Hacker News new | ask | show | jobs
by sshine 783 days ago
> you'd get a lot of mileage out of open sourcing it

I’m not sure. Maintaining an open source project requires even more time than a closed source project. You can have a community-oriented closed source project, too.

> and doubling down on the privacy / local storage angle

Yeah!
2 comments
beeboobaa3 783 days ago
There's a difference between open sourcing and "maintaining an open source project".

Realistically most open source android apps do not receive many, if any, contributions from outsiders. Being open source does however signal the app isn't likely to become a paid shitfest.

link
freedomben 782 days ago
Exactly. I wish people would get over this idea that the only two options are closed source or setup and maintain a vibrant community of contributors. It's perfectly fine to just put the code on github and never look at it again. If you're willing to take an additional 30 seconds to be honest in the README.md about your intentions, even better.

Code doesn't have to be perfect to be open.

link
whstl 782 days ago
Hosting the source code outside of Github/Gitlab/etc is enough to make maintenance easier already.
link
simple10 783 days ago
Open sourcing would just be a PR tactic IMO. Since it's all local storage anyway, there shouldn't be many security maintenance issues. I just think it gives a nice story angle for bloggers and tech press. But agreed, trying to build an active open source project with a community around it is a whole other ballgame and likely not worth the trouble.
link
freedomben 782 days ago
It's not just a PR tactic. If the app is closed source, how do you know it's all local storage? Because someone on the internet said so? These days you can't really MitM and investigate the network connections.
link
InitialBP 782 days ago
Agree with you if privacy first is the goal then open sourcing it is absolutely the right move. However, it IS still possible to MITM these days - although more difficult.

frida.re has a ton of useful features and community tooling built around it including scripts that will let you "un-pin" certificates by hooking and rewriting the functions that verify whether cert pinning worked or not.

https://frida.re/

https://codeshare.frida.re/@masbog/frida-android-unpinning-s...

link
freedomben 782 days ago
Neat, thank you! I hadn't heard of frida.re. I'll definitely have to dig in to that!
link