41–50 of 97 posts
Would prefer everything is hosted on GitHub to reduce the attack surface. But this is cool!
Earlier quoted context omitted.
How does that apply to F-Droid though? I don't think they are bullying any of the app maintainers, NewPipe seems to be on there?
Honestly I started using obtainium because I can't figure out why F-Ddoid builds are a month behind. RedReader became completely broken and needed the newer version. Not sure what's up with that lag. It's extremely frustrating.
Anyhow, when the apps stop being updated, it's usually due to something that was added that doesn't make them compliant with F-Droid's policies anymore; or, they changed something in the release process without telling F-Droid.
Other times, the apps were set to be updated only at the developer's request, and for some reason they still haven't done that request (some developers deliberately update F-Droid less frequently, to be more confident of not giving bugged releases to the F-Droid usere).
The normal delay, due to their manual (and lazy) signing process, is from few days to about ten
Earlier quoted context omitted.
Obtanium exists for a very specific use case. 1. You have an app you want to use. 2. That app isn't on the google app store or you don't want to/can't use google services. 3. The app is not open source so it can only be built and packaged by the first party. 4. You don't want to manually update the app by downloading a new APK every time. 5. You don't want to give a black-box closed-source app you downloaded from the…
Why do you trust it to run code and to install updates from their website but not to execute that update? What’s the threat model there?
i've been using this app and i honestly prefer it this way. Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. I trust github much more than google right now. Especially since the object being fetched is generic as opposed to a appstore. Google's app store has only shown to hinder publishing. Take syncthing for instance. The only thing I wish was better wa…
> Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. What? Don't assume that the APKs are generated by GitHub's CI, anyhow, anything can be uploaded as a release
Can't access the site. It says: "Sorry, you have been blocked You are unable to access imranr.dev"
Earlier quoted context omitted.
Obtanium exists for a very specific use case. 1. You have an app you want to use. 2. That app isn't on the google app store or you don't want to/can't use google services. 3. The app is not open source so it can only be built and packaged by the first party. 4. You don't want to manually update the app by downloading a new APK every time. 5. You don't want to give a black-box closed-source app you downloaded from the…
Why do you trust it to run code and to install updates from their website but not to execute that update? What’s the threat model there?
You don't see the difference between allowing a dedicated app installer app written by an author with no other goal and no other source of reputation to install apps, vs allowing a random app to install apps just to hopefully only use that power to keep itself updated and do so in a way that only serves your interests and not those of the apps author? (ie it will never be a Facebook and one day decide that it wants you to use Messenger, and that's the nicest example let alone something hidden)
The thing that you give permission to install apps must be a seperate thing written by a seperate author who has no incentive to install or remove any other apps.
Would prefer everything is hosted on GitHub to reduce the attack surface. But this is cool!
Github reserve the right to stop serving those release downloads at any time. They usually just kick you off entirely if your project gets unwanted attention. I don't see them allowing revanced (modded popular social apps) forever so we still need a better way to trust outside that touch and go easy relationship.