Response from SMSPool on what they do with used phone numbers
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Before we begin, I want to make a quick disclaimer. If you’re just starting out using GrapheneOS, I highly recommend not using the setup I’m about to discuss in this video. This setup will create friction, and friction is the enemy of adapting to something new, especially if you’re hesitant to begin with. When you install GrapheneOS, just install the Play Store, sign in, download apps as you normally would, and get used to things. You can always switch to a different setup later. For everyone else, here’s how I install apps on my Google Pixel running GrapheneOS.
So, this idea was suggested to me around two years ago, but I finally set it up about one year ago. This isn’t something that was just shared with me recently and now I’m sharing it—I’ve tested it, and it’s been working well for me. This also won’t be a step-by-step guide. I’ll demonstrate installing three different apps from three different sources and give you details of my setup. When I upgrade my device in the future (still TBD), I plan to make a step-by-step video.
Before we begin, I want to mention that I just published the second episode of my podcast, which is called In the Hell. If you want to find out how you can listen to it, head over to inthehellpodcast.com, which I’ll link below. It’s also worth noting that it’s hosted on Yellowball, the no-BS podcast hosting platform I recently launched, in case you’re looking to start your own podcast.
When you first install GrapheneOS, you have one user profile, the owner profile, which is there by default, and you cannot delete it. From there, you can create additional user profiles depending on how you want to separate your apps. In my setup, all apps are installed from the owner profile, and I use the “Install Available Apps” feature to push those apps to my daily user profile. I like this setup because it lets me install apps from the Google Play Store without actually having the Play Store installed on my daily user profile. It’s kind of like having a command center for app installations.
The recording on the screen right now is my owner profile. The first thing I did when I set this up was install Orbot, which is a free proxy that lets you send all your device traffic over the Tor network. That means that all of our traffic when accessing the Play Store will go over the Tor network, along with any downloads of system updates from GrapheneOS, since those are all done from the owner profile. You can install Orbot by downloading the APK from GitHub, which I’ll also link down below.
Once we open Orbot, we can click “Start VPN” and give it a minute to connect. Now we have a full-device VPN, which means all of our owner profile traffic is going over the Tor network. It’s important to note that VPNs are profile-specific, so while our owner profile traffic is using Orbot, any secondary user profiles (which we’ll discuss later) will not use Orbot by default—it’s only for the profile that it’s installed on.
You might notice where it says “Change Exit.” I currently have it set to the United States, and the reason for that is that sometimes when you go into Google Play, it might say “App not available” if the exit node is in a different country. This is common with banking apps or social media apps. If you run into that issue, you can change the exit node to match your country and see if you can access the app.
One other quick tip about Orbot: if you switch networks (for example, from Wi-Fi to cellular) or the Wi-Fi disconnects, Orbot might say it’s connected, but it’s really not. You’ll notice that because your browser won’t be able to load anything. What I found helpful is to long-press on the Orbot app, select “App Info,” force stop it, then clear the cache (but don’t clear the storage). After that, restart Orbot, click “Start VPN,” and nine times out of ten, it fixes the issue.
Now, let’s talk about the first app store I use. The first store I search for apps is the default GrapheneOS app store. In this case, I installed Accrescent from here, which is actually the second app store I use. If an app isn’t available in the first store, I move on to the second. The GrapheneOS app store mostly has system apps, but Accrescent is available there, so I installed it from there.
The second app store I use is Accrescent. There aren’t a ton of apps here, but it’s actively developed, and they’re constantly adding new apps and working with developers to get more. I plan to make a video just about Accrescent in the future because they’re doing great work, especially from a security perspective. For this demonstration, I’ll be installing Xf Eraser. I just click “Install,” and it’s done.
The third app store I use is Obtainium. If you’ve never used it before, it can be confusing, but I have a video dedicated to it, which I’ll link below. I use Obtainium for all my open-source apps or any apps that publish APKs directly on their site or on GitHub. For this example, I’ll install NewPipe. I’ll copy the GitHub link, add the app to Obtainium, and let it download. Then I’ll install it.
