71–80 of 97 posts
Earlier quoted context omitted.
What is broken in F-Droid? I just got Android 15 and are using F-Droid but have not noticed anything broken yet.
Crashes on startup. Offers to send a stack trace, which I've done. I've been updating apps manually, which is tedious.
Love this app, makes it really easy to keep non-store apps up to date by linking directly to the apps GitHub repo for example. Obviously you have to be careful what you install, just as with any app not found in Play Store, but if you're getting your apps elsewhere anyway this is really convenient.
Its still a lot more dangerous than the Play store, and I assume a good threat actor can go undetected, but the Play Protect even scans apps that are installed from outside the store.
Earlier quoted context omitted.
Github reserve the right to stop serving those release downloads at any time. They usually just kick you off entirely if your project gets unwanted attention. I don't see them allowing revanced (modded popular social apps) forever so we still need a better way to trust outside that touch and go easy relationship.
Your app is a massive target, if your domain or web server is taken over, what implications would this have on the end users using your app (if any)?
Earlier quoted context omitted.
> just as with any app not found in Play Store I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
Alright, well I don't think I personally know anyone who has ended up with malware on their phone. I'm sure it could be better but it seems alright. I'm not gonna advise everyone I know to stress out about it by trying to have a high bar of trust and evaluate every app they wanna try only to have the exact same result they've had for years. The advice is absolutely not the same as it's always been - it would be weird…
People treat installing apps like a casual activity that involves no real thought or consideration. They've been trained to do so. The mental model needs to change: installing software is granting it some measure of ground on your device, and should only be done in cases where you have good reason to trust the developers. For everything else, that's what we have websites for.
Earlier quoted context omitted.
> just as with any app not found in Play Store I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
Alright, well I don't think I personally know anyone who has ended up with malware on their phone. I'm sure it could be better but it seems alright. I'm not gonna advise everyone I know to stress out about it by trying to have a high bar of trust and evaluate every app they wanna try only to have the exact same result they've had for years. The advice is absolutely not the same as it's always been - it would be weird…
That's... kind of the point when distributing malware? Not only has the game changed as to what actually happens, but malware is only valuable as long as it's installed - meaning getting noticed is pretty well the worst-case scenario for the attacker.
The main point though is malware is no longer stealing credit card numbers. It's not 15 ad-laden toolbars in browsers, or pop-unders and overs, or in-your-face obvious. A subtle miner over half a million users is a decent chunk of shitcoin to mine, and efficiency doesn't matter when it's not your hardware, or your power.
Finally, a no nonsense Auto-App-Updater App! if only sites would include a version number somewhere on the download page so obtainium could find it. Looking at you https://grayjay.app (it doesn't seem to work for partial file hash either so I had to turn auto updates off for this one) We sorely need 1:1 replacement of app store trust and discovery mechanisms too without any kafka-esque approval hoops. Obtainium app c…
Earlier quoted context omitted.
Github should provide a certificate when binaries are built from source with their tools.
They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case, there's for sure no GitHub certificate added to the APKs
Earlier quoted context omitted.
What is broken in F-Droid? I just got Android 15 and are using F-Droid but have not noticed anything broken yet.
Crashes on startup. Offers to send a stack trace, which I've done. I've been updating apps manually, which is tedious.