the #Syncthing Android drama is exploding.
https://github.com/researchxxl/syncthing-android/issues/16
@[email protected] at this point is being used to push out an app with sensitive permissions that's been taken over by an unknown individual who refuses to engage with its large community of users and developers.
I STRONGLY recommend disabling updates from Fdroid, if not uninstalling and manually installing 2.0.11.2, or installing the Google Play version which has a different maintainer.
this is extremely shady and it's just looking worse as time goes on. I'll link to the Syncthing forum thread from about where I left off last time in a subsequent post.
#SyncthingFork #SyncthingAndroid
@fdroidorg at this point is being used to push out an app with sensitive permissions that’s been taken over by an unknown individual who refuses to engage with its large community of users and developers.
I STRONGLY recommend disabling updates from Fdroid, if not uninstalling and manually installing 2.0.11.2, or installing the Google Play version which has a different maintainer.
this is extremely shady and it’s just looking worse as time goes on. I’ll link to the Syncthing forum thread from about where I left off last time in a subsequent post.
What do you mean by signed deploys? The APK is already signed, and this new person got the signing keys. I’m not sire any additional signing would have helped.
Stealing another comment’s update (thanks @[email protected] ), because catfriend1 explicitly says the new maintainer reseachxxl was willingly given the key material, which is how the update was pushed in the first place l:
Update: it seems that as of a few hours ago, Catfriend1 broke the silence and confirmed the transfer to researchxxl:
Therefore, I did hand over all my stuff to my inheritant @researchxxl inluding the com.github.catfriend1* apps, digital signing material and wish them the best to fulfill the mission of carrying on the Syncthing-Fork app. :woman_technologist: We have met in online gaming and developing modding code together for a level that tells the story of a research station attacked by some alien-like monsters. Two players do have to cooperate on fixing electrical devices, a low power emitting nuclear reactor and avoiding a bath in acid. If you stumble upon the game, say hello to us during our test sessions. :slightly_smiling_face:
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
… This is somehow going to be a ridiculously strong argument for requiring signed deploys because users are idiots, huh?
What do you mean by signed deploys? The APK is already signed, and this new person got the signing keys. I’m not sire any additional signing would have helped.
Stealing another comment’s update (thanks @[email protected] ), because catfriend1 explicitly says the new maintainer reseachxxl was willingly given the key material, which is how the update was pushed in the first place l: