Earlier quoted context omitted.
here's their github: https://github.com/ImranR98/Obtainium
Hmm if only I had an app to easily install it from github
When you install Obtanium from an APK, it prefills the Obtanium source for self-management.
Obtainium: Get Android App Updates Directly from the Source
51–60 of 97 posts
Re: Obtainium: Get Android App Updates Directly from the Source
#52Can't access the site. It says: "Sorry, you have been blocked You are unable to access imranr.dev"
same here
Re: Obtainium: Get Android App Updates Directly from the Source
#53I've been using it for a while I'm surprised that Android allows third party app installers that can update apps in tbe background. I don't follow the specifics of Android developments but I 100% expected it to get more locked down with time.
Re: Obtainium: Get Android App Updates Directly from the Source
#54I've been using it for a while I'm surprised that Android allows third party app installers that can update apps in tbe background. I don't follow the specifics of Android developments but I 100% expected it to get more locked down with time.
The opposite happened; for a while, it did not allow third party installers to run without user interaction but now it does. EU legislation probably had a role in that change.
Re: Obtainium: Get Android App Updates Directly from the Source
#55Earlier quoted context omitted.
Why do you trust it to run code and to install updates from their website but not to execute that update? What’s the threat model there?
You don't see the difference between allowing whatsapp to run, vs allowing whatsapp to install apps? You don't see the difference between allowing a dedicated app installer app written by an author with no other goal and no other source of reputation to install apps, vs allowing a random app to install apps just to hopefully only use that power to keep itself updated and do so in a way that only serves your interests…
Maybe android can limit allowing apps to install updates of themselves, only if this could be implemented, https://issuetracker.google.com/issues/378112214
Re: Obtainium: Get Android App Updates Directly from the Source
#56Love this app, makes it really easy to keep non-store apps up to date by linking directly to the apps GitHub repo for example. Obviously you have to be careful what you install, just as with any app not found in Play Store, but if you're getting your apps elsewhere anyway this is really convenient.
> just as with any app not found in Play Store I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
it's worse than that imo. People claim the web is dangerous because it runs untrusted code but apps do the same with auto updates from stores and that the majority of apps are just webviews running code from the net but without the same level of sandboxing as a browser
Re: Obtainium: Get Android App Updates Directly from the Source
#57Earlier quoted context omitted.
They're excellent at inconveniencing legitimate devs for "mistakes" like links to external payment options, but oddly bad at spotting actual scams. I think that tells you something about the actual goal of app review.
The way you phrase mistakes is interesting, it’s been abundantly clear that’s not allowed for a long time. It’s not a “mistake” if you link to an external payment method . I’m an iOS user but one of the reasons I like iOS is because I know that I’ll be able to Sign in with Apple, and pay via the App Store. I recently signed up to a service which charged me for a free trial and I opened a support ticket. They refunded…
Apple does allow links to external payment options in some cases (see App Store Review Guideline 3.1.1), and sometimes rejects apps for links that it itself says should be legal, and is even legally required to allow in some jurisdictions. Which is not surprising, app reviewers spend only a few minutes looking at each app, and don't always understand the current rules.
Re: Obtainium: Get Android App Updates Directly from the Source
#58Earlier quoted context omitted.
> just as with any app not found in Play Store I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
it's worse than that imo. People claim the web is dangerous because it runs untrusted code but apps do the same with auto updates from stores and that the majority of apps are just webviews running code from the net but without the same level of sandboxing as a browser
[deleted]
Re: Obtainium: Get Android App Updates Directly from the Source
#59Love this app, makes it really easy to keep non-store apps up to date by linking directly to the apps GitHub repo for example. Obviously you have to be careful what you install, just as with any app not found in Play Store, but if you're getting your apps elsewhere anyway this is really convenient.
> just as with any app not found in Play Store I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
Alright, well I don't think I personally know anyone who has ended up with malware on their phone. I'm sure it could be better but it seems alright. I'm not gonna advise everyone I know to stress out about it by trying to have a high bar of trust and evaluate every app they wanna try only to have the exact same result they've had for years.
The advice is absolutely not the same as it's always been - it would be weird if the advice from the early aughts, when it was common to be affected by malware or viruses, was the same as the advice now when it's rare.
Re: Obtainium: Get Android App Updates Directly from the Source
#60i've been using this app and i honestly prefer it this way. Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. I trust github much more than google right now. Especially since the object being fetched is generic as opposed to a appstore. Google's app store has only shown to hinder publishing. Take syncthing for instance. The only thing I wish was better wa…
> Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in. What? Don't assume that the APKs are generated by GitHub's CI, anyhow, anything can be uploaded as a release
A great example of this would be the XZ backdoor, which never got commited to the source tree, but got implanted in the release tarballs, which were built on the attacker's systems