VideoLAN @videolan App Stores were a mistake. Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users… For now, iOS App Store still allows us to ship for iOS9, but until when?

  • Lemmchen@feddit.de
    1·
    6 months ago

    Okay, but are they still releasing updates via other channels? The newest version on their website is 3.5.4, the same that I got through the play store.

  • shortwavesurfer@monero.townEnglish
    1·
    6 months ago

    I don’t think app stores are the problem. I think big company app stores are the problem, such as the Google Play Store and the Apple App Store. I think something like F-Droid where you can add your own app sources or Droid-ify that has a ton of sources by default you just need to enable is the way to go.

  • batman without ears@sh.itjust.works
    0·
    6 months ago

    Fdroid is the obvious answer me thinks. Anyway love you guys/gals at videolan still haven’t come across a piece of software that destroys every other in its field in every aspect.

        • delirious_owl@discuss.online
          0·
          6 months ago

          Thats not secure. Isn’t the pount of the Windows Store that packages are signed by developers and verified when downloaded?

            • dev_null@lemmy.ml
              0·
              6 months ago

              You can pay a one time fee if $25 to get Microsoft to sign your app on the Microsoft store, or you can pay $400+ per year to buy your own certificate. So Microsoft Store is sadly the cheap way to release apps on Windows. (Without users getting scary warnings from Windows and AV about installing unsigned aoftware)

                • dev_null@lemmy.ml
                  1·
                  6 months ago

                  The certs are sold by certificate authority companies, and Microsoft doesn’t get a share of that, though I’m not sure.

                  Yeah, software being signed says nothing about it not being malicious or insecure, but it does prove the author is what it says, and if it is malicious then the responsible party is clearly visible.

                  For non-commercial hobby/open-source software the certificate price is prohibitive, so the only 2 options are Microsoft Store or accepting that users will see the scary warnings, and of course complain to the developer about it.

    • sabreW4K3@lazysoci.al
      0·
      6 months ago

      They’ve not updated it there either though. It seems to be less of a case of can’t update Android and more of a case of won’t update Android

      • deweydecibel@lemmy.worldEnglish
        1·
        6 months ago

        From their Twitter:

        If you wonder why we can’t update the VLC on Android version, it’s because Google refuses to let us update:

        • either we give them our private signing keys,
        • or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes.

        It’s not much, just dozens of millions of people use Android TV before Android-11…

        Maybe we should tell users to buy new TVs? #electronicWaste

        I can’t speak to why they’re not updating on FDroid but seeing as how it’s much more difficult to get people to use FDroid on Android TV, I don’t think it will help them with that issue anyway.

        • stoy@lemmy.zip
          2·
          6 months ago

          Google requiring their private signing key is insane, and goes completely against the concept of private/public keys.

          Why is Google asking for this?

          • Synnr@sopuli.xyz
            2·
            6 months ago

            See also: NSA PRISM

            Member when all the companies listed released a PR statement within 24 hours of each other, all very basic and denied allowing the NSA direct access to their users?

            I member.

          • Kindness@lemmy.ml
            1·
            6 months ago

            C-I-A Confidentiality, Integrity, Accessibility. They don’t need the keys for C or A. Only one option remains. To modify the code and pass it off as code VLC wrote or signed off on.

            Likely to install malware and re-sign. Brazen identity theft.

            Maybe I’m wrong, they could use VLC’s private keys to gobble encrypted communications too.

      • bionicjoey@lemmy.ca
        0·
        6 months ago

        What exactly is the issue preventing them from updating the Android version?

        Also, if that’s the case, it sounds like “App stores were a mistake” is a bit misleading, since the particular app store isnt the problem.

        • sabreW4K3@lazysoci.al
          1·
          6 months ago

          Basically, modern app stores have changed how they work and now require the signing keys, VLC feel this is a bad thing and refuse to update. Banks are okay with it, but VLC feel more strongly than banks.

          • taladar@sh.itjust.works
            1·
            6 months ago

            Banks are okay with it, but VLC feel more strongly than banks.

            I mean banks are known for horrible security practices all around so that makes perfect sense.

          • deweydecibel@lemmy.worldEnglish
            1·
            6 months ago

            Banks aren’t run by the people that develop the apps. They have no idea what a signing key is, they just want the app available and updated.

        • deweydecibel@lemmy.worldEnglish
          0·
          6 months ago

          In addition to the private key thing, the Play Store is requiring them to drop support for APIs older than API 30 unless they provide the key.

          Which in effect means VLC can no longer be updated on AndroidTVs running Android 11 or earlier.

          Which is millions of customers, according to VLC