - wongarsu 10mo ago
        They'd probably burn it without much to show for, like the rest of their funds
      - jeltz 10mo ago
        6 million is 30 really good senior software devs in Stockholm, or I think 10 in SF. American CEO salaries are crazy.
websiteapi 10mo ago
> Another important part of this story is where the server lives and how it is managed. F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. > The previous server was 12 year old hardware and had been running for about five years. In infrastructure terms, that is a lifetime. It served F-Droid well, but it was reaching the point where speed and maintenance overhead were becoming a daily burden. lol. if they're gonna use gitlab just use a proper setup - bigco is already in the critical path...
PaulKeeble 10mo ago
Modern machines go up to really mental levels of performance when you think about it and for a lot of small scale things like F droid I doubt it takes a lot of hardware to actually host it. A lot of its going to be static files so a basic web server could put through 100s of thousands of requests and even on a modest machine saturate 10 gbps which I suspect is enough for what they do. This just reads to me like they have racked a box in a colo with a known person running the shared rack rather than someone’s basement but who really knows they aren't exactly handing out details.
- wtallis 10mo ago
  This isn't about a server for hosting the website or package repo, it's about the server building all the packages.
- JuniperMesos 10mo ago
  Which is itself kind of suspicious - why can't they say "yeah we pay for Colo in such-and-such region" if that is what they are doing? Why should that be a secret?
JimBlackwood 10mo ago
While I get their setup is amateurish, it's also a good reminder of how simple setups can be. Saying this on HN, of course.
Aurornis 10mo ago
> this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access. I can’t be the only one who read this and had flashbacks to projects that fell apart because one person had the physical server in their basement or a rack at their workplace and it became a sticking point when an argument arose. I know self-hosting is held as a point of pride by many, but in my experience you’re still better off putting lower cost hardware in a cheap colo with the contract going to the business entity which has defined ownership and procedures. Sending it over to a single member to put somewhere puts a lot of control into that one person’s domain. I hope for the best for this team and I’m leaning toward believing that this person really is trusted and capable, but I would strongly recommend against these arrangements in any form in general. EDIT: F-Droid received a $400,000 grant from a single source this year ( https://f-droid.org/2025/02/05/f-droid-awarded-otf-grant.html https://f-droid.org/2025/02/05/f-droid-awarded-otf-grant.htm... ) so now I’m even more confused about how they decided to hand this server to a single team member to host in unspoken conditions instead of paying basic colocation expenses.
- silisili 10mo ago
  Yup. But the same can happen in shared hosting/colo/aws just as easily if only one person controls the keys to the kingdom. I know of at least a handful of open source projects that had to essentially start over because the leader went AWOL or a big fight happened. That said, I still think that hosting a server in a member's house is a terrible decision for a project.
  - Aurornis 10mo ago
    > if only one person controls the keys to the kingdom True, which is why I said the important parts need to be held by the legal entity representing the organization. If one person tries to hold it hostage, it becomes a matter of demonstrating that person doesn’t legally have access any more. I’ve also seen projects fall apart because they forgot to transfer some key element into the legal entity. A common one is the domain name, which might have been registered by one person and then just never transferred over. Nobody notices until that person has a falling out and starts holding the domain name hostage.
ZiiS 10mo ago
Let's focus on how they have done so much with such simple hardware, rather then comparing them to companies that do so little with so much more.
anticorporate 10mo ago
It's frankly embarrassing how many of the comments on this thread are some version of looking at the XKCD "dependency" meme and deciding the best course of action is to throw spitballs at the maintainers of the critical project holding everything else up.
- wtallis 10mo ago
  At the very least, it's reasonable to expect the maintainers of such a project to be open about their situation when it's that precarious. Why wouldn't you take every opportunity to let your users and downstream projects know that the dependency you're providing is operating with no redundancy and barely enough resources to carry on when things aren't breaking? Why wouldn't they want to share with a highly technical audience any details about how their infrastructure operates?
  - tcfhgj 10mo ago
    > when it's that precarious assumptions
    - wtallis 10mo ago
      They're building all the software on a single server, and at best their fallback is a 12 year old server they might be able to put back in production. I'm not making any unreasonable assumptions, and they're not being forthcoming with any reassuring details.
- charcircuit 10mo ago
  F Droid is no where near being a critical project holding Android up. The Play Store, and the Play Services themselves are much more critical. Being open source doesn't make you immune from criticism for not following industry standards or being called out for poor security.
