eighthave

7 ms·

1.
by eighthave 9mo ago
Lots of projects with good security track records host key servers in a "member's house". That said, the F-Droid buildserver is not hosted in anyone's house.
2.
by eighthave 9mo ago
There are two key concepts at play here: "least authority" and "infrastructure as code". The buildserver host is sensitive security-wise, but easy to set up an instance. We have multiple instances running, and spin up
3.
by eighthave 1y ago
The limiting factor for upgrading our buildserver is finding a trusted, skilled sysadmin to physically install, setup and maintain new hardware at the high level of security that is needed for a release buildserver for a project like F-Droi
4.
Distributed Community-Controlled Backup Ceremony(f-droid.org)
4 points by eighthave 3y ago|1 comments
5.
by eighthave 3y ago
F-Droid is working to figure out how to manage secure backups in a way that is controlled by a free software community and is as secure and usable as possible.
6.
by eighthave 3y ago
I hope that this precedent applies to any and all countries waging illegal wars. This definitely should apply to US/UK/etc regarding the Iraq War.
7.
by eighthave 4y ago
Interesting points, I agree the Updates tab could do better there. Update All is implemented if you have F-Droid Privileged Extension installed, it could also be implemented when it is directly installed, if someone wants to contribute the
8.
by eighthave 4y ago
We welcome contributions to support APK diffs, it would make a big impact: https://gitlab.com/fdroid/fdroidclient/-/issues/450
9.
by eighthave 4y ago
JSON is the file format, it is then parsed and stored in the local SQLite
10.
by eighthave 4y ago
Hey @pserwylo, great to hear from you, and I especially appreciate your message here with the background. And I'd like to highlight your point that there is much less contributor time than people imagine. If anything, the F-Droid cli
11.
by eighthave 4y ago
This is a full revamp of a bunch of the key guts of the app. We hope that other F-Droid-compatible clients like Classic, Foxy, NeoStore, droid-ify, etc. can benefit from this revamp as well: we've split out this core functionality int
12.
by eighthave 4y ago
I disagree that the main question is: "do multiple stores benefit the user?". The main question is: "Should the user have the choice in their stores?". Apple believes that their users should not have that choice, and
13.
by eighthave 4y ago
How people access apps is not a on/off switch between walled garden and dog eat dog free for all. Decentralized systems need to be designed with safety in mind, just like walled gardens do. Both can be done badly or done well.
14.
by eighthave 4y ago
With free software and reproducible builds, it is possible for small scale curators to inherit the security of the large scale curators. That is why they are key pieces of the f-droid.org collection.
15.
by eighthave 4y ago
I agree with basically all the points in this thread, one thing that is missing is that most of these points are not mutually exclusive. A decentralized system like F-Droid does not close out the possibility of walled gardens, it just give
16.
by eighthave 4y ago
It is true that many essential organizations cannot effectively defend their networks. But it is also important to point out that there are many orgs that _are_ effectively defending their networks. I've worked in IT in a huge range
17.
by eighthave 4y ago
With free software and decentralized repositories, users in each country can decide which software they want to distribute and how. If someone thinks a local ban is unjust, they know they have the right and the tools to redistribute any ap
18.
by eighthave 4y ago
https://apt.izzysoft.de/fdroid/index/
19.
by eighthave 4y ago
If you're interested in learning more about what F-Droid offers, I can recommend some more blog posts: * https://f-droid.org/2022/09/30/free-software-and-inspection-... * https://f-droid.org&#
20.
by eighthave 4y ago
GNOME Software is an app: https://apps.gnome.org/app/org.gnome.Software/
21.
by eighthave 4y ago
It is not about scale as much as the possibility of getting apps from multiple sources. Each source can set its own curation policies, and each user can choose the sources they want. And for things that people want to keep out of their lif
22.
by eighthave 4y ago
IEEE is not alone in that, basically all editorials in major publications are backed by PR staff. That's how it works, at least in the US.
23.
by eighthave 5y ago
That may be true if you are sideloading F-Droid. Our security model focus is based on integrating F-Droid into the ROM, like with CalyxOS. This method is proven to provide better security than Google Play devices, since by default, all ap
24.
by eighthave 5y ago
Jitsi lets you set room passwords, and it is also very easy to create a new Jitsi room, so you can easily send a new URL around as needed.
25.
by eighthave 5y ago
F-Droid is about user freedom, so there are clients that are more like Linux package managers, for example https://github.com/mvdan/fdroidcl
26.
by eighthave 5y ago
I was also initially skeptical, but after looking into IPFS, I think the core ideas are real and useful. IPFS is inspired by bittorrent, and addresses some of the issues with bittorrent that keep torrenting a very manual process. Debian d
27.
by eighthave 5y ago
We're taking a hybrid approach right now, where we incorporate IPFS support into our working stack. Then we can transition more and more to IPFS as it proves mature enough to replace the more centralized methods.
28.
by eighthave 5y ago
Yes, but f-droid.org actually does let devs use their own keys via the reproducible builds process ( https://f-droid.org/docs/Build_Metadata_Reference/#Binaries ). The only blocker for getting Signal into f-droid.o
29.
by eighthave 5y ago
If a project maintained reproducible builds, then they can have the best of both worlds: their own repo where they can publish builds as they like, then f-droid.org can later reproduce them and use the upstream developer's signature.
30.
by eighthave 5y ago
This patch workflow would also work with F-Droid. I don't know of any other workflows for this situation.

More ›