Login

Recent searches

No recent searches

Search options

Only available when logged in.
podcastindex.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Intended for all stake holders of podcasting who are interested in improving the ecosystem

Administered by:

Server stats:

162
active users

podcastindex.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

Ben Hills

Hi @mitch I wonder if I could pick your brain please? I am looking to add Anytime to F-Droid, but as they build from source I'm not sure how to handle the PodcastIndex keys. Locally, I pass these in as build time parameters so they're not stored in source. How do you do this for Podverse, or are you using a F-Droid Reproducible Build? Cheers.

Jan 30, 2024, 11:31 AM·Public·Web
0boosts·1favorite
Public
Sir Alecks Gates
@amugofjava

I was thinking about this the other day, wasn't Dave talking about removing the key requirement for some APIs because of issues like this?


@mitch
Public
Ben Hills

@agates @mitch I do remember Dave talking about that some time ago, but I think the concern was that, without keys, it could open up PI to a lot more random traffic.

Public
Sir Alecks Gates
That's already the case though, I could disassemble your app and get your key even from the play store. Client side keys are effectively public no matter what.
Public
Ben Hills

@agates @mitch Yes, that is true, though I'm still loathed to put keys in the source - just doesn't feel right.

If I'm reading the API docs right, the endpoints I am using are still secured with keys.

Public
Ben Hills

@steven @mitch Ah, thanks Steven. That makes sense.

Public
Mitch Downey :pci:

@amugofjava yes @steven is correct. We can't keep keys private within the mobile app as env vars, so any thing that needs a private key goes through our API.

ExploreLive feeds
About