Hans-Christoph Steiner @eighthave@librem.one

@daniel Oh this is interesting. Does that mean that Google thinks that their LLM scraping might not count as "fair use"? Is there any reporting on this?

@alsutton @postmarketOS sounds like you are proposing some kind of government ID check, then, albeit via the domain name registrar. Also, there is no natural link between a domain name and an app, that has to be invented.

@mro if the signing key is the root of trust in the developer, then it is important to know that the developer understands that and takes it seriously, and doesn't just give away the keys to the root of trust.

@alsutton @postmarketOS This would specifically link the app and the domain name. That would give the app signer's pseudonym a website/email link, building a more complete pseudonym profile. But I can't see how that would change anything for when the user wants some method of verifying the developer. Linking to someone's government identity does make it easier to track down the actual people who are involved.

@mro I agree, highlighting the role of the signing key seems key. An app signing key is in effect a pseudonym. The hard part is that there is that there is no concrete way for users to verify what the key management practices of the developer are. Judging that from the outside means looking for any signs that the signing key was misused. If a dev wants to hide misuse of their signing key, that is pretty easy to do. For example, they could sign malware and only ship that to targeted users

@jexner your formulation seems like its going the right direction. On one hand, in the world of financial accountability, "know your customer" and showing government ID is normal. Borrowing an established practice makes sense when it works, but it doesn't feel right to apply that to developing software. I don't think the requirements are the same between finance and software, although sometimes similar. I haven't found a good breakdown though that maps that out.

@jexner Can the human be anonymous while the "dev" is public? Clearly, we want the apps we use to be maintained by entities that we can trust. Are given names required for that? I think clearly not. For example, non-profits. People trust #EFF as an entity, even without knowing who everyone works there is, and whether the staff changes. So the entity can be trusted separately from human participants. I think developers are similar. Many trusted FOSS contributors operate under pseudonyms

@rene_mobile @marcprux @fdroidorg @GrapheneOS @lehtimaeki @ottok @grote

You are all people who have specifically thought about this kind of stuff in relation to software distribution, what do you think?

At the core of #AndroidDeveloperVerification are a couple potentially useful ideas. #Google has entirely wrapped them in a pile of anti-competitive garbage designed to defend their massive #monopoly profit margins, but nonetheless, those specific technical ideas might still be useful. #iOS's "notarization" is basically the same. That leads me to ask the key question:

What would a #FOSS-respecting system of #verification look like? What #identity info is useful for trusting the #developer?

@exitcode @fdroidorg Good to hear! I'd love to see more feedback from users who need "full manual" mode. Replying here is good, posting to https://gitlab.com/fdroid/fdroidclient/-/work_items/3171#note_3483200283 is even better (that way we don't lose track of the feedback).

@exitcode @fdroidorg "Check for updates" is on the menu on "My Apps"

@aerique @waag oops, that's Volla not Jolla. So confusing. Volla is making their own version of Play Integrity, and Jolla makes SailfishOS, which is proprietary.

@exitcode @fdroidorg In 2.0-alpha11, a "Check for updates" menu item has been added. How does that work for you?