Some devices don't have browsers, some are locked-down and only support one app store, or sideloading via adb, sometimes the UX is better (SideQuest for the Meta Quest).

The large majority of Android devices have a browser by default.

Hi, developer of a top-rated app in the Play Store [AnkiDroid].

What do I need to do to make a difference, and how much time will this take?

[My elected officials listen, what's the path? Legislation?]

> What do I need to do to make a difference, and how much time will this take?

EU or US?

> what's the path? Legislation?

Send them a letter explaining why this is bad for you. Keep it strictly factual and ideally concise. Copy Google’s legal [1] and any relevant digital or markets regulators. (If in the US, don’t forget your state regulators.)

Wait two weeks and then call the elected. Make sure they’re aware, and talk through your options. Send a letter thanking them for the call, incorporating any new information and actions they said they would take, and copy all of the previous parties again.

More work: reach out to other top developers and organise an open letter. This will be hard because everyone wants to include their pet issue and everyone will fight over scope and language.

[1] https://support.google.com/faqs/answer/6151275?hl=en

In the US, perhaps try complaining to the lawyers on the DOJ antitrust case as they've been considering splitting Android off from Google.

> try complaining to the lawyers on the DOJ antitrust case as they've been considering splitting Android off from Google

The way to do this is funding an amicus curiae.

what about EU? ChatControl has a website, but I am having trouble finding out who the hell to contact for the requirement for google play integrity in our goverment apps (which was recently changed from requiring hardware integrity, as graphene can only do the latter.), both national and comunitary, and whoever is in charge of the repositories is not responding to the tens of issues opened for it.

Now there's also this new requirement, and it's shocking the EU hasn't responded yet. Weren't we supposed to make ourselves more independent from US technology? But i wouldn't be surprised someone would be lobbying on google's behalf to convince the politicians that "trust me bro, google play is more secure"

> what about EU?

https://digital-markets-act.ec.europa.eu/contact-dma-team_en

> EU or US?

Neither, sadly.

Thanks for the link. I have neither the time nor inclination to be a figurehead, but I can have conversations once I feel there's a reasonable/achievable outcome. I'll put some thought into it.

You can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma, who lost a large sum of money by installing malware after ignoring multiple warnings.

If you want to make a difference, try to communicate with someone from OEM companies. Google is making their phones inferior and they'll loose money and market share because of it.

After this change, "I can install NewPipe and Ad blockers" will become a major selling point for Chinese phones among large and profitable segments of the population. And that high-end manufacturers might as well give up and let Apple take that part of the market. If OEMs can be made to understand that, that's going to be the end of this initiative.

> can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma

You’re correct, but for the wrong reasons. Privacy framings don’t work because people who care about privacy are unusually politically nihilistic and/or lazy. I’ve worked on privacy legislation. I’ve also worked on other laws. Nobody calls or writes about the former. With the latter, it was almost trivial to demonstrate to the elected that there was real political capital in embracing the issue.

Well, depending on the sort of other laws you've supported, that shouldn't be very surprising.

The special interest of a particular group always result in far more intense support than any law that benefits the public at large. And privacy is usually a general concern.

Also, am I the only one who finds the idea that you need to demonstrate the existence of political capital to elected politicians concerning? (As opposed to persuading them that it's the right thing to do.) I don't want to sidetrack the whole discussion, but this makes me doubt the future of western democracy in a hundred different ways.

JumpCrisscross's reply was really good, and I would like to add additionally that US congress representatives and senators usually maintain local offices in cities in their constituency, and a visit to these offices (usually you can make an appointment by calling them) to discuss issues in person is a very powerful way to be heard. If you aren't in the US, you'll need to find out if your government has anything similar.

> But on topic: why not create docker.io/bsi and let /bitnami as is without new updates?

If people are relying on you for automatic security updates, and you've decided to no longer provide these updates [for free], users should opt in to accept the risk.

This would normally require user action (after a period of warnings/information), and having the fix look 'obviously' unsafe (`/bitnami ` ->`/bitnamilegacy`) feels reasonable.

The workflows were set up to execute with a read/write `GITHUB_TOKEN` for `nx` when a PR was created/edited (no approval necessary).

See the security warnings on `pull_request_target`

https://docs.github.com/en/actions/reference/workflows-and-a...

https://securitylab.github.com/resources/github-actions-prev...

> the build tool

Doesn't this give the LLM the ability to execute arbitrary scripts?

As a maintainer, if you're dealing with a contributor who's sending in AI slop, you have no opportunity to prompt the LLM.

The PR effectively ends up being an extremely high-latency conversation with an LLM, via another human who doesn't have the full context/understanding of the problem.

You're totally dismissing this person's agency and their ability to learn. You're all but writing off their existence.

Added on March 18: https://github.com/TecharoHQ/.github/commits/main/SECURITY.m...

Copied to the root of the repo after the disclosure

ref: https://github.com/TecharoHQ/anubis/issues/1002#issuecomment...

Adding a security policy to an unrelated repository is easily missed and questionably applicable.

In a different repository, though. I think it's understandable that someone would miss it.

> Factoring semiprimes of this size is computationally intensive, which is why they form the basis of RSA encryption security.

Not if it's divisible by 2.

    from sympy import isprime
    num = 29927402397991286489627837734179186385188296382227646249397073654051914085318503794952624411151858464246403027505634195232053330357484129331920822220662818816547063469215394303721576869467659309978113411955550111870966028627418736664
    print(num//2) # 14963701198995643244813918867089593192594148191113823124698536827025957042659251897476312205575929232123201513752817097616026665178742064665960411110331409408273531734607697151860788434733829654989056705977775055935483014313709368332
    print(isprime(num//2)) # False

Indeed that works for that case. But you can prompt yourselves, it will not always generate natural that are easy to validate with such shortcuts. So I don't think it invalidates the point I'm making.

I have up to 4x (in steps of 0.05) with YouTube Premium on Android

> Android allows apps to open ports without permissions.

Just to clarify: you need `android.permission.INTERNET`. This is a default permission (granted by default at install time with no user interaction).

GrapheneOS allows this permission to be disabled.

As far as I'm aware, you can't lock this down to 'allow only intra-app communications via localhost', please let me know if I'm mistaken.