Does anyone know why syncthing-fork is no longer available on Github?

If I had a last wish … :star::heart::christmas_tree:

  • Don’t fight
  • Don’t lie
  • Get together in one place
  • Publish one App
  • Establish trust by contributing, for example, code, translations, build recipes, support for users

Therefore, I did hand over all my stuff to my inheritant @researchxxl inluding the com.github.catfriend1* apps, digital signing material and wish them the best to fulfill the mission of carrying on the Syncthing-Fork app. :woman_technologist: We have met in online gaming and developing modding code together for a level that tells the story of a research station attacked by some alien-like monsters. Two players do have to cooperate on fixing electrical devices, a low power emitting nuclear reactor and avoiding a bath in acid. If you stumble upon the game, say hello to us during our test sessions. :slightly_smiling_face:

@researchxxl Thank you for your will to take a try on coding. Without your work, the app would die until revival for a while.

To the community:

  • I am sorry to see how things developed during my absence.

    • “What a mess they have created” (Source: 4PDA)
    • I did not expect this but never the learning curve is complete in my life. :pensive_face:
  • THANK YOU for all those great 7 years we were together.

  • THANK YOU for - currently - 82k for following a genuine, transparent and reproducible release of the app with all its cat purring friendliness.

I’ll authorize every attempt to clean up this mess.

I’ll review the progress from time to time and if I find anything malicious going on, I’ll let you know here.

:grinning_cat:

16 Likes

With all due respect, on the point of developer or tech savvy aspect, why won’t researchxxl publish his dev profile, complete the f-droid reproducible build, publish your and researchxxl’s public signing key, and IDK, the communication being silent is weird. Also whats about the issue that starts with “dont play with my desktop“ implying hacker getting into your computer, which info are correct?

the dichotomy of one big changelog vs many releases notes (Aves in contrast to, standard notes), i get it. what i dont get is the communication going silent. IDK anymore about cryptography, but Linus has his rage over email listing

OutOfTopic

(east bloc diverging from west bloc linux codebase [no idea about NK linux distro], Unicodia stance is fine, i like his approach since its linguistic, but it’s also not possible without neologism since u s spellings are more lingua franca than uk-en right now as su per po wer, but it’s a fine approach, linus is also justrified, since he lives in the u s, the agency is on his thr oat, and it will also jeopardizes the whole internet stack, so diverging east bloc and NK linuxes are fine, harmonyOS of chi na will probably help br ic tech stack or something similar, the xkcd comic of standardization)

OOT, and your silence. other could chime in, with the cryptography aspect, sorry for the comment, this is my main syncing app, so this is why this sounds urgent, and defensive, or just usual “reproducible build”, public signing key gpg verification, ways of devs to legitimate apps, confirm pdf, email. I might not produce any of this cryptographic app release aspect, but I do have keepass + syncthing workflow;

so I have researched cryptography before, but yeah with all due respect this is out of my scope, I’m gonna go with nel0x or martchus for now. this is kind of similar to how the linux codebase diverge after the triple a agency knock on linus door, so yeah at least this one doesn’t get that much coverage.

To compare even though abrupt, the forks and original devs communications are better in picocrypt vs picocrypt-NG, no silence, the og dev is kind of fed up with neural network but thats a different story.

DivestedOS went EOL, Ironfox and AXP OS for android take some of the projects into a new fork but with new names. havent see dialogues between them, but the divestedOS dev is live again with commercial profile, old repos archived.

while picocrypt will probably use his trademark for commercial release but still allowed picocrypt-NG to exist and provide FOSS community with a fork release. something like tachiyomiSY existing even tho Mihon exist, also because of QoL or features differences.

answering this might strengthened your defense/clarification, but it’s your decision to answer or not.

making an exhaustive chronology since your last commit up to researchxxl commit or dialogue might make this clear. I really dont get why you dont take picocrypt or divestedOS approach, archived repos, but still let others make fork of your work?

  1. f-droid reproducible build,
  2. maybe github version of token or public signing key (gitlab asymmetric key needs to be made if one made gitlab acc from github acc, similar to token) to prove the legitimate handover of catfriend1 to researchxxl repo, (maybe an ignorant assumption from me, CMIIW)
  3. the full chronology why catfriend1 account is gone,
  4. last commit of yours up to researchxxl first commit chronology?

email or pdf gpg are out of scope. those 2, 3, or 4 questions are probably enough for clarification.

Either Nel0x or Martchus version, Martchus’ syncthingtray currently is still experimental, but aligned more with the desktop web-ui, some issues or bugs are problems on the android side instead of QT. while ATM, nel0x fork of syncthing-android and syncthing-fork of catfriend1 has more features. I think martchus’ syncthing-app of syncthingtray currently needs more beta tests.

I feel like most people following this would be most comfortable with @nel0x’s having the owner rights of the repo, and @researchxxl being welcome to contribute to that repo. This is solely based on what has transpired so far, where @researchxxl failed to establish trust with his communication. Of course having any communication from Catfriend1 before the repository was deleted would’ve prevented most of this, but that’s in the past. Nel0x seems to have the community’s trust on his side, and that’s crucial. Researchxxl can then establish trust in his work with his coding contributions, but speaking for myself here, I wouldn’t yet be comfortable with him being the project’s “heir”, even if his code is impeccable. This seems like the best compromise to me.

