Hans-Christoph Steiner @eighthave@librem.one
Joined Aug 2019
Hans-Christoph Steiner
boosted
This week in F-Droid (TWIF) was just published again!
We explain the "unattended upgrades for everyone" in 1.19.0 of our client in more depth.
Additionally:
- we talk about Acode editor - Android code editor, MRepo, PiliPala, SIYuan, K-9 Mail, Rocket.Chat and SimpleX Chat.
- big apps like Gao&Blaze, TuxPaint and Katawa Shoujo: Re-Engineered got their own paragraph
- the spring-cleaning continues
- our recap of FOSDEM is also linked
@vitriolix I've watched a bit, #Putin is sure good at "truthiness"! He gives this whole lecture about various kings etc then says things like "In 1939... western Ukraine was to be given to Russia. Thus Russia, which was then named USSR, regained its historical lands". Except the USSR was never Russia, it was many states including the Russian Soviet Federative Socialist Republic and the Ukrainian Soviet Socialist Republic, which were always distinct entities in the USSR. I call bullshit
@cryptax wow yeah impressive. And app in question isn't malware. it is a well known company using a super complex packer. It seems that APK is not in #GooglePlay either, I wonder if that's related. They do have this DJI Pilot app on #AppStore, any ideas if it has the same kind of packer?
This kind of thing highlights how app review processes must review source code in order to be effective. Binary-only reviews like #Apple and #Google are at a disadvantage.
Hans-Christoph Steiner
boosted
Totally impressed by the level of this blog post on de-obfuscation of an advanced packer
https://blog.quarkslab.com/dji-the-art-of-obfuscation.html
I hadn't ever seen the trick about "stealing bytecode" from methods from the ART class verification stage.
@roptat From what I've seen, it is quite common for one translator to be very active in their language. So many languages in many projects are translated basically by a single person. So complete translations can often just mean a very dedicated single volunteer rather than lots of users interested in the language. This is the volunteer-driven model. I imagine that paid translations would follow user demand a lot more.
There will be more interesting data coming soon, we'll announce it soon.
Hans-Christoph Steiner
boosted
"To restore Earth’s forests and mitigate climate change, states should devolve management rights to the communities in these land parcels and grant them secure tenure."
#rewilding #restoration #forests #climatechange
https://www.rewildingmag.com/the-best-way-to-restore-forests/
@easterhegg2024 @Kurt easterhegg klingt interessant, aber ich habe dann keine Zeit zum Reisen.
@blue_led you're welcome! I'm happy to hear that all of our work has helped push free software on Android forward.
Hans-Christoph Steiner
boosted
Big thanks to Kai-Chung Yan, Komal Sukhani (couldn't find them in the Fediverse), @eighthave and everyone else involved for packaging the open source parts of the Android SDK for Debian! 💙
With this I managed to revive an old Android app of mine that stopped working several years ago due to server-side changes.
#AndroidSDK #OpenSource #AndroidApp
git fsck makes it much harder to attack a git repo, but it seems that the normal git workflow does not enable it by default. In #FDroid it is enabled for all fetches in our config:
https://f-droid.org/docs/FAQ_-_App_Developers/#how-can-i-handle-fsck-error-in-packed-object-for-my-app
But I still can't find a clear answer about what checks #Git does by default. Anyone know?
I got the opportunity to go to #FOSDEM and of course I had my #FDroid "hat" on. I wrote up some quick impressions of my trip, including what I learned about the #EU's #DigitalMarketsAct #CyberResilienceAct and #ProductLiabilityDirective
There really are a lot of important projects represented there:
https://f-droid.org/2024/02/06/at-fosdem.html
@roptat how so? You mean like level of completion versus how popular a language is?
Based on @maarten 's post https://blog.nlnetlabs.nl/what-i-learned-in-brussels-the-cyber-resilience-act/ I think the only people listed in my example that would be at all regulated by the #CRA would be the last one: "contracted contributors". It sounds like they might be considered "open source software stewards" with obligations under Article 17a depending on whether the #EU considers F-Droid as "intended for commercial activities"
https://www.cyberresilienceact.eu/the-cyber-resilience-act/
My guess is #Nextcloud/#Ubuntu would be considered commercial while #FDroid/#Debian would not
Hans-Christoph Steiner
boosted
Last weekend I co-organised a "EU policy devroom" at #FOSDEM, marking the end of a wild 17 month ride in EU policy land working on the #CyberResilienceAct.
A blog I just published provides an overview of CRA #FOSDEM content, including my personal story starting #FOSS policy engagement in Brussels.
I hope it will contribute to a shared understanding of how the #CRA will most likely affect developers of #opensource software. Feedback welcome.
https://blog.nlnetlabs.nl/what-i-learned-in-brussels-the-cyber-resilience-act/
Hans-Christoph Steiner
boosted
Later this week, Let's Encrypt will stop including the cross-sign from Identrust's Root CA in our API by default. That cross-sign will expire later this year, so this is the first step in preparation for that.
This means devices which haven't gotten an updated root CAs that added Let's Encrypt may get errors. This mostly affects a small number of old Android devices (Version 7.0 and before), as most other operating systems update root CAs by default.
For most people, no action is necessary. To continue supporting old clients, or to control your rollout of this change, your ACME client can be configured to explicitly choose a chain to serve until June at which point we'll stop serving the cross-signed chain.
You can read all the details on our blog post at https://letsencrypt.org/2023/07/10/cross-sign-expiration.html
If you have any questions, happy to answer them over on our Community forum: https://community.letsencrypt.org/t/questions-regarding-shortening-the-lets-encrypt-chain-of-trust/201581
@roptat thanks for your nice visualization of #l18n in apps in #FDroid
https://i18n.lepiller.eu/i18n.html it is interesting to see which languages are the most active. If you're interested in more data sources, there are a lot of public data sources:
https://f-droid.org/docs/All_our_APIs/
For example, you might enjoy looking at the most popular search queries with the included language and country data:
https://fdroid.gitlab.io/metrics/search.f-droid.org/2024-01-29.json
Hans-Christoph Steiner
boosted
A week ago someone around here mentioned the #Android app StreetComplete, an app made to help people add data points that are missing on #OpenStreetMap ("Wikipedia for geographical information").
The app is super smooth and I fell down the rabbit hole hard - there's so much information missing for #Calgary #yyc! You walk around, you pay more attention to urban features, do it for a few days and you somehow end up in the worldwide top 50 this week 😯
Do it! It's fun!
#opensource #FOSS #OSM
Hans-Christoph Steiner
boosted
Think tank funded by Big Tech argues #AI’s climate impact is nothing to worry about - https://www.theregister.com/2024/02/07/ai_climate_impact/ it's the "cryptocurrencies don't use much energy" argument all over again...
Hans-Christoph Steiner
boosted
As part of #ISRG's work towards memory-safe infrastructure for the internet, @cpu has opened a merge request that implements TLS ECH support on the client side:
https://github.com/rustls/rustls/pull/1718
We agree that "the ECH spec is very challenging to implement and required a lot of trial/error" and we are working with #DEfO to help implementers. Please reach out if that is you:
https://defo.ie/#contact
@vitriolix Mozilla is also offering a scrubbing service for a fee. I hope that takes off, that seems like a great business model for Mozilla: getting paid by users to decrease personal tracking.
Joined Aug 2019
