In reply to @shuvashish76:matrix.org
https://github.com/MuntashirAkon/AppManager/issues/892

In reply to @tsuame:mozilla.org
Wireless debugging mode using paircode cannot be completed in ROMs without freeform windows mode that can be displayed in Settings(of course includes Development Options )
App Manager can get the port but the pairing code needs typing manually, but once the focus switches from Settings to others, the pairing code becomes invalid immediately.
Some apps like Shizuku use a notification to solve this problem, like these screenshots below. Can App Manager add this feature in the future? Thanks

⚠️ Important.
From now on, if you want to contact me via email, please send it to am4android [at] riseup [dot] net. This shall be enforced with the release of the next stable release, which means that any attempt to contact me via any other email addresses will be ignored and may be reported as spam. Also, due to a high volume of emails of late, I may not be able to reply to all of them, especially the ones that does not contain any helpful info such as crash reports or the steps to reproduce the issue. If you're blocked on GitHub for your misconduct, chances are your messages will be filtered in my email client as well. This is a part of the ongoing measure to ensure the safety and longevity of my projects by blocking anybody who tries to harm the projects by any means. It should also be noted that only official sources should be used to download the applications. Third-party sources may provide modified version of the applications which may contain malware.

Third-party app stores should also take note of my message and take necessary actions to update the email address.

still justifiable that people do not fully trust the method of signing apks used by F-Droid

There is no point in trusting the apk files from GitHub either. On what basis you'd trust them? You never know 1. if some parts are proprietary, 2. by using obtainium you never verified them using VirusTotal or Pithus as it has no.built in mechanism for it 3. never checked what permission they use (izzyrepo check some of them vs F-Droid at least shows general permissions before you download them.

help more people make the transition to open source apps.

Obtainium is great for personal use but it’s the worst one for general users.
Yes F-Droid has issues but unlike F-Droid, it's wrong to assume downloading from GitHub = all FOSS. Fundamentally there is no difference between a sketchy/pirated site & GitHub (the sourciest of source).

I hope AM will handle this in a better way.

still justifiable that people do not fully trust the method of signing apks used by F-Droid

There is no point in trusting the apk files from GitHub either. On what basis you'd trust them? You never know 1. if some parts are proprietary (F-Droid build them, now supports reproducible builds), 2. by using obtainium you never verified them using VirusTotal or Pithus as it has no.built in mechanism for it 3. never checked what permission they use (izzyrepo check some of them vs F-Droid at least shows general permissions before you download them.

help more people make the transition to open source apps.

Obtainium is great for personal use but it’s the worst one for general users.
Yes F-Droid has issues but unlike F-Droid, it's wrong to assume downloading from GitHub = all FOSS. Fundamentally there is no difference between a sketchy/pirated site & GitHub (the sourciest of source).

I hope AM will handle this in a better way.

still justifiable that people do not fully trust the method of signing apks used by F-Droid

There is no point in trusting the apk files from GitHub either. On what basis you'd trust them? You never know 1. if some parts are proprietary (F-Droid build them, now supports reproducible builds), 2. by using obtainium you never verified them using VirusTotal or Pithus as it has no.built in mechanism for it (AM has built in option for both Pithus & VT) 3. never checked what permission they use (izzyrepo check some of them vs F-Droid at least shows general permissions before you download them.

help more people make the transition to open source apps.

Obtainium is great for personal use but it’s the worst one for general users.
Yes F-Droid has issues but unlike F-Droid, it's wrong to assume downloading from GitHub = all FOSS. Fundamentally there is no difference between a sketchy/pirated site & GitHub (the sourciest of source).

I hope AM will handle this in a better way.

In reply to @muntashir:matrix.org
I agree with @[§] on this. “Trust” is a quite complicated matter in security and privacy. When you install an app from GitHub, you trust the person who released the app along with the signer installed in your browser or device that verified the GitHub’s certificate. For F-Droid repo, you also trust F-Droid. Although F-Droid says that the app supplied by them is guaranteed to be reproduced from the source they supplied with it. But I don’t know if they actually verify this. It’s possible to use external sources in a way that doesn’t ensure such reproducible builds.

In reply to @LjL:matrix.org
For the main, official F-Droid repository, it's "verified" in that we definitely build from the source that is also provided as a tarball on f-droid.org, but of course it's still a matter of trust because you have to take F-Droid's word on that... unless the app features reproducible builds, in which case it's externally verifiable, but in that case it's signed with the original signature (not F-Droid's) as well.
You're right also that the F-Droid app allows adding arbitrary third-party repos and F-Droid as an organization has no control or oversight on those. It's an open ecosystem and guarantees are only made about the official repository.

In reply to @shuvashish76:matrix.org
Official client should show which versions are reproducible builds. Currently there is no way to distinguish between FD signed builds vs reproducible builds. FD definitely has the resources to improve the client in a better way.

BTW LjL what's your position at FD? social platforms moderation? 

In reply to @shuvashish76:matrix.org
Official client should show which versions are reproducible builds. Currently there is no way to distinguish between FD signed builds vs reproducible builds. FD definitely has the resources to improve the client in a better way.

BTW LjL what's your position at FD? social platforms moderation?