Hacker News Reader

Comment by simple10 | Hacker News Reader

Well done! It's great to see more female developers building apps for women. I agree with other commenters that you'd get a lot of mileage out of open sourcing it and doubling down on the privacy / local storage angle. It would help you get press coverage if you want to grow the user base.

View on HN

> you'd get a lot of mileage out of open sourcing it

I’m not sure. Maintaining an open source project requires even more time than a closed source project. You can have a community-oriented closed source project, too.

> and doubling down on the privacy / local storage angle

Yeah!

There's a difference between open sourcing and "maintaining an open source project".

Realistically most open source android apps do not receive many, if any, contributions from outsiders. Being open source does however signal the app isn't likely to become a paid shitfest.

Hosting the source code outside of Github/Gitlab/etc is enough to make maintenance easier already.

Exactly. I wish people would get over this idea that the only two options are closed source or setup and maintain a vibrant community of contributors. It's perfectly fine to just put the code on github and never look at it again. If you're willing to take an additional 30 seconds to be honest in the README.md about your intentions, even better.

Code doesn't have to be perfect to be open.

Open sourcing would just be a PR tactic IMO. Since it's all local storage anyway, there shouldn't be many security maintenance issues. I just think it gives a nice story angle for bloggers and tech press. But agreed, trying to build an active open source project with a community around it is a whole other ballgame and likely not worth the trouble.

It's not just a PR tactic. If the app is closed source, how do you know it's all local storage? Because someone on the internet said so? These days you can't really MitM and investigate the network connections.

Agree with you if privacy first is the goal then open sourcing it is absolutely the right move. However, it IS still possible to MITM these days - although more difficult.

frida.re has a ton of useful features and community tooling built around it including scripts that will let you "un-pin" certificates by hooking and rewriting the functions that verify whether cert pinning worked or not.

https://frida.re/

https://codeshare.frida.re/@masbog/frida-android-unpinning-s...

Neat, thank you! I hadn't heard of frida.re. I'll definitely have to dig in to that!

Reply on news.ycombinator.com