With this owner profile setup, I always make sure to uncheck “Allow Network Permission” when installing apps because I don’t use these apps in the owner profile. If you forget to uncheck it, you can always change it later. Now we can see that NewPipe is installed.
So far, we’ve seen the GrapheneOS app store, Accrescent, and Obtainium. The last store I use is the Google Play Store, which I installed using the GrapheneOS app store. You’ll notice that there’s no “Install” button for Google Play Services because I already have it installed. The issue with the Play Store is that you need an account to access it, which sucks. Unlike Aurora Store, which lets you use anonymous accounts, I’m not a fan of shared anonymous accounts, so I prefer this setup.
Creating an anonymous Google account without getting it blocked or locked is somewhat difficult but not impossible. If you try to create it over a VPN or Tor, you’ll likely run into issues. What I do is drive to a parking lot with free Wi-Fi—like at a grocery store or coffee shop—connect with my laptop, and create the account using a fake name generator for the required information.
The tricky part is when they ask for a phone number for SMS verification. You don’t want to use your real number here because it would ruin the anonymity. Instead, you can temporarily rent a phone number just for receiving the SMS code. There are free services, but I wouldn’t recommend them because they’re public and often blocked. You’ll have to pay, but it’s usually 50 cents to a dollar. I’ll link the site I use in the blog post for this video, but I won’t mention it here on YouTube. Once you receive the SMS code, you can validate your account.
I’ve done this for about ten different Google accounts without any issues. The key is to practice compartmentalization—don’t use this account for anything else. Just use it for the Play Store. If you get a new device, create a new account rather than using the same one. It sounds like a hassle, but it’s how you keep things separate and private. And since Orbot is running, all of your Play Store traffic is going over the Tor network, which helps maintain your anonymity.
Some people might critique using a shared phone number for account validation. While there’s a small risk someone else could gain control of that number, from what I can tell, it’s only used for initial validation, and Google doesn’t tie it to your account. If you’re concerned, you could use a prepaid SIM instead, but personally, I think the risk is low.
At this point, you can now sign into the Play Store with an anonymous Google account and start installing apps. For this demo, I’ll install WhatsApp. You might notice slower downloads when using Tor, but that’s normal. After installation, I’ll uncheck “Allow Network Permission” like I did with NewPipe.
Now, to avoid accidentally using the apps in the owner profile, I’ll disable them. Long-press on the app, go to “App Info,” and click “Disable.” I’ll do this for NewPipe, WhatsApp, and Xf Eraser.
The next step is to use the “Install Available Apps” feature to push these apps to my secondary user profile. In the demo, I created a profile called “YouTube Demo,” but you can call it whatever you like. This is the profile you’ll use daily instead of the owner profile. Once you select the secondary user profile, you can go to “Install Available Apps,” check the apps you want to install, and they’ll be available in the secondary user.
To switch profiles, swipe down from the top of the screen, tap the user icon, and select the profile. Screen recordings don’t work across profiles, so I’ll be back in a moment.
Now we’re in the secondary user profile. If I swipe up, you’ll see the apps we installed—Xf Eraser, NewPipe, and WhatsApp—all from different sources.
So this is how I install apps on my device running GrapheneOS. If you have apps that require Play Store Services, you can install them in the secondary profile. In my setup, I only have Play Store Services running in a specific profile for calls, not in my daily profile.
The benefit of separating profiles like this is that you can end a session for a profile where Play Store Services are running. This essentially puts that profile to rest, so Play Store Services are no longer running in the background. You can’t do this with the owner profile unless you power off the device. This method allows you to shut down Play Store Services without turning off your device.
One more thing to note: there’s only one instance of an app installed on the device at a time, so when you update an app in the owner profile, it’s updated across all profiles. You don’t need to worry about updating it in each profile.
