390
VLC - App stores were a mistake (archive.is)
submitted 2 years ago by to c/privacy@lemmy.ml
191 comments fedilink hide all child comments
 

VideoLAN @videolan App Stores were a mistake. Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users... For now, iOS App Store still allows us to ship for iOS9, but until when?

you are viewing a single comment's thread
view the rest of the comments
[–] 63 points 2 years ago* (last edited 2 years ago) (5 children)

From their Twitter:

If you wonder why we can't update the VLC on Android version, it's because Google refuses to let us update:

  • either we give them our private signing keys,
  • or we drop support for Android TV before API-30, and all our users on TV API<30 can't get fixes.

It's not much, just dozens of millions of people use Android TV before Android-11...

Maybe we should tell users to buy new TVs? #electronicWaste

I can't speak to why they're not updating on FDroid but seeing as how it's much more difficult to get people to use FDroid on Android TV, I don't think it will help them with that issue anyway.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 89 points 2 years ago (3 children)

    Google requiring their private signing key is insane, and goes completely against the concept of private/public keys.

    Why is Google asking for this?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 26 points 2 years ago* (last edited 2 years ago)

    C-I-A Confidentiality, Integrity, Accessibility. They don't need the keys for C or A. Only one option remains. To modify the code and pass it off as code VLC wrote or signed off on.

    Likely to install malware and re-sign. Brazen identity theft.

    Maybe I'm wrong, they could use VLC's private keys to gobble encrypted communications too.

  • permalink
  • fedilink
  • source
  • parent