Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A faster heart for F-Droid

f-droid.org

Post reply on HN
Print view View original

21–30 of 231 posts

Re: A faster heart for F-Droid

#21

Post by skiing_crawling »

AndrewDucker wrote: post #12
skiing_crawling wrote: post #9

Earlier quoted context omitted.

I never questioned or thought twice about F-Droid's trustworthiness until I read that. It makes it sound like a very amateurish operation. I had passively assumed something like this would be a Cloud VM + DB + buckets. The "hardware upgrade" they are talking about would have been a couple clicks to change the VM type, a total nothingburger. Now I can only imagine a janky setup in some random (to me) guy's closet. In…

For a single server why would you use cloud services rather than go the self-owned route?

A "single server" covers a pretty large range of scale, its more about how F-droid is used and perceived. Package repos are infrastructure, and reliability is important. A server behind someone's TV is much more susceptible to power outages, network issues, accidents, and tampering. Again, I don't know that's the case since they didn't really say anything specific.

> not hosted in just any data center where commodity hardware is managed by some unknown staff

I took this to mean it's not in a colo facility either, assumed it mean't someone's home, AKA residential power and internet.

Re: A faster heart for F-Droid

#22

Post by PaulKeeble »

Modern machines go up to really mental levels of performance when you think about it and for a lot of small scale things like F droid I doubt it takes a lot of hardware to actually host it. A lot of its going to be static files so a basic web server could put through 100s of thousands of requests and even on a modest machine saturate 10 gbps which I suspect is enough for what they do.

This just reads to me like they have racked a box in a colo with a known person running the shared rack rather than someone’s basement but who really knows they aren't exactly handing out details.

Re: A faster heart for F-Droid

#23

Post by pwndByDeath »

IshKebab wrote: post #5
valgaze wrote: post #4

Hmm: “F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.”

"F-Droid is not hosted in a data centre with proper procedures, access controls, and people whose jobs are on the line. Instead it's in some guy's bedroom." Not reassuring.

I think there are countless examples of worse failures by organisations that meet your criteria for far more valuable assets than some free apps.

Re: A faster heart for F-Droid

#24

Post by lukan »

mcsniff wrote: post #13

Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I underst…

"I understand this is a volunteer effort, but it's not a good look."

I would agree, that it is not a good look for this society, to lament so much about the big evil corporations and invest so little in the free alternatives.

Re: A faster heart for F-Droid

#25

Post by kiddico »

neogodless wrote: post #14
cvwright wrote: post #11

Earlier quoted context omitted.

Unfortunately you can’t even get the RAM for $400 anymore.

I was able to find 2 x 16GB DDR4 for $150... Building a budget AM4 system for roughly $500 would be within the realm of reason. ($150 mobo, $100 cpu, $150 RAM, that leaves $100 for storage, still likely need power and case.) https://www.amazon.com/Timetec-Premium-PC4-19200-Unbuffered-... https://www.amazon.com/MSI-MAG-B550-TOMAHAWK-Motherboard/dp/... For a server that's replacing a 12 year old system, you don't need…

I don't think 32GB is going to be enough lol

Re: A faster heart for F-Droid

#26

Post by a3w »

IshKebab wrote: post #5
valgaze wrote: post #4

Hmm: “F-Droid is not hosted in just any data center where commodity hardware is managed by some unknown staff. We worked out a special arrangement so that this server is physically held by a long time contributor with a proven track record of securely hosting services. We can control it remotely, we know exactly where it is, and we know who has access.”

"F-Droid is not hosted in a data centre with proper procedures, access controls, and people whose jobs are on the line. Instead it's in some guy's bedroom." Not reassuring.

Depends on the thread model, which one is worse.

State actor? Gets into data centre, or has to break into a privately owned apartment.

Criminal/3rd party state intelligence service? Could get into both, at a risk or with blackmail, threats, or violence.

Dumb accidents? Well, all buildings can burn or have an power outage.

Re: A faster heart for F-Droid

#27

Post by viraptor »

mcsniff wrote: post #13

Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I underst…

> shove it in a special someone's basement

They didn't say what conditions it's held in. You're just adding FUD, please stop. It could be under the bed, it could be in a professional server room of the company ran by the mentioned contributor.

Re: A faster heart for F-Droid

#28

Post by xandrius »

mcsniff wrote: post #13

Ugh. This 100% shows how janky and unmaintained their setup is. All the hand waving and excuses around global supply chains, quotes, etc...it took pretty long for them to acquire commodity hardware and shove it in a special someone's basement and they're trying to make it seem like a good thing? F-Droid is often discussed in the GrapheneOS community, the concerns around centralization and signing are valid. I underst…

"Nothing is ever good enough" (tm)

Re: A faster heart for F-Droid

#29

Post by gpm »

lrvick wrote: post #19
gpm wrote: post #10

Earlier quoted context omitted.

Eh... The set of people who can maliciously modify it is the people who run f-droid, instead of the cloud provider and the people who run f-droid. It'd be nice if we didn't have to trust the people who run f-droid, but given we do I see an argument that it's better for them to run the hardware so we only have to trust them and not someone else as well.

You actually do not have to trust the people who run f-droid for those apps whose maintainers enroll in reproducible builds and multi-party signing, which only f-droid supports unlike any alternatives.

That looks cool, which might just be the point of your comment, but I don't think it actually changes the argument here.

You still have to trust the app store to some extent. On first use, you're trusting f-droid to give you the copy of the app with appropriate signatures. Running in someone else's data-center still means you need to trust that data-center plus the people setting up the app store, instead of just the app store. It's just a breach of trust is less consequential since the attacker needs to catch the first install (of apps that even use that technology).

Re: A faster heart for F-Droid

#30

Post by phantom784 »

IshKebab wrote: post #6
NoiseBert69 wrote: post #3

So.. what kind of hardware did they buy?

Yeah kind of conspicuously absent! They said > The previous server was 12 year old hardware which is pretty mad. You can buy a second hand system with tons of ram and a 16-core Ryzen for like $400. 12-year old hardware is only marginally faster than a RPi 5.

Plus the fact that it's been running for 5 years. Does that mean they bought 7 year old hardware back then? Or is that just when it was last restarted?
Post reply on HN