Originally I've download the signal app through playstore, but often it also get updates from Droid-ify(Fdroid client). Today its weird and I got this . Explain to me this.
On the Droid-ify the signal app is provided by: org.thoughtcrimes.securesms
Today I got this POP-UP, anyone?
66 Comments
nottheengineer@feddit.de · 265 pts · 2y
The package name is correct, but signal was never on F-droid.Do you have a third party repo that might be compromised?
Edit: Package name isn't correct, so that's almost definitely a compromised version. Get rid of it ASAP.
miss_brainfart@lemmy.ml · 110 pts · 2y
To add to that:
Always check the projects' website to see the official ways it's distributed, before you just download it from anywhere.
Pantherina@feddit.de · 5 pts · 2y
Not applying for signal though, as their apk site is hidden away
miss_brainfart@lemmy.ml · 1 pts · 2y
Not a fan of that either, that really is unfortunate. But with a bit of common sense, a person should then ask about that, if the Play Store is not an option. It's still not a reason to download it from a source you haven't verified to be official
Pantherina@feddit.de · 4 pts · 2y
No thats absolutely a reason. Signal is 100% to blame that they have no fully FOSS code repository that could then simply be compiled by FDroid and shipped there.
Instead I have to rely on some Dude I know nothing about, Twinhelix could just as well spread Malware. But I like my updates through FDroid, I like a blob Free Signal
miss_brainfart@lemmy.ml · 2 pts · 2y
Call it blame, but that decision is fully within their right, and what Twinhelix does technically violates F-Droids' guidelines. If a creator doesn't want their app on there, F-Droid calls to respect that.
The official Signal apk updates itself, so that's not even an issue.
If your unoffical build from a third-party gives you issues one day, you are fully responsible for that.
Pantherina@feddit.de · 1 pts · 2y
Huh? They could just as well provide a blobfree APK themselves. They have their Google Play crap already, everyone not using that will probably also have a googlefree OS.
They have a FOSS client and provide no FOSS binaries, which is totally their right. I heard their Desktop clients are not reproducible though, maybe because of Electron?
metacolon@lemmy.blahaj.zone · 1 pts · 2y
Or just use Molly
otter@lemmy.ca · 64 pts · 2y
It actually might not be, googling
"org.thoughtcrimes.securesms"doesn't get results.thoughtcrimesvs.thoughtcrimeMy question though is how this popped up in droidify, would someone need to manually add some special repo?
nottheengineer@feddit.de · 37 pts · 2y
I missed that, thanks for pointing it out. The one without S is the correct one.
But that makes me wonder, how did OP not end up with two signal apps then?
DAT@feddit.de · 37 pts · 2y
by that popup blocking him from installing the wrong one?
nottheengineer@feddit.de · 23 pts · 2y
Oh, that's from the installer and not one of those warnings you get after opening apps. Makes sense.
amju_wolf@pawb.social · 10 pts · 2y
Technically it's from "Google Play Protect" that got triggered during the install but yeah.
Pantherina@feddit.de · 3 pts · 2y
Yes, where is that from? Its not in the repos I use.
Pantherina@feddit.de · 10 pts · 2y
Twinhelix is the only one compiling the app from source without proprietary blobs
geoma@lemmy.ml · 17 pts · 2y
And molly.im
fartsparkles@sh.itjust.works · 4 pts · 2y
DetectiveSanity@lemmy.world · 1 pts · 2y
Skimmer@lemmy.zip · 105 pts · 2y
Google is actually right here for once. Signal is not offered on F-Droid, and its package name is org.thoughtcrime.securesms, not org.thoughtcrimes.securesms.
Only official places to download Signal are through the Google Play Store or their website (which self-updates).
mintycactus@lemmy.world · 1 pts · 2y
AnokLola@lemm.ee · 69 pts · 2y
I recommend checking the official website or the Play Store to ensure that you are downloading the latest and official version of the app.
bob_lemon@feddit.de · 42 pts · 2y
https://www.signal.org/download/android/
The official website only links to Google Play for the Android client, even on the fairly "hidden" download page.
Pantherina@feddit.de · 47 pts · 2y
They hide it away, thats the tricky part
https://signal.org/android/apk/
Below the Playstore link
AnokLola@lemm.ee · 22 pts · 2y
If the official website redirects you to the Play Store, then it is safe to download the app from there.
And to be noted, I don't think that the Android app client for Signal is available on F-Droid.
Quereller@lemmy.one · 61 pts · 2y
From which (enabled) repository does the app come. Signal is not on F-Droid or Izzydroid.
sylphio@lemmy.ml · 6 pts · 2y
I don't know about OP, but it is available in https://thecapslock.gitlab.io/fdroid-patched-apps/fdroid/repo and https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo
Quereller@lemmy.one · 3 pts · 2y
Yes, I heard that it is in the CalyxOS repo. This seems to be a legit version.
yoz@aussie.zone · 2 pts · 2y
It is but in a different repo
LtLiana@startrek.website · 53 pts · 2y
kworpy@lemm.ee · 53 pts · 2y
"This app tries to spy on your personal data"
Needless to say Google hates competition
Anticorp@lemmy.ml · 48 pts · 2y
They hate the competition.
yoz@aussie.zone · 22 pts · 2y
Catsrules@lemmy.ml · 18 pts · 2y
Google is like your big brother. They will beat the shit out of you. But If anyone else tries to beat you they will kick their ass.
