The Boost android client for Lemmy is displaying these dark pattern ads pretending to be system notifications. What security/privacy conscious Lemmy clients do you recommend? - eviltoast
  • imkali@lemmy.dbzer0.com
    link
    fedilink
    arrow-up
    6
    ·
    edit-2
    8 months ago

    Jerboa (FOSS. Play Store + F-Droid)

    Voyager (FOSS. Play Store + F-Droid + PWA + iOS App Store)

    Thunder (FOSS. Play Store + IzzyOnDroid + iOS App Store)

    Eternity (FOSS. Play Store + F-Droid)

    edit: formatting

  • Max-P@lemmy.max-p.me
    link
    fedilink
    arrow-up
    3
    ·
    8 months ago

    The ads come from an ad network where there is very little visibility into what’s going to be displayed in your app. And bad people also keep managing to get their ads published even though the ad network doesn’t allow them

    And it all ties into the whole targeted advertising, where they also make sure very few people get the bad ad, and tries to target people they think may be more susceptible to these kinds of tactics. Depending on the amount of interactivity allowed, the ad can even display two different things if it deems you too savvy to fall for it.

    It’s basically unescapable unless you only use apps without ads, or pay for the ad-free versions.

    The whole advertising industry is sketchy, more news at 10.

    • Darkassassin07@lemmy.ca
      link
      fedilink
      English
      arrow-up
      2
      ·
      8 months ago

      Pi-hole blocks ads served by these networks just fine. Never seen an ad in Boost for Lemmy or for Reddit, though I tend to use Jerboa now that I’ve gotten used to it while I was waiting for Boost for Lemmy to release.

      DNS based adblocking like Pihole or Adguard limits you to receiving advertising hosted by the app provider (youtube for example) which is usually better curated than third party advertising networks and less commonly found at all.

      • BoofStroke@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        1
        ·
        8 months ago

        To be truly effective you must also block DoH and DoT. The first can only be done with endpoint lists, since it is https.

        • N0x0n@lemmy.ml
          link
          fedilink
          arrow-up
          0
          ·
          8 months ago

          Hey, could you elaborate or send some lecture? I have the upstream quad9 DoH address in adguard. It’s supposed to better encrypt my traffic right? Never saw any ads or strange DNS requests.

          Never heard about ads being inject though DoH or DoT, or did I misunderstood your comment?

          • Darkassassin07@lemmy.ca
            link
            fedilink
            English
            arrow-up
            2
            ·
            8 months ago

            Theoretically an app could use a custom DoH endpoint to retrieve ads instead of the standard dns provided by the system. As this uses purely https without a preceding dns request, pihole/adguard would fail to block it; but it’s just not something currently employed.

    • Otter@lemmy.ca
      link
      fedilink
      English
      arrow-up
      0
      arrow-down
      1
      ·
      edit-2
      8 months ago

      Yep, also the ads don’t get initialized at all if the user buys the ad-free version (going to top all in the Lemmy Boost community should bring up the post about it). It’s relatively cheap and the dev is very active with bugs and requests. The dev is developing for the Fediverse and I’m happy to support that (as well as devs for Sync, Connect, Lemmy, etc.)

      I like Boost and paid for ad-Free, but a lot of other clients should work for your needs. While they might not be privacy focussed, many are open source so you can check what is going on.

      My preference goes

      • Boost (not FOSS, one time payment to remove ads)
      • Connect (not FOSS, ad free)
      • Eternity (FOSS & ad free)

      I uninstalled the other ones and haven’t kept up with them. There may be better ones out there, these are the ones I’m keeping up with

  • Rubén@lemmy.world
    link
    fedilink
    arrow-up
    3
    ·
    edit-2
    8 months ago

    Boost dev here. There should be an Ad icon on the top right to report the ad. Not sure why it is not showing in this case. I will try to block those ads in the AdMob console. Edit: Done

    • Sho@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      8 months ago

      This is the stuff I come to Lemmy for. Love the quick feedback and positive approach to the situation.