  - lucb1e 10mo ago
    If you have nothing to install on your device, what's the point of being able to? For me, f-droid is a cornerstone in the android ecosystem. I could source apks elsewhere but it would be much more of a hassle and not necessarily have automatic updates. iOS would become a lot more attractive to me if Android didn't have the ecosystem that's centered around the open apps that you can find on f-droid
whalesalad 10mo ago
Absolutely zero details on the old or new server.
j1elo 10mo ago
I wonder if anyone knows about Droid-ify. Whether it it a safe option, or better to stay away of it? It showed up one day while I searched about why F-Droid was always so extremely slow to update and download... then trying Droid-ify, that was never a problem any more, it clearly had much better connectivity (or simply less users?)
- kasabali 10mo ago
  it's a different client using same servers. fdroid official client is just super buggy.
debugnik 10mo ago
> not hosted in just any data center [...] a long time contributor with a proven track record of securely hosting services This is ambiguous, it could mean either a contributor's rack in a colocation centre or their home lab in their basement. I'd like to think they meant the former, but I can't deny I understood the latter in my first read. Also, no details on the hardware?
basilgohar 10mo ago
I think all the criticism of what F-Droid is doing here (or perceived as doing) reflects more on the ones criticising than the ones being criticised. How many things went upside down and all the "right" things were done (corporate governance, cloud native deployment, automation, etc.). The truth is none of these processes are actually going to make things more secure, and many projects went belly up despite following these kinds of recommendations. That being said, I am grateful to F-Droid fighting the good fight. They are providing an invaluable service and I, for one, am even more grateful that they are doing it as uncompromisingly as possible (well into discomfort) according to their principles.
- dugite-code 10mo ago
  Not to mention this is a build server, its uptime isn't actually all that critical, assuming they then mirror the artifacts out from there. Not to mention it also simplifies the security of controlling signing keys significantly.
  - deleted 10mo ago
    [deleted]
- vachina 10mo ago
  Exactly, if you run out of money, processes meant jackshit.
alexnewman 10mo ago
i'm glad we have a wing that's against gab app store. Can we have one that's for them for balance?
anthk 10mo ago
Good. But I wish PostmarketOS supported more devices. On battery, tons of kernel patches could be set per device plus a config package in order to achieve the best settings. On software and security...you will find more malware in Play Store than the repos from PmOS/Alpine. I know it's not a 100% libre (FSF) system, but that's a much greater step towards freedom than Android, where you don't even own your device.
- drnick1 10mo ago
  The issue with Linux-based phones is and remains apps. Waydroid works pretty well, but since you need to rely on it so much, you are better off using Graphene or Lineage in the first place.
  - anthk 10mo ago
    But Android it's a clusterfuck. Look Lemuroid, a Retroarch based emulator with a nice GUI. With the new SAF related permissions you can't make the emulator work any more. And that being a libre package from F-Droid. And I noticed several other bugs. Tyr for instance (an Yggmail service which bundles Yggdrasil) doesn't have an armv7a version. Tyr could be really useful with DeltaChat because you could talk with any relative without depending on 3rd party mail services. And because of arbitrary limitations, compiling a 32 bit binary it's damn difficult for maintainers, yet I could compile yggmail for Go under Termux without no issues. Thus, that's why I prefer PostMarketOS, software would just run once it's installed and for sure I wouldn't need to set an SDK weighting several GB's.
    - drnick1 10mo ago
      Those are valid criticisms of Android, but I see at least two problems that prevent wider adoption of PostmarketOS (even among HN readers). First, it only supports what seems to be ancient hardware. Contrast this with Graphene and latest-gen Pixel support. Second, compatibility with Android is critical. People just want to run their Starbucks app and expect it to work.
trusttrusttrust 10mo ago
[flagged]
ilaksh 10mo ago
Is it possible to add some kind of hardware detection to the build process of a project submitted and inspect the details?
Gelob 10mo ago
so uhhh what are the specs of said server?
SuperNinKenDo 10mo ago
Christ, comment sections like this make me never want to do anything that might gain widespread adoption, ever. Brought to you by the helpful folks who managed to bully WinAmp into retreating from open source. Very productive.
- wolpoli 10mo ago
  A lot of people here are used to working for companies with a larger infrastructure budget.
deleted 10mo ago
[deleted]
vjay15 10mo ago
I wish they could give more clarity on whether its hosted in a professional server or someone's bedroom, because just saying that "it's held by a long time contributor with a proven track record of securely hosting services" is not very reassuring.
Abishek_Muthian 10mo ago
I don't understand why governments haven't started to fund F-Droid, almost all govt. apps are open-source. Countries which fear they could be cut off from the duopoly mobile ecosystem should be forcing android manufacturers to bundle in F-Droid; For the amount of nonsense regulations they force phone manufacturers to adhere to, bundling F-Droid wouldn't be that hard. Google won't be happy, but anti-trust regulations would take care of it.