After recording this, I realized it’s a lot of information, and it might seem overwhelming. But once you set it up, it’s pretty much “set it and forget it.” When you need to install a new app, install it in the owner profile, disable it, use “Install Available Apps” for the secondary user, and you’re good to go.
If you have any questions or comments, feel free to leave them down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So after a year, I figured it was finally time to put out an update on my Pixel Tablet experience running GrapheneOS. Spoiler alert: my original video had some high ambitions of replacing my laptop and taking this with me when I travel, along with a keyboard and things like that. None of that happened—it didn’t work out. But if you’re curious as to why, keep watching. If all you wanted was that quick answer, there you go, and I’ll see you next time.
Before I get into the apps that I’m using and things like that, I first want to talk about the physical aspects of the tablet that I really like. To begin, let’s start with the case. This is the official case from Google, and if you end up buying the tablet after watching this video, or have bought the tablet, I highly suggest you buy this case. It’s probably one of the best-designed cases I’ve ever used—not that I’ve used many cases, but to start off, it’s a nice rubbery, grippy texture that helps with holding onto it. Besides that, you have this circle thing on the back—or oval, I should say—and that’s great for a kickstand, holding it up in the landscape position. It also works in the portrait position, so it can lean back like that. When you’re just kind of walking around or laying on your couch, it works great for holding it just like this.
You might be wondering why it’s that shape. You see those four pins on the bottom? Those correspond to the dock. When this goes on the dock, the handhold—or whatever that metal thing is—helps align the dock so that it locks into those pins, giving you a good connection. It’s all magnetic, so the dock just snaps on. This is the only way I charge it—I’ve never actually plugged a USB cable into this, except for during installation. So, the case—I highly recommend it.
Now, back to the dock. The dock is included in the box. I’m not going to say that the dock is free because, of course, I’m sure that’s baked into the price somewhere, but the dock has exceeded my expectations, mostly from an audio standpoint. When you set the tablet on the dock, this then turns into the main speaker; the internal speakers on the tablet are disabled, and the audio comes out of this. For listening to music or podcasts, things like that, you’re not getting room-filling booming audio, but it is pretty impressive for the form factor. I like using this when I’m listening to podcasts or audiobooks on the tablet. It just works really great for that.
Speaking of podcasts, I wanted to let you know that I just published the first episode of my podcast, which is called In the Shell. You can check that out at intheshellpodcast.com to find out where you can listen to it, and I will also leave a link down below in the description if you want to check it out.
So now, let’s get back to the reason why you clicked on this video. One more thing to mention about the physical appearance: I don’t use a screen protector on the tablet. They do make them for it; I just never found a need for one. It’s not like a cell phone where I’m carrying it around, constantly taking it out of my pocket—this wouldn’t fit in my pocket. So, I didn’t really see a need to have a screen protector. So far, after a year, it looks good—no chips, cracks, or scrapes. Hope I didn’t jinx myself, but so far, so good.
On the actual tablet, I have two user profiles set up. I have my main owner/admin user profile that you can see here, and I have my daily “Josh” user profile. On my main owner profile, I have the Google Play Store installed along with Obum. On that profile, I do all the installation of apps, and then I use the “install available apps” feature from the main owner profile to push the apps to my daily profile. It was suggested to me a while ago to test out that method, and I’ve been using it ever since on my phone and tablet. I’m not going to cover it in this video, but I will make a dedicated video specifically for that topic because I think it’s a really useful way to configure your GrapheneOS device.
As I mentioned, I have two user profiles set up. We’re currently in my daily profile that I use, named “Josh.” You can see that in the top right-hand corner up there. On the main home screen, I have two Progressive Web Apps (PWAs) installed: one is for Miniflux, a self-hosted RSS reader that I use, and the other is Wallabag, which is kind of a bookmarking tool—another self-hosted app that I use.
So let’s now swipe up and get to the app drawer. I’m not going to explain the default apps installed, like the camera, gallery, etc. If you have GrapheneOS, you’re already familiar with those.
