Comment by elchananHaas
15 days ago
I wonder what would happen if F droid signed all software under their keys even though they aren't the developer? Make Google ban them instead of just giving up?
15 days ago
I wonder what would happen if F droid signed all software under their keys even though they aren't the developer? Make Google ban them instead of just giving up?
This is addressed in the article as well, and while there's no technical reason they couldn't do this, it would break the licensing of the apps as well as the dangers of centralizations mentioned by a sibling reply.
> The F-Droid project cannot require that developers register their apps through Google, but at the same time, we cannot “take over” the application identifiers for the open-source apps we distribute, as that would effectively seize exclusive distribution rights to those applications.
Oh... this makes things much clearer to me actually. The issue is that you don't want apps that impersonate other apps showing up. For example, if someone put an app in another market that could sideload to impersonate Facebook's intents and do evil-maid type things. In the new system it would become very difficult to install a fake Facebook that is able to convince other apps that it is in fact Facebook's own app. Google's announcement can be seen as them operating essentially like DNS for app ids and intents and making things safer for a multi-app-store universe.
For example, there is an annoyance that happens sometimes with apps that are distributed in both F-Droid and Play Store related to updates. F-Droid and Play Store will think they both can update the app (they have the same tld.what.ever identifier) but the signing keys only match the store they were installed from. I think F-Droid is now a bit more careful about this and only tries ones it has specifically installed. This is different... but somewhat related.
F-Droid in general is a model good actor as far third-party app stores go, but from the perspective that malicious app stores might exist you would want to try and isolate apps from each other (and prevent unauthorized re-distribution of tampered versions etc). I think what Google is doing forces apps in each store to be cleanly namespaced from each other and prevent collisions (accidental or otherwise). This lets each app store tend and be responsible for its own walled garden.
F-droid only distributes apps it builds (unless you add an additional repository). The official F-droid repository only contains code they build from source. You can't upload binaries/bytecode to the official F-droid repo.
1 reply →
That makes a lot of sense. Unfortunate indeed that Google would be the sole arbiter of that “DNS”, but that explanation was pretty good
f-droid could distribute their apps with a different identifier.
That might be the least-worst option here.
Any centralisation like this is bad: it's too easy for Google to delete all f-droid apps with their play protect one day.
Okay so the options are:
- don't exist
- exist until you get deleted
You seriously prefer the former?
Are you serious? There are more options than you think (or try to convince others). I do prefer control over what I can install to my computer be it a box or a mobile one, and control on what runs there.
1 reply →
FDroid owns the keys for any app submitted without reproducible builds. But I believe they would prefer 100% reproducible builds and to own no keys
maybe they can distribute the apps with a different identifier? just add a suffix? like fdroid.__original_identifier__ ?
Maybe users could provide their own keys into the F-Droid app and the F-Droid installer swaps keys as part of the download and install. At the end of the day we're just talking about a signature.
No. You pay Google for the license and Google can kill your app, even on f droid.
We don't need a work around. We need Google to stop killing our apps.
The new registration system is not the paid the full developer registration--that's only needed for Play Store distribution. The new thing everyone is complaining about is a different registration system that will be free (but likely requires identity verification). Google's announcement said that a solution was being developed but is not yet available to support individual and hobbyist use. They said it will be available before the system becomes mandatory (except for a few high-risk countries)
Frankly, I don't see why anonymous app distribution is necessary. The "I own my own device goddammit" thing is hobbyist category. Why should it be friction-less to install crap that has no provenance? That specifically seems like a really dumb hill to die on.
2 replies →