399
VLC - App stores were a mistake
(archive.is)
Reminder that VLC is on F-Droid
They've not updated it there either though. It seems to be less of a case of can't update Android and more of a case of won't update Android
From their Twitter:
If you wonder why we can't update the VLC on Android version, it's because Google refuses to let us update:
- either we give them our private signing keys,
- or we drop support for Android TV before API-30, and all our users on TV API<30 can't get fixes.
It's not much, just dozens of millions of people use Android TV before Android-11...
Maybe we should tell users to buy new TVs? #electronicWaste
I can't speak to why they're not updating on FDroid but seeing as how it's much more difficult to get people to use FDroid on Android TV, I don't think it will help them with that issue anyway.
Google requiring their private signing key is insane, and goes completely against the concept of private/public keys.
Why is Google asking for this?
See also: NSA PRISM
Member when all the companies listed released a PR statement within 24 hours of each other, all very basic and denied allowing the NSA direct access to their users?
I member.
Oh yeah, I remember that...
C-I-A Confidentiality, Integrity, Accessibility. They don't need the keys for C or A. Only one option remains. To modify the code and pass it off as code VLC wrote or signed off on.
Likely to install malware and re-sign. Brazen identity theft.
Maybe I'm wrong, they could use VLC's private keys to gobble encrypted communications too.
I didn't know F-droid was on Android TV, but it will be on mine pretty soon.
What exactly is the issue preventing them from updating the Android version?
Also, if that's the case, it sounds like "App stores were a mistake" is a bit misleading, since the particular app store isnt the problem.
Basically, modern app stores have changed how they work and now require the signing keys, VLC feel this is a bad thing and refuse to update. Banks are okay with it, but VLC feel more strongly than banks.
Banks are okay with it, but VLC feel more strongly than banks.
I mean banks are known for horrible security practices all around so that makes perfect sense.
Are they?
My bank restricts the length of my password to...16 characters, I think.
Mine only uses a 4-to-6 digit pin as a password, and sms for 2fa
Darren Kitchen from Hak5 has an amusing story about a bank teller who assured him email was entirely fine to send sPII through. "No sir, you just need to send it to us, and once we have your information then it'll be secure." No encryption. So, yes.
Also look into the Equifax security breach. Un-patched software for months.
It makes almost no sense to have a password length limit. 1_000_000, that's One Million, characters is equal to 1MiB. That's twice the length of the Lord of the Rings Trilogy and much less than most modern webpages. After hashing, which is how passwords should be stored, text length is irrelevant. All hashed inputs come out the exact same length. 65 characters for SHA256.
Very much known for their horrible security practices, yes. Absolutely.
Setting a max password length is sometimes done to prevent ddos attacks. Without it, attackers could just spam 1MB passwords constantly and force the login server to just spend all its cpu time hashing garbage.
That being said, a password limit of under 20 characters probably just means they are just storing passwords in plaintext.
load more comments
(1 replies)
Absolutely. They are entrenched in their regulations so much that it takes forever to change things.
Years ago, I had an account at an american big4 bank with an 8 character password and was going through and making all my passwords unique. I was changing everything to random strings of 20-30 characters (this isnt the best practice, btw, but still better than 8chars), so when I get to this bank account it capped me at 15chars. I couldnt believe the forced low entropy they gave me for something as vital as a bank account.
I asked them why, and basically they said their system would break with anything over 15chars.
load more comments
(3 replies)
Who do you think makes the decisions for a bank?
The person writing the Android app?
Or the person who just wants customers to be able to access the app and use the services?
load more comments
(2 replies)
Isn't that how fdroid worked for a long time?
Edit: although it doesn't make sense to me for play store to do the same without the source code available
Edit 2:
The reason is that they forced new apps AND apps for Android TV to use App Bundles https://developer.android.com/guide/app-bundle This type of release cannot be installed as it but can be used to generate the apk files. In order to do so, the Play Store has to sign on the fly.
Not buying it. They could let the dev sign evey combination before uploading. They'll be caching them anyways
Traditionally Fdroid signs every app. Not with the developers key. The future are reproducible builds. https://f-droid.org/2023/01/15/towards-a-reproducible-fdroid.html this is a futuristic app store, not what google has.
load more comments
(3 replies)
In addition to the private key thing, the Play Store is requiring them to drop support for APIs older than API 30 unless they provide the key.