- edent 10mo ago
  What did your local politician say when you wrote to them and suggested it? (I've worked with several politicians. You'd be surprised what a well timed letter or meeting can achieve.)
  - idoubtit 10mo ago
    Not much... I wrote a few times to my local MPs ("député", as we call them in France). I usually got a response, though I suspect it was written by their secretary with no other consequence. In one case (related to privacy against surveillance), they raised a question in the congress, which had just a symbolic impact. It may be different in other countries. In France, Parliament is de-facto a marginal power against a strong executive power. Even the legal terms are symptomatic of this situation: the government submits a "project of law" while MPs submit a "proposal of law" (which, for members of the governing party, is almost always written by the government then endorsed by some loyal MP).
- worldsavior 10mo ago
  Because it's not their responsibility. Why they should care about these kind of stuff? Don't drop everything on governments. A project like F-Droid is dumb to begin with where they're the one to build the apps.
  - MYEUHD 10mo ago
    > A project like F-Droid is dumb to begin with where they're the one to build the apps. I heartily disagree. Linux distributions also build the packages themselves, and that adds a layer of trust. It ensures that everything in the fdroid repo is free software, and can be self-built.
Johnny555 10mo ago
Does anyone know what the server is? I don't see it on their site. I'm curious why supply chain issues got in the way and why they couldn't just configure a Dell Poweredge and get delivery in a couple weeks. I'm assuming they have some special requirements that weren't met by an off-the-shelf server, so I'm just curious what those requirements are.
utopiah 10mo ago
I think there are quite some misconceptions about F-Droid in the comments : - you can be your own F-Droid server In fact it's a basic static HTTP(S) server that is generated with the list of .apk and meta-data so it rely doesn't require much. I think what is concerning to people is that the most popular INSTANCE of F-Droid, the one that is by default when one downloads the F-Droid CLIENT, is "centralized" but again that's a misconception. It's only popular, it's not really central to F-Droid itself. Adding another repository in the F-Droid parlance is just a simple option of changing or adding a URL to more instances. That being said if anybody here would like to volunteer to be provider a fallback to the build system to that popular instance, I imagine the F-Droid team would welcome that with open arms.
- 1vuio0pswjnm7 10mo ago
  "It's only popular, it's not really central to F-Droid itself." I've used F-Droid for years and I've never used the client ("the F-Droid app") For me the value of F-Droid is as a list of open-source software with (a) pointers to source code and (b) sample binaries The goal of F-Droid could be to enable Android users to read, edit and compile the software they choose to run on their "phones" But F-Droid promotes their own app ("the client") so maybe the project's goal is something more like an "app store"
  - herewulf 10mo ago
    Likely they are trying to make said list of open-source software easily accessible. The vast majority of users are incapable of compiling their own software. Probably it's better (for users' freedom, privacy, and a healthy Android FOSS ecosystem) to have these users obtaining software through an F-Droid "app store" than through Google Play. The goal that you suggest is interesting. It reminds me of Guix, where one can obtain binaries or one can build the entirety of packages oneself. All from the same system. Perhaps you could share how you are currently building software from source and/or F-Droid?
  - 1vuio0pswjnm7 10mo ago
    Is F-Droid intended for "the vast majority of users" Is popularity, e.g., user majorities versus user minorities, always equivalent to "importance". For web traffic and associated data collection, ad services, etc., popularity is obviously important. But what if one is not focused on such things Consider the statement "It's only popular, it's not really central for F-Droid itself"
amake 10mo ago
I publish an app to the App Store, Google Play, and F-Droid. For years, F-Droid took absolute ages to reflect a new release. People used to criticize the walled gardens for having capricious reviewers and slow review times, but I found F-Droid much more frustrating to get approval from and much slower to get a release out. So this development is much appreciated. In fact I had an inkling that build times had improved recently when an update made it out to F-Droid in only a day or two.
hindustanuday 10mo ago
[dead]
user205738 10mo ago
Disappointed in HN because of these comments
- Xunjin 10mo ago
  Criticism is good when it comes with feasible suggestions or even a little help. I wonder how many of HN audience does know someone, or a guy who knows a guy, which works in a data center able to manage the hardware and a simple email/message/hello there could open a new opportunity.
Dwedit 10mo ago
Is there anything that can be done about F-Droid downloading very big files (over 50MB) every time it needs to update the repository? I'd expect at the very least regular checkpoint files, then difference files that get you from one checkpoint to the next.
TerribleThings 10mo ago
[dead]

