Hacker News Reader

Comment by janosdebugs | Hacker News Reader

I think policies[1] are blocking F-Droid more than anything from being a viable alternative. A bank will likely never release their app as open source, nor will any of the big authentication vendors. This means that you cannot completely replace the Google Play Store with F-Droid if you have to use any of these, you can only use it as an additional store, at which point many won't be bothered.

[1]: https://f-droid.org/en/docs/Inclusion_Policy/

View on HN

I'm not entirely sure why this is a problem. Nothing's stopping you from using f-droid as an app source as well as some other store - it doesn't need to cover every use case. It's already a viable alternative for apps which can't go on the Play Store due to Google's policies, like AdAway, NewPipe and Termux.

The fact there's no freedom respecting bank applications is a problem on its own, though. I will continue avoiding them until there is...

> A bank will likely never release their app as open source, nor will any of the big authentication vendors.

I suppose you're right and I think it's worrying that precisely these kinds of organizations still seem to rely on security through obscurity (to some extent, not solely).

I'll go further and say that a bank should be required by law to implement and enable access to open banking APIs.

As well as not require, under any circumstances, an account holder to install a proprietary application in order to use the bank.

Not just obscurity, but also requiring you to have a mobile phone, with software made by two spcific companies, (for us europeans) both foreign, and in some cases, not even allow you to have the phone rooted.

I miss the time of totp dongles.

It's also its strength and raison d'etre. What use is F-droid if it starts including proprietary software?

An alternative for app distribution outside of Google Play Store.

No tracking? Providing an alternative? Not strengthening the Google-Apple duopoly on the mobile phone market? I was looking at it as a platform to publish an app on, which the open source requirement stopped dead in its tracks. I didn't have a viable open source business model for it at this time because it was a straight "customer pays money, gets software" deal with no tracking or other nonsense.

As-is, F-Droid will not be an _alternative_, it can, at most, be an extension to the Play Store.

That's what this article is about. Building a federated platform for distributing any type of mobile app, open source or not.

I mean, f-droid allows adding custom repositories that don't follow the main one's rules. There's a decent amount of apps that do this for one reason or another. Other apps, like for example OSMAnd, have a special f-droid build with google services removed, leading to the lack of some features like android auto support.

The client doesn't support any form of purchases and I don't think it ever will. I think you'd be best served using any of the other stores that support this or hosting it on your own website.

I don't see why fdroid would never provide a payment feature. At least for ethical reasons. Fdroid focuses on free software (and is also concerned with privacy and other features). Free software does not need to be gratis. As long as the payment code is open source. At worst it would be a NonFreeNet anti feature. Could be mitigated by supporting several payment platform.

Of course it could be hard to set up in practice.

You're right, but I don't think there's any incentive to do it. They pride themselves on having no tracking or otherwise user information (not even app popularity statistics), and adding any form of payment would require managing user accounts or coming up with impractical multi-device proof-of-purchase sharing solutions.

It's also worth mentioning that since everything on the store would still remain free software, making it legal to share purchased copies, people seeking to use it as a business model (like the parent post) would generally be ill-served.

I won't trust no tracking if it's non free.

I know I will sound extreme (although I think it shouldn't be the case in among developers) and no offense, but this sounds like a happy outcome to me. I believe proprietary software to be unethical. I'm not interested in being proposed non free software. The software industry should figure it out and start respecting its users.

However software funding is a real concern and I do believe there's room for some set of builtin solutions allowing free software funding beyond a donate link.

There are many ways to fund free software. I'm not saying it's easy but there are many open source businesses now and as a developer I decided to join one of them.

Support, consulting and paid (but still open source) paid features are some options. I don't think anybody would remove a license check in an app sent to f-droid if it's free software.

Now, I genuinely thank you for having considered an alternative to Google for distributing your software.

I know it's hard to build stuff and bootstrap it. I'm with you on this.

In f-droid, you can still add third party repositories and I heard it's getting easier for users. Not sure it is easy enough.

Now I'm totally aware only free software doesn't cut it for most people yet, and fdroid will not suffice. Most people will do with the play store, but some will use fdroid as a store of "trusty" apps and resort to the play store if really needed. I know people doing this.

In this case the software in question was a game. I have not seen any visble business models for truly open source games under the acceptable licenses for F-Droid. There are source-available games, but that would not be enough in this case.

I think the main issue may be how much up-front investment games need that would never be recouped with an open source license, but I'd love to be shown an example to the contrary.

Game is its own thing indeed and I'll admit that first, I don't play much, and second, never even started thinking about business models for open source games.

Maybe you could license the data for a fee and have the code as open source?

Of course this is low effort and you know way better than me.

I've done a fair bit of open source work, but the best I could come up with for games is "source available" where you can get the code to recompile for yourself or mod it. (My wife and I put up the source code of our first game as a DLC on Steam as an experiment.)

Re only code: Game engines often tie code and data together and the code without the data won't even compile in many cases, or you won't be able to produce a new dataset because documenting the required settings is a monumental task.

Finally, there is no real benefit to open sourcing a game if you want to make money. There is no complementary product or service you can sell with it. Reviewing and incorporating community fixes requires work and potentially legal review as not everyone in the modding community is also necessarily well versed in IP law. All these things need funding which is not a given if the game is open source in any meaningful way. If a game is truly open source, a less than ethical company with a bunch of cheap labor can go and undercut you, so there is an incentive to make creating an alternative build as hard as possible, defeating the entire idea of open source.

I would like to be able to release on an alternative storefront so people who want to degoogle their phones, but F-Droid's policies (most known alternative) make that impossible. (To be clear, it's a perfectly legit choice, I just wish there was a meaningful alternative to Google.)

(Not commenting most of your comment, I assumed a clear data and code separation because that's typically what doom does, but that's very old and I'm utterly incompetent in this domain)

> Finally, there is no real benefit to open sourcing a game if you want to make money.

the same thing can be said for pretty much all software (although it's not always actually true, sometimes open source is a selling point and/or have specific strengths beyond ethics)

> a less than ethical company with a bunch of cheap labor can go and undercut you

Isn't the data which is the most costly part in developing a game? Of course I realize you stated that separating the data is not practical.

> I would like to be able to release on an alternative storefront so people who want to degoogle their phones

Still 100% with you on this. Also degoogled with some proprietary software is still a step in the right direction

I wish that transparency and security were a selling point in gaming, but to me it doesn't seem like it. People will install all kinds of stuff and give them administrator permissions without a second thought. Anti-cheat eating itself into the kernel seems to be perfectly normal for most people. It's an entertainment product and people don't want to be inconvenienced for the most part.

Regarding the development costs, I'm not exactly an expert and I have never worked in a game studio (apart from the company my wife and I are running), but let's take StarCraft 2 for example. If you were to have the engine, but not the art, you could likely easily develop a very capable multiplayer RTS game. Heroes of the Storm was developed out of a StarCraft 2 mod[1]. As another example, Stormgate[2], made by ex Blizzard devs, is getting a whole lot of press coverage for their netcode. It stands to reason that a good engine and netcode are very real competitive advantages in the RTS space. Other game types, such as a walking sim or an adventure game will have a lot less "secret sauce" in the code and more in the art, voice acting, etc. (The Invincible[3] is great in this area) so the code/data split would likely heavily depend on the type of game. (Games can also become very messy between art, visual scripting, engine settings and code, which is what makes releasing the code separately tricky.)

My wife and I are (slowly, next to the day job) working on a Python programming/learning game and hopefully we'll manage to make a clean split between the engine and the art because it would be important for modding. However, I wouldn't feel comfortable releasing it under an open source license because it would cut off a potential source of revenue to license it to educators wanting to make their own challenges and courses. Maybe later we'll figure out that the base game makes enough money and it doesn't matter anymore, but it's really hard to predict success. As a game dev I would really like to make it possible, for example, for game archivists to do their work legally, for people to legally backup and rebuild their games for newer operating systems, or for their kids to be able to inherit their games[4], but carving out specific exceptions, especially for unknown future use cases 10-20 years down the line is exceptionally hard and I'm also not a lawyer, so for desktop the Steam Subscriber Agreement is governing our PC releases for now.

[1]: https://starcraft.fandom.com/wiki/Heroes_of_the_Storm

[2]: https://www.pcgamer.com/an-upcoming-rts-will-incorporate-the...

[3]: https://store.steampowered.com/app/731040/The_Invincible/

[4]: https://arstechnica.com/gaming/2024/05/after-you-die-your-st...

I appreciate the thoughts you put into this, and thanks for sharing.

Why would a game need to be a business?

Because it takes time and quite some work to build one and there's nothing wrong wanting to live from it.

Sure, but nobody is forcing you to publish on F-Droid.

I'm not sure what you are arguing for or against. I think janosdebugs made it quite clear what they are trying to do.

You do realize that many apps on F-Droid are developed by businesses? OSMAnd, Fennec, Jitsi Meet, Element, Telegram being big examples. We also had the Simple family of apps for a while.

Shattered Pixels is one example of a game with a commercial side that is published on f-droid.

> I won't trust no tracking if it's non free.

Meanwhile, lots of non-mobile free software includes tracking (telemetry) these days. The cynic in me has had to switch to

I won't trust no tracking if it's not enforced by a security boundary.

Which free software does this without asking / telling the user? Especially free software that tells you no tracking?

But yes, free software is not a guarantee against tracking. It only allows auditing and be modified.

