31–40 of 69 posts
> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.
Yup. Raising the target SDK means that more phones become ewaste, not because of their hardware becoming outdated, but because their software will never receive an update.
Yes, you have to trust F-Droid to sign apps. But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymore, Google holds the keys instead. The security model already assumes a third party is signing the apps.
A lot of bragging takes place about Play, but is silent on Amazon's appstore or any of the Chinese alternatives.
Earlier quoted context omitted.
Yes, last I checked, Google signs the app with your private key, which they force you to give them. In other words, they have the ability to make any changes to your app and re-sign it at their whim. Anyone concerned about the security of their shit should only install apps directly signed directly by the developer, using a private key only the developer possesses. It's a shame these platforms go to such great length…
Playing devil's advocate, given the choice between trusting a random developer to keep their keys private or Google to keep their keys private, I'd probably side with Google. Yeah that doesn't help with coercion or government letters, but neither would being a solo dev, both parties will comply.
A team-maintained package repository on the other hand operates through transparency.
F-Droid demands more trust but it is also infinitely more trustworthy than the Play store. It looks like things can be improved (a lot) and I hope it does. F-Droid provides an invaluable service to those who value privacy and open source with very few volunteers.
Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.
In the GOS chatrooms this article has come up a few times but I've seen them say they don't know why people keep saying this person is a GOS dev. I mean look at the author's github. They sponsor the lead dev but have no commits or forks in the project to show for.
> [in] a third-party Play Store client called Aurora Store [...] I’d recommend against using the shared “anonymous” accounts feature: you should make your own throwaway account with minimal information. Why is that? I've been using the anonymous accounts because I figured sharing an account gives a lot less info to google, and we're downloading the apks directly from Google servers in the end. Is there something I sh…
Earlier quoted context omitted.
I'm not saying that the author has never contributed a PR (there'd be a lot of repos for me to look through), but AFAICT the author is just a user/fan of GrapheneOS, not a contributor to GrapheneOS itself or to the GraphenOS App Repository.
After reading the article, I clicked the link to their Github and saw a @GrapheneOS tab in their contribution graph. But taking a second look, I see that they haven't contributed to any of their repos in quite some time.
Looking a little closer, AFAICT, they have only filed 2 GrapheneOS PRs ever: https://github.com/GrapheneOS/platform_packages_apps_Setting... and https://github.com/GrapheneOS/platform_packages_apps_SetupWi...
Yes, you have to trust F-Droid to sign apps. But that doesn't weaken the security model — since August2021, (new) Android devs can't sign their own apps anymore, Google holds the keys instead. The security model already assumes a third party is signing the apps.
What surprises me about this article is that not one word is spoken of other appstores. A lot of bragging takes place about Play, but is silent on Amazon's appstore or any of the Chinese alternatives.
Not to discredit the article, but it would be nice to know from the get-go that it's written by a contributor to GrapheneOS and gives a plug to their upcoming App Repository at the end.
> 3. Low target API level (SDK) for client & apps Yeah well Google fucked up and removed a lot of important API stuff that supported tools. So I'll continue to use termux from F-Droid. Otherwise I might as well not have a phone.
This is a similar situation to iOS which has a saner app ecosystem for this reason (in my opinion). That doesn't prevent apps with the same purpose to exist. iSH and a-Shell are examples of that on iOS. UserLAnd on Android takes the proot approach: https://userland.tech/