VideoLAN @videolan App Stores were a mistake. Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users… For now, iOS App Store still allows us to ship for iOS9, but until when?

  • sabreW4K3@lazysoci.al
    0·
    6 months ago

    They’ve not updated it there either though. It seems to be less of a case of can’t update Android and more of a case of won’t update Android

    • deweydecibel@lemmy.worldEnglish
      1·
      6 months ago

      From their Twitter:

      If you wonder why we can’t update the VLC on Android version, it’s because Google refuses to let us update:

      • either we give them our private signing keys,
      • or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes.

      It’s not much, just dozens of millions of people use Android TV before Android-11…

      Maybe we should tell users to buy new TVs? #electronicWaste

      I can’t speak to why they’re not updating on FDroid but seeing as how it’s much more difficult to get people to use FDroid on Android TV, I don’t think it will help them with that issue anyway.

      • stoy@lemmy.zip
        2·
        6 months ago

        Google requiring their private signing key is insane, and goes completely against the concept of private/public keys.

        Why is Google asking for this?

        • Synnr@sopuli.xyz
          2·
          6 months ago

          See also: NSA PRISM

          Member when all the companies listed released a PR statement within 24 hours of each other, all very basic and denied allowing the NSA direct access to their users?

          I member.

        • Kindness@lemmy.ml
          1·
          6 months ago

          C-I-A Confidentiality, Integrity, Accessibility. They don’t need the keys for C or A. Only one option remains. To modify the code and pass it off as code VLC wrote or signed off on.

          Likely to install malware and re-sign. Brazen identity theft.

          Maybe I’m wrong, they could use VLC’s private keys to gobble encrypted communications too.

    • bionicjoey@lemmy.ca
      0·
      6 months ago

      What exactly is the issue preventing them from updating the Android version?

      Also, if that’s the case, it sounds like “App stores were a mistake” is a bit misleading, since the particular app store isnt the problem.

      • sabreW4K3@lazysoci.al
        1·
        6 months ago

        Basically, modern app stores have changed how they work and now require the signing keys, VLC feel this is a bad thing and refuse to update. Banks are okay with it, but VLC feel more strongly than banks.

        • taladar@sh.itjust.works
          1·
          6 months ago

          Banks are okay with it, but VLC feel more strongly than banks.

          I mean banks are known for horrible security practices all around so that makes perfect sense.

        • deweydecibel@lemmy.worldEnglish
          1·
          6 months ago

          Banks aren’t run by the people that develop the apps. They have no idea what a signing key is, they just want the app available and updated.

      • deweydecibel@lemmy.worldEnglish
        0·
        6 months ago

        In addition to the private key thing, the Play Store is requiring them to drop support for APIs older than API 30 unless they provide the key.

        Which in effect means VLC can no longer be updated on AndroidTVs running Android 11 or earlier.

        Which is millions of customers, according to VLC