5 Likes

If I can add my 2c on how to peacefully resolve all this (which is basically what @nel0x and the Syncthing team have already come up with, I think), let us assume everyone is working in good faith. Then it should be no problem whatsoever if the @ researchxxl’ version is the “upstream“, and the @nel0x is the “downstream” which might pull commits from the upstream after inspecting them (and optionally may diverge a bit, too). The “officially endorsed“ version by the Syncthing project would be the downstream by @nel0x (as, to my understanding, the Syncthing project already trusts them). If, after a few years or however many is necessary, nothing problematic occurs, and everything works without any issues, one can revisit this situation, and potentially merge the two versions (and its maintainers) into one (there should hopefully not be many reasons for both versions to significantly diverge in the following years, so this should not be all that problematic). While not ideal, if @ researchxxl’ intent is truly just to continue developing the application, there should not be an issue with this approach. And this is the most straightforward way I can think of to slowly build the trust between the community and @ researchxxl while keeping the users secure as well, following the idea that trust must be earned, not given.

On the other hand, if there is a malicious intent (for example, there was already mentioned above that the credentials to @Catfriend1’ accounts could be compromised (let us assume every account, so even in here on this forum)), the malicious code will not reach the officially endorsed version by @nel0x as such commits would be (hopefully) caught by @nel0x.

Of course, this is all based on the assumption that @nel0x or other trusted community members are willing to verify the upstream commits to not contain anything strange. But it seems to me that this is the only option on how the two version do not diverge too much, and save everyone duplicated effort of developing the application side by side (as for the matter even @ reserchxxl said on GitHub: status · Issue #16 · researchxxl/syncthing-android · GitHub ).

To @Catfriend1: Thank you for all the years maintaining the client. I am sorry that you were having difficulties in real life that lead to you dropping projects such as Syncthing-fork. I wish you all the best in your life as well as future endeavours. Have a good one :heart:

1 Like

Take it easy, people; we are just mobs. imsodin promised them a less noisy environment, which I supposed is applicable to Catfriend1 too.

If I’m reading this correctly, those would probably be the first few things to happen.

1 Like

THANK YOU for all the effort you’ve put into the project, one that was only intended to be for the use of you and some friends. What a monster it turned into! I’m glad that you’ve chosen someone you trust to take on the responsibility and the hostile maelstrom that swirls around. I only hope that the new maintainers weather this storm and are still able to keep going tomorrow, next week and next year. May we all be a bit more friendly from today onwards.

Thank you so much for your reliable and trustworthy work on this indispensable app. Unfortunately the communication and changes made (removing SU permission without an alternative) of the person you chose for following up does not contribute to keep the trust in this work. @researchxxl is still not a member of this forum.

I always believe that you should decide for yourself which forum you want to be in.

:crossed_fingers:I have high hopes that at some point @nel0x’s repo can become the official replacement for @imsodin’s archived repo, under the official Github org.

2 Likes

Yeah, but the repository links to our forum for “support requests or asking a question”, so one would expect the maintainer to be active here as well. Of course, if they don’t want to interact with users on the forum and keep everything on GitHub only, that’s fine too, but then they shouldn’t link to the forum as the place for support.

2 Likes

In addition, if you truly care about the community, you hang out where the community is active.

Even after @Catfriend1‘s message here stating that the handover was planned and is intentional and normal I find it incredibly suspicious… This is simply not how you do a handover. Unfortunately I completely lost my trust in this project (as in the Android app) and I’m not going to upgrade until a decent amount of time has passed and this “fork” gained enough trust from the community.

We have seen how determined bad actors can be (see the aforementioned XZ utils backdoor drama), and even though the Syncthing Android app is not that big of a “prey” I still won’t risk installing malicious software on my devices.

2 Likes

Yeah… I guess there’s something to be said for adopting well-known/used community additions into the syncthing github org, for the purpose of safekeeping a repo and making orderly transitions between maintainers, if nothing else.

5 Likes

@nel0x has builds available and has stated they will continue their work. They’ve been responsible for the GPlay forms for a very long time and, thanks to this mess, have published builds on GitHub for those of us not using the Play Store. This doesn’t help F-Droid users but it’s pretty clear nel0x intends to continue to work on the project and keep it going despite the current mess with Catfriend1 and researchxxl.

As others (and myself) have mentioned here and elsewhere: it’s probably ‘best’ to setup a GitHub org sooner than later to avoid this kind of mess in the future. I have a feeling nel0x is wise enough to avoid creating this kind of mess but it can’t hurt to make things more robust. Especially now that we do have a mess.

Additionally: someone alerted F-Droid to the situation and they have decided to ‘wait and see’ for the current app in their repo and nel0x has stated they’ve looked at possible F-Droid releases.

Hopefully the dust will settle sooner than later. Many thanks to nel0x and syncthing devs for ensuring we all have good options, even if the current situation is a **** mess.

Hi, I’m new, I created an account because of the confusion.

@nel0x Can you make an official post somewhere about your plans for whether/when you’ll start publishing your app to F-Droid?

A lot of people are understandably confused right now about the best course of action.

Personally, even with the post from @Catfriend1’s account above, I no longer trust the Syncthing-Fork app in F-Droid (at least for now) and won’t install updates from it. But it’s very hard to tell from the very long forum thread and several Github issues what is the best thing to do.

I think people are wondering:

  • Which is the best app to install now?
  • Whether you (@nel0x) will release your app on F-Droid in the future?
  • If we remove the Syncthing-Fork app from F-Droid and install your (@nel0x) app from Google Play, is there likely to be any problem because your Google Play version (2.0.10.1) was a little behind Syncthing-Fork on F-Droid (2.0.11.x, 2.0.12.x)?

Questions which I think have been answered:

  • Which is the last known good version of Syncthing-Fork on F-Droid?
    • Answer: 2.0.11.2
    • Answer: Nothing malicious was found when people looked thru the source of 2.0.11.3 or 2.0.12.1, but these were released after the transition.

Thanks @nel0x and @Catfriend1 and all the Syncthing maintainers for all your time and effort on these projects.

2 Likes