Which in effect means VLC can no longer be updated on AndroidTVs running Android 11 or earlier.
Which is millions of customers, according to VLC
load more comments
(2 replies)
load more comments
(1 replies)
load more comments
(9 replies)
Fdroid is the obvious answer me thinks. Anyway love you guys/gals at videolan still haven't come across a piece of software that destroys every other in its field in every aspect.
load more comments
(20 replies)
Dear VLC, in your download section there is the F-Droid app store option which I consider a good thing. p.s. Why are you still posting on Twitter ??? On your website I see two buttons Facebook and Twitter. Time for a change ?
By the way, archive.is and archive.ph are Tor unfriendly. Another link : https://news.ycombinator.com/item?id=39798565
The guy upset about his 14 year old iPad not still receiving support is hilarious!
Ok yeah it's kind of funny but if you think about it for a second that ipad is perfectly functional. If apple doesn't want to support it because it doesn't make them money, then why can't the community? Why does apple get to decide what is e-trash and what isn't?
The laptop I bought second hand in 2014 is still very much functionnal, and in fact it still runs. I'll concede that it doesn't run well, as it was already unpowered back then, but it runs some flavors of Linux oriented towards low-power devices, because people made them to do specifically this. If I had bought a second had ipad instead, it would be in a landfill by now. It didn't even take any special actions on toshiba's part to make it behave like this, they just made a laptop that was up to the standards of every other laptop at the time. What I'm getting at is that this isn't a new idea, we know how to take care of our devices for longer already, were it not for the apples and googles telling us what we can't and can do on the device we own.
load more comments
(4 replies)
Its hilarious that apple is creating a bunch of ewaste for no good reaaon?
My mom's macbook is 14 years old and perfectly functional. So why doesnt it work (well) anymore?
Apple doesnt provide updated root certificates anymore, so all https sitesare borked.
Name a company that gives security updates to 15 year old tablets.
I wish they did, but this is hardly just an Apple problem. The only reason I bring this up is because people very quickly dunk on Apple without thinking about the fact that we need more access to all of our hardware in order to increase the longevity for those who want to.
Frankly I find iPads work longer on average than most other tablets. Purely anecdotal though.
The other elephant in the room is that most people don’t want to use 15 yr old tablets. I know I don’t want to edit video on 15 yr old desktops, even though they were perfectly capable of editing 15 years ago. But not current videos. Just like 15 year old tablets will not be able to readily stream or display a lot of modern content correctly.
Why does it have to be a company?
Tons of old hardware continues to be useful to its owners just by virtue of being on open and maintainable platforms.
But Apple continues to push harder and harder for planned obsolescence while claiming they support their devices better than the competition.
Apple earns unique hate in this category because of how strenuously they fight against things like right to repair. Failing to support old products isn't the end of the world but intentionally making it so that old products aren't supportable is very bad and the Apple App Store is a major instrument for making sure old Apple devices stop being useful.
load more comments
(4 replies)
load more comments
(10 replies)
VLC is still on Twitter? I thought they would be quick to migrate to Mastodon, slightly disappointed.
And thanks OP for linking outside of Twitter.
Probably on both?
load more comments
(1 replies)
and yet the fdroid version was updated last month!
Or just using their official release APK over obtainium
TIL that my country has bended over the copyright trolls and blocked Archive.is, need a VPN to view...
I wish I was lost in dessert, but it's better for my wasteline that I'm not.
And good on VLC for standing up against this. This type of thing should absolutely be opt-in by the developer.
With Play App Signing, Google manages and protects your app's signing key for you and uses it to sign optimized, distribution APKs that are generated from your app bundles
You can use google's play app signing. It's not mandatory.
That is not better, it still means that the app is signed with a non private key, which goes against the very concept of the private/public key concept
load more comments
(6 replies)
I've scrolled through the F-Droid repositories in Droidify app and see that VLC does not have their own F-Droid repository ? They could create one, and set up mirrors for it, think of a way to cover the hosting costs, why not ? Making yourself depend on Apple and Google and saying that app stores were a mistake feels wrong.
load more comments
(4 replies)
view more: next ›
this post was submitted on 24 Mar 2024
399 points (100.0% liked)
Privacy
34178 readers
344 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS