Bought a new phone? Moved from iPhone to Android? Want help from your friend/family member/librarian/other to setup your new phone for getting apps? Sorry, you need to come back a day later before you can actually use it.

Guess what the normal/non-tech user does in this 24hr period? Go to Play Store, install a bunch of apps, forget that you had the desire to use an alternative.

This indeed does make F-Droid no longer a tool for normal people, but only a tool for those willing to do a bunch of "Advanced" things on their phone. By definition, not regular users.

> Our new Registered App Stores program will provide a more streamlined installation flow for Android app stores that meet certain quality and safety benchmarks.

As with Developer Verification, I hold little confidence that the criteria for "certain quality and safety benchmarks" will be specified before this is rolled out (or even after).

> Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. [0]

> Advanced users will be able to"Install without verifying," but expect a high-friction flow designed to help users understand the risks. [1]

Firstly - I am yet to see "ongoing conversations with the community" from Google. Either before this blog post or in the substantial time since this blog post. "The community" has no insight into whether any such "advanced flow" is fit for purpose.

Secondly - I as an experienced engineer may be able to work around a "high-friction flow". But I am not fighting this fight for me, I am fighting it for the billions of humans for whom smart phones are an integral part of their daily lives. They deserve the right to be able to install software using free, open, transparent app stores that don't require signing up with Google/Samsung/Amazon for the privilege of: Installing software on a device they own.

One example of a "high friction flow" which I would find unacceptable if implemented for app installation on Android is the way in which browsers treat invalid SSL certificates. If I as a web developer setup a valid cert, and then the client receives an invalid cert, this means that the browser (which is - typically - working on behalf of the customer) is unable to guarantee that it is talking to the right server. This is a specific and real threat model which the browser addresses by showing [2]:

* "Your connection is not private"

* "Attackers might be trying to steal your information (for example, passwords, messages or credit cards)"

* "Advanced" button (not "Back to safety")

* "Proceed (unsafe)" link

* "Not secure" shown in address bar forever

In this threat model, the web dev asked the browser to ensure communication is encrypted, and it is encrypted with their private key. The browser cannot confirm this to be the case, so there is a risk that a MITM attack is taking place.

This is proportionate to the threat, and very "high friction". I don't know of many non-tech people who will click through these warnings.

When the developer uses HSTS, it is even more "high friction". The user is presented all the warnings above, but no advanced button. Instead, on Chromium based browsers they need to type "thisisunsafe" - not into a text box, just randomly type it while viewing the page. On Firefox, there is no recourse. I know of very few software engineers who know how to bypass HSTS certificate issues when presented with them, e.g. in a non-prod environment with corporate certs where they still want to bypass it to test something.

If these "high friction" flows were applied to certified Android devices each time a user wanted to install an app from F-Droid - it would kill F-Droid and similar projects for almost all non-tech users. All users, not just tech users, deserve the right to install software on their smart phone without having to sign up for an "app store" experience that games your attention and tries to get you to install scammy attention seeking games that harvest your personal information and flood you with advertisements

Hence, I don't want to tell people "Just install [insert non-certified AOSP based project here]". I want Android to remain a viable alternative for billions of people.

[0] - https://android-developers.googleblog.com/2025/11/android-de...

[1] - https://x.com/matt_w_forsythe/status/2012293577854930948

[2] - https://wrong.host.badssl.com/

Comments URL: https://news.ycombinator.com/item?id=45346701

Points: 10

# Comments: 0

https://www.opentech.fund/security-safety-audits/f-droid/

https://f-droid.org/2018/09/04/second-security-audit-results...

https://f-droid.org/2022/12/22/third-audit-results.html

I was involved in addressing in issues identified in the first one in 2015. It was a great experience, much more thorough than the usual "numerous static analysers and a 100 page PDF full of false positives that you often receive.

Other useful environmental information we find useful includes "which DB is being used", which OpenShift namespace (with a link to the console), traceability for the deployed artifact (e.g. links to the GitHub release tag, CI pipeline which built the artifact, docker registry with the correctly tagged image). Especially useful if you have downstream or upstream services, is to have colour coded status info about whether the services are up.

For the few days investment getting this up and running, it pays itself back in terms of time gained answering questions such as "Why doesn't this feature work? Oh, after investigation, this service was down during testing".

The linter/autocompletion/auto-fix/refactoring/etc made it much simpler to a avoid having to rote-learn the syntax for functions, lambdas, structs, etc. To go with that, the error handling becomes much easier to learn because the editor is able to tell you when you've got the wrong number of return values / wrong type of values.