    • Danny M@lemmy.escapebigtech.info
      link
      fedilink
      arrow-up
      0
      arrow-down
      1
      ·
      8 months ago

      I’m not a boost user, but why does boost have ads exactly? Why don’t you just ask users to buy a license a la grayjay? Make it 0.99 or less. This has a few advantages:

      • You’ll make more per user than you ever will with ads
      • Users won’t be tracked endlessly
      • It’s good PR for the app

      Also quick question, where is the source code for Boost? I can’t seem to find it

        • Danny M@lemmy.escapebigtech.info
          link
          fedilink
          arrow-up
          0
          arrow-down
          1
          ·
          8 months ago

          Regarding boost, yep my bad! I did not know that when I asked that question.

          As for grayjay, it’s source available, that’s fine to me, there is a difference naturally and it’s worth discussing, but I’d rather live in a world where every piece of software is source available and we discuss the merits of source availability vs pure FOSS, than in a world where understanding our software requires days or months of work looking at asm and poking it with a stick

        • Danny M@lemmy.escapebigtech.info
          link
          fedilink
          arrow-up
          0
          arrow-down
          2
          ·
          edit-2
          8 months ago

          I don’t think Boost is open source

          oh, so that’s why it has ads, they don’t care about their users… alright… I’m not interested in this conversation anymore

          • HaruAjsuru@lemmy.world
            link
            fedilink
            arrow-up
            2
            ·
            8 months ago

            This is a bad mindset. Even though FOSS software is a good thing, but there is nothing wrong to make money from their hard work, you cannot and should not force developers to work for free if they don’t want to.

            If you want free software then there are FOSS alternative options out there and nobody forces you to use Boost.

            • Danny M@lemmy.escapebigtech.info
              link
              fedilink
              arrow-up
              0
              arrow-down
              1
              ·
              edit-2
              8 months ago

              there is nothing wrong to make money from their hard work

              I assume you didn’t read my parent comment or perhaps you extrapolated on my beliefs without asking. I even proposed a direct way to ask users to pay.

              you cannot and should not force developers to work for free if they don’t want to.

              My word, of course not! Where did you get the impression that I want that from? I would NEVER propose something like that, as it stands against everything I believe in; in fact if you read through my history on lemmy I am certain that you’re gonna find plenty of proof of that.

              I stand by the original meaning of the word when I say FOSS. It does NOT mean gratis; the misuse of the term FOSS as gratis is my biggest pet peeve. I don’t care how much you charge for your software, if I like the software I will pay for it, exactly how much you’re asking, without a problem.

              The F in FOSS stands for Freedom, not price. I have paid for most FOSS software I use on a regular basis and I’m a HUGE proponent of paid FOSS and I have, multiple times, asked FOSS developers that release gratis software to PLEASE open up donations; I do this constantly and I think I may even have done it here on lemmy once or twice.

              If you want free software then there are FOSS options out there and nobody forces you to use Boost.

              Indeed. My preferred client at the moment is the web ui on desktop and jerboa on mobile. Those are FOSS and developed by the developers of lemmy themselves (to whom I HAVE donated to). But I was thinking about switching client, which is why I asked for the code for Boost to see if it’s software I would be willing to run on my device (and pay for!).

              In fact I will even go as far as to say that it is your RESPONSIBILITY as a user of FOSS applications to donate if you can.


              To me if software is not FOSS it signals one thing: they are doing something they don’t want me to know about, sometimes this is acceptable (tho never preferred), but that’s the exception, not the rule.

              Being able to decide what software runs on your machine should never be a point of contention. Non FOSS software is always a trade off, and for most things (including lemmy clients), it’s not one I’m willing to make, nor should you!

  • hackris@lemmy.ml
    link
    fedilink
    arrow-up
    5
    arrow-down
    2
    ·
    8 months ago

    Please. For the love of god, NEVER use a proprietary app to use a piece of FOSS software. I think it’s kind of sad that we have this amazing FOSS social network and people use fucking proprietary software to use it.

