21–30 of 69 posts
* https://articles.59.ca/doku.php?id=pgpfan:tpp
The article also claims that Debian has moved away from GPG signatures. This is not true.
This all seems like a pointless distraction from the point that article is attempting to make...
Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.
Earlier quoted context omitted.
Doesn't google do exactly the same thing with the app store anyway?
Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great length…
Yeah that doesn't help with coercion or government letters, but neither would being a solo dev, both parties will comply.
Earlier quoted context omitted.
Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great length…
Playing devil's advocate, given the choice between trusting a random developer to keep their keys private or Google to keep their keys private, I'd probably side with Google. Yeah that doesn't help with coercion or government letters, but neither would being a solo dev, both parties will comply.
> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.
Earlier quoted context omitted.
Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great length…
Playing devil's advocate, given the choice between trusting a random developer to keep their keys private or Google to keep their keys private, I'd probably side with Google. Yeah that doesn't help with coercion or government letters, but neither would being a solo dev, both parties will comply.
> [devs] have to maintain a slightly different version of their codebase that should comply with F-Droid’s requirements Perhaps that's because I've got half a foot in the foss community and you don't hear a lot of "fml why is f-droid so strict about not using secret code", but to me it seems much more often that people complain about Google's policies than about F-Droid's. Especially since F-Droid's > “quality contro…
Not to mention that an app may be hosted on a different platform, perhaps one that doesn't do auto-builds. Or, as was already pointed out, builds do exist but contain telemetry or secret code. In that case, a trusted intermediary (which I trust heck of a lot more than Google) that pulls and compiles the code and then distributes it, is a strictly value-added proposition.
Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.
I have been using for the past year, and the 'advanced' user experience is not great. Updates are forced to the latest version of android, does not seem safe, and definitely does not feel stable, less customization than other roms, a bit aggressive towards root
I will probably go back to lineageos microg f-droid and some hardened configurations
F-Droid is provides invaluable service for android, privacy, open-source, android developers. GrapheneOS seems like an exercise in craziness a bit to extreme for me
Given the amount of malware in the play store, I'm not sure about this...
It is addressed in the article. The point is that F-Droid weakens Android's security model, in other words, F-Droid requires more trust on your part. I think it is reasonable to trust the somewhat niche open source community more than the most popular and therefore the most attacked app store. You may also not want to feed Google, but it doesn't change the fact that F-Droid is technically less secure. The article's d…
The article is completely baffling in not really covering that. "strong security and privacy guarantees" mean jack shit when the game from the play store starts leaking all data it can grab or adds bank phishing - and it will have a bunch of permissions anyway, it legitimately needs them to function.
2) One person's overly broad API permissions are another person's gateway to programming an awesomely powerful application. Having my storage API taken away for an entire Android release because "hurr durr, security, we'll fix it in the next sprint" and not being able to use a file manager other than the meager thing I had included with my OS showed me how true that is.