AOSP Messaging app dark mode and text size

matchboxbananasynergy

zehyani I would personally recommend against the Simple Mobile Tools apps for now, even though I've previously recommended them.

It seems that security vulnerabilities aren't taken seriously by their developer, so it doesn't exactly inspire confidence.

Google's app uses RCS, which means you can take advantage of encryption when the other person also uses it.

This of course shouldn't replace Signal, but it's at least an upgrade to regular SMS, which is completely unencrypted.

[deleted]

matchboxbananasynergy I would personally recommend against the Simple Mobile Tools apps for now, even though I've previously recommended them.

It seems that security vulnerabilities aren't taken seriously by their developer, so it doesn't exactly inspire confidence.

Could you please elaborate on this? I use couple of their apps (calendar pro and gallery pro). I grant them no permissions and they have network access denied, but still.

mythodical

matchboxbananasynergy you might have seen this already, but it looks like Tibor has replaced the PDF viewer today to address the vulnerability.

matchboxbananasynergy

[deleted]

https://github.com/SimpleMobileTools/Simple-File-Manager/issues/619
https://github.com/SimpleMobileTools/Simple-File-Manager/issues/656

I did not find their response to be satisfactory, and the first issue has been open since August.

[deleted]

Thank you.

zehyani

Signal is working well as a default messaging app right now. When they completely stop supporting SMS I will have to try something else. If messages is not changed from the way it is now, I will try Google messaging.f
Thank you everyone for your responses and contributions to this topic.

matchboxbananasynergy

mythodical Agreed. Though do note that the issue on the tracker was opened and acknowledged by the developer in August. You can see the developer's response essentially saying it's no big deal.

Then, just a few days ago when F-Droid flagged the app as vulnerable and people started actually asking questions, he suddenly thinks it's enough of a problem to address?

It feels like the only reason he did this is because people found out, not because he cares about the security of his apps. Very discouraging to see, as a person who used to recommend his apps to folks.

sugseg52

It is interesting to read the developers comments in this case. The security problem that comes with using those old libraries is evident. However it seems he is downplaying it, for whatever reason. With the arguments he is using, to me it seems he really lacks a sense for security at all. And now I am wondering what that might mean for his other apps. Because as another commenter said here - from this point of view the reason for his latest app update seems to be pure opportunism.

matchboxbananasynergy

To add to my last point, even after he fixed the vulnerability, when people ask what happened, the response is "nothing serious":

https://github.com/SimpleMobileTools/Simple-File-Manager/issues/659

newbie24689

Heh.... could he have replaced the pdf viewer with GOS pdf viewer?

matchboxbananasynergy

newbie24689 I don't believe so. GrapheneOS' PDF Viewer is an app, not a library that you can integrate within another app. GrapheneOS itself uses pdf.js, which I assume is something that they could use.