1052
submitted 5 months ago by [email protected] to c/[email protected]
you are viewing a single comment's thread
view the rest of the comments
[-] [email protected] 7 points 5 months ago* (last edited 5 months ago)

If you set URLCheck as a default browser and you can automate the process of making people think you love them

[-] Cheradenine 6 points 5 months ago
[-] [email protected] 3 points 5 months ago

While fdroid is great for discovery or if you're running without Play Services, I'm using the Play Store anyway so I'll use that if they're on there or if not then Obtanium to get them from the source repo.

Isn't there some weirdness with signing apps on fdroid? A bit beyond my security knowledge when I last saw it discussed.

[-] [email protected] 6 points 5 months ago* (last edited 5 months ago)

F-Droid compiles apps from source by itself, without blindly trusting that the APK provided by the developer actually came from the source code. After independent compilation, one of two things happen:

If the app uses reproducible builds, then F-Droid verifies that its own compiled APK matches byte-for-byte with the APK provided by the developer. If they match, F-Droid distributes the APK signed with the developer's signing key, same as Play Store does (except Play Store doesn't verify anything).

Otherwise, F-Droid distributes its own compiled APK signed with F-Droid's signing key.

In either case, F-Droid guarantees that you get an app that matches the source code exactly.

None of this process should matter to you as a user, and it's all fairly transparent from a user's perspective. F-Droid gives you certain guarantees and internally enforces these guarantees, while Play Store does not.

[-] [email protected] 3 points 5 months ago

Plus, if the app supports reproducible build, fdorid will just delivers the app to you via the developer's signature. So it is just a additional verification without adding any trusted party. App signing section https://f-droid.org/docs/Security_Model/

fdroid also manually inspect the source to make sure nothing funky is going on. But of course that cannot be absolutely through, because the time and workforce constraint.

Finally, fdroid has updated to index v2 which improves the security of index v1, specifically:

  • As of index-v2, files from the repo are verified based on SHA-256, including icons, screenshots, etc.
  • index-v2 uses any algorithm supported by apksigner and android-23 and newer, and relies on OpenJDK’s and Google’s maintenance of the currently valid signing algorithms. When index-v2 was launched, the signature algorithm in use was SHA256withRSA and the digest algorithm was SHA-256. index-v1 is signed by SHA1withRSA. As of this writing, SHA1 are still considered strong against second pre-image attacks, which is what is relevant for index JARs.

https://f-droid.org/docs/Security_Model/

[-] brbposting 3 points 5 months ago

On iOS, I use the Clean URLs iOS shortcut to cleanup links & remove tracking parameters.

Credit: mastodon.social/@DavidBlue

I want to create a version that adds a check for a YouTube link and creates a Piped.video link too - save me a few seconds each time.

[-] [email protected] 3 points 5 months ago

Nice to see an app for it.

Android 13 and above comes with a clipboard editor which is super handy. I just edit all my links in that.

[-] [email protected] 2 points 5 months ago

Oh nice, I had no idea that's what that did, cheers!

this post was submitted on 06 Feb 2024
1052 points (99.0% liked)

Microblog Memes

4844 readers
2281 users here now

A place to share screenshots of Microblog posts, whether from Mastodon, tumblr, ~~Twitter~~ X, KBin, Threads or elsewhere.

Created as an evolution of White People Twitter and other tweet-capture subreddits.

Rules:

  1. Please put at least one word relevant to the post in the post title.
  2. Be nice.
  3. No advertising, brand promotion or guerilla marketing.

Related communities:

founded 1 year ago
MODERATORS