littlerack Why don't you apply your suggestion to yourself first?
I am trying, but you are not helping me lol
The first "controversial" reply you had is that:
Johnnyloans Termux is safe.
(I guess as in secure).
Then you started a crusade about Termux privacy:littlerack
And then you are wondering if people:
littlerack understand security and privacy are two distinct areas?
So i think there have been some miscomunication, and it's ok.
Let's try to de-escalate.
littlerack Termux has never advertised itself as a privacy-concise environment and no-one should pretend it is.
We agree on this and if you skim on previous replies, no one is trying to tell otherwise.
In fact in my very first post I started with:
DohnJoe While Termux is not privacy focused, [ . . . ]
I think everything started after @starglider suggested you can't use ufw effectively unless you root your OS (?)
But let's concentrate on the feedback you are searching for...
At a certain point you somewhat suggested that f-droid is trustable:
littlerack F-droid at least has reproducible builds and warnings.
I would like to skip the fact that you can change repo on f-droid, because I want to underline another point that seemed to go unnoticed:
Jasper82 Get it from the F-Droid repo, they build it from source.
@Jasper82 is suggesting us that f-droid already reviewed the code of Termux and that they consider it trustable enough to build it and publish it.
With the presence of the eventual warnings on the store page, I would say this is the feedback you are searching for.
For what concerns the official repo, you had the idea they where chinese:
littlerack It's "official" repositories are in China and xyz domains
Apart from the fact that an .xyz domain is not less secure than a .com domain (it's just, usually, less expensive) I might accept that in the past they had official chinese repositories (I really don't know the entire repository story of Termux, I can accept that at a certain point on time they were).
But if you are installing Termux today, we should take into consideration the current state of the project.
While examining termux.dev domain we can see cloudflare's DNSs, having a lookup of their IP address 5.75.242.194 we can see it is part of the Hetzner network.
This point has been made clear, already:
Johnnyloans 1 official repository + cloudflare CDNs
Germany sponsored by Hetzner
packages.termux.dev
https://i.imgur.com/tgwH6M7.png
These are facts, and wether we like them or not, are facts.
On top of this we can create all the good arguments we want.
You already found your solution in RDNS, so whatever we are going to discuss here should be just for the sake of discussion, in the hope of growing up.
Maybe someone didn't know about RDNS and now has a new tool in their arsenal.
Maybe someone started to trust Termux because they found out they rely on a German server.
Maybe someone decided to leave Termux because of the same German server.
To be honest I growed up in this thread, especially reading about why Always on VPN breaks the terminal.
Let's agree we value different things and that your way of assessing an app works good enough for you, and that my way of assessing an app works good enough for me.
All things considered, if you didn't searched for an alternative to Termux, you couldn't have helped others like in this reply:
littlerack
Everyone has their use cases, and I personally wouldn't trade the Always on VPN feature to use the native terminal app, especially with a configurable Termux app around.
But maybe in my country there is a different kind of censorship that forces me to make different choices, this doesn't mean that my choice is better than yours.
I was genuinely wondering why you prefer your solution, to learn something new.