this post was submitted on 15 Jun 2023

7 points (88.9% liked)

Jerboa

10372 readers

1 users here now

Jerboa is a native-android client for Lemmy, built using the native android framework, Jetpack Compose.

Warning: You can submit issues, but between Lemmy and lemmy-ui, I probably won't have too much time to work on them. Learn jetpack compose like I did if you want to help make this app better.

Built With

Features

Open source, AGPL License.

Installation / Releases

Releases

Support / Donate

Jerboa is made by Lemmy's developers, and is free, open-source software, meaning no advertising, monetizing, or venture capital, ever. Your donations directly support full-time development of the project.

Crypto

bitcoin: 1Hefs7miXS5ff5Ck5xvmjKjXf5242KzRtK
ethereum: 0x400c96c96acbC6E7B3B43B1dc1BB446540a88A01
monero: 41taVyY6e1xApqKyMVDRVxJ76sPkfZhALLTjRvVKpaAh2pBd4wv9RgYj1tSPrx8wc6iE1uWUfjtQdTmTy2FGMeChGVKPQuV
cardano: addr1q858t89l2ym6xmrugjs0af9cslfwvnvsh2xxp6x4dcez7pf5tushkp4wl7zxfhm2djp6gq60dk4cmc7seaza5p3slx0sakjutm

Contact

founded 3 years ago

MODERATORS

[email protected]

Why has Jerboa moved Repository? (mander.xyz)

submitted 2 years ago by [email protected] to c/[email protected]

15 comments fedilink hide all child comments

It wants me to uninstall and reinstall since the signature of different, which makes sense as it from a different source, but it doesn't mention anything in the changelog.

all 16 comments

sorted by: hot top controversial new old

[+] [email protected] 9 points 2 years ago (2 children)

[deleted]

[–] [email protected] 0 points 2 years ago (1 children)

Doesn't Izzy typically pull release directly from GitHub?

[–] [email protected] 1 points 2 years ago

It does indeed

[–] [email protected] 0 points 2 years ago (1 children)

Do you know why the signatures would be different? At my company we release our app on Google play, galaxy and Amazon store and I'm pretty sure we use the same signing key for each

[–] [email protected] 4 points 2 years ago (1 children)

because fdroid build all of their apps themselves, so every app on the fdroid repo uses the fdroid signing key

[–] [email protected] 0 points 2 years ago (3 children)

Interesting, I was not aware of that. sounds like a security risk, as you don't know who actually published it, but I guess since its open source that doesn't really matter as much

[–] [email protected] 1 points 2 years ago

It's actually the opposite, an evil developer could upload in GitHub an apk with malware not included in the source, while fdroid guarantees that it matches with the source published

[–] [email protected] 1 points 2 years ago (1 children)

You know who published it. It's the fdroid devs. Fdroid follows very much the old Linux repository philophosy where the owner of the repo acts as a middleman, providing the central layer of trust. You don't have to trust the developers because the distributor has done their due diligence and checked it. That's why fdroid takes a couple of days to push updates. They are doing some basic quality control first.

This model made a lot of sense in the world of traditional Linux packaging, where every obscure distribution has their own package format and developers couldn't possibly be expected to support all of these. It makes less sense on Android (or in a word where flatpak exists for that matter).

[–] [email protected] -1 points 2 years ago* (last edited 2 years ago)

It makes less sense on Android

Quite the opposite. From the user perspective, it's much easier to trust the repository than trusting every single developer not losing their password. In case of OSS it also ensures reproducible builds.

[–] [email protected] 1 points 2 years ago (1 children)

I'd recommend giving this article a read, just to inform you about f-droid client https://privsec.dev/posts/android/f-droid-security-issues/

An alternative client being Neo Store

[–] [email protected] 0 points 2 years ago* (last edited 2 years ago)

Privsec.dev is a libel slinger and an anonymity abuser on Reddit who is also Daniel Micay's equivalent of left hand. He is supportive of GrapheneOS and Micay's actions, and only went silent after Louis Rossmann exposed Micay.

Privsec_Dev/Tommy_Tran/B0risGrishenk0 did this to me last year. https://old.reddit.com/r/privatelife/comments/s0h73l/rprivacyguides_continues_its_harassment_campaign/

GrapheneOS members, Micay and his friends like Wonderfall have attacked F-Droid in the name of security, only to push using Google Play Store that annihilates all privacy of people. Google Play Services gather every possible metric about your phone which includes sensor, location, IP address, telephone number, IMEI and so on every 7 minutes. Just to be fair, Apple does the same things and is far worse. This theme of evangelising Google products at the cost of bashing all other projects is a thumb rule for GrapheneOS community.

https://forum.f-droid.org/t/what-are-the-issues-fdroid-have-about-security/17520

[–] [email protected] 2 points 2 years ago

Izzyondroid gets updates faster. Give it a few days and the fdroid repo will get it

[–] [email protected] 1 points 2 years ago

They didn't change the repo, it's just on both and f-droid repo updates slower.

[–] [email protected] 0 points 2 years ago (1 children)

What application is that? Some third-party app for GitHub?

[–] [email protected] 1 points 2 years ago

It's the official lemmy app