Conversation

Notices

Embed this notice
ploum (ploum@mamot.fr)'s status on Saturday, 21-Oct-2023 00:11:29 JST ploum
- Proton Mail
Good news, the @protonmail android app is now available on F-Droid.
Is it official? I do not install something like that without official confirmation.
#fdroid
In conversation about a year ago from mamot.fr permalink
Attachments
1. Domain not in remote thumbnail source whitelist: f-droid.org
  
  F-Droid - Free and Open Source Android App Repository
  
  F-Droid is an installable catalogue of FOSS (Free and Open Source Software) applications for the Android platform. The client makes it easy to browse, install, and keep track of updates on your device.
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 00:11:28 JST Albert ARIBAUD ✎
  in reply to
  - Proton Mail
  @ploum @protonmail I only see the ProtonVPN app on F-Droid. What's the URL for the ProtonMail one?
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 02:09:38 JST Albert ARIBAUD ✎
  in reply to
  @mondstern
  It's a bit short especially for an app for protonmail. Why is it a must have?
  @ploum @LenticularCloud @protonmail @IzzyOnDroid
  
  In conversation about a year ago permalink
- Embed this notice
  -/mondstern (mondstern@mastodon.green)'s status on Saturday, 21-Oct-2023 02:09:40 JST -/mondstern
  in reply to
  @ploum @LenticularCloud @aaribaud @protonmail
  The @IzzyOnDroid repo is the Must-Have Repo
  
  In conversation about a year ago permalink
- Embed this notice
  LenticularCloud (lenticularcloud@mastodon.social)'s status on Saturday, 21-Oct-2023 02:09:41 JST LenticularCloud
  in reply to
  - Albert ARIBAUD ✎
  - Proton Mail
  @aaribaud @ploum @protonmail
  Same, I dont see it atm.
  
  In conversation about a year ago permalink
- Embed this notice
  ploum (ploum@mamot.fr)'s status on Saturday, 21-Oct-2023 02:09:41 JST ploum
  in reply to
  @LenticularCloud @aaribaud @protonmail : I have it in the Izzyondroid repository:
  https://apt.izzysoft.de/fdroid/index/apk/ch.protonmail.android
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 03:27:47 JST Albert ARIBAUD ✎
  in reply to
  - -/mondstern
  - sll - Macron destitution.
  @sll I'm afraid you might have misunderstood (or I did).
  There's F-Droid the repo and F-Droid the app.
  @mondstern says that apps get from the Izzy *repository* to the F-Droid *app* on your mobile faster than they do from the F-Droid *repository*.
  But because an app is available on the izzy repo does not mean it will ever be on the F-Droid repo.
  
  In conversation about a year ago permalink
- Embed this notice
  sll - Macron destitution. (sll@pouet.chapril.org)'s status on Saturday, 21-Oct-2023 03:27:49 JST sll - Macron destitution.
  in reply to
  - Albert ARIBAUD ✎
  - -/mondstern
  @mondstern OK. If it gets faster to FDroid, then no need to hurry, I can wait till the FDroid people add it :) @aaribaud
  
  In conversation about a year ago permalink
- Embed this notice
  -/mondstern (mondstern@mastodon.green)'s status on Saturday, 21-Oct-2023 03:27:51 JST -/mondstern
  in reply to
  - Albert ARIBAUD ✎
  @aaribaud
  Through Izzy, apps get to F-Droid faster, plus there's a daily repo update.
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 05:01:46 JST Albert ARIBAUD ✎
  in reply to
  - IzzyOnDroid ✅
  @IzzyOnDroid Thanks for chiming in! With such (understandable) size constraints, I imagine you do not rebuild the APKs from source?
  
  In conversation about a year ago permalink
- Embed this notice
  IzzyOnDroid ✅ (izzyondroid@floss.social)'s status on Saturday, 21-Oct-2023 05:01:48 JST IzzyOnDroid ✅
  in reply to
  - Albert ARIBAUD ✎
  @aaribaud Well, their APK is close to 0 MB. My repo runs on my personal space and thus has a size limit: 30 MB per app. Which means, their mail app simply does not fit in, or it would be there 🤷♂️
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 05:29:18 JST Albert ARIBAUD ✎
  in reply to
  - IzzyOnDroid ✅
  @IzzyOnDroid Thanks a lot for your answer!
  
  In conversation about a year ago permalink
- Embed this notice
  IzzyOnDroid ✅ (izzyondroid@floss.social)'s status on Saturday, 21-Oct-2023 05:29:19 JST IzzyOnDroid ✅
  in reply to
  - Albert ARIBAUD ✎
  @aaribaud No. As the "Readme's" say, my repo serves the APKs built by the developers. Just follow the "details" link at the top of the list 😉 Or go directly to the question you raised via this link:
  https://apt.izzysoft.de/fdroid/index/info#how_enter
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 05:55:51 JST Albert ARIBAUD ✎
  in reply to
  @SylvieLorxu @ploum @LenticularCloud @protonmail @IzzyOnDroid
  For the record: in the risk scenario(s) that I imagined with the "fetch APKs" model, IzzyOnDroid never was the bad actor -- after all, they could not tamper with the APKs they fetch without ruining the cryptographic signatures.
  The actual risk scenario would be that a github repo owner build an APK from sources other than those on the repo and upload it to the repo, then have IzzyOnDroid fetch it.
  [1/2]
  
