• 0 Posts
  • 22 Comments
Joined 2 years ago
cake
Cake day: July 23rd, 2023

help-circle


  • Signal uses Play Services for its push notifications. It does have a fallback method which maintains a connection to their servers to get message notifications. It requires changing some battery optimisation settings which might have some minor battery impacts.

    Personally I’m using Molly which implements UnifiedPush for Push Notifications without Molly/Signal needing to run in the background constantly. Also swaps a few other Google dependencies (like location pins) with open source alternatives.

    Having the second profile with Google Services is a good idea though. That was what I used to do before I shed my last few Google dependencies.










  • dracs@programming.devtoPrivacy@lemmy.mlIs F-droid insecure?
    link
    fedilink
    English
    arrow-up
    3
    ·
    5 months ago

    I’ve seen posts by the GrapheneOS team about recommendations against using both F-Droid and Aurora. F-Droid had a decent sized list of issues they raised. One of the key ones they raised against both was that it added an extra person to trust. You always need to trust the code of the developer of the app. No way to avoid that. With F-droid you need to trust that their build system/infrastructure is serving you the app as per the developers code. With Aurora you need to trust the Aurora devs are giving you the app unmodified from Google.

    There were other criticisms on F-Droid that they sign almost all apps with their own key rather than the developers. They do offer to serve apps with the developer keys, but it’s difficult to setup and not many apps implement it. Google Play also does the same thing though, so I feel this risk isn’t that big. Generally they seem to recommend getting apps directly from developers rather than via a 3rd party. They offer Accrescent in the GrapheneOS app store which is designed for this, just pulls files from Github AFAIK.

    All that said. I prefer to get all my apps from F-Droid (NeoStore technically) and Aurora for anything without a F-Droid repo.





  • The UnifiedPush server is intended to be a single source your phone can keep a persistent connection open to, rather than needing a connection per service/app (this is how Google’s Firebase notifications work too).

    As Signal doesn’t support UnifiedPush, MollySocket keeps a permanent connection open to Signal’s servers to listen for new activity and forward them to your UnifiedPush server. This saves your phone keeping a permanent connection open to Signal’s servers and draining your mobile battery more.