Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A faster heart for F-Droid

f-droid.org

Post reply on HN
Print view View original

201–210 of 231 posts

Re: A faster heart for F-Droid

#201

Post by drnick1 »

anthk wrote: post #184
drnick1 wrote: post #124

Earlier quoted context omitted.

The issue with Linux-based phones is and remains apps. Waydroid works pretty well, but since you need to rely on it so much, you are better off using Graphene or Lineage in the first place.

But Android it's a clusterfuck. Look Lemuroid, a Retroarch based emulator with a nice GUI. With the new SAF related permissions you can't make the emulator work any more. And that being a libre package from F-Droid. And I noticed several other bugs. Tyr for instance (an Yggmail service which bundles Yggdrasil) doesn't have an armv7a version. Tyr could be really useful with DeltaChat because you could talk with any re…

Those are valid criticisms of Android, but I see at least two problems that prevent wider adoption of PostmarketOS (even among HN readers). First, it only supports what seems to be ancient hardware. Contrast this with Graphene and latest-gen Pixel support. Second, compatibility with Android is critical. People just want to run their Starbucks app and expect it to work.

Re: A faster heart for F-Droid

#202

Post by drnick1 »

kube-system wrote: post #125
drnick1 wrote: post #117

Earlier quoted context omitted.

That's not the point. The point is that a "home" setup can basically replicate or exceed a "professional" setup when done right.

A home setup might be able to rival or beat an “edge” enterprise network closet. It’s not going to even remotely rival a tier 3/4 data center in any way. The physical security, infrastructure, and connectivity will never come close. E.g. nobody is doing full 2N electrical and environmental in their homelab. And they certainly aren’t building attack resistant perimeter fences and gates around their homes, unless they’…

> The physical security, infrastructure, and connectivity will never come close. E.g. nobody is doing full 2N electrical and environmental in their homelab. And they certainly aren’t building attack resistant perimeter fences and gates around their homes, unless they’re home labbing on a compound in a war torn country.

Why would you need all of that if what they have works? Nobody is going to raid a repo of open source software, you can just download everything for free.

Re: A faster heart for F-Droid

#203

Post by herewulf »

1vuio0pswjnm7 wrote: post #200
utopiah wrote: post #163

I think there are quite some misconceptions about F-Droid in the comments : - you can be your own F-Droid server In fact it's a basic static HTTP(S) server that is generated with the list of .apk and meta-data so it rely doesn't require much. I think what is concerning to people is that the most popular INSTANCE of F-Droid, the one that is by default when one downloads the F-Droid CLIENT, is "centralized" but again t…

"It's only popular, it's not really central to F-Droid itself." I've used F-Droid for years and I've never used the client ("the F-Droid app") For me the value of F-Droid is as a list of open-source software with (a) pointers to source code and (b) sample binaries The goal of F-Droid could be to enable Android users to read, edit and compile the software they choose to run on their "phones" But F-Droid promotes their…

Likely they are trying to make said list of open-source software easily accessible. The vast majority of users are incapable of compiling their own software. Probably it's better (for users' freedom, privacy, and a healthy Android FOSS ecosystem) to have these users obtaining software through an F-Droid "app store" than through Google Play.

The goal that you suggest is interesting. It reminds me of Guix, where one can obtain binaries or one can build the entirety of packages oneself. All from the same system.

Perhaps you could share how you are currently building software from source and/or F-Droid?

Re: A faster heart for F-Droid

#204

Post by herewulf »

jabwd wrote: post #192
well_ackshually wrote: post #186

Earlier quoted context omitted.

> this server is physically held by a long time contributor with a proven track record of securely hosting services. This is effectively a rando's basement. It doesn't matter that they've been a contributor or whatever. Individuals change, relationships sour. Securely hosting how ? By locking the front door ? By being a random tech company in the midwest ? Or by having proper access control ? As a little reminder, F-…

> This is effectively a rando's basement. You. Do. Not. Know. Stop straw-manning stuff its so pointless.

The not knowing is the point. From a security perspective, you have to assume the worst.

And maybe that is F-Droid's point: Security through obscurity. If the build infrastructure with the signing keys is unknown, then it's that much harder for Bad Actor to do things like backdoor E2E encrypted communication apps. This is, of course, the weakness in E2E encryption in apps obtained from mainstream/commercial app stores. For all we know, these may already be backdoored depending on where it came from.