Here's a sampling of stuff I've semi-recently encountered on Github that all spy on you by default. For some, it's undocumented, for others it's a minor subsection in the docs. (Some of them are source-available not free, I didn't keep track as I collected the URLs.)

https://github.com/zed-industries/zed

https://github.com/microsoft/vscode

https://github.com/keystonejs/keystone

https://github.com/meilisearch/meilisearch

https://github.com/hasura/graphql-engine

https://github.com/manticoresoftware/manticoresearch/

https://github.com/coder/code-server

https://github.com/loft-sh/devpod

https://github.com/quickwit-oss/quickwit

https://github.com/rilldata/rill-developer/

https://github.com/hocus-dev/hocus

https://github.com/firezone/firezone

Here's a write-up of how bad it gets -- it's pretty obnoxious: https://www.roboleary.net/tools/2022/04/20/vscode-telemetry....

VSCode is proprietary.

That's why the difference between Codium and VSCode matters. Actually, IIRC the code from the ms repo does not do telemetry, they add it to the binary they distribute.

Yeah personally that's what I love most about F-Droid. There's not a very wide selection of applications there, but if you can find an app that does what you want you're almost guaranteed that it'll be open source and free of ads, tracking, and other annoyances.

I used Graphene OS on a Pixel 4 for a few years and loved it. I feel like I'm a total minority user who doesn't attach themselves to specific apps so not having Firefox available wasn't really a huge thing for me. There were several apps I did have to have, but they were all available through the F-Droid store.

Graphene was easy for me but like you pointed out, many will not use it because it doesn't have exactly what they use/need. To some degree this inflexibility reminds me of people not switching to the Windows Phone platform for the same reason - which is sad considering we only have two choices now because people wouldn't take the chance and Microsoft abandoned the OS before really giving it a good opportunity to thrive.

Kind of a sad state of affairs when people are totally comfortable handing over all their personal information to the likes of Apple, Samsung and Google.

Full disclosure: Yes, I'm a totally disgruntled former Windows phone user. Yes, there were a lot of factors that led to its demise, but I felt at the time we finally had an alternative to what we were being spoon fed in Apple and Google.

Windows Phone 8.0 was great, partially because of the OS, and partially because MS paid for ports of the top-N apps to it.

GrapheneOS didn’t work as a daily driver for me because I couldn’t reliably use it for uber, lyft, parking or ev charging. The camera support was missing some features.

Most of that is fixable by adding back the google services, but then you lose most of the privacy advantages of having a de-googled phone.

A note regarding your last point:

  - Google Play is sandboxed [1], you have (important) privacy advantages
  - with a second account for banking apps (or in your example) uber, lyft, one can nicely separate "google-play-apps" from free apps, account switching is fast

[1]: https://grapheneos.org/usage#sandboxed-google-play

I'm not using Google play or any other services on android over 6 years now. You don't need banking apps for making transactions.

I live in an EU country and I, in fact, cannot use online banking without a Google-enabled Android or an iPhone. There is exactly one bank that offers a desktop authenticator, but we had a really bad experience with them when we tried them for a year.

MicroG could work, but I never used banking app, so I cannot verify it. Adopt paying by other, more secure and private friendly ways.

What payment method would you recommend for paying mortgages, utility bills, and company expenses?

You said you're in the EU right ? SEPA works. The only moment I need to confirm identity with my bank is when I buy frivolities, not for my bills.

Here's the problem: I can do a SEPA transaction using online banking (with a Google-enabled phone) or by walking to my bank personally.

I might be lucky enough to have online banking work with sms and a pre-shared secret. My bank (also in the EU) didn't tell me I could do it automatically, they only mentioned it when I told them I lost my phone (it was true) and that I didn't know when I could buy a new one. Maybe it'll work with yours ?

No, ever since PSD2 came into effect, banks here refuse to do SMS-based verification and have switched to apps. They also don't support hardware authenticators for consumers. I asked.

Fortunately we have competition and possibility to switch to banks that are more private and user friendly.

I have accounts at 1 Swiss bank, 2 German banks, and 2 UK banks. None of them require an app for any functionality.

You can get a little hardware thing to generate their OTP codes, as an alternative to apps.

The hardware dongle sounds like it might be TOTP. There are plenty of clients for that for laptops and phones, assuming you can enroll your own secret.

likely, but it's a custom time based token from RSA that you definitely will never get the keys out. so the implementation doesn't matter much.

Unfortunately it's not plain TOTP. Most banks in Europe give you a standalone cheap plastic smart card reader into which you put your bank card.

The website shows you a code. You input it into the reader, followed by your card PIN. The reader outputs a code you put into the website.

This is what it looks like:

https://www.post.ch/-/media/portal-opp/k/bilder/postgeschich...

I live in a EU country as well, Netherlands to be exact. Never had an issue with any bank. What are you talking about?

Netherlands today is more like the USA. anything it can fight the EU it will. it's the reason it's the new silicon valley with all tax dodging companies moving there.

and it's not going to improve. second factor auth in Europe now legally means "second factor auth via means the gov can positively link your Identity".

for anything EU or eu commission, you must either have an app in stock OS smartphone, or receive a sms on a network they can validate sim is attached to a tax id, or nothing else is allowed. totp et al is legally verboten.

Reply on news.ycombinator.com