To start off, I have AntennaPod, which I use for listening to podcasts. Like I said, that goes really well with the dock—you get really good audio quality, and it works well for listening to those. The next app is Audiobookshelf, a self-hosted app I use to listen to my audiobooks. Then there’s Bitwarden, a password manager. I also have a calendar app and EteSync, which is a contacts, calendar, and task sync app—another self-hosted app that I use. They also offer a cloud service, so if you’re looking for an encrypted way to store your calendar, contacts, and tasks, I would suggest checking out EteSync. You don’t have to self-host it; you can just sign up and use their service.
Following that, I have Jellyfin. I run a Jellyfin server at my house for my movies and TV shows that I want to watch. The Jellyfin app lets me access and watch those on the tablet, which, with the 11-inch screen, works perfectly—much nicer than trying to watch on my phone. Material Files is a third-party file explorer I use to connect to some network shares I have in my house. I don’t have it installed on my phone because I don’t access my network shares on my phone, but on the tablet with a larger screen, it works great for that.
Mullvad is my VPN of choice—it’s running on here all the time. NewPipe is the next app, which is a third-party client for YouTube that helps you avoid the ads, which is nice. Notify is an app that provides push notifications to my device when it receives a webhook notification from the uptime services that monitor my site and different services. It works without Google Play Services, which is why I have it installed on here, since I don’t have Google Play installed on this user profile.
ProtonMail is my email provider. I have their paid plan, so I use it for my sideofburritos.com domain. If you’re looking for a decent email provider that’s privacy- and security-focused, I would recommend them. The next app is Standard Notes, which I use for all my note-taking. I have a couple of files stored in there, but primarily just text files. I self-host the Standard Notes server at my house, so it syncs locally to a Raspberry Pi where I have that running. They do have a cloud offering, so if you’re looking for an encrypted notes service, I would suggest checking them out.
Next is Tasks, which syncs with EteSync, as I mentioned earlier, for contacts, calendar, and tasks. Tutanota is another privacy-focused email provider that supports end-to-end encryption, just like Proton does, which means they have no access to your emails or the content of them. I’ve always wanted to test them out, so when I set up the email for (https://yellowball.fm), the podcast hosting provider that I recently launched, I decided to go with them. So far, so good—I like their product and interface. As a company, I kind of prefer them over Proton. Proton’s kind of turning into a commodity; it seems like they’re just launching more products and everyone’s using them. While I appreciate that because it means they’re more accessible to the masses, at the same time, it’s kind of nice to support companies that are more niche in privacy and security, and Tutanota seems to be that.
The last app is VLC, which I use to play any files that the default gallery app can’t play. VLC basically plays any file you throw at it—sometimes I think it’ll even play a text file. It’s just one of those solid apps to have.
As I mentioned in the intro, I had high ambitions for this—plugging it into an external monitor, plugging it into a keyboard, possibly using it as my full-time device. But it’s just not going to replace a laptop, especially for someone like me doing programming, editing, recording videos, and things like that. The interface just isn’t meant—at least at this point—for a mouse and keyboard to be as productive, or even close to it, as a laptop, at least from my perspective. Again, your results may vary.
But that being said, would I recommend this to someone? If you want to use it like me, where 99% of the time I use it as an entertainment device—watching YouTube videos, watching Jellyfin, checking my email, or browsing the web—then absolutely, I think this is a great device to purchase. But other than that, I don’t really use it for much else.
So I hope I didn’t disappoint you too much, and if you have any questions about the tablet, feel free to leave those down below, and I will see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. ✔️
Six months ago, I made a few videos on F-Droid and why you should stop using it. Shortly after the release of those videos, someone sent me a project on GitHub that says in the readme it was motivated by one of those videos. I didn’t start using it then, but I kept an eye on the project.
Now, just over six months later, the project has over 900 stars on GitHub, and it has come a long way, to say the least.
In my original video, I covered how you could manually add the source for APKs you wanted to track and download to an RSS reader. While this method did work, it was cumbersome.
