Privacy @lemmy.ml ozoned @lemmy.world 11mo ago

VLC - App stores were a mistake

VideoLAN @videolan App Stores were a mistake. Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users... For now, iOS App Store still allows us to ship for iOS9, but until when?

191

You're viewing a single thread.

191 comments

Fdroid is the obvious answer me thinks. Anyway love you guys/gals at videolan still haven't come across a piece of software that destroys every other in its field in every aspect.
- Have people actually checked the versions there before making the suggestion?
  
  F-Droid: Version 3.5.4 (13050408) suggested Added on Feb 23, 2023
  Google Play: Updated on Aug 27, 2023
  
  https://f-droid.org/en/packages/org.videolan.vlc/
  https://play.google.com/store/apps/details?id=org.videolan.vlc
  
  The problem seems to be squarely with VLC themselves.
- I dont think that works for windows?
  
  On Windows you should be downloading from the website.
  
  Or winget if they provide it.
  
  Doesnt winget use the same store?
  
  Or use scoop or something similar. Or better yet don't use Windows
  
  Thats not secure. Isn't the pount of the Windows Store that packages are signed by developers and verified when downloaded?
  
  No, the point of the windows store is that Microsoft gets more control over your machine.
  
  Code downloaded from websites can still be (and is) signed; when it’s not you get that box where you have to click “Run Anyway”
  
  Pretty sure they're signed by Microsoft instead? At least that's what other app stores do.
  
  It's all a game of shifting the point of trust around. Personally, I'd trust most small time developers more than the likes of Microsoft and Google, however I'd trust Fdroid more than unknown developers (but still go direct to the developers I do trust).
  
  The good ones are signed by the devs, otherwise there's a risk of malicious modifications at upload or on the publishing infrastructure. This is how Maven works. All packages MUST be signed with PGP by the devs.
  
  Apt isn't signed by the devs but its signed by the package maintainers, whose job it is to verify the packages that they prepare (devs can't upload software in Debian)
  
  You can try chocolatey store then. Community maintained.
  
  And also no.security. what's the point?
  
  How about winget or the other commandline package managers? winget does have VLC according to winget-pkgs. This is the kind of "stores" we need, ones that emulate Linux repositories instead of locked down smartphone garbage.
  
  Is singer secure tho? Iirc chocolaty isnt
  
  Asking if something is secure on an insecure OS. Seriously, both the program and the repositories are on github:
  
  https://github.com/microsoft/winget-cli
  
  https://github.com/microsoft/winget-pkgs
  
  So you be the judge.
  
  Unfortunately even FlatPak is insecure, so OS doesn't really matter
  
  Maybe don't check all the permission boxes in flatseal and you might find it's more secure than you think.
  
  It's all about default permissions
- Winrar?
  
  7zip.
  
  PeaZip is something you should check out too
  
  What does 7zip do better?
  
  Not show annoying popups about licenses?
  
  7z is better than rar and its algorithm is fully open source
  
  Oh shit I did not know that. Switching now, thanks
  
  Encryption?
  
  I tried it and went back so winrar.

191 comments