So I’ve been in the rabbit hole of android privacy for some time, last I joined the GrapheneOS community but let’s just say that they doesn’t have a “healthy” opinion about other projects like f-droid.
So I am looking for generic communities that focus on mobile privacy that doesn’t have drama or toxicity or “extreme opinions”. Any suggestions? I prefer chat based communities like matrix or simplex instead of like reddit or lemmy.
You must log in or # to comment.
What does a healthy opinion of F-Droid look like though? Lol
Fdroid is introducing another trusted party to your supply chain, which should be a factor in anyone’s threat molding.
https://f-droid.org/docs/Reproducible_Builds/ However, with reproducible builds now a package is built and signed by both fdroid and the original developer, so you get a net security benefit of having a third party attesting they can independently reproduce the binary from source. Problem solved right? Well, yes but mostly no. Most projects and packages don’t have reproducible builds, so if your using fdroid for most packages your still trusting droid.
I think a lot of the online hate comes from people making assumptions that their use case and threat model applies to everyone. That’s why I prefer discourse where we just talk about the attributes and not “you should”
I feel like there’s a lot of FUD around this subject, because people bring it up as if it’s purely a negative without talking about the reasons why it’s done the way it is. The whole point of F-Droid is that it’s a repository (not a store) of free software applications. They have an inclusion policy forbidding proprietary code and dependencies, and in order to enforce this policy they have to build from publicly available source code, and in order to do so they need to sign the builds themselves. This means, yes, you are trusting F-Droid instead of the upstream developer - but given F-Droid has higher standards than upstream developers this is a tradeoff I am willing to make.
Reproducible builds solves this in a way that preserves the standards of F-Droid, however, “security peoples’” favored “alternatives” (such as Accrescent, Obtainium, and Google Play Store/Aurora Store) forego this entirely, showing they don’t either have a viable solution to offer or that they don’t really care about the problem that F-Droid is addressing to begin with.
Really well said!
Do you know of an equivalent to https://reproducible-builds.org/citests/ for Android/F-Droid packages? I’d like to see some public verification of these reproducible builds, especially Signal.
Signal isn’t on F-droid. You need to use Molly for that.
Indeed… I was not trying to imply that it was.
the public verification is that the developer signed binary matches the fdroid built binary
Yes, but this is often not an option for non-developers
There isn’t anything better than F-droid as far as I can tell
I completely understand, but this only adversely affects you if f-droid getting hacked is in your threat model. And not everyone have that.
Yeah exactly. So pointing that out is sufficient, and it’s up to every user to decide if the benefit is worth the risk. And I’m sure for most people fdroid is a net positive.
Now, I want to change gears, and talk about annoying personalities also being really beneficial. Crazy principled people drive change in the world. The open BSD founder, RMS, the graphene founder, these are crazy unreasonable uncompromising people which are difficult to get along, but they drive change. Sometimes we need those uncompromising people. I think putting up with them is the cost of a vibrant ecosystem.
I disagree.
If you’re an asshole, people don’t want to work with you, and will actively avoid you.
I’m the IT guru in my family and extended circle. Of the probably 100+ people I advise, none will ever use Graphene now.
They alienate people with their hubris and condescension. Rather than help people understand their perspective, they act like it’s “the only answer”.
That’s never a solution. Discussing pros and cons of different approaches moves us forward, not the Graphene “us VS them” mentality.
What’s an unhealthy opinion of f-droid? Is something wrong with it? Genuine question. I’m out of the loop.
F-droid acts as a trust for all the apps you download through it, which means if F droid is hacked, hackers can push fake update to all the apps. It is an issue, but not the biggest concern of average joe. Although F-droid should take it pretty seriously.
But I think hating on them is not the solution…
Oh. Same is true for Google Play and literally every self updating app/program on the planet lmao.
For Google Play: Google has root on play devices which is a separate issue, but the apps are actually signed by their developers and not google.
not google
This is not true… play store now requires you to give up your signing keys to google so they can sign the app themselves after injecting whatever they feel like. F-Droid does the same because they also compile your apps for you. Another reason some don’t trust F-Droid (or Signal, Tor and a bunch of other free/open source software for that matter) is that they received funding from OTF which is funded by the US government and some people don’t like that. And yes I know computers and the internet also came from the government /shrug
I have no skin in this game, I am not intentionally trying to spread any FUD (but I realize some people will still claim so, they are free to do so), just relaying information I have seen elsewhere. Happy to provide sources if anyone likes.