The app I’m talking about today is Obtainium, and it aims to automate the process of tracking and updating apps. While it doesn’t solve the inherent problem with F-Droid and third-party app repositories, I do think it provides some viable alternatives to help reduce or even eliminate some of those concerns. As always, you should use my advice and experience as a starting point for your own research. Make sure to test and validate everything you hear, especially if you are considering using it.
I’m going to cover a few use cases and then talk about my experience the last two weeks using Obtainium on my main device, a Pixel 7. The demo you see today will be from my testing device, which is a Pixel 6A.
So, to obtain Obtainium, we’re going to head on over to the official GitHub page. All links will be down below in the description box.
So, we’re going to open up our browser and search for Obtainium GitHub. And this first one here is the one we want. And if you scroll down, we’re going to select the “Get it on GitHub” under installation. We’re going to expand the assets, and the one we want to select for the Google Pixel is the “app-arm64-v8a.”
Select that, download anyway. Once that finishes, select “Open.” If you’ve never used your browser to install an app before, you’ll have to allow this permission. Once you see the install window pop up, select “Install.”
Done, and we have now obtained Obtainium. You should now see it on your home screen, or if you swipe up, it should be in your app drawer. Ignore the X Recorder; I’ve had some issues with the built-in Android screen recorder, so I’m trying a different one.
You can now open the app, allow notifications. Notifications are done locally, so there’s no need for Google Play services for notifications to work.
And I first want to start off by saying how refreshing it is to use an open source app that took design into consideration. I’ve noticed a lot of times that aesthetics is an afterthought, which is fine, but I think it hurts long-term adoption. I personally have motivation from a security and privacy perspective to use an app, even if the interface is less than ideal. Others who might not have as strong of a motivation to use an app could get quickly turned off by its looks.
So when I first opened Obtainium, I was pleasantly surprised by the design. The developer is very active on this project, so what you see on my screen right now might not be what you see if you’re watching this video in the future, but the general overall concept should be the same.
Going through the interface, the first option is the apps. This is our apps list that we’re tracking. Obtainium is added here by default so it can track and update itself, so that’s pretty handy. We have add app, which we’ll come back to shortly. Then we have import/export. If you’re currently using an RSS reader like I talked about in my previous videos, there’s an option here to import from URLs and file like OPML. The Repla app, the main export type that I had was OPML for its backups, so you could perform an export from that and import it to Obtainium. I didn’t test this functionality; I just manually added the apps that I wanted. You can also perform an Obtainium export, so once you get everything set up, that’s handy. You can export it, save it, and then if you switch devices or your phone gets lost or stolen, you can always import that backup so you don’t need to set it up all over again.
The last option on the bottom is settings. I just left this set to the default, but feel free to change anything you might want.
Now let’s add our first app. So select add app. We can see down here listed are the supported sources, and if we look next to GitHub and Codeberg, those are labeled as searchable. So in the second box here, we can search for an app. In this case, I’m going to search for NewPipe because that’s on GitHub. Search, so you’re going to be presented with a lot of results, especially for a project that’s popular. But this first one here is the official one, Team NewPipe. Just to be safe, I always suggest that you check first to validate that it is the correct one. So let’s go to that repo. We can see here, this is the correct one, the official NewPipe. So once you validate that, we’re going to go back, select the first one, and then press pick.
There’s a separate section for additional options for GitHub. The first one is to include pre-releases. By default, you should leave this unchecked.
Prereleases technically aren’t releases that you should be using, so that’s why it’s left unchecked by default. The next option is fallback to older releases, and that is enabled by default. This option is for when developers on GitHub do not do the releases correctly, and they might have one release for iPhone and one for Android. If they are listed in different releases, when Obtainium goes to check what the latest version is, if the iPhone one was released latest, it will see that there’s no Android APK available to install. Therefore, this option lets it fall back to an older release, which would be the Android version, and you can then update that.
