Hacker News Reader

Comment by leshow | Hacker News Reader

It seems pretty odd to me to distrust someone because they aren't using the platform that you'd like them to use. Aren't there other issues with f-droid? You have to root your device to run it, allow third party code. Those are all security concerns too.

It was posted elsewhere but here's Moxie's take: https://github.com/signalapp/Signal-Android/issues/127#issue...

View on HN

You don't need root to run F-Droid, just enable 'Untrusted Applications' in Settings, which I think is what you meant by third party code. The core reason I prefer F-Droid is that apps on it are not bundled with Play Store APIs and thus you can run on Android devices that don't have GApps installed.

> You have to root your device to run it

wtf. I have been using F-Droid for many years, and this has not been the case. as far as I know, this has never been the case, as Android has always had functions for third party app stores. in fact, even today, F-Droid recommends not using root for installs, since then you don't get the screen showing permissions.

> allow third party code

that's called running apps.

tl;dr nice FUD.

'allow third party code' means code which is not signed. Once you tick that any unsigned code can run, not only the app you downloaded. Makes exploitation significantly easier. It would be better if Android forced you to explicitly select which code could run, but too hard for most users.

Then you "untick" it until the next time you need to install something.

This is what I do on lineageOS. I don't regularly install new apps.

Side rant: This marketer-driven "install an app for everything" is a threat to the open internet and privacy. Usually the only reason is to extract more personal info.

Already, young people barely use a web browser. That appears to be the future. Now get off my lawn or I'll start talking about the war.

You might do it, but thousands wouldn't.

Android could undoubtedly be stronger in this regard, and in permission control, firewall, ad blocking etc, but it's not going to happen.

Apps wouldn't be so bad if they were actually sandboxed properly, but yeah, they suck.

I was interested in Copperhead OS as an alternative, but it seems to have fallen into a greed induced mess.

You just shot your own argument against his point in the foot. Thousands of people doesn't even make up a percentage point of the users of Android. Most people on Android use Google Play because it's sufficient against the threats that they need to it be sufficient against. Most people are okay with the risk/reward ratios that come with using commercial software because they then don't have to think about it. Signal provides a nearly turnkey level of protection above and beyond standard messaging in an easy enough format for most people to use.

IDK what you're going on about. What is your argument?

I am arguing Play store is fine, and side loading is bad policy.

I argued that for every person who will take the time to micromanage permissions, thousands wouldn't.

So what are you talking about?

We're about to see what happens with APK side loading at scale... Fortnite is bypassing Play store. I predict massive pwnage.

https://twitter.com/APKMirror/status/1027580291374702592?s=1...

Android explicitly forbids running unsigned APKs, it is not possible to do.

> that's called running apps.

And you accuse me of making things up? "Allow third party code" is not called "running apps"

> You have to root your device to run it, allow third party code.

Most likely one of those, yes. Though on Android 8+ you can only give that allow-install from unknown soures permission to F-Droid.

Also both Copperhead and Fairphone Open ship with the F-Droid priviledged extension by default allowing you to kee that setting entirely disabled.

> It seems pretty odd to me to distrust someone because they ...

... are using a platform "you" don't trust.

Really? That's not really odd.

At least, it's not odd, if that usage and what it entails is the denominating part of the persona in this question.

Whats odd is calling a application "not secure" because it uses the platform's software distribution channel.

Here's a thought. If you are so concerned about the NSA that you think Google's cloud is a problem, why are you running the OS developed by Google?

The open-source base OS is fine, the closed-source services layer and cloud platform are not.

Sounds like you're confident you (or the FOSS community collective) can spot cleverly hidden backdoors.

I'm not, and I find that position naieve. For the overwhelming majority of people who are not a cross between Bruce Schneier and Linus Torvalds, a threat model that tries to protect against the NSA and GRU and MSS pretty much requires avoiding anything with a network connection. If you have a smartphone, you should probably just use its default application store.

The application uses google play, which almost every other android application in the world uses by default. And somehow that makes them untrustworthy?

Reply on news.ycombinator.com