536 points by kasabali 10mo ago

Context: "F-Droid build servers can't build modern Android apps due to outdated CPUs" (https://news.ycombinator.com/item?id=44884709 https://news.ycombinator.com/item?id=44884709)

NoiseBert69 10mo ago

So.. what kind of hardware did they buy?

IshKebab 10mo ago
Yeah kind of conspicuously absent! They said > The previous server was 12 year old hardware which is pretty mad. You can buy a second hand system with tons of ram and a 16-core Ryzen for like $400. 12-year old hardware is only marginally faster than a RPi 5.
- cvwright 10mo ago
  Unfortunately you can’t even get the RAM for $400 anymore.
  - neogodless 10mo ago
    I was able to find 2 x 16GB DDR4 for $150... Building a budget AM4 system for roughly $500 would be within the realm of reason. ($150 mobo, $100 cpu, $150 RAM, that leaves $100 for storage, still likely need power and case.) https://www.amazon.com/Timetec-Premium-PC4-19200-Unbuffered-Computer/dp/B0FZTN2381 https://www.amazon.com/Timetec-Premium-PC4-19200-Unbuffered-... https://www.amazon.com/MSI-MAG-B550-TOMAHAWK-Motherboard/dp/B089CWDHFZ https://www.amazon.com/MSI-MAG-B550-TOMAHAWK-Motherboard/dp/... For a server that's replacing a 12 year old system, you don't need DDR5 and other bleeding edge hardware.
    - kiddico 10mo ago
      I don't think 32GB is going to be enough lol
      - calgoo 10mo ago
        Also, you would want ECC for something this important.
        krautsauer 10mo ago
        I seriously wonder if doing the same build twice by two people in two locations wouldn't provide the same benefit and others for less money. (I might be spoiled by sane reproducible build systems. Maybe F-droid isn't.)
- DaSHacka 10mo ago
  > 12-year old hardware is only marginally faster than a RPi 5. A Dell R620 is over 12 years old and WAY faster than a RPi 5 though... Sure, it'll be way less power efficient, but I'd definitely trust it to serve more concurrent users than a RPi.
- phantom784 10mo ago
  Plus the fact that it's been running for 5 years. Does that mean they bought 7 year old hardware back then? Or is that just when it was last restarted?
- lucb1e 10mo ago
  > 12-year old hardware is only marginally faster than a RPi 5 My 14yo laptop-used-as-server disagrees. Also keep in mind that CPU speeds barely improved between about 2012 and 2017, and 2025 is again a lull https://www.cpubenchmark.net/year-on-year.html https://www.cpubenchmark.net/year-on-year.html I'm also factoring in the ability to use battery bypass in phones I buy now because they are so powerful, I might want to use them as free noiseless server in the future. You can do a heck of a lot on phone hardware nowadays, paying next to nothing for power and no additional cost on your existing internet connection. A RPi 5 is that same ballpark