Thats a good point, but it looks like they still let you use your own keys if you want to, but they even say 90% of apps let google sign on their behalf. yeah, ok, full trust with google then.
Before 2021 all apps used their own keys it seems
Play App Signing is required for new apps.
Also now required is giving up your government identity document to google in order to keep publishing on the play store.
They have actually made a bunch of security enhancements to there systems and processes. You can look at the blog if you are curious.
I would like to not delve into infighting and would like to avoid it
As you wish. But maybe open up to some new perspectives.
As long as it doesn’t get dissolved into pure hate.
There are no non-toxic spaces these days.
Uggh, I even hate that word.
There are assholes everywhere, always have been, always will be.
Lemmy isn’t bad although there are some far left
Can y9u share some?
They said there are none
Oh shit I missed the “no”
Fuck that’s sad…
Two words: Fuck Graphene
(More words): and the assholes who run it.
I’ve been flashing phones since my OG Droid in 2009. Done probably 200+ flashes across numerous phones.
I’ve been in IT since the early 90’s.
Had an error with the Graphene flash on a clean Pixel. The way they talked to me would’ve gotten me a re-training session with my management, possibly fired, back when I was on a help desk.
Bunch of arrogant, condescending pricks. They need a Red Foreman boot up their ass.
Oh brother tell me about it. They talk like they are the final word on computer security lol
That ego lol
Main guy got into a pissing match with Louis roassmann lol
Some people got no social skills
To be fair Graphene OS is probably a big part of there personality
I run graphene on several devices and recommend it. I do not participate in much discussion about it through. You can just use the best we got in android and be fine with that.
Discussion forums are the same all over I think. I don’t see much difference around graphene here on Lemmy or XDA forum.
For the love of God do not ever go to their community in any case… If you need technical help literally ask anywhere else… If you go there, you’ll end up hating GOS you’ve been warned
Was this recently? It was bad under micay but thought it had improved by now.
Still not great…
Isn’t he still pretty involved in the project? I only followed the Rossmann story for a bit until I encountered random attacks on microg in the issue for Mozilla Location Services shutting down.
There’s also this random attack on alternative location services by GrapheneOS.
https://grapheneos.org/articles/positon-location-service(Some surrounding discussion on the article can be found here (microg issue for MLS retiring))
Overall, Graphene does not seem like a friendly project in my opinion.
I’ve always got help, and the moderators are really nice.
You can just join XDA. TBH if Graphene is not your thing and Lineage OS isn’t supported on your device, you can just unlock the bootloader and install the patched kernel using KernelSU which will give you the control you want.
what about DivestOS?
Device support?
Best supported devices: https://divestos.org/pages/devices_golden
All devices supported: https://divestos.org/pages/devices
Most of them older devices. This is not the fault of the Lineage OS devs, but companies just aren’t allowing it anymore. So if you have a new device, Lineage OS is not an option, if you’re in the US
It’s based on Lineage, so lots
Most of them older devices. This is not the fault of the Lineage OS devs, but companies just aren’t allowing it anymore. So if you have a new device, Lineage OS is not an option, if you’re in the US
Yeah, I want all my devices to run LineageOS and that limits me from lots of options to maybe 2 or 3 modern ones at reasonablish price points.
Thankfully I don’t live in the US, it would be even more difficult as you said.
The dev has ties with the Graphene OS project and has had some controversy. Not to say that it is bad but you should be aware of the person who controls it.
Any good tutorial??
Read KernelSU docs
XDA has a chat?
They have a forum
‘Just trust me bro’ hardware, Google Play Integrity API, banned and GrapheneOS is still simping it.
Running away doesn’t fix this.
At least they could like not be paranoid and hostile…
Doesn’t tick all the boxes as it is on Lemmy, but feel free to join us at !degoogle@lemmy.ml
I’ve learned a lot about privacy/security from xmpp chatrooms, especially the room for the conversations client and the divestos chatroom. They both are kind of support chatrooms for the chat client/ android rom but privacy is often a topic and the programmers/ rom maintainers are also present and very knowledgeable. https://search.jabber.network/rooms/1
Be prepared to be assaulted by the Graphene OS community
My suggestion would be the Calyx OS community or even the F-droid forms.
