Obtainium: Get Android App Updates Directly from the Source
obtainium.imranr.dev
obtainium.imranr.dev
Obviously you have to be careful what you install, just as with any app not found in Play Store, but if you're getting your apps elsewhere anyway this is really convenient.
I would recommend caution with apps from the store too. Not only are many predatory practices not disallowed, outright malware can and does slip through review. The advice is the same as ever when it comes to computers: don't run programs you don't trust, and set your bar of trust high.
We hear enough story how Google removes legit app without reason, using automated process, to know that there is at least as much malicious app that goes through being undetected.
The advice is absolutely not the same as it's always been - it would be weird if the advice from the early aughts, when it was common to be affected by malware or viruses, was the same as the advice now when it's rare.
[0] https://www.tomsguide.com/news/these-35-malicious-android-ap...
I'd love it to be zero but the amount of vigilance warranted has gotta be a lot less than it was in the past unless there's some argument that magnitude of harm has gone up by a massive amount while probability has gone down by the same amount. Which, idunno, maybe that argument can be made actually.
Also I guess 2001 felt unsafe to visit trusted websites, so the advice upthread was already a bit lessened.
Isn't this cause for people to be more vigilant? You can't even trust apps that are vouched for by large numbers of users (with these large numbers being not mere claims on a shady website, but statistics officially certified by the authority of the app store).
But 2 million downloads among 35 apps is nothing when it comes to evaluating your personal risk. There's like 50,000 times that many apps downloaded every year. The point is the odds of you installing this app are very low. And if those numbers are half fraudulent then the odds are half of that already very small number.
People treat installing apps like a casual activity that involves no real thought or consideration. They've been trained to do so. The mental model needs to change: installing software is granting it some measure of ground on your device, and should only be done in cases where you have good reason to trust the developers. For everything else, that's what we have websites for.
the mcdonald's app has never sent me a notification
That's... kind of the point when distributing malware? Not only has the game changed as to what actually happens, but malware is only valuable as long as it's installed - meaning getting noticed is pretty well the worst-case scenario for the attacker.
The main point though is malware is no longer stealing credit card numbers. It's not 15 ad-laden toolbars in browsers, or pop-unders and overs, or in-your-face obvious. A subtle miner over half a million users is a decent chunk of shitcoin to mine, and efficiency doesn't matter when it's not your hardware, or your power.
How?
Its still a lot more dangerous than the Play store, and I assume a good threat actor can go undetected, but the Play Protect even scans apps that are installed from outside the store.
Lets not forget that certificates are created and checked for github.com, so unlikely for a middleman to get in.
I trust github much more than google right now. Especially since the object being fetched is generic as opposed to a appstore. Google's app store has only shown to hinder publishing. Take syncthing for instance.
The only thing I wish was better was the .apk selection process. It would be nice if a database existed with filename formats or a little extra metadata to match the correct asset.
What?
Don't assume that the APKs are generated by GitHub's CI, anyhow, anything can be uploaded as a release
In any case, there's for sure no GitHub certificate added to the APKs
It seems to not check it automatically, though?
- uses: JS-DevTools/npm-publish@v2
with:
token: ${{ secrets.NPM_TOKEN }}
access: public
provenance: true
We sorely need 1:1 replacement of app store trust and discovery mechanisms too without any kafka-esque approval hoops. Obtainium app config sharing and perhaps a standard for APK release webpages would be a great first step towards that.
Reference images: - Add app: https://ibb.co/dL1Hqw6 - Result: https://ibb.co/whmL3PY
2. FFUpdater
3. Obtanium
4. Aurora Store
2. FFUpdater
3. Aurora Store