someacntJun 3

Is F-droid insecure?

https://sh.itjust.works/post/39301047

Cold-blooded Cone - sh.itjust.works

(olivetty [https://civitai.com/images/4007611]) (2023) Image Caption: A photo-realistic image of a green lizard-like creature holding a large ice cream cone. The creature has a large head with a wide mouth and sharp teeth. Its body is covered in green scales, and it has two arms with hands. The ice cream cone is a waffle cone with a large scoop of vanilla ice cream on top. The creature is standing in front of a blue truck with a window. The background is blurred and appears to be a city street. ::: spoiler Full Generation Parameters: a beautiful high definition crisp portrait of old (reptile:1.2) skin selling icecream from a truck in a suburban area, taken with a professional grade camera with exquisite color grading Negative prompt: ((blurry:1.3)), worst quality, 3D, cgi, drawing, mouth open, undefined Steps: 5, RNG: CPU, VAE: sdxl_vae_0.9_Fix.safetensors, Size: 1152x1752, Seed: 706916861, Model: RealitiesEdge_TurboLCM, Sampler: DPM++ 2M SDE, CFG scale: 2, \"skip_factor\": 0.6}, {\"backbone_factor\": 1.2, "[{\"backbone_factor\": 1.1 :::

Show threadkolorafaJun 3

In case of f-droid, it’s follow more the Linux distro phylosopy, where the binaries are build and offered to you not by the developer but by distro/repository maintainers people.

You can add your own repository or use your friend repository or use f-droid ones.

In case od f-droid repository, to get app published your app need to adhere to rules one of them is that the code need to be public so the repo maintainers can build the app from it.

Comparing it to play store where the app is build and sign by the developer without making the code public, in turn making it almost impossible to know and follow what the app is doing.

So its a matter of trust.

For some apps I would rather install them from f-droid as I have higher confidence that someone looked at it if the app is not harmful or leaking my private data. For other apps like Banking apps I would rather install them from Aurora store where I dont know what the app is doing but I trust more to protect my money than some random dude on internet. And if bank does something bad I will sue them or just stop using their service.

Show threadshortwavesurferJun 5
I actually take it even one step farther than that. I don’t want a bank app on my phone because it’s proprietary and I don’t know what it’s doing. So I only access my bank through the web browser.
Show threadkolorafa
I use bank app for contactless payments. But the bank app have no other permissions, even location is fake.
Jun 6 at 10:29amWeb
Show threadshortwavesurferJun 7

The one good thing about banks is they make these little plastic rectangles with metal chips in them that you can insert into a device at the terminal in order to pay for your stuff. No bank app required.

At least in the United States, these little plastic rectangles have a series of 16 numbers on them, followed by a date and a year and a three digit code.

Show threadkolorafaJun 7

Those plastic rectangles doesn’t have any security against range extend attacks so they can steal money from you and you would be plain unaware and defenses. While phone or watch will only enable contactless payment on demand making it way safer. And you can pay with contactless payment everywhere in Poland while you sometimes can’t pay with inserting physical card on some automated devices as there is no where to insert that card, you can only use contactless feature of that card.

Not to mention those plastic rectangles cost yearly or sometimes even monthly, while app is 100% free. And if the app at any point in time do anything that I didn’t agree in the agreement and/or bypass any permissions I didn’t grant them there will be hell to pay for them.

But maybe I’m wrong, I don’t know…

Show threadshortwavesurferJun 7
If you think that app is not collecting your data, you are totally naive.