Probably sounds confusing, so just leave that enabled like it is. There’s another option here for filter release titles by regular expression. Again, this is for edge cases. I haven’t needed this yet for any of the apps I’m tracking on my main device. The last option down here is for track only, and what this will do is it will just track it and will not actually try to download the updates and let you install them. I leave this disabled because I want Obtainium to download the APKs for me so I can install them, and then standard version detection, I just leave that set to the default. So those are the options that are listed.
We can now select Add. Obtainium needs permission to install unknown apps, a lot from this source. Let’s go back. You’ll see this screen next. We can see latest version 0.25.0 installed, a version none. I want to install it. Install done. And now if we go back to our apps list, we can see New Pipe is now here and being tracked. Latest version 0.25 installed version 0.25. Nice clean interface, and as expected, New Pipe is installed.
So, I know that took a few minutes to go through and talk about, but in reality, it only takes 30 seconds to add an app, and now in the future, Obtainium will check for updates in the background and notify you when they are available. As always, you should be skeptical of anything open source or any app for that matter, especially something that will be installing apps on your behalf or for you. So one extra precaution that you can take is to install the app manually first from the source, and then add it to Obtainium. When you install an app, Android pins the certificate and enforces signature checks for app updates, so even if something malicious was happening with Obtainium, it wouldn’t be able to install a malicious app update because the signature check would fail.
So as an example, let’s go ahead and install Dev X5. I know their source code is on GitHub, so I’m going to search for that. I know this is the official repo for it. I’m going to go to the releases and download the latest one. Let’s open and install that.
So now at this point, Dev X5 has been installed. We downloaded it from the trusted source that we know; therefore, the certificate has been pinned by the OS. So any updates that are installed either manually by us or using Obtainium must pass the signature check, which means that the APK is signed by the developers. We can see Dev X5 was installed. Let’s now add it to Obtainium. We just copy this URL, go back to Obtainium, add app, paste in the URL, select add. We can see that it found that Dev X5 is installed, latest version 4.3, installed version 4.3.
There’s no updates to install. So now, if we go back, then go back to the apps list, we can now see that DAV X5 is listed there. We installed it from a trusted source, and now we’re going to let Obtainium handle any future updates.
There are a few other caveats or features that I want to go over. So, going back to the “add app” option, we can see here that Malvad and Signal are both listed as sources. If we select one of those, Malvad publishes their APK on their website, so we can just copy this, and Obtainium on our behalf will find the APK for us and download it.
Select “add,” and we can see in the background downloading Malvadvpn. So it’s pretty handy that the developer went ahead and built in this functionality for us already. Even though we’re not actually adding the exact page the APK is on for the apps listed there. In this case, Malvad and Signal, the app automatically knows where to look. It’s a good minute to finish.
Once it finishes, we’re prompted to install. Now, if we go back to the apps list and refresh, we can now see Malvad is shown here and being tracked.
Just to show an example of what updates look like, I went ahead and installed an older version of New Pipe. You’ll receive a notification, and then when you go inside the app, you’ll see a notification next to the app that needs to be updated. In this case, New Pipe. Select the purple download icon, and you can see the download. So Obtainium went ahead and downloaded the APK for us. We now select “update,” and now New Pipe was successfully updated.
One of the easiest ways to find where the source code for an open-source app is hosted is to use the F-Droid website. So if we go to f-droid.org in our browser and then scroll down and let’s search for New Pipe as an example, the second one is the one we want.
To access the source code for the application, we need to scroll down to the section above the donate button and click on the link to the source code. By examining the URL, we can see that the source code is hosted on GitHub. If we scroll down further to the releases section, we can see that NewPipe publishes their APK on GitHub, which means Obtainium can download it from there.
Returning to fdroid.org, we can find that some developers only publish the APK on F-Droid, even if they have already published the source code on GitHub. As an example, let’s search for a productivity app that starts with “Good Time,” which is the fifth one down. Looking at the source code, we can see that it is also hosted on GitHub. However, when we scroll down to the releases section, we notice that they do not publish the APK on GitHub; only the source code is available. In this scenario, our only option is to return to F-Droid, copy the F-Droid link, and paste it inside Obtainium.
