F-Droid version of KDEConnect uninstalled by PlayProtect

[ensignavenger]

Happened to me, I had to disable Play Protect scanning... interestingly, in ghe deacription in Android settings, it claims Play Protect will scan and WARN, not remove, apps. That is clearly a lie.

[Zambyte]

My phone forces me to reject "Play Protect" every single time I want to install an app.

If I have to explicitly reject it more than once, it is obviously malware. Once is already arguable.

[neilv]

One way to be a little less constantly violated by your phone is to run GrapheneOS, instead of iOS or ordinary Android: https://grapheneos.org/

[drowsspa]

Sadly device attestation has all but destroyed installing other OS. I couldn't use government or banking apps back in my old phone with LineageOS.

[blameitonme]

They only seem to support pixel, although pixels can be bought for cheap when compared to iphones, they're still expensive for countries which are still developing.

For example Im using a device which is 1/4th the price of cheapest first hand pixel that I can get

:(

[lawn]

There are other alternatives as well; LineageOS, /e/OS and CalyxOS that might be more your taste.

[BlueTemplar]

It's still based on Android though - so isn't it building on sand ?

Isn't it better to focus our efforts on projects unrelated to Android, especially since some viable ones have appeared recently : Librem 5 and especially PinePhone.

[WD40forRust]

Based fellow GrapheneOS enjoyer!

[gjsman-1000]

… as long as you trust the developers, and their ability to secure themselves, of course.

I mean, if I was a three letter agency, sneaking into some GrapheneOS developer’s basement to add a camera to record his keystrokes would be the easiest trade ever for all the paranoid people using it. It’d be way easier than sneaking into Apple or Google. Might even be worth violating internal law to do it; because getting caught is extremely unlikely, and forgiveness is easy.

Edit: Also, don’t forget that, if you should get arrested, “he used GrapheneOS” is 100% going to be used against you in court. You might use technical arguments or principled reasoning, but that doesn’t resonate with juries. Unfortunately, using extra-strong privacy tools is perfect for framing you as a criminal.

[stderrout]

Google wants more control by projecting itself as infallible trust authority on device. Its standards are so high that if you are ever on other side of its automated tools first response usually is blame user rather than hire any human support team to investigate issues even if they may be coming from its programs. And then the reports keep coming on how it was error or mistake due to scale of operations its just rounding error. Next time it will be different. Trust us we are the only ones who knows this or able to do it right even if we sometimes do make mistakes you should only let us do it. No one is better than us.

[grishka]

Related to this, I really dislike how Google Play acts like it owns your device. Installing an apk? Hey, I'm Google Play, I exist, how about turning Play Protect on?

[chenxiaolong]

Looking at AOSP, the logic that allows something like Play Protect to work is at [1]. It looks for system apps that can handle the ACTION_PACKAGE_NEEDS_VERIFICATION intent, which is the Play Store app in this case. Looking at the Play Store's AndroidManifest.xml, the PackageVerificationReceiver component is what listens for that intent.

With root access, it should be possible to disable just that component without breaking other functionality by running:

    pm disable com.android.vending/com.google.android.finsky.verifier.impl.PackageVerificationReceiver

To reenable:

    pm default-state com.android.vending/com.google.android.finsky.verifier.impl.PackageVerificationReceiver

Without root access, disabling the Play Store completely (if you don't need it) via the normal Android settings should also do the trick.

[1] https://android.googlesource.com/platform/frameworks/base/+/...

[garciansmith]

Those messages are very annoying. Play Protect periodically tries to get you to turn it back on, once every few weeks or so. I really wish there was a way to turn that annoying nag off.

Glad I have it off though: KDEConnect is great, I use it all the time to transfer files and send text messages from my computer.

[wkat4242]

I agree but millions of users are ok with Tim Cook deciding what they may use on their own phone. We're so screwed.

[hardcopy]

It looks like KDE Connect doesn't have reproducible builds set up for F-droid. I wonder if this problem could be avoided with reproducible builds?

[RGBCube]

Mm, resisting the urge to mention NixOS.

[ekvintroj]

We should be able to install any OS that we want on our phones.

[eks391]

This is precisely one of the perks of rooting.

Unless you mean as a right, without needing to root? I'd disagree (from a corporate/warranty perspective), but I'll bite

[raybb]

Today I learned KDEConnect has a MacOS app. Unfortunately, it doesn't seem to be actively developed.

https://kdeconnect.kde.org/download.html

[drampelt]

I've been using Soduto, a 3rd party KDE Connect client, on the Mac for a few years now and it works quite well for my needs

https://soduto.com/

[shmde]

I swear on God. Just 2 days back playstore decided to auto update my installed apps. The thing is I have them disabled by default. I cancelled the update, switched off the wifi. But once I turned it back on, it started auto updating again.

[haunter]

https://news.ycombinator.com/item?id=37861467

[ognarb]

A lot more similar reports can be found here: https://old.reddit.com/r/kde/comments/175upzi/has_play_prote...

[npteljes]

Shows who's boss on the phone. It's practically a remotely managed corporate environment.

[eddythompson80]

But you can turn it off. It’s basically AV for Android.

[zvmaz]

Is it ill-intentioned? If so, why? Has anyone any idea?

[aib]

I think that line has been blurry (blurred?) for a long time. Is it ill-intentioned when Apple slows down charging with non-authenticated cables because "they might be shitty and high currents can cause a fire"? If companies can hide behind good intentions, they will. And I'm not even sure such intentions originate from human beings, anymore. Not from individuals, at any rate.

[prirai]

I can't really comment on that but what I know is that play store also has KDE connect available and this issue is not happening for the people who got it from there. Perhaps it's someone who has some sort of play signing enabled with uploading unknown apps and the signature difference between play and fdroid versions might have created a false positive.

[jenadine]

Hapenned to me a couple of days ago. I then just re-installed it from the f-droid and it worked.

[flyinghamster]

I don't use KDEConnect, but quite a while ago I got FUD about battery life from Play Protect concerning F-Droid itself. Never mind that F-Droid has never used more than trivial amounts of battery.

[awinter-py]

solution: need f-droid version of play protect

they could raise so much money for lawsuit to force G to allow it to be swapped in

[its-summertime]

https://f-droid.org/en/packages/us.spotco.malwarescanner/

[38]

Non crap link

http://farside.link/twitter.com/albertvaka/status/1712954968...

[nolok]

I don't understand what you mean ? F-droid doesn't ship a keyboard app.

[gbil]

Is this proven? Some days ago I saw the reddit thread which is actually the first and only reply in the link and in that reddit thread there is no conclusion yet on who is actually affected

why this conclusive title then?

[boomboomsubban]

The reddit thread makes it pretty clear that KDE Connect installed through third party sources are what's getting uninstalled.

Nobody with it installed from the play store mention it being removed, and though some users that got it from F-Droud mention it still being installed, there are several possible explanations for that. Like me, it wasn't removed on my phone but it turns out I disabled PlayProtect at some point.

[heavyset_go]

I can speak from experience that I woke up yesterday with KDE Connect missing from my device.