Purism's PureOS To Explore OSTree/Flatpak, Wants To Develop An "Ethical App Store"

[L_A_G]

...

No mention of any Chinese popularity in that link so it's pretty clearly you really have absolutely no evidence whatsoever of f-droid actually being popular in China, or anywhere else for that matter. If I can find information on what android app stores are popular in China, which doesn't include f-droid, then I'm pretty sure this information is obviously not going to sit behind the firewall.

Not that popularity means something is any good, but when it comes to how interesting something is to intrusion for profit or mass surveillance, i.e most major intrusions these days, then something as obscure as f-droid just isn't going to worth the effort.

In other words; Now that you've shown you can't prove your point, it's time to shut up.

[oiaohm]

If I can find information on what android app stores are popular in China, which doesn't include f-droid, then I'm pretty sure this information is obviously not going to sit behind the firewall.

Check china policy on advertising overseas based app stores. If you had checked that in the first place you would have known why your information is incorrect. F-droid as an application due to device to device sharing and local source code audit gets to be classed as local so able to be include on devices. But advertising the name gets in the wrong side because F-droid has storage outside china. This is why ground survey is required laws somethings get in way so popular non china based stores get deleted from those sites you found.

Not that popularity means something is any good, but when it comes to how interesting something is to intrusion for profit or mass surveillance, i.e most major intrusions these days, then something as obscure as f-droid just isn't going to worth the effort.

That logic does not explain attacks against f-droid being as common as they were. Unless of course you have f-droid popularity wrong.

[L_A_G]

...

I've looked up multiple articles on what the most popular app stores are in China and none of them has even mentioned f-droid so I'm just going to call your bluff on this policy somehow hiding the truth when all the articles talk about the Baidu and Tencent stores. If you're going to continue talking about your "ground surveys" it's well past the point where you needed to start posting actual links to them and this I'm starting to suspect they simply don't exist.

There's nothing that stops you from continuing to make excuses, but I'm just getting less and and less convinced of anything you're saying.

That logic does not explain attacks against f-droid being as common as they were. Unless of course you have f-droid popularity wrong.

You've been talking about how secure f-droid is, but haven't mentioned a single time it's actually been attacked so you're going to have to prove this first. However seeing how making claims and then expecting me to find the proof, and continuing to make the claim after I can't, has become something of a theme for you I don't expect you to deliver any proof of your claims now either.

If I didn't know better, I'd accuse you of just making things up...

[oiaohm]

You've been talking about how secure f-droid is, but haven't mentioned a single time it's actually been attacked so you're going to have to prove this first. However seeing how making claims and then expecting me to find the proof, and continuing to make the claim after I can't, has become something of a theme for you I don't expect you to deliver any proof of your claims now either.

F-droid use to accepted independent developers building their own binaries and uploading them. This was stopped due to infected software uploads. You still see regular complains that they have to use f-droid build system. Interesting most of the developers who are complaining use to bundle malware containing advertisement ware. Before the change f-driod was just as malware attacked as google play is.

Do you think google advertises every time they are attacked. No they don't. Neither has f-droid the meeting minutes when the change was done detailed why. At the worst 1/10 of the applications on F-droid had problem today its basically zero.

By the way L_A_G you have claimed F-droid is not attacked yet you have not presented any evidence. The reality is F-Droid changed their system because they were attacked. The change has been highly effective but has annoyed a few people.

Think about it L_A_G you want to spread malware to lots of different applications and have the best chance of being on devices. Don't target google play that is hard. Target the developers of applications with offers of money being if they include your code they will get paid so much. Of course that code can include back doors. This kind of spread attack is not selective any app store that allows developers to upload binaries is at risk.

[L_A_G]

...

As I've told you multiple times already, when you make a concrete claim and someone asks you to provide evidence for that claim, you really do need to provide evidence for that claim. Otherwise it's just an unsubstantiated claim and worth about as much as one that has actually been proven to be wrong. Claiming that anyone who complains about the build system is a malware developer is taking such massive leaps of logic it's downright laughable. Particularly when you seem to label all advertisement APIs as malware even thou in-app advertisement is how most people who make mobile applications for a living make their money.

Maybe it's a good thing that you can't make any money off f-droid if you want to keep it a hobbyist thing, but it's not a good thing if you want to maximize the amount of actually useful and quality software.

Also, I never said that f-droid had never been attacked, I said that there wasn't really much of a reason to actually attack it due to it's miniscule userbase (i.e barely any reward for doing so). There's a pretty big difference there even if it may be lost on you.

[oiaohm]

Claiming that anyone who complains about the build system is a malware developer is taking such massive leaps of logic it's downright laughable.

https://f-droid.org/docs/Reproducible_Builds/

Its not laughable. You have them requesting to upload own binaries and skip the Verification builds stage. Please note f-droid system will spit out a apk that a developer can sign and put up on google play.

