> This is because app stores do a lot of heavy lifting to provide security for the app ecosystem. Specifically, they provide integrity, ensuring that apps being delivered are not tampered with, consistency, ensuring all users get the same app, and transparency, ensuring that the record of versions of an app is truthful and publicly visible.
The Google Play Store does none of this, lol. All apps created since 2021 have to make use of Google Play App Signing, which means Google holds the keys used to sign the app. They leverage this to include stuff like their Play Integrity in the builds that are served. The Android App Bundle format means that completely different versions of the app are delivered depending on the type of device, locale, etc. There is 0 transparency about this for the end-user.
This sounds great! Does anyone know what this means for Google Pay and Apple Pay? In this country there's not a single bank anymore that offers contactless payments without going through Google or Apple...
Very fair. Doing anything with online advertising, either as an advertiser or as a publisher, without it involving any of Google's platforms is nearly impossible.
GrapheneOS found a way to provide eSIM support, but it depends on installing a patched version of Google's proprietary LPA app. I don't know how future-proof that is..
The lack of a physical SIM tray is just one more way to lock users in Google's walled garden. eSIM support is not implemented in Android itself (AOSP), but part of the proprietary GMS package. This means Google-free Android forks like LineageOS will be unusable on the Pixel 10 series :-(
My Garmin (Vivosmart 4) band tracks "stress" and "body battery" metrics, which are based on your Heart Rate Variability. For the first couple of days after my first mRNA shot there were no anomalies at all, but then out of nowhere my stress levels went through the roof (and my body battery completely flatlined) in a way that I've never seen before. This lasted for 6 full days, now everything seems to have returned to baseline..
I didn't feel anything about the whole ordeal though, apart from some sore muscles in the first days. Crazy interesting to quantify the amount of stuff going on in the background without you being aware of it.
EDIT: Specifically, during these 5 nights my stress level was reportedly _unmeasurable_ for about 50% of the time. Unmeasurable is common when you are physically active (making the PPG data too noisy to properly calculate normalized RR intervals) but very rare during sleep, so this probably indicated a very high amount of irregular/ectopic heartbeats.
I bought a Garmin the day Fitbit sold out and haven't touched the Fitbit since. I'm very happy with the switch, the Garmin (Vivosmart 4) app and device are actually better than Fitbit's on almost every account, so that's a double win :)
The only unfortunate consequence is that Garmin's import service only imports very coarse data from your Fitbit export, so all detailed historic records are lost unless you manually dig through your Fitbit export files. I hope Garmin will still provide a 100% complete importer in the future.
This is terrible news. As if Google didn't know enough about you already - they will now be supplied with a 24/7 live feed of your most sensitive health statistics.
I'll be switching to a competitor and closing down my account there as soon as possible to hopefully prevent years of my historic data from being merged into the (ghost) profile Google has on me.
But at this rate it won't be long before there are simply no more competitors to FAANG left anymore. Actually enforcing antitrust laws, anyone, pretty please?
I tried to register for an account with N26 early this year. After uploading all my personal information and passport scans, I received a generic rejection notice almost immediately. Extensively talked to the customer service, but they couldn't possibly figure out the rejection reason and eventually just stopped replying.
N26 appears to be one of those modern companies built on automation and algorithms where human customer service is an afterthought. It'll work until it doesn't - and then you're on your own. Wouldn't recommend using them to handle significant amounts of money.
In many countries it's not (legally) possible to buy a SIM card without providing your ID.
Sure, you go ahead and buy an illegal burner number, then download Signal/Whatsapp from the Play Store and reverse engineer that binary to see if it "does what it says". Other people might find it useful to look at this comparison to discover alternatives that better fit the characteristics they find important.
I didn't say that Conversations from the Play Store is significantly more trustworthy in this regard than WhatsApp from the Play Store. I said that an app - such as Conversations - that you can build from source or download from F-Droid is more trustworthy than the Play Store version.
WhatsApp is a proprietary app and as such it's only available on the Play Store. Conversations is open source so you can download it from the Play Store, or from F-Droid, or compile it from source. So if you care, you can be significantly more sure that your version of Conversations "does what it says" than you can be of WhatsApp.
The difference of course being that WhatsApp is closed source, and they can push any kind of change without anyone noticing.
If the client is open source, you can verify exactly what it does. Compile the app yourself or download it from F-Droid and you can be sure that the binary you get matches those sources.
Sure you can argue this all the way down to "Trusting Trust", but that doesn't really make sense when comparing two apps/ecosystems that operate in the same real world's constraints.
Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.
Fair enough, but this is kind of inherent for anything based on open standards. Was your email encrypted? It depends on whether the sending and receiving mailserver support TLS. Is your website visit perfect-forward-secret? Depends on whether your browser and the webserver support modern cipher suites. Is your DNS request encrypted? Only if your OS and your DNS server support DNSSEC or DoH.
These are valid challenges, but moving to propietary and centralized solutions instead is throwing away the baby with the bathwater. Was your WhatsApp conversation encrypted? You honestly can't know, and even if it is right now, Facebook could disable Whatsapp's e2e encryption at any time without you even noticing.
FWIW, OMEMO has been the (only) de facto encryption mechanism for modern XMPP clients in the last couple of years, and most clients that support it clearly distinguish encrypted and non-encrypted messages.
Yes, Conversations (Android) and ConverseJS (web) are on par with - or better than - the commercial apps like Whatsapp. On ios, Chatsecure is pretty close.
The Google Play Store does none of this, lol. All apps created since 2021 have to make use of Google Play App Signing, which means Google holds the keys used to sign the app. They leverage this to include stuff like their Play Integrity in the builds that are served. The Android App Bundle format means that completely different versions of the app are delivered depending on the type of device, locale, etc. There is 0 transparency about this for the end-user.