valgaze 10mo ago

Hmm: “F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.”

IshKebab 10mo ago
"F-Droid is not hosted in a data centre with proper procedures, access controls, and people whose jobs are on the line. Instead it's in some guy's bedroom." Not reassuring.
- ugh123 10mo ago
  The 'cloud' has come full circle
- TomatoCo 10mo ago
  In some respects, having your entire reputation on the line matters just as much. And sure, someone might have a server cage in their residence, or maybe they run their own small business and it's there. But the vagueness is troubling, I agree. A picture of the "living conditions" for the server would go a long way.
- gpm 10mo ago
  Eh... The set of people who can maliciously modify it is the people who run f-droid, instead of the cloud provider and the people who run f-droid. It'd be nice if we didn't have to trust the people who run f-droid, but given we do I see an argument that it's better for them to run the hardware so we only have to trust them and not someone else as well.
  - lrvick 10mo ago
    You actually do not have to trust the people who run f-droid for those apps whose maintainers enroll in reproducible builds and multi-party signing, which only f-droid supports unlike any alternatives.

mcsniff 10mo ago

Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I understand this is a volunteer effort, but it's not a good look.

lrvick 10mo ago
As someone that has run many volunteer open source communities and projects for more than 2 decades, I totally get how big "small" wins like this are. The internet is run on binaries compiled in servers in random basements and you should be thankful for those basements because the corpos are never going to actually help fund any of it.
- deleted 10mo ago
  [deleted]
- pydry 10mo ago
  It's a shame mozilla wont step up to fund it. They've spunked way more money on way dumber things.
  - quantummagic 10mo ago
    Imagine the good they could do if they didn't pay their CEO 6 million a year.
    - wongarsu 10mo ago
      They'd probably burn it without much to show for, like the rest of their funds
    - jeltz 10mo ago
      6 million is 30 really good senior software devs in Stockholm, or I think 10 in SF. American CEO salaries are crazy.

websiteapi 10mo ago

> Another important part of this story is where the server lives and how it is managed. F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. > The previous server was 12 year old hardware and had been running for about five years. In infrastructure terms, that is a lifetime. It served F-Droid well, but it was reaching the point where speed and maintenance overhead were becoming a daily burden. lol. if they're gonna use gitlab just use a proper setup - bigco is already in the critical path...

PaulKeeble 10mo ago

Modern machines go up to really mental levels of performance when you think about it and for a lot of small scale things like F droid I doubt it takes a lot of hardware to actually host it. A lot of its going to be static files so a basic web server could put through 100s of thousands of requests and even on a modest machine saturate 10 gbps which I suspect is enough for what they do. This just reads to me like they have racked a box in a colo with a known person running the shared rack rather than someone’s basement but who really knows they aren't exactly handing out details.

wtallis 10mo ago
This isn't about a server for hosting the website or package repo, it's about the server building all the packages.
JuniperMesos 10mo ago
Which is itself kind of suspicious - why can't they say "yeah we pay for Colo in such-and-such region" if that is what they are doing? Why should that be a secret?

JimBlackwood 10mo ago

While I get their setup is amateurish, it's also a good reminder of how simple setups can be. Saying this on HN, of course.

