No user accounts, by design

I then go through the list of updates in the Play Store once a week or so and install those that I think might improve app functioning/stability. I look over and install Windows updates once a way-too-long (need to work on this).

Feel like everyone is skimping on QA these days or something else fishy is going on. In the last handful of years there have been 2 or 3 Windows updates that either permanently erased data or caused some other insane issues. I didn't get them (tbf I understand that most people didn't), partially thanks to having auto updates disabled.

> ...this makes using packages installed through F-Droid a nightmare.

I run 2x Androids with near 80%-90% of the packages installed from F-Droid repos (to include Bromite and Bitwarden custom repos); it has quirks and is not perfect - but far from "not usable" and "nightmare" as your hyperbole would suggest.

So for at least some users, this isn't a problem at all. It's a better default.

You need to install the F-Droid Privileged Extension, or use a ROM that has it pre-installed. That way it can update apps without user interaction.

You are right that the download / install process is very quirky. It often fails to provide the right feedback about what's going on and errors are common. Is it downloading, is it installing, did it get my touch? However I really want to install from there and not from Google.

I actually tried to play with this not long ago, and it is so broken that it makes me think they just wanted to "check the box" in case some judge thought this was abusive behavior. It probably still is.

Not only this API is available only on Android 12, it also _only_ works for programs that have Android 12 as target level API (i.e. when you try to upgrade older programs the prompt will still show up), and only works for programs that your package manager installed in the first place. GPlay does not have this limitation and will happily update packages you installed, after which your package manager is no longer allowed to upgrade them. It's all a big mess.

So does Bromite browser. https://www.bromite.org/fdroid

Further, I disable notifications for nearly everything, so that point doesn't matter to me either.

I'm definitely relieved that the most-upvoted comment critiquing F-Droid doesn't raise anything of concern for me! I was worried I was about to read something that might push me away from making a de-Googled Android device my next smartphone... haha

I also haven't had issues with update flow. When was the last time you used F-Droid for a prolonged period of time?

It seems to me that if you can compromise the f-droid infrastructure you can compromise millions of handsets.

I think the main idea around user accounts is that they centralize a point of applying captchas as well as a tiny bit of data collection (some form of contact information) that can be used for antispam (e.g. banning certain email address domains from creating accounts, or banning certain email addresses, etc).

Without customization or user tracking, many, many workflows shift to read-mostly. Many are idempotent. Some can be fully cached. Some can be edge-cached.

The dark secret of 'social' media that has been slowly coming out is that they aren't social. They aren't about 'Us', they're about me. Me, me, me. So of course the whole workflow is build around who I am and what I want. That's not just unhealthy, it's also really fucking expensive. And if it's really expensive we can't just eat the cost as a 'value add', we now have to monetize it. So things were already pretty dark and then compensation came into the picture and now it's positively dire.

I am trying to get telemetry in place to demonstrate how much of our capacity is going to particular features, so that we can say, okay, that wizbang thing is costing us $100k a year. Our profit is 1:X (we make $X for every dollar we spend). Is this lowering or raising our profit margin?

I think we are completely disconnected from opportunity costs and the entire center of most orgs I've been in are all about covering your own butt and telling stories. Until the layoffs happen and then we discover that the investors, advisors and some of the C suite actually care about whether spending $1 for the prospect of making $1.50 is a complete waste of time and energy. And I often wonder if some of the narratives I hear about who got laid off and why are not seeing this calculus in the results.

And maybe prefer procedurally-generated identicons rather than photo avatars if you want a visual aspect.

No, they have an unexploited asset and you think you're safe because nobody has exploited it yet. This is false security. If money gets tight they'll exploit it. If they get bought out the new owners will exploit it. If they get hacked, the entire Internet will exploit it.

I would highly recommend that you spend a little bit of time thinking about or working with groups of dissidents, other oppressed groups, even people who have been sexually harassed. I have seen so much wrong-thinking about what Security actually is and it's always people living in a privilege bubble, not thinking of actual, real life existential threat that exposure can represent until they have some user in hiding because they got death threats after being doxxed. Or just plain disappearing because their government black-bagged them over something they posted online.

The official Firefox Klar builds originally contained slightly less tracking than the official Firefox Focus builds. Nowadays it might be only the trademark that keeps them separate, but originally there were clear differences in code.

The vast bulk of sites want to make signup easy, meaning user objects are cheap. Cheap user ids are easily disposed of and replaced. So if you need to keep bad actors out, user accounts may not help a ton.