Yes, the compiler does all of this, but the way it happens in real time using the same keybindings/UI/UX that I use for my day job makes it all that much easier.

"Vim Exit% Speedrun [WR - 2.50:13]"

https://www.youtube.com/watch?v=TLbfqZBL8t8

[0] - https://www.sbnation.com/a/17776-football

For a retro Android game I maintain, I use the term "Gratuitous Eye Straining Effects" in the settings page. It needs to be toggleable, because I can only tolerate it for a short period. My naming was inspired by k9mail's settings called "Gaudy visual effects". May as well have some fun with words when implementing such effects.

For those interested, I've documented the process I adopted to try to increase the bus factor beyond one [0]. I want people who download the game and open it to be able to find a public server instantly from the main menu, even if I am unable to maintain the main server myself. This is done via the game requesting a manifest containing public servers from a GitHub repo, which accepts PRs from those willing to maintain their own servers. Although I am the only one able to accept those PRs right now, it would be silly not to be liberal in onboarding others who show an interest in maintaining the list. That way the game lives on beyond just me.

I also make sure to offer local multiplayer, and in other games I've built I which don't need realtime multiplayer, I try to offer "Play against others by sending an SMS invite" or other novel approaches that don't even need a server.

It is a fun space to work on and try to come up with novel solutions to ensure games continue working into the future.

[0] - https://peter.serwylo.com/2021/07/03/sustainable-server-infr...

But yes, you are correct that they are indeed an inconvenient database abstraction.

The only thing I will say is that despite the crummy abstraction, we did put the effort in to have good test coverage of each ContentProvider. It took a while to get the infrastructure up and running so that we even could test them, but once the plumbing was added, it became simple to add new tests to ensure they worked as expected.

This is important when you need to take into account things like "Get me all the apps, but filter on category, and then also limit those Apps to ones for which they have at least one Apk which is installable on my hardware, meets my AntiFeatures requirements, and then also pull back data about whether there is a version that can be upgraded to or not based on currently installed apps. I fell in love with the SQLite explain output. I found it really good at explaining what was going on with these mildly complex joins - much easier than the MySQL explain output I was familiar with.

[0] - https://gitlab.com/fdroid/fdroidclient/-/blob/b3773a156121cf...

To see Torsten and others working on replacing my crufty-passed-their-use-by-date ContentProvider code with a modern Kotlin + Room implementation is heart warming. If any of you are reading this, please accept my deepest sympathies for having to pull that code out and rework it - that is not something I would have enjoyed doing! It is even better that it all lives in libraries that other clients can adopt if they choose so they don’t need to reinvent the wheel.

For those interested, yes, I am also responsible for writing the bulk of the code for the “new” (now several years old) UI in the offical client which often gets maligned on HN (and this thread is no exception). At the time I did my best to fight off edge cases and quirks of the Android system. F-Droid needs to ask Android which apps are installed and what their signatures are, then cross verify that with its own database to tell you whether updates are available. It also needs to know whether new apps have been installed outside of F-Droid since last time you opened it, etc. It also needs to pass downloaded .apk files to the system and request for them to be installed, then wait for confirmation from the system. The API’s Android provide for this kind of work, but they always seemed flakey, unwieldily, and slow to respond. The whole experience is full of race conditions, and each bistro seems to handle it ever so slightly differently.

I am still proud of how much we managed to achieve, and I’m also very pleased with the fact we were able to do so much great work around internationalised metadata, screenshots, encouraging donations to app developers, etc. But I’d be lying if I said I wasn’t still a little disappointed that I couldn’t iron out all of the kinks.

Life circumstances meant that I drifted away from the project and no longer contribute (other than via Liberapay donations to the wonderful fdroiddata team). However I would love to revisit the project in the future to see if I can address some of those edge cases to ease the user experience for all of us. You may have noticed that for such an amazing project, used by many people (not just the client, but the entire infrastructure), there has been comparatively few contributors. Despite that, I am still extremely fond of the value they bring to the Free and Open Source ecosystem.

1. "YouTube University" as per the top comment on this HN post [0]. I watch a few videos on the train to work or when winding down in my spare time. Over the past few months I've come to appreciate certain channels, your learning style may prefer others, but my list includes: The Engineering Mindset, Ben Eater, EEVBlog, learnelectronics, and ElectroBOOM, as well as whatever else I stumble upon when searching specific topics.

2. Reading theoretical concepts from text books. I've read https://www.allaboutcircuits.com/textbook/ recommended elsewhere in these comments and found it very well written for someone like myself just starting out. It covers the full gamut covering basic movement of electrons through to practical stuff - indeed much like the Ben Eater YouTube channel does).

