Join the FSF and friends on Friday, December 13 from 12:00 to 15:00 EST (17:00 to 20:00 UTC) to help improve the Free Software Directory.

When F-Droid is installed, it provides a strong, trusted channel to the apps
you want to install. Ideally, F-Droid comes pre-installed on your device,
like with CalyxOS,
LineageOS-for-microG or
DivestOS. Then there is already a verified version
of F-Droid in place, ready to serve you.

We work to make the f-droid.org web site as hardened as
possible to
provide a trustworthy channel for first time installers to download the
F-Droid.apk. For example, we recently rolled out Domain Name System
Security Extensions (DNSSEC) and DNS Certification Authority Authorization
(CAA) protections for the f-droid.org domain name.

If a user already knows about the f-droid.org domain, or a trusted source
tells them that f-droid.org is the right domain, then they will get the
right F-Droid.apk directly from this website. Unfortunately, on the web,
there are lots of ways to trick users into believing they are visiting the
right website. This is usually known as “phishing”. For example,
https://f-droid.org/de/ is the German version of this site, but
https://f-droid.org.de/ is a site controlled by someone else who owns the
org.de domain. Or some unknown owner has controlled
f-droid.cn since 2015. We have not
seen any activity on that domain, but it could still be used to lead users
astray. We regularly buy domains that might be confusing to users to avoid
them being misused. But that alone is unfortunately not enough (note: we’d
love to buy that domain, let us know if you can help us find the owner).

This problem led us to look for other “roots of
trust”. When a user already
knows and trusts a channel, they can use to fetch and verify the
F-Droid.apk. For GNU/Linux distros like Debian, there is a strong trust
anchor provided by the built-in package manager. For other operating
systems, there are add-in package managers, like Homebrew for macOS. So we
made the new fdroid install command to take advantage of these trust
anchors. If you already trust your package manager, and it ships
fdroidserver v2.3.0 or newer (e.g. apt-get install fdroidserver), then
you can just install that, run fdroid install, and get a cryptographically
verified F-Droid.apk to install on your device.

On top of that, fdroid install will automatically try to download from a
number of built-in mirrors. So installing using fdroid install could be
more reliable than trying to download F-Droid.apk from this website. For
extra privacy, use fdroid install --privacy-mode and it will avoid
downloading from https://f-droid.org and instead download from mirrors
that host lots of different kinds of software. Any network observers will
not be able to see which specific software you are downloading from the
mirror. The visible parts of your download traffic will not show that you
are downloading something related to F-Droid. It is important to note that
the operator of that mirror will be able to see that you are downloading
F-Droid.apk.

As of this writing, here are some sources of the required version of
fdroidserver:

• Debian/trixie and Ubuntu/plucky: apt-get install fdroidserver
• Debian/bookworm-backports: apt-get install
fdroidserver/bookworm-backports
• Homebrew: brew install fdroidserver
• Python pip: pip install fdroidserver
• Our Ubuntu
  PPA

Access to the law includes access to the harmonized standards it predicates. But is it right that those standards can include royalty-due patents (SEPs)?

Some news is both sad and dystopian at the same time, and this is one of those cases. Moxie, a start-up selling $800 emotional support robots intended to help children is shutting down operations since it can’t find enough money, and since their robots require constant connectivity to servers to operate, all of the children’s robots will cease functioning within days. They’re not offering refunds, but they will send out a letter to help parents tell their children “in an age-appropriate way” that their lovable robot is going to die. If you have kids yourself, you know how easily they can sometimes get attached to the weirdest things, from fluffy stuffed animals designed to be cute, to random inanimate objects us adults would never consider to be even remotely interesting. I can definitely see how my own kids would be devastated if one of their favourite “emotional” toys were to suddenly stop working or disappear, and we don’t even have anything that pretends to have a personality or that actively interacts with our kids like this robot thing does. We can talk about how it’s insane that no refunds will be given, or how a company can just remotely kill a product like this without any repercussions, but most of all I’m just sad for the kids who use one and are truly attached to it, who now have to deal with their little friend going away. That’s just heartbreaking, and surely a sign of things to come as more and more companies start stuffing “AI” into their toys. The only thing I can say is that we as parents should think long and hard about what kind of toys we give our children, and that we should maybe try to avoid anything tied to a cloud service that can go away at any time.