111

F-droid is working on locking down (f-droid.org)

submitted 1 year ago by possiblylinux127@lemmy.zip to c/fdroid@lemmy.ml

9 comments fedilink hide all child comments

all 12 comments

sorted by: hot top controversial new old

[-] TropicalDingdong@lemmy.world 39 points 1 year ago

Seems like a good thing. I download and install things from Fdroid all the time and I assure you, I have no clue what I'm doing.

[-] LUHG_HANI@lemmy.world 8 points 1 year ago

Could do with knowing if the app is actively maintained instead of looking to see when it was last updated.

[-] cron@feddit.de 23 points 1 year ago

This is a good thing and an interesting read, especially for developers and security-focused users.

[+] MagneticFusion@lemm.ee 13 points 1 year ago

[deleted]

[-] incogtino@lemmy.zip 28 points 1 year ago

F-Droid used to build and sign the APK for each app they distribute using keys owned by F-Droid

That meant you had to trust F-Droid to distribute the app as per the source, and hope that the source hadn't been compromised (as the developer wasn't signing anything)

Now when a new app is added to the repo, they build an APK from source and compare it with an APK distributed by the developer

If they match exactly (and if there is no reason to think the developer key has been compromised) then F-Droid will instead distribute APKs signed with the developer key, and verify that the same key was used for each update

If the same key was used, F-Droid doesn't need to build the APK themselves but can distribute the update as-is

The advantages then are that F-Droid is acting as an additional layer of security and assurance to the developer signing the APK, and updates can be distributed faster as F-Droid doesn't have to build them

[+] MagneticFusion@lemm.ee 1 points 1 year ago

[deleted]

[-] incogtino@lemmy.zip 3 points 1 year ago

Yes, that video is primarily complaining about F-Droid self-signing, and that it creates: a requirement to trust them; a single point of failure for security; and slows updates

The trade off is that developers must maintain their key, if they lose it the user must uninstall and reinstall the app, as Android will not trust an update signed with a different key

[-] Nakres@lemmy.one 2 points 1 year ago

What alternative does the video promote? Trusting Google and the Playstore? Trusting each dev of every app to deliver apks which match the code? I don't want to give the video more clicks if it's scaring away people from F-droid towards worse alternatives.

[-] incogtino@lemmy.zip 1 points 1 year ago

No need to click, it complains about exactly what has now been changed. In essence you are always trusting the dev, why add other parties to that chain

[-] Nakres@lemmy.one 1 points 1 year ago

Wrong, if you are using F-droid, you aren't trusting the dev, you are trusting F-droid and the source code, the dev CAN NOT give you an app that doesn't match the code, and the code can be seen and reviewed by anyone.

[-] zwekihoyy@lemmy.ml 2 points 1 year ago

good. this is the only reason I've recommended people avoid fdroid. would be useful to fix that

this post was submitted on 20 Sep 2023

111 points (98.3% liked)

F-Droid

8006 readers

189 users here now

F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.

Website | GitLab | Mastodon

Matrix space | forum | IRC

founded 3 years ago

MODERATORS

fossdd@lemmy.ml

testman@lemmy.ml