148
Is it safe the new Syncthing-Fork v2.0.14 on F-Droid? (f-droid.org)
submitted 9 months ago by to c/selfhosted@lemmy.world
21 comments fedilink hide all child comments
 

Asking because of the latest issues with the maintainer.

you are viewing a single comment's thread
view the rest of the comments
[–] 8 points 9 months ago (3 children)

I don't use syncthing (anymore) and didn't know the story behind this, but one thing I know is, f-droid builds the apk from source and signs it with their keys, or if reproducible builds are available, it verifies the signed apk provided by the maintainer to match bit-for-bit with the source code, so at least even if one doesn't trust the new maintainer, they should be able to trust f-droid that the apk matches the source, so e.g. no spyware or malware was added for example. Sure, someone still needs to review the source, of course.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 21 points 9 months ago (2 children)

    Thats part of the problem though. Supposedly catfriend1 gave researchxxl their signing keys, and researchxxl used these on their new github account. No one was aware that catfriend1 was not maintaining the repo anymore until users saw unexpected/unannounced updates and looked into the matter. This sparked a short lived discussion on F-Droid forums about what should be done when maintainer transfers are handled poorly like this. F-Droid admins decided that it wasn't that big of an issue, which is problematic... this supposedly happened between two people meeting each other online and discussing it with each other. But its possible that catfriend1 is being blackmailed or otherwise coerced into handing off this data. This type of credential attack could happen with a compromised machine, without the victim ever realizing it in time. The fact that F-Droid treats this so casually is upsetting. Signed developer certificates protect you from MITM attacks, it does not protect you from the sources themselves being compromised.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 9 months ago

    Yes, I understand the situation is shady and f-droid maybe didn't handle it the best way on a human level, and that is important when evaluating trustworthiness.

    What I was focusing on was more on the technical side: As long as I can:

    • trust f-droid to actually build from source and only publish something guaranteed to match the source, and
    • read the source code myself, or trust an independent researcher to study it, and confirm there's no malware,

    then I don't need to trust the maintainer of the project at all, and I can ignore all the drama, being assured with a high degree of certainty there is no malware

    I can also ignore any drama involving f-droid as long as I still trust them to build from source. This can also be verified by independent researchers by buulding themselves ans comparing, once again filtering out the drama and noise, though most people probably won't go this far.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 9 months ago

    Signed developer certificates protect you from MITM attacks, it does not protect you from the sources themselves being compromised.

    Very true, and that's why f-droid building from source can only guarantee the apk matches the source, but you still need to trust someone else (or yourself) to study the source and confirm nothing shady is going on, which of course isn't something most people would do for any open source app they install.

    Still, for "high profile" cases it just take one (independent) person to go through the source and publish their findings.

  • permalink
  • fedilink
  • source
  • parent