Hans-Christoph Steiner

We're starting to implement support for split APKs in #FDroid. #Google wants to gather as much data about its users as possible, so trying to hide info about language, country, device specs was not a design concern for them. It is central for us. We want the official client to leak as little data as possible to any server, be it ours, mirrors, or custom repos. We welcome input:

https://gitlab.com/fdroid/fdroidclient/-/issues/2963

#Android #APK #privacy #DataEfficiency #efficiency #technology #data #metadata

Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now

https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889

I got the opportunity to go to #FOSDEM and of course I had my #FDroid "hat" on. I wrote up some quick impressions of my trip, including what I learned about the #EU's #DigitalMarketsAct #CyberResilienceAct and #ProductLiabilityDirective

There really are a lot of important projects represented there:
https://f-droid.org/2024/02/06/at-fosdem.html

After #FOSDEM my current understanding of how #EU #CRA and #PLD affects #FDroid and anyone who contributes to it:

* F-Droid org makes the "product" so it would be liable
* F-Droid is currently entirely non-commercial, handles no money
* Volunteer contributors are very clearly exempt from all this
* Donation funded contributions are also exempt
* Contracted contributors are helping build the regulated product, so the legal entities of the contractors would not be liable for F-Droid's "product"

#FDroid is consistently growing in its bandwidth usage over the years, as shown by this stats graph from the #UniFAU mirror. Interesting to see the short downward section when we added new official mirrors in April and November.

Thanks @FAU for the mirror, the bandwidth, and the stats! https://ftp.fau.de/cgi-bin/show-ftp-stats.cgi

(Medien: 1)

I like #Matrix and #Signal both for group communications, but there are still many things that #email does much better. For example, I often want to quickly preview a message to see if I want to deal with it now. If not, then I leave it marked unread. Not possible all the messenger apps I've tried. That leads to slower response times because I won't open messages until I'm fully ready to deal with something more complicated. Maybe #DeltaChat is the best direction for the long term.

This screen that #Google shows on #Android when installing #FDroid really bugs me. It is purely based on the integer value targetSdkVersion, without considering our security model, public audits results, track record over 10+ years, exclusive use of memory safe languages, or even what our code actually does. It is as if #FDroid marked anything that comes from Google as containing ads and trackers. 1/2

(Medien: 1)