Hacker News Reader

Comment by mary-ext | Hacker News Reader

See this issue talking about WireGuard and F-Droid. https://gitlab.com/fdroid/fdroiddata/-/issues/3110

OpenAPK here seems to be linking directly to official binary downloads, whereas F-Droid insists on building the APKs for the apps.

View on HN

> F-Droid insists on building the APKs for the apps.

You could say that OpenAPK blindly redistributes whatever APK upstream is peddling whereas F-Droid builds from source. I see the merits of both systems but prefer reproducible builds so that we can have the best of both worlds

Maybe it's just me but I'm kinda struggling to see much merit in blind distribution.

Well, for starters it is just a whole lot less work and money to distribute and maintain binaries up from the distributers' side, for the developers it comes down to a lower-barrier of entry to not have to adjust their workflow to whatever x platform may demand for building on their servers and in the end that gives the users more choices to work with. Of course, this is all in a perfect world where the chain of trust isn't broken so easily, which isn't an easy feat but given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think.

All of that said, not particularly speaking for OpenAPK here, given their motives seems rather unclear to me. If I am to be charitable, I guess they're just trying to provide a different platform than f-droid for discoverability, but for whatever reason they seem to be marketing the distribution-side of things more which is just odd to me, but alas.

> given platforms like Windows thrive in spite of it, it is probably not as bad as many people may think.

There is a lot of extra work done behind the scenes to "thrive in spite of it". Windows Defender (built into Windows after XP) has to periodically download updated virus definitions and always scans programs for potential malware, and still can't catch them all.

Shizuku's license disallow 3rd party recompilation of the APK, fork or not. Presumably this is done to provide an option to legally takedown fake Shizuku which could contains backdoor. (The original APK is redistributable) Hence Shizuku is not on F-Droid.

F-Droid, however, allow the developer's binary to be reproduced if they have tested that the APK is reproducible when replacing the APK's signature with the original APK.

It allows recompilation, just not using the official logo. Similar to Firefox in Debian kind of issue.

Reproducible builds would allow distributing Shizuku in F-Droid, that’s correct. (If Shizuku banned third party builds by the means of code license, it would not be FOSS and thus wouldn’t be eligible for inclusion in F-Droid altogether.)

It's a reason why I don't really trust signal. They don't want to be recompiled by 3rd party. You must either trust them (or the app stores, which isn't better) or go through the hassle of figuring out how to build it yourself.

It's fairly reasonable to discourage people from using random third-party compiled signal variants though. If you can't figure out building it yourself, using the official one will probably be safer.

If they had proper reproducible builds it wouldn't be an issue… Also, why do you think fdroid is more likely to backdoor it than they are themselves?

With fdroid i trust 1 party, by downloading random binaries I have to trust hundreds.

But they do have reproducible builds?

https://github.com/signalapp/Signal-Android/blob/main/reprod...

Except it's out of date…

> using the official one will probably be safer.

Why? The official one can be backdoored and with a gag order you would never hear about it

Not trusting signal's build and building it yourself is a reasonable thing to do.

Not trusting signal's build and then turning around and trusting some third party build seems strange. The official build probably has more eyes on it, and signal has more reputation to lose.

You don't need to run the binaries at all if you don't want, you can just get the standard VPN configs and use your OS's network stack. You won't get all the fancy features, but otherwise it works fine.

Uh?

Good question.

I'd start here if I were you: https://protonvpn.com/support/wireguard-configurations

The context was Signal

Oof. Thanks, I must have been switching tabs too quickly.

F-Droid can also redistribute the signed upstream APK. The requirement for that is that the build is reproducible.

This is the best of both worlds because the distributor (F-Droid) verifies that the published source matches the binary but does not possess the private key to sign the APK. This means the distributor cannot push a backdoored binary blob at some later date.

> OpenAPK here seems to be linking directly to official binary downloads, whereas F-Droid insists on building the APKs for the apps.

F-Droid guarantees that the binaries it distributes always match the corresponding source, which adds another layer of security.

To ensure transparency, it also provides an archive of the source code used to compile different versions.

After reading the issue you linked I came away very strongly in favor of continuing to use F-Droid. Why would I want to switch to an alternative distributor whose policies would permit the WireGuard devs "I don't want to provide a clear explanation to end users" antics? (Of course I happen to trust the WireGuard maintainer, but individual cases should generally be irrelevant when setting policy.)

I am impressed to see the F-Droid maintainers sticking to their principles.

As others have said, it does not update automatically, you have to do that yourself.

Reply on news.ycombinator.com