Aurornis 10mo ago

> this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access. I can’t be the only one who read this and had flashbacks to projects that fell apart because one person had the physical server in their basement or a rack at their workplace and it became a sticking point when an argument arose. I know self-hosting is held as a point of pride by many, but in my experience you’re still better off putting lower cost hardware in a cheap colo with the contract going to the business entity which has defined ownership and procedures. Sending it over to a single member to put somewhere puts a lot of control into that one person’s domain. I hope for the best for this team and I’m leaning toward believing that this person really is trusted and capable, but I would strongly recommend against these arrangements in any form in general. EDIT: F-Droid received a $400,000 grant from a single source this year ( https://f-droid.org/2025/02/05/f-droid-awarded-otf-grant.html https://f-droid.org/2025/02/05/f-droid-awarded-otf-grant.htm... ) so now I’m even more confused about how they decided to hand this server to a single team member to host in unspoken conditions instead of paying basic colocation expenses.

silisili 10mo ago
Yup. But the same can happen in shared hosting/colo/aws just as easily if only one person controls the keys to the kingdom. I know of at least a handful of open source projects that had to essentially start over because the leader went AWOL or a big fight happened. That said, I still think that hosting a server in a member's house is a terrible decision for a project.
- Aurornis 10mo ago
  > if only one person controls the keys to the kingdom True, which is why I said the important parts need to be held by the legal entity representing the organization. If one person tries to hold it hostage, it becomes a matter of demonstrating that person doesn’t legally have access any more. I’ve also seen projects fall apart because they forgot to transfer some key element into the legal entity. A common one is the domain name, which might have been registered by one person and then just never transferred over. Nobody notices until that person has a falling out and starts holding the domain name hostage.

ZiiS 10mo ago

Let's focus on how they have done so much with such simple hardware, rather then comparing them to companies that do so little with so much more.

anticorporate 10mo ago

It's frankly embarrassing how many of the comments on this thread are some version of looking at the XKCD "dependency" meme and deciding the best course of action is to throw spitballs at the maintainers of the critical project holding everything else up.

wtallis 10mo ago
At the very least, it's reasonable to expect the maintainers of such a project to be open about their situation when it's that precarious. Why wouldn't you take every opportunity to let your users and downstream projects know that the dependency you're providing is operating with no redundancy and barely enough resources to carry on when things aren't breaking? Why wouldn't they want to share with a highly technical audience any details about how their infrastructure operates?
- tcfhgj 10mo ago
  > when it's that precarious assumptions
  - wtallis 10mo ago
    They're building all the software on a single server, and at best their fallback is a 12 year old server they might be able to put back in production. I'm not making any unreasonable assumptions, and they're not being forthcoming with any reassuring details.
charcircuit 10mo ago
F Droid is no where near being a critical project holding Android up. The Play Store, and the Play Services themselves are much more critical. Being open source doesn't make you immune from criticism for not following industry standards or being called out for poor security.
- lucb1e 10mo ago
  If you have nothing to install on your device, what's the point of being able to? For me, f-droid is a cornerstone in the android ecosystem. I could source apks elsewhere but it would be much more of a hassle and not necessarily have automatic updates. iOS would become a lot more attractive to me if Android didn't have the ecosystem that's centered around the open apps that you can find on f-droid

whalesalad 10mo ago

Absolutely zero details on the old or new server.

j1elo 10mo ago

I wonder if anyone knows about Droid-ify. Whether it it a safe option, or better to stay away of it? It showed up one day while I searched about why F-Droid was always so extremely slow to update and download... then trying Droid-ify, that was never a problem any more, it clearly had much better connectivity (or simply less users?)

kasabali 10mo ago
it's a different client using same servers. fdroid official client is just super buggy.

debugnik 10mo ago

> not hosted in just any data center [...] a long time contributor with a proven track record of securely hosting services This is ambiguous, it could mean either a contributor's rack in a colocation centre or their home lab in their basement. I'd like to think they meant the former, but I can't deny I understood the latter in my first read. Also, no details on the hardware?

