Comment on apps .. repo or not
gencha@lemm.ee 5 weeks ago
It’s good to have established release channels that don’t rely on third parties in the first place. Everything beyond that is for convenience and strictly optional.
Comment on apps .. repo or not
gencha@lemm.ee 5 weeks ago
It’s good to have established release channels that don’t rely on third parties in the first place. Everything beyond that is for convenience and strictly optional.
kristoff@infosec.pub 5 weeks ago
The problem is here is this: how is a user supposted to know if the official website of an application is organicmaps.app, organic-maps.app, organicmaps.org or github.com/organicmaps?
And even if she/he knows, hackers do ways to make you look the other way. The funny thing in this case is that the original author complained that the app was removed from google playstore, and did so on the fosstodon mastodon-server. Although I guess this was not at planned, he made the almost perfect social-engineering post. :-)
moonpiedumplings@programming.dev 5 weeks ago
en.wikipedia.org/wiki/Organic_Maps
Unironically, wikipedia is pretty good for getting official links to projects/websites. It’s not a guarantee, but it’s a lot betted than just googling it,
gencha@lemm.ee 5 weeks ago
I totally agree with you on the phishing aspect. Good thinking.
I would prefer it if people already knew the domain from prior association. I still download desktop software regularly on the developer website, even though I am also aware that this is not without safety concerns. I know this is an unrealistic expectation at this point, but I dislike that the Google/Apple Stores have more trust, even though they regularly publish fake apps or apps with security/privacy issues.
Ultimately, publish on multiple channels regularly and let your users be aware of alternatives. Then they are enabled to switch when they need to, and it might also be easier for new users to recognize which release channels are official