However, the obscurity makes F-Droid hard to trust as an outsider to the project.

Re: A faster heart for F-Droid

#205

Post by ptx »

utopiah wrote: post #163

I think there are quite some misconceptions about F-Droid in the comments : - you can be your own F-Droid server In fact it's a basic static HTTP(S) server that is generated with the list of .apk and meta-data so it rely doesn't require much. I think what is concerning to people is that the most popular INSTANCE of F-Droid, the one that is by default when one downloads the F-Droid CLIENT, is "centralized" but again t…

I don't think it's necessarily a misconception but rather people having different conceptions of what the term "F-Droid" refers to. It could refer to the client, the server tools, a specific server instance, the project, the collection of applications, or possibly other things.

Some people might use "F-Droid" in the same sense as the main page [1] does, to mean "an installable catalogue of FOSS (Free and Open Source Software) applications" but others in the sense the about page [2] uses it, referring to the "non-profit volunteer project", which is consistent with the project statues [3]:

> F-Droid is the name of a not-for-profit technical, scientific and creative community effort serving the public benefit.

The documentation start page [4] makes it a bit more clear:

> F-Droid is both a repository of verified free software Android apps as well as a whole “app store kit”, providing all the tools needed to setup and run an app store. It is a community-run free software project developed by a wide range of contributors. It also includes complete build and release tools for managing the process of turning app source code into published builds.

[1] https://f-droid.org/en/

[2] https://f-droid.org/en/about/

[3] https://commonsconservancy.org/dracc/0039/

[4] https://f-droid.org/en/docs/

Re: A faster heart for F-Droid

#206

Post by [deleted] »

dugite-code wrote: post #108
basilgohar wrote: post #61

I think all the criticism of what F-Droid is doing here (or perceived as doing) reflects more on the ones criticising than the ones being criticised. How many things went upside down and all the "right" things were done (corporate governance, cloud native deployment, automation, etc.). The truth is none of these processes are actually going to make things more secure, and many projects went belly up despite following…

Not to mention this is a build server, its uptime isn't actually all that critical, assuming they then mirror the artifacts out from there. Not to mention it also simplifies the security of controlling signing keys significantly.

[deleted]

Re: A faster heart for F-Droid

#207

Post by ptx »

wtallis wrote: post #144
troyvit wrote: post #142

Earlier quoted context omitted.

It's like ya'll are so eager to crap on a thing that you don't even read tfa. > this server is physically held by a long time contributor with a proven track record of securely hosting services. So you are assuming it's a rando's basement when they never said anything like that. If their way of doing business is so offensive either don't use them, disrupt them or pitch in and help. > I understand this is a volunteer…

> What does make a "good look" for a volunteer project? It's an open-source project. It should be... open . Not mysterious or secretive about overdue replacements of critical infrastructure.

What would that look like in this case?

Re: A faster heart for F-Droid

#208

Post by kevin_thibedeau »

stefan_ wrote: post #123
1f60c wrote: post #62

Earlier quoted context omitted.

> a $400,000 grant IDK if they could bag this kind of grant every year, but isn't this the scale where cloud hosting starts to make sense?

So that they can pay 100x more expenses for.. no gain? They would pay an arm just for traffic.

It's OpEx. MBAs will pour unlimited money into OpEx to avoid CapEx.

Re: A faster heart for F-Droid

#209

Post by [deleted] »

well_ackshually wrote: post #185
1f60c wrote: post #62

Earlier quoted context omitted.

> a $400,000 grant IDK if they could bag this kind of grant every year, but isn't this the scale where cloud hosting starts to make sense?

400k could get you 10 Dell Poweredges with a 128 core CPU, 256GB of RAM and multiple terabytes of storage _multiple times_. 400k easily covers two of these machines, and colocation space is about 2k per year. Cloud hosting only makes sense at a very, very small scale, or absurdly large ones.

[deleted]

Re: A faster heart for F-Droid

#210

Post by esseph »

stackghost wrote: post #128
silisili wrote: post #115

Earlier quoted context omitted.

For reference, in the US at least, there was/is a company called Joes Data Center in KC who would colo a 1U for $30 or $40 a month. I'd used them for years before not needing it anymore, so not some fly by night company(despite the name). At that rate, that would buy you nearly 1000 years of hosting.

Joe's got bought out by Patmos. The jury's still out on whether or not this is a good thing.

Love finding other metro area folks on hn!
Post reply on HN