basilgohar 10mo ago

I think all the criticism of what F-Droid is doing here (or perceived as doing) reflects more on the ones criticising than the ones being criticised. How many things went upside down and all the "right" things were done (corporate governance, cloud native deployment, automation, etc.). The truth is none of these processes are actually going to make things more secure, and many projects went belly up despite following these kinds of recommendations. That being said, I am grateful to F-Droid fighting the good fight. They are providing an invaluable service and I, for one, am even more grateful that they are doing it as uncompromisingly as possible (well into discomfort) according to their principles.

dugite-code 10mo ago
Not to mention this is a build server, its uptime isn't actually all that critical, assuming they then mirror the artifacts out from there. Not to mention it also simplifies the security of controlling signing keys significantly.
- deleted 10mo ago
  [deleted]
vachina 10mo ago
Exactly, if you run out of money, processes meant jackshit.

alexnewman 10mo ago

i'm glad we have a wing that's against gab app store. Can we have one that's for them for balance?

anthk 10mo ago

Good. But I wish PostmarketOS supported more devices. On battery, tons of kernel patches could be set per device plus a config package in order to achieve the best settings. On software and security...you will find more malware in Play Store than the repos from PmOS/Alpine. I know it's not a 100% libre (FSF) system, but that's a much greater step towards freedom than Android, where you don't even own your device.

drnick1 10mo ago
The issue with Linux-based phones is and remains apps. Waydroid works pretty well, but since you need to rely on it so much, you are better off using Graphene or Lineage in the first place.
- anthk 10mo ago
  But Android it's a clusterfuck. Look Lemuroid, a Retroarch based emulator with a nice GUI. With the new SAF related permissions you can't make the emulator work any more. And that being a libre package from F-Droid. And I noticed several other bugs. Tyr for instance (an Yggmail service which bundles Yggdrasil) doesn't have an armv7a version. Tyr could be really useful with DeltaChat because you could talk with any relative without depending on 3rd party mail services. And because of arbitrary limitations, compiling a 32 bit binary it's damn difficult for maintainers, yet I could compile yggmail for Go under Termux without no issues. Thus, that's why I prefer PostMarketOS, software would just run once it's installed and for sure I wouldn't need to set an SDK weighting several GB's.
  - drnick1 10mo ago
    Those are valid criticisms of Android, but I see at least two problems that prevent wider adoption of PostmarketOS (even among HN readers). First, it only supports what seems to be ancient hardware. Contrast this with Graphene and latest-gen Pixel support. Second, compatibility with Android is critical. People just want to run their Starbucks app and expect it to work.

trusttrusttrust 10mo ago

[flagged]

ilaksh 10mo ago

Is it possible to add some kind of hardware detection to the build process of a project submitted and inspect the details?

Gelob 10mo ago

so uhhh what are the specs of said server?

SuperNinKenDo 10mo ago

Christ, comment sections like this make me never want to do anything that might gain widespread adoption, ever. Brought to you by the helpful folks who managed to bully WinAmp into retreating from open source. Very productive.

wolpoli 10mo ago
A lot of people here are used to working for companies with a larger infrastructure budget.

deleted 10mo ago

[deleted]

vjay15 10mo ago

I wish they could give more clarity on whether its hosted in a professional server or someone's bedroom, because just saying that "it's held by a long time contributor with a proven track record of securely hosting services" is not very reassuring.

Abishek_Muthian 10mo ago

I don't understand why governments haven't started to fund F-Droid, almost all govt. apps are open-source. Countries which fear they could be cut off from the duopoly mobile ecosystem should be forcing android manufacturers to bundle in F-Droid; For the amount of nonsense regulations they force phone manufacturers to adhere to, bundling F-Droid wouldn't be that hard. Google won't be happy, but anti-trust regulations would take care of it.

