At the core of #AndroidDeveloperVerification are a couple potentially useful ideas. #Google has entirely wrapped them in a pile of anti-competitive garbage designed to defend their massive #monopoly profit margins, but nonetheless, those specific technical ideas might still be useful. #iOS's "notarization" is basically the same. That leads me to ask the key question:

What would a #FOSS-respecting system of #verification look like? What #identity info is useful for trusting the #developer?

This #PlayIntegrity stuff is really questionable. My banking app won't run on a #GoogleFree #LineageOS running #Android 16 with all the latest security updates. But a #GooglePlay device running Android 10 that was last updated in 2021 is approved. This is not a real #security check. This looks like a #gatekeeper #monopoly check.

Dear tech media, could we please stop using GrapheneOS as the judge on what's secure? I respect very much what GrapheneOS has built, but their stance that free software is not important to security is very short sighted. They literally are willing to call binary blobs secure because someone told them they are? They have no other standard to go on, since they can't inspect them.

https://www.theregister.com/2025/10/15/fsf_librphone_vs_proprietary_binary_blog/

#FreeSoftware #FOSS #mobile #LibrePhone #FSF #proprietary

We're starting to implement support for split APKs in #FDroid. #Google wants to gather as much data about its users as possible, so trying to hide info about language, country, device specs was not a design concern for them. It is central for us. We want the official client to leak as little data as possible to any server, be it ours, mirrors, or custom repos. We welcome input:

https://gitlab.com/fdroid/fdroidclient/-/issues/2963

#Android #APK #privacy #DataEfficiency #efficiency #technology #data #metadata

The first time I went to FOSDEM, I was constantly explaining what F-Droid was to people who never heard of it. I was introducing it and promoting it.

Second FOSDEM, people said "oh yeah, I heard of it, what does it do?"

Third FOSDEM, people said "I'm a user!"

Fourth FOSDEM, I listened to people tell other people what F-Droid is, and heard groups of people talking about it as the app store that everyone in the group had on their phone.

It has been quite a ride!

#FDroid #FOSDEM #FreeSoftware

@Mer__edith Here is one thing Signal could be doing that it is not: the Signal fork @mollyim has already implemented #UnifiedPush support, Signal can help there, or even integrate that work https://github.com/mollyim/mollysocket

@Mer__edith seems pretty off base to call that FOSS culture. In my 30 years of working in FOSS, the people who are actually immersed in FOSS are much nicer and more helpful than in general. It is the people who treat FOSS contributors of any kind as some kind of service provider that are the shitty ones. Way back, I worked in corp tech support, and got treated shitty. So often, I see people laying on that kind of crap on volunteer FOSS devs on the internet. That is not FOSS culture.

@Mer__edith Try to find the stressed out, overworked dev who implemented some piece of macOS or Google that annoys you. You can't, they are hidden within the corp. That doesn't mean they aren't an asshole, it just means you can't interact with them. FOSS devs are vastly more likely to operate in public and respond to feedback from anyone. So there is a data bias at work here.

@captainepoch @cnx @fdroidorg @husky hehe you're welcome. That's perfect! If we focus on fixing things upstream as much as possible, many apps will just automatically become #ReproducibleBuilds without the devs even being aware. Your message made me feel like we're on the right track, thanks!

@cnx @fdroidorg @captainepoch @husky All our rebuilds of Husky from v1.4.0 til v1.5.3 have been reproducible, so most likely, the newer ones still are. We'll see for sure once our rebuilders catch up with the backlog.

@WPalant Because the submitter deleted their account as a response to the review, I think it could be an deliberate attempt to insert the vuln. Plus all the attention from random new accounts. If it had been a normal review process, I could see how it could have been an honest mistake. But that scenario also makes it more attractive to the attacker, since making a mistake there is quite plausible, and could serve as an easy cover story.

Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now

https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889

#Debian has been moving more towards the deb.debian.org mirror which is provided by a single CDN company, #Fastly. It works well, but also feeds an enormous amount of #metadata to a single company, and it can be used to track computers and maybe even people. And the privacy policy in effect is unclear. Fastly says the #privacy policy of the "subscriber" applies, but the privacy policy for deb.debian.org is not listed anywhere I could find. Anyone have any insight here?

@feld 3 vs 10 would make a big different. If I remember correctly, Amnesty Panic Button had a 10 second countdown. Also, Apple designs things in a very integrated way so they would have designed the hardware power button to also work for this use case. That kind of design integration rarely happens in the Android ecosystem. Google Pixel devices do it to some degree, but not nearly as in-depth as Apple does. I would love to see an Android device that applied the same level of polish as Apple does

@feld Apple's PR department is better at shifting blame to other people? My experience with Apple phones is via my mother, whose ringer switch is constantly being accidentally flipped off, so she's rarely reachable. She doesn't know what the switch does, it just gets accidentally switched somehow.

A decade ago, #AmnestyInternational did some extensive UX work on #panic buttons using the power button. They used 10 presses as their trigger, and still got far too many false positives. Their conclusion was power button triggers were not workable. #GuardianProject reached a similar conclusion back then. I guess #Google missed that research: they shipped #Android with a 5-press trigger, and now emergency services numbers are receiving record numbers of false calls:

https://arstechnica.com/gadgets/2023/06/uk-police-blame-android-for-record-number-of-false-emergency-calls/