Particularly when you seem to label all advertisement APIs as malware even thou in-app advertisement is how most people who make mobile applications for a living make their money.

https://f-droid.org/wiki/page/Antifeatures

17 applications on F-droid have managed to do advertising supporting without being API closed so able to be audited. This has not been popular form. So not all advertisement API are malware just the ones that are not are not that popular. You would think when you are depending on a block of software to work correct to register advertisement views and the like so you get income you would want to audit it??? Apparently not. This is a problem.

Please note biggest cause of applications with issues is lack of developer updates. Google is also suffering from the same problem. Its scary when you think about 50% of applications in f-droid and google play have known issue simple due to no new APK file being made and still using MD5 checksum. Since 2017 google has been asking developers to grant permission for Google to manage the APK signing keys they they can resign packages as key requirements change. Yes google is having the app developers fight them tooth and nail in this as well. So long term APK signing is likely to be taken out of developers hands completely because developers doing it just cause too many problems for app stores.

Maybe it's a good thing that you can't make any money off f-droid if you want to keep it a hobbyist thing, but it's not a good thing if you want to maximize the amount of actually useful and quality software.

https://f-droid.org/en/2018/03/02/liberapay-support.html

You have donations what is number 1 way. You have paid for network services what is your number 2 way of making money in f-droid. There are many parties who find they make more income in f-droid than google play. Mostly smaller app store simpler for user to find you application if you meet the requirements to be in f-droid.

Of course I guess it did not cross your mind that apps shipped on f-droid are also shipped on google play and other app stores. If you pass the f-droid build audit your normally pass all the other app stores without any issue.

[L_A_G]

Its not laughable. You have them requesting to upload own binaries and skip the Verification builds stage. Please note f-droid system will spit out a apk that a developer can sign and put up on google play.

Blanket claiming that anyone who doesn't like the loads of extra hoops a developer on f-droid has to jump trough to is a malware developer is like claiming that anyone who doesn't like going trough post 9/11 airport security is a terrorist. It's a RIDICULOUS statement to make, pure and simple.

17 applications on F-droid have managed to do advertising supporting

So only 17 apps on f-droid have ever been able to get the main source of monetization on android and compatibles/forks, but you don't see this as an issue? You also talk about apps being abandoned while touting an alternative that pretty much removes the financial incentive to keep developing apps. Are you really this badly bereft of self-awareness?

You have donations what is number 1 way. You have paid for network services what is your number 2 way of making money in f-droid. There are many parties who find they make more income in f-droid than google play. Mostly smaller app store simpler for user to find you application if you meet the requirements to be in f-droid.

Oh yes the tip jar solution... Only problem with that is that the tip jar has never worked as a sustainable source of income for software development on any level beyond hobby projects, as clearly evidenced by how even the f-droid store isn't getting any more than 30€/week in tips. Less selection is also not a good thing and when peer reviews exists people can easily narrow down their choices to good options so being overwhelmed by options isn't an argument either.

Of course I guess it did not cross your mind that apps shipped on f-droid are also shipped on google play and other app stores. If you pass the f-droid build audit your normally pass all the other app stores without any issue.

Having to go trough all of the cumbersome hoops to not make any money on a comically small app store just doesn't make any sense for app developers. Not only that, if they want to make any money on their apps they're going to have to maintain two different versions of every app they're maintaining so it makes even less sense to put anything on f-droid unless you're some kind of open source jihadist who has to have their software on f-droid.

[oiaohm]

So only 17 apps on f-droid have ever been able to get the main source of monetization on android and compatibles/forks, but you don't see this as an issue? You also talk about apps being abandoned while touting an alternative that pretty much removes the financial incentive to keep developing apps. Are you really this badly bereft of self-awareness?

https://fueled.com/blog/much-money-can-earn-app/

Sorry to say advertising in applications is not talked about as a income stream. Turns out users get really sick of advertisement.
Like 17 applications in Fdroid use advertisement.
92 you have to pay a subscription per month/year to use the online service they connect to.
20 have addons / in application purchases.

Turns out most of apps with advertisement never recover their development cost.

https://techcrunch.com/2016/04/28/google-play-is-now-labelling-which-apps-contain-ads/

The ability to make money on android by putting advertisement in your applications started disappearing as of 2016.

F-droid has applications using the most common way. Lead income for free applications on google play is also donations.

Google play has a huge number of abandoned applications as well it just part of the development process.

[L_A_G]

https://fueled.com/blog/much-money-can-earn-app/

Did you even read that blog post? Because it only talks games and a handful of apps that are just what's used to access various paid services rather than something where the value is actually in the app itself (i.e what most apps need to do).

Turns out most of apps with advertisement never recover their development cost.

[Citation needed]

The ability to make money on android by putting advertisement in your applications started disappearing as of 2016.

If that was true there would be a very significant downturn in free applications, but that just hasn't happened. Over here in reality most apps that aren't just clients for various services still have advertisement as tips have never really cut it for funding professional app development.

F-droid has applications using the most common way. Lead income for free applications on google play is also donations.

Again, [Citation Needed]

Google play has a huge number of abandoned applications as well it just part of the development process.

Sure, but making the #1 source of revenue for most app developers (there can only be so many spotifies and netflixes) exceedingly difficult isn't exactly going to help in regards to keeping app developers interested in further developing their apps.