After adding the app and pasting the F-Droid URL, we can see that Obtainium found the app and we can proceed to install it. Upon returning to our list of apps, we can see that Productivity is now installed, and it shows that it is signed by F-Droid.
Using Obtainium is still a better option than the official F-Droid app because it avoids some of the shortcomings mentioned in the previous video, such as targeting out-of-date SDKs. Although the process might seem complicated, it is relatively simple once you go through the steps yourself. It has made the process of downloading, installing, and updating apps much more accessible for the past two weeks, and the update functionality and tracking have worked flawlessly. The experience so far has been enjoyable, and the plan is to continue using it.
However, there are a few limitations to be aware of that are listed on the GitHub readme. The first one is that app installs occur asynchronously, and the success or failure of an install cannot be determined directly. This results in install statuses and versions sometimes being out of sync with the OS until the next launch or until the problem is manually corrected. If you notice any unusual behavior, close the app and relaunch it.
The second limitation, which will be revisited later, is that auto unattended updates are unsupported due to the lack of a capable Flutter plugin. Also, for some sources, data is gathered using web scraping, which can easily break due to changes in website design. In such cases, more reliable methods may be unavailable, and scraping is an unreliable method to gather data. If you have ever used NewPipe and noticed that it broke randomly because YouTube changed its layout one day, that is a similar situation to what the developer is describing here. It is not the app developer’s fault, but rather the nature of web scraping.
Regarding the second limitation mentioned above, before making this video, the app developer was contacted to see if there was anything specific they wanted to mention. They requested that any Android developers watching the video take a look at issue number 25, linked below, to help complete the auto-update feature before releasing version one of Obtainium. Contributions to help with that would be greatly appreciated.
Overall, using Obtainium has been a great improvement and has made the manual tracking process much more efficient. Although it is not a solution to the underlying problems that still exist, it is a step in the right direction. The plan is to continue using it, and there are no plans to go back to the RSS reader method.
And while it’s not a solution to the underlying problems that still exist, which I covered in my previous videos, it is a great improvement and makes the manual tracking process much more efficient. So, I hope you enjoyed this video. If you did, check out this top one here, and the bottom one has been automatically selected for you.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. ✔️
It’s good practice to document answers to frequently asked questions, as it allows other users to reference them. For example, I’ve been asked multiple times through email and video comments why a user is unable to install F-Droid in another user profile. To avoid answering these questions individually, I decided to make a video explaining the reason behind this issue. To demonstrate the process, a user can go to f-droid.org on their Android device and click the “Download” button on the home page to download F-Droid. Once the download is complete, they can install the APK.
Open the app, ignore the warning, allow it a minute to update the repositories. Now, if you go to updates because of the notification, the first thing the app wants you to do is update F-Droid to the newest version. The user now has the latest version of it installed. They go through and download whatever apps they want, install them, and then shortly after this, the user finds out about user profiles and wants to start separating their apps to different user profiles to separate user data.
So, they create a new user profile and we’re on that new user profile. And again, the first thing they want to do is install F-Droid so they can download apps. They go to fdroid.org again, same process as before, click the download button, download once the download finishes, open, and install again. And they are presented with an error. This is the error I get asked about and that I see different posts about online.
So now that we see what is happening, let’s talk about why this is happening. This diagram is overly simplified, but I think it’ll help paint the picture of what’s going on. At the bottom here, we have the system and part of the system is the Android Package Manager, which we can see here. And above the system level is the user profiles, as we saw in the example. We had our initial owner user profile that we were on and then switched to our user profile, which was that second user profile where the F-Droid install failed.
A common misconception is that when you install an app on a user profile, it’s installed in that user profile and then when you switch to the other user profile, it’s installed there as well. But that is not correct. What happens when you install an app on Android is that it is handled by the Android Package Manager. That app is installed and then linked, for lack of a better term, to the profile that you are presently in.