edent 10mo ago
What did your local politician say when you wrote to them and suggested it? (I've worked with several politicians. You'd be surprised what a well timed letter or meeting can achieve.)
- idoubtit 10mo ago
  Not much... I wrote a few times to my local MPs ("député", as we call them in France). I usually got a response, though I suspect it was written by their secretary with no other consequence. In one case (related to privacy against surveillance), they raised a question in the congress, which had just a symbolic impact. It may be different in other countries. In France, Parliament is de-facto a marginal power against a strong executive power. Even the legal terms are symptomatic of this situation: the government submits a "project of law" while MPs submit a "proposal of law" (which, for members of the governing party, is almost always written by the government then endorsed by some loyal MP).
worldsavior 10mo ago
Because it's not their responsibility. Why they should care about these kind of stuff? Don't drop everything on governments. A project like F-Droid is dumb to begin with where they're the one to build the apps.
- MYEUHD 10mo ago
  > A project like F-Droid is dumb to begin with where they're the one to build the apps. I heartily disagree. Linux distributions also build the packages themselves, and that adds a layer of trust. It ensures that everything in the fdroid repo is free software, and can be self-built.

Johnny555 10mo ago

Does anyone know what the server is? I don't see it on their site. I'm curious why supply chain issues got in the way and why they couldn't just configure a Dell Poweredge and get delivery in a couple weeks. I'm assuming they have some special requirements that weren't met by an off-the-shelf server, so I'm just curious what those requirements are.

utopiah 10mo ago

I think there are quite some misconceptions about F-Droid in the comments : - you can be your own F-Droid server In fact it's a basic static HTTP(S) server that is generated with the list of .apk and meta-data so it rely doesn't require much. I think what is concerning to people is that the most popular INSTANCE of F-Droid, the one that is by default when one downloads the F-Droid CLIENT, is "centralized" but again that's a misconception. It's only popular, it's not really central to F-Droid itself. Adding another repository in the F-Droid parlance is just a simple option of changing or adding a URL to more instances. That being said if anybody here would like to volunteer to be provider a fallback to the build system to that popular instance, I imagine the F-Droid team would welcome that with open arms.

1vuio0pswjnm7 10mo ago
"It's only popular, it's not really central to F-Droid itself." I've used F-Droid for years and I've never used the client ("the F-Droid app") For me the value of F-Droid is as a list of open-source software with (a) pointers to source code and (b) sample binaries The goal of F-Droid could be to enable Android users to read, edit and compile the software they choose to run on their "phones" But F-Droid promotes their own app ("the client") so maybe the project's goal is something more like an "app store"
- herewulf 10mo ago
  Likely they are trying to make said list of open-source software easily accessible. The vast majority of users are incapable of compiling their own software. Probably it's better (for users' freedom, privacy, and a healthy Android FOSS ecosystem) to have these users obtaining software through an F-Droid "app store" than through Google Play. The goal that you suggest is interesting. It reminds me of Guix, where one can obtain binaries or one can build the entirety of packages oneself. All from the same system. Perhaps you could share how you are currently building software from source and/or F-Droid?
- 1vuio0pswjnm7 10mo ago
  Is F-Droid intended for "the vast majority of users" Is popularity, e.g., user majorities versus user minorities, always equivalent to "importance". For web traffic and associated data collection, ad services, etc., popularity is obviously important. But what if one is not focused on such things Consider the statement "It's only popular, it's not really central for F-Droid itself"

amake 10mo ago

I publish an app to the App Store, Google Play, and F-Droid. For years, F-Droid took absolute ages to reflect a new release. People used to criticize the walled gardens for having capricious reviewers and slow review times, but I found F-Droid much more frustrating to get approval from and much slower to get a release out. So this development is much appreciated. In fact I had an inkling that build times had improved recently when an update made it out to F-Droid in only a day or two.

hindustanuday 10mo ago

[dead]

user205738 10mo ago

Disappointed in HN because of these comments

Xunjin 10mo ago
Criticism is good when it comes with feasible suggestions or even a little help. I wonder how many of HN audience does know someone, or a guy who knows a guy, which works in a data center able to manage the hardware and a simple email/message/hello there could open a new opportunity.

Dwedit 10mo ago

Is there anything that can be done about F-Droid downloading very big files (over 50MB) every time it needs to update the repository? I'd expect at the very least regular checkpoint files, then difference files that get you from one checkpoint to the next.

TerribleThings 10mo ago

[dead]