hummingbird @ hummingbird @lemmy.world

Posts

0

Comments

48

Joined

2 yr. ago

They video was quiet promising. However looking at the app website shows that what was a false promise. The app does track every single launch and sends that to their servers (see privacy policy) not legal without consent in the EU. Calling this "tracker free" is more than misleading here. I'd call it a lie actually.

Have you tried https://github.com/jeena/fxsync-docker? It is a docker compose for selfhosting the new Firefox sync server rewritten in Rust.

Credits: https://lemmy.world/post/5839867

That's so sad. Uses to buy all my music through them.

The reported tracker is ACRA, a crash report library (https://github.com/ACRA/acra).

I digged a bit into the source code and the apk. From looking at the code alone one can't tell if the crash report is actually enabled, the build configuration depends on some unpublished file. But looking into the apk allows to reconstruct it. These are my findings:

• the usage is implemented here: https://gitlab.futo.org/alex/voiceinput/-/blob/master/app/src/main/java/org/futo/voiceinput/CrashLoggingApplication.kt
• the crash handler is compiled in and also enabled (BuildConfig.ENABLE_ACRA=true)
• the crash handler is configured to dialog mode. According to the ACRA documentation (https://www.acra.ch/docs/Interactions#dialog) that means that user interaction is required for sending (a popup dialog with a cancel button).
• the upload domain is crash.sapples.net
• the dialog can't be disabled via settings
• the usage of ACRA is missing in the licenses and about dialogs (https://gitlab.futo.org/alex/voiceinput/-/blob/master/app/src/main/assets/license-list.html)
• the privacy policy is correctly stated (https://voiceinput.futo.org/VoiceInput/PrivacyPolicy)

  4.1. If the app crashes, you may be asked if you wish to submit a crash report. If you accept, your device information and crash details will be sent to us for the purposes of investigating the crash and improving the software.

Thank you, I'll look into it.

Can you give more details of the scan result? Exodus only lists the Play store version. I installed the F-Droid version but Exodus app reports it as "same version" and just shows the clean Google Play Store results. This is obviously wrong, the SHA1 listed for the Play Store version on the Exodus website is different compared to the F-Droid .apk I have installed. Sadly the Exodus website does not support scanning F-Droid apps from third-party repos so I have no idea how to scan it.

That being said, according to the privacy policy (https://voiceinput.futo.org/VoiceInput/PrivacyPolicy), the F-Droid .apk version should have some kind of crash report build-in. So I could imagine that this might get flagged.

Keepass on phone, desktop and tablet. Sync serverless via Syncthing.

• completely private
• always available when needed
• no dependency on services which may go away
• all open source software
• maximum security

If you want more in depth control on google services, CalyxOS supports microg in various combos (https://calyxos.org/docs/guide/microg/#options-for-running-microg-in-calyxos). While it has some limitations compared to the official google services, it also allows better privacy control and is fully open source.