3. Practicing mechanical skills like soldering (which also results in earning things I didn't know I needed to learn, such as "how do you keep this thing still while trying to work on it").

4. Prototyping with breadboards - both projects including micro controllers and those focusing on discrete electronics. This feels most like a literal application of my software dev skills, but with all of the theoretical electronics stuff sprinkled in. Although starting with just a basic collection of a few resistors, capacitors, LEDs, transistors was fine, now I enjoy having a steady stream of orders from AliExpress coming in. Each one is only the price of my morning coffee but takes a month to arrive, so whenever I am working on something and think I am lacking the components, I'll place an order then forget about it until it arrives.

5. Pulling apart things to see how they work - this is extremely satisfying because it helps not just with learning about how people lay out electronics projects, but also how the physical connections are made - how are PCBs mounted, where are springs and screws and other bits placed. It also helps practice desoldering skills.

6. Designing PCBs and getting them printed. It only costs about $5 to get a few copies of a PCB printed and mailed to you, designed using the free software KiCad. When I've got a toy project that worked on a breadboard, then also worked on a prototype board, I then go and design a PCB to print. So far in 2 months I've designed and printed 3 boards. This is also extremely satisfying, and also helps learn more skills on the software and design side of things.

Finally, I share liberally with my friends via SMS when I make progress. I have a few close friends who are good at electronics but don't do it professionally. By sharing my progress with them, I have people ask me how it is going, which keeps me honest and makes me want to keep making progress.

After 2 months of spending an hour or so each night after the family goes to bed, I feel like this time I may actually pick up the skills I wanted. Previous attempts over the past 10 years have all failed due to lack of motivation.

[0] - https://news.ycombinator.com/item?id=16775744

At a few months old I created BabyDots [0] as she loved this YouTube video of dancing dots [1] which really settled her when she was upset as a young baby.

At over a year old I added BabyPhone [2] to let her talk to family and have them “talk back” to her even when they were not available. I missed the timing on this and she didn’t enjoy it at all until literally this week when she started talking back to the little baby on the other end of the phone.

At 18 months old I made a book-building app [3] that takes titles of pages on Simple English Wikipedia, and creates pages for a book that can then be exported as a PDF and printed (or viewed on the phone). It also has a website [4] on a free heroku dyno which definitely won’t take much traffic. This was because when she gets interested in, e.g. planets, I don’t want to have to order a book on planets, I want to print one out 5 minutes later to keep her interested.

One of my proudest moments was at my new job where a team member said during our first standup “I have your baby dots app installed and although we don’t do screen time, the music really sooths our kid during nap time!”.

[0] - https://github.com/babydots/babydots [1] - https://www.youtube.com/watch?v=8DILz54aYFU [2] - https://github.com/babydots/babyphone [3] - https://github.com/babydots/babybook [4] - http://book.serwylo.com/

F-Droid follows a similar model to traditional linux package managers which has shown time anda gain the they are both trustworthy and secure (or at least, they offer the user the freedom to choose the level of trust they have in the package signers).

When installing from a Debian repo, I'm typically installing a package that is not build/signed by the upstream developer. I am implicitly (in the case of a default install) trusting the Debian developers signing practices or explicitly (if you add a third party repo). This means you trust both those in charge of the building/packaging/signing as well as the upstream developers. The same is true of F-Droid.

Of course, the notable exception is that F-Droid also supports upstream packages signed by the developer if the builds are verifiably reproducible.

However, about a year ago I did two things:

- Enabled sponsorship through GitHub and Liberapay.

- Put my GPL apps (freely available on FDroid) on GPlay for $1.

Since then, I've made a fun amount of ~$300 in little donations (a combination of one off and recurring sponsorships). Although a tiny amount of income in the scheme of things, it is still thrilling each time someone kicks a small donation my way even though there is no obligation to do so. Itis a nice pat on the back for things I do for free anyway.

Also, given that I do zero self promotion and very minimal nagging (just in some of my release notes), and given I spend probably less than a total 7hrs a week on all of my projects combined, it makes me think that this could be ramped up if I was to dedicate more time to it.

Some things I try to do with each project to help gain traction:

- Release often, so it appears at the top of the FDroid front page regularly.

- Take i18n seriously so that people around the world can benefit from the apps.

- Foster a sense of community and inclusion in any discussions (e.g. GitHub issues and PRs). I also try to add new apps whenever a new idea comes along. Hopefully a large diverse range of apps will find use with more people.

Hopefully in the future that $300 will grow to $500, $1000, or even more.

Comments URL: https://news.ycombinator.com/item?id=26469144

Points: 4

# Comments: 0