stebo02@sopuli.xyz · 17 pts · 2y
they obviously want all the data to themselves
Rustmilian@lemmy.world · 41 pts · 2y
0x2d@lemmy.ml · 31 pts · 2y
It's a fake copy of Signal
The actual package name is org.thoughtcrime.securesms, not org.thoughtcrimes.securesms
Also Google officially recommends Signal on the Android website last I checked, so I don't see why Play Protect would flag it as malware
edit: attach screenshot of package name
edit 2: fix typo in package name (accidentally typed thoughcrime)
Harry_h0udini@lemmy.dbzer0.com · 4 pts · 2y
Thanks mate
cl4p_tp@lemmy.dbzer0.com · 15 pts · 2y
I'm on the apk from the signal website. This showed up for me as well.
possiblylinux127@lemmy.zip · 10 pts · 2y
I'll just drop this here
https://molly.im/
nameisnotimportant@lemmy.ml · 19 pts · 2y
What is the benefit of using this instead of Signal?
pufferfischerpulver@feddit.de · 29 pts · 2y
You get to convince your peers once more to use a different app.
NullGator@lemmy.ca · 16 pts · 2y
Uses the signal back end and is cross compatible
affiliate@lemmy.world · 12 pts · 2y
you don’t have to tell your peers that, you can still convince them to switch anyways
pufferfischerpulver@feddit.de · 3 pts · 2y
It seems you are not cross compatible with my joke. I admit, I use an obscure back end.
Anticorp@lemmy.ml · 25 pts · 2y
It's named after a rave drug.
LufyCZ@lemmy.dbzer0.com · 13 pts · 2y
Hell yeah
AlecSadler@sh.itjust.works · 10 pts · 2y
Android tablets as linked devices is why I use it. Something Signal seems to refuse to add.
Lemongrab@lemmy.one · 9 pts · 2y
Fully foss dependencies, degoogled (doesnt require Google Play services), and further hardening to the app. And you can still keep your signal contacts since it is just a fork. Available through Accressant, fdroid, and github.
newIdentity@sh.itjust.works · 3 pts · 2y
But note that you need to download the Fdroid version for the degoogled version
possiblylinux127@lemmy.zip · 3 pts · 2y
It has an official F-droid repo.
Also it may work as a temporary solution for those who are having signal troubles
Sygheil@lemmy.world · 9 pts · 2y
Maybe a botched version and goolag was triggered. On the safe side get rid of it.
Check the repo where it was downloaded.
Slow@lemmy.today · 5 pts · 2y
Use molly.Im. They have a repository for F-droid.
breadsmasher@lemmy.world · 4 pts · 2y
Are you installing from Playstore or FDroid?
ThePancakeExperiment@feddit.de · 4 pts · 2y
Got something similar yesterday, but for KDE-Connect from F-Droid. Downloaded the Play Store version instead.
newIdentity@sh.itjust.works · 8 pts · 2y
Either it got compromised or Google is warning you because it has a different signature than the Google play version
Extrasvhx9he@lemmy.today · 1 pts · 2y
Quereller@lemmy.one · 1 pts · 2y
KDEconnect from FDroid also go similar warnings. Might be related or OPs app might really be fake. https://twitter.com/albertvaka/status/1712954968477401478
blkpws@lemmy.ml · -7 pts · 2y
Pantherina@feddit.de · -68 pts · 2y
Just get a degoogled phone...
KISSmyOS@lemmy.world · 39 pts · 2y
Pantherina@feddit.de · -4 pts · 2y
Sure? Why can people upload apps called signal there?
Gush@lemmy.ml · 4 pts · 2y
me poor
possiblylinux127@lemmy.zip · 3 pts · 2y
Degoogle your existsing device
Gush@lemmy.ml · 1 pts · 2y
I have an EMUI system, it's very hard to tinker, but i uninstalled maps and playstore ecc
Blizzard@lemmy.zip · -114 pts · 2y
Turn off Play "Protect".
DAT@feddit.de · 112 pts · 2y
In most cases I'd be the first to support your idea.
but here it actually blocked malware?
Blizzard@lemmy.zip · -57 pts · 2y
Didn't notice the "droid-ify" part, whatever that is. Install apps from trusted sources like F-Droid or dev's website and you don't need Google to scan your phone and tell you what you can or cannot install.
mapletree@sh.itjust.works · 44 pts · 2y
Droid-ify is just a different client for F-Droid. It should be safe and uses the same repositories
PropaGandalf@lemmy.world · 16 pts · 2y
I really like droid-ify. Its a nice, good-looking alternative to fdroid. Also I'd advice to use molly foss instead of the original signal app.
KISSmyOS@lemmy.world · 2 pts · 2y
Lemongrab@lemmy.one · 5 pts · 2y
Here what I replied to someone else:
Fully foss dependencies, degoogled (doesnt require Google Play services), and further hardening to the app. And you can still keep your signal contacts since it is just a fork. Available through Accressant, fdroid, and github.
BetaDoggo_@lemmy.world · 6 pts · 2y
They could have added their own repos which is the concern here.
newIdentity@sh.itjust.works · 3 pts · 2y
Actually, it uses more repos
Signal isn't in the official Fdroid repos
vector_zero@lemmy.world · 2 pts · 2y
I'm using droidify and couldn't find signal in there either.
Black_Gulaman@lemmy.dbzer0.com · 18 pts · 2y
Lol what are you talking about.
MangoPenguin@lemmy.blahaj.zone · 3 pts · 2y
Don't, in this case it's actually blocking a fake app correctly.