In this example, we installed F-Droid from our owner profile. We downloaded it and installed it, which was version one. And as we saw in the example, once we installed F-Droid, we were immediately prompted to update the app, so we went from version one to version two. These are not the actual version numbers. I’m just doing this for the sake of simplicity. So at this point, we now had version 2 of it installed and being managed by the Android Package Manager.
We went to our second user profile, downloaded and installed F-Droid, or tried to install it, but the issue that was occurring was that when we downloaded F-Droid from the website, the version we downloaded was actually version one. Since Android packages are managed by the system, there’s a protection in place that prevents an app from being downgraded. So in this case, we were trying to install version one of F-Droid, but the Package Manager saw that we had version 2 installed, therefore it blocked the install on that second user profile, and we were unable to install F-Droid on it.
Just to reiterate, because it was a misconception that I had as well, user profiles are meant to separate user data. The actual installation of apps is handled at the system level by the Android Package Manager. And if you try to install an app on a separate user profile that is an older version than the one currently being tracked by the Android Package Manager, the install will fail.
You may have noticed that when you update an app in one user profile, the same update is reflected in all other user profiles. This is because the package installation is handled at the system level, not at the user profile level. When the app is updated in one profile, the actual package is upgraded across the system, making all user profiles use the same updated version.
This is why the issue of updating F Droid continually occurs. F Droid hosts an outdated version of their app on their website, so every time a new user visits the site, they end up downloading an older version of the app, which then prompts them for an update. To avoid this, you can download the latest version of the app from the home page and save it in a folder titled “F Droid”. From there, you can search for “F-Droid” on the right side.
We can scroll down to the latest version labeled “Suggested Download”. Again, placing that in the “F Droid” folder. Now, for the sake of simplicity, I’m going to use this online APK analyzer. Here we have our “F Droid” folder with the “F Droid.apk” that was downloaded from the home page and the “org.fdroid” that was the most recent suggested version we downloaded.
If we look at these, we can see that the one from the home page is version 1.15.4, and the version from the actual page in the search was 1.15.6. The 1.15.4 was published on December 2nd, 2022, and the most recent suggested version on January 14th, 2023.
That’s why if you go to a separate user profile and try to download F Droid from the main home page, you receive an older version that’s out of date and the install fails because Android’s downgrade protection kicks in and blocks the install.
Now that we know what is happening and why, there are a couple of things you can do to get around this issue:
Instead of going to the F Droid home page, you can scroll down, search for “Appdroid”, select F Droid, and download the latest version with the tag “Suggested”. When you open this one and select “install”, it’s not blocked by Android because you’re not trying to install an older version of the app. This is probably the easiest for most people.
If you are running Graphene OS, you can go into “Settings”, “System”, “Multiple Users”, select the second user profile, and use the option “Install Available Apps”. Change the toggle next to F Droid, and it will be accessible from your second user profile. The reason the “Install Available Apps” feature works is that APK installation is handled by the package manager at the system level, so when you are in the owner profile, you can give additional profiles access to installed apps.
For the F Droid team, you could update the version on your home page to the latest stable version. It’s not good security practice to intentionally host an outdated version of your app in the most popular place to download it. This one change of hosting the most recent version on your home page would save everyone time and make for a better overall user experience.
If you enjoyed this video, I think you’ll like the top one listed here, and the engineers at Google think you will like the bottom one.
]]>
Full Size Diagram from video -
To download a full-size copy of the image, Right-Click the Full Size Image link and select Save Link As (or just click it to view)
Settings on the bottomMy Apps section, select Repositories+ in the upper right cornerAddress listed on the page -
https://www.bromite.org/fdroidAddress you copied in the Repository address boxFingerprint of the signing keyFingerprint of the signing key in the Fingerprint boxBromite and install the app
Full Size Image -
To download a full-size copy of the image, Right-Click the Full Size Image link and select Save Link As