Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fossdroid.com: Free and open source Android applications

fossdroid.com

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Fossdroid.com: Free and open source Android applications

#71

Post by eighthave »

fossdroid.com looks quite nice, a great start. As a big contributor to FDroid, I think it makes sense to run fossdroid.com as a separate project right now so it can develop fast on its own. Then we can figure out how best to integrate it with f-droid.org.

One thing that MUST be addressed before considering it something that people actually use is the total lack of HTTPS. This is not optional, and indeed should be mandatory like with https://f-droid.org and https://play.google.com.

I'd love to see more thinking about the detail view of the app. For example, there should be a "buy/donate" button, since many apps on fdroid have a way to accept donations. You can scrape that from the standard metadata or the `index.xml`. I think it would be best to present it like https://elementary.io does: force the user to click "Buy" with a recommended value, but let them set any value including 0.

Re: Fossdroid.com: Free and open source Android applications

#72

Post by justonepost »

vetinari wrote: post #65
justonepost wrote: post #46

Earlier quoted context omitted.

Google has made it so you can't enforce APK signatures via PKI on android os. Gee, I wonder why!

You can use self-signed certificate to sign APKs. Once you publish the signed package, you have to use this same certificate for the package forever. When updating, the system checks, whether the newer APK is signed by the same certificate and refuses update, if the certificate differs. It simply does not matter, whether your cert is vetted by CA or not. So using PKI would not make sense there. The rationale was not…

The rationale was that Google doesn't want a secure code signing mode as it would undermine their thesis that turning off the Google Play store is insecure.

At least even MacOS has a App Store + Identified Developers. Though of course, iOS doesn't have that..

Re: Fossdroid.com: Free and open source Android applications

#73

Post by vetinari »

justonepost wrote: post #72
vetinari wrote: post #65

Earlier quoted context omitted.

You can use self-signed certificate to sign APKs. Once you publish the signed package, you have to use this same certificate for the package forever. When updating, the system checks, whether the newer APK is signed by the same certificate and refuses update, if the certificate differs. It simply does not matter, whether your cert is vetted by CA or not. So using PKI would not make sense there. The rationale was not…

The rationale was that Google doesn't want a secure code signing mode as it would undermine their thesis that turning off the Google Play store is insecure. At least even MacOS has a App Store + Identified Developers. Though of course, iOS doesn't have that..

> it would undermine their thesis that turning off the Google Play store is insecure.

I don't quite understand. How do you turn off the Play store?

It is necessary to make a distinction between what you want to believe and the reality. The reality is, that requiring validated keys would put the keys to the "official Android" kingdom into CA's hands. In addition, because Android is an open-source project, any alternative distribution would disable that. It would cause real fragmentation of the platform, where apps would run on one distribution and not on another, the difference would be only the signature. Google (correctly) decided, that they do not have to fight this fight.

A side note: getting CA verified can be problem in some parts of the world. What if you are Chinese? Crimean? You can still use Android as it is; you can't use any platform, that requires to be "Identified" by CA.

Re: Fossdroid.com: Free and open source Android applications

#74

Post by SnaKeZ »

eighthave wrote: post #71

fossdroid.com looks quite nice, a great start. As a big contributor to FDroid, I think it makes sense to run fossdroid.com as a separate project right now so it can develop fast on its own. Then we can figure out how best to integrate it with f-droid.org. One thing that MUST be addressed before considering it something that people actually use is the total lack of HTTPS. This is not optional, and indeed should be man…

Thanks for the reply: i added HTTPS and donate/license info.

Re: Fossdroid.com: Free and open source Android applications

#76

Post by SnaKeZ »

mkesper wrote: post #66
SnaKeZ wrote: post #45

Earlier quoted context omitted.

Yes, isn't competing with F-Droid...it's just a frontend for F-Droid with popularity data.

Please include a short About section telling us so (can link to a longer About page). Always imagine someone stumbles over your page, not knowing what it's about at all.

Thanks for the suggestion, I added an "About" page with a short info and changelog.
Post reply on HN