    • voxel@sopuli.xyz
      link
      fedilink
      arrow-up
      1
      arrow-down
      1
      ·
      edit-2
      8 months ago

      i use sync. there’s nothing even close to the quality of the client. (The onlt client that implements material you in a fun and usable way, sync is usable one-handed)
      I had been using Liftoff for a while (before switching to Sync as soon as it came out), which i quite liked but it feels a lot worse than sync

      • Arthur Besse@lemmy.ml
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        edit-2
        8 months ago

        (The onlt client that implements material you in a fun and usable way, sync is usable one-handed)

        Touchscreen keyboards and their consequences have been a disaster for the human race.

    • pirrrrrrrr@lemmy.dbzer0.com
      link
      fedilink
      arrow-up
      1
      arrow-down
      1
      ·
      8 months ago

      Open-source it a better interface then.

      Until it’s as useful as at least Sync for Lemmy, people will use 3rd party proprietary apps

      • hackris@lemmy.ml
        link
        fedilink
        arrow-up
        0
        ·
        8 months ago

        I mean isn’t Lemmy licensed under the AGPL? I’m just asking because AFAIK a proprietary client is not even allowed under this license.

        • SeriousBug@infosec.pub
          link
          fedilink
          English
          arrow-up
          0
          ·
          8 months ago

          You couldn’t make a proprietary server. Client is fine, AGPL doesn’t apply when you are accessing the server over a public API.

          • Preston Maness ☭@lemmygrad.ml
            link
            fedilink
            arrow-up
            0
            ·
            8 months ago

            AGPL doesn’t apply when you are accessing the server over a public API.

            The AGPL does apply when interacting with the covered work (Lemmy server) over a network. A proprietary client would still nevertheless be required, upon request, to furnish you with the source code of the covered work it is talking to over the network (the Lemmy server).

            • boyi@lemmy.sdf.org
              link
              fedilink
              arrow-up
              0
              arrow-down
              2
              ·
              8 months ago

              Do you really know what you are talking about? I think you’re bullshitting. We are talking about propriety client which doesnt modified the source codes of the server.

    • HypnoticSheep@lemm.ee
      link
      fedilink
      arrow-up
      1
      ·
      8 months ago

      I’ve tried all the other popular apps, and keep coming back to Connect.
      The main features that pull me back are profile-specific settings so I can set up different accounts without having to reconfigure everything every time I switch instances, and the ability to customize post card quick actions, specifically the Mark As Read quick button combined with the persistent Hide All Read toggle. It’s just so convenient, I keep coming back even though it deletes my account info every time it logs me out.

  • ono@lemmy.ca
    link
    fedilink
    English
    arrow-up
    2
    ·
    8 months ago

    I start with whatever is on F-Droid, and narrow it down from there.

    Jerboa was the only option there until recently. I see Voyager and Eternity are there now. I’ll have to give them a try.

    • schizoidman@lemmy.ml
      link
      fedilink
      English
      arrow-up
      1
      ·
      8 months ago

      Voyager is currently many versions ahead of the one listed on F-Droid. It is still usable but you may want to get the latest version from GitHub.

      • ono@lemmy.ca
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        8 months ago

        If new versions don’t make it to F-Droid, they might as well not exist for me. There are only a couple of apps that I find important enough that I’ll spend time manually building/pulling/installing, and a Lemmy reader isn’t one of them. Thanks for the tip, though.

          • ono@lemmy.ca
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            Part of what I value in F-Droid is the additional layer in the build/release process, because it makes tampering more likely to be detected.

            It’s still nice to know a tool like obtanium exists, though. Thanks for the link.

  • I’m not so sure about clients that are specifically focused on security and privacy, however my general FOSS mobile app suggestions would be Voyager for a polished UX, or Eternity for a more native Android experience.

    Both are available on GitHub and F-Droid