  In conversation about a year ago permalink
- Embed this notice
  Sylvia (sylvielorxu@chaos.social)'s status on Saturday, 21-Oct-2023 05:55:52 JST Sylvia
  in reply to
  @ploum @LenticularCloud @aaribaud @protonmail I mean, if you use the IzzyOnDroid repository you trust @IzzyOnDroid to pull it in from the official source and not do anything weird :)
  I personally do trust him a lot and I think he has a well-deserved reputation of trustworthiness after years of running IzzyOnDroid.
  For context, his website on https://apt.izzysoft.de/fdroid/index/apk/ch.protonmail.android states the .apk file comes from https://github.com/ProtonMail/proton-mail-android
  In conversation about a year ago permalink
  Attachments
  1. Domain not in remote thumbnail source whitelist: apt.izzysoft.de
    
    „Proton Mail“ – IzzyOnDroid F-Droid Repository
    
    World’s largest encrypted email service - easy to use, free for all
  2. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
    
    GitHub - ProtonMail/proton-mail-android: Proton Mail Android app
    
    Proton Mail Android app. Contribute to ProtonMail/proton-mail-android development by creating an account on GitHub.
- Embed this notice
  ploum (ploum@mamot.fr)'s status on Saturday, 21-Oct-2023 05:55:53 JST ploum
  in reply to
  @SylvieLorxu @LenticularCloud @aaribaud @protonmail : for something as sensible as Protonmail, it would be interesting to know exactly who have pushed this and how we can trust that person.
  
  In conversation about a year ago permalink
- Embed this notice
  Sylvia (sylvielorxu@chaos.social)'s status on Saturday, 21-Oct-2023 05:55:55 JST Sylvia
  in reply to
  @ploum @LenticularCloud @aaribaud @protonmail IzzyOnDroid is not F-Droid. When you add a third party repository to F-Droid, you get apps directly from that repository without *any* checks from F-Droid.
  Izzy is pretty trustworthy, his repo grabs apps straight from GitHub/GitLab/etc. of the developers, but there are no checks if the .apk file matches the source code in question and apps may contain proprietary code.
  But yeah, Proton Mail is not in F-Droid. It is in IzzyOnDroid. Not the same.
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 06:00:47 JST Albert ARIBAUD ✎
  in reply to
  @SylvieLorxu @ploum @LenticularCloud @protonmail @IzzyOnDroid
  [2/2] And I am fine with a risk as long as I am aware of it -- then I can decide to either take that risk or take precautions which I think the risk makes necessary.
  Apologies if I appeared to distrust IzzyOnDroid.
  
  In conversation about a year ago permalink
- Embed this notice
  Albert ARIBAUD ✎ (aaribaud@mastodon.art)'s status on Saturday, 21-Oct-2023 06:38:02 JST Albert ARIBAUD ✎
  in reply to
  @ploum @IzzyOnDroid @SylvieLorxu @LenticularCloud
  From the respective site, it seems like the submission processes are separate and independent for F-Droid and IzzyOnDroid, and duplication (or its avoidance) is not considere.
  
  In conversation about a year ago permalink
- Embed this notice
  ploum (ploum@mamot.fr)'s status on Saturday, 21-Oct-2023 06:38:03 JST ploum
  in reply to
  @IzzyOnDroid @aaribaud @SylvieLorxu @LenticularCloud : I’m a bit confused about the F-droid process. Who decide what goes on the F-droid official repository and how do you ensure you don’t duplicate too much with them ?
  
  In conversation about a year ago permalink
- Embed this notice
  IzzyOnDroid ✅ (izzyondroid@floss.social)'s status on Saturday, 21-Oct-2023 06:38:04 JST IzzyOnDroid ✅
  in reply to
  @ploum it indeed mostly is. The entire framework and all (see https://gitlab.com/IzzyOnDroid/repo/). There were some contributions, and I got some help on questions – but for the most part (95%?) it's just me… Same with the companion site at https://android.izzysoft.de/ and my eBook server at https://ebooks.qumran.org/ (see my profile here). Glad to read you find it helpful! 😍 @aaribaud @SylvieLorxu @LenticularCloud
  In conversation about a year ago permalink
  Attachments
  1. Domain not in remote thumbnail source whitelist: gitlab.com
    
    IzzyOnDroid / repo · GitLab
    
    The F-Droid compatible repo at https://apt.izzysoft.de/fdroid/
  2. Untitled attachment
  3. Domain not in remote thumbnail source whitelist: ebooks.qumran.org
    
    Izzy's freie Bibliothek
    
    Katalog mit freien eBooks (Public Domain, Creative Commons): kostenlos und ohne Anmeldung stöbern und herunterladen!
- Embed this notice
  ploum (ploum@mamot.fr)'s status on Saturday, 21-Oct-2023 06:38:05 JST ploum
  in reply to
  @IzzyOnDroid @aaribaud @SylvieLorxu @LenticularCloud : wait a minute… You mean that IzzyOnDroid repository is a one-person-project ?
  If that’s the case, good job! Thanks for that, it is really useful.
  
  In conversation about a year ago permalink
- Embed this notice
  IzzyOnDroid ✅ (izzyondroid@floss.social)'s status on Saturday, 21-Oct-2023 06:38:07 JST IzzyOnDroid ✅
  in reply to
  @aaribaud @SylvieLorxu @ploum @LenticularCloud
  "The actual risk scenario would be that a github repo owner build an APK from sources other than those on the repo and upload it to the repo"
  That indeed is a real risk as I have no means to check that. There are other checks in place (library scanner, VT etc) which should reduce the risk of "bad stuff" – but a little risk always exists. So you need to trust the developer, too…
  
  In conversation about a year ago permalink

Public

Conversation

Notices

Feeds