feddit.org

1 point

13 days ago

The link for F-Droid security issues is goijg on 3 years old, have you looked at the code xhanges for F-Droid since then?

For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services? That’s wh I uae F-Droid and disable all anti-features so those apps are never listed, even if I search for an app that has Google dependancies, F-Droid will say that app does not exist or is not listed, as long as all anti-features is disabled.

report

[ - ]

N0x0n@lemmy.ml

1 point

12 days ago

For using Obtainium, how do you avoid or block all apps from Github that depend on GCM, Firebase, or Google services?

You do have a point though, but how does that even comes into the mix? Obtainium fetches directly from the source (api.github.com).

But to answer your question, it’s blocked at the DNS level with RethinkDNS. Blocking all requests, except those explicitly allowed by myself.

This seems more like hardcoded into the .APK or that we can’t correctly interpret the results or something is wrong in the analysis. And I’m also curious to get more Info’s from someone.

report

[ - ]

1 point

12 days ago

I woud still like for you to do a scan on the FDroid SimpleX apk to verify the difference for yourself instead of whatever I say about it.

report

[ - ]

N0x0n@lemmy.ml

1 point

12 days ago

Hello !

Version 6.1.1 (250) arm64-v8a https://f-droid.org/en/packages/chat.simplex.app/ https://f-droid.org/repo/chat.simplex.app_250.apk

Here’s the analysis: https://www.hybrid-analysis.com/sample/9b14b4f80b479a7eb2a5e9fb22ad3f5d547690f4e30da6b5c6f0e9ed8d4039da/672727b3fd3db6063b002513

Same exact result:

Pattern match: “https://android.googlesource.com/toolchain/llvm-project”
Pattern match: “https://developers.google.com/protocol-buffers///”
Pattern match: “https://issuetracker.google.com/issues/new?component=618491&template=1257717”

Dunno if this is something we should worry about or not ? Maybe OP and myself are not educated enough to interpret the results, however I’m also not very comfortable seeing those Found potential URL in binary/memory from SimpleX’s APK. Do you have any further thoughts?

Thanks.

report

IronJumbo68@lemmy.worldOP

[ - ]

2 points

11 days ago

I hope @epoberezkin@lemmy.ml will dispel our doubts or a member of the Simplex.chat team :(

report

[ - ]

0 points

12 days ago

In the details for potential URL in memory, it says that’s for .onion address.

Thank you for posting the report, after I read through it, everything to me is clean and clear. The FDroid apk does not communicate with any outside resource that is not part of the anonymous network.

The Github version relies on Google, and to me nothing in the report suggeats that the FDroid version communicates with Google services.

report

IronJumbo68@lemmy.worldOP

[ - ]

1 point

11 days ago

It’s not about whether the application communicates with these addresses or not. It’s about the fundamental question: why are these addresses even encoded in the code of a VERY privacy-sensitive application?

My friend, in every answer you push F-Droid as a cure for all evil. There is no perfect store, F-Droid also has its problems (I wrote about it above). I am not an enemy of F-Droid (I also use it sometimes), but I will repeat: F-Droid control is insufficient (it’s security theater - it’s not a full audit of the source code).

report

[ - ]

-1 points

11 days ago

I think I can agree with the crux of your statement, the problem I see completely outside of your argument is the online privacy community is both highly toxic and highly ignorant. Most of them have never worked in IT or as an admin and have to work with customers according to what the customer is paying for and not what someone believes is a better way but the paying customer has no interest in learning, so they spout their opinions online but have never had formal employment in network security and privacy for a company.

report