let’s get it off the jolla store, ffs
5 Likes
I believe that an app like this that handles sensitive info should only be in the store if its code is auditable (open source) or somehow audited by an acceptable 3rd party with appropriate disclosures. Or maybe some other alternative that I haven’t thought of. As of now, this app does not satisfy that in any way I can see. Just the dev’s hinkiness about AI involvement, etc. and his ignoring requests for the source are red flags IMO. And not because of AI in particular, just the caginess around the subject and non-assurance assurances.
But is there any Jolla store policy that would require that? AFAIK, the store doesn’t require open source, right? Is there something that could be cited in store policies that would apply here? A store app has an aura of trustworthiness that I think a user might put too much faith in. Just because an app isn’t hacking around in the filesystem outside of its own space doesn’t mean that it handles sensitive data freely given to it responsibly. Where "responsibly* means not “spilling the beans” through carelessness or malice.
Jolla, if you’re listening, would you weigh in on what your responsibility is here?
7 Likes
The ‘developer’ hasn’t been here or updated anything in two months (subscription ran out, maybe) so a couple of OS updates from now, it’ll just stop working and the problem will solve itself.
1 Like
Well, the “developer” went out of their way to hide even the qml from view using some custom obscuration protocol. Which I, ironically, reversed using AI to extract the raw qml.
Didn’t find anything intentionally malicious (though that could still be hidden in the compiled C++), but found at least one security bug where all your generated password history is stored in plaintext.
Used a new account and nuked the emulator I tested this in, just to be sure.
7 Likes
I’ve been following the discussion on this since the beginning, and there were a lot of emotions from both sides, lots of insults were flinged and there were lots of righteous indignation.
Too bad that those pesky luddites were right again about this kind of “development”. 
Note that the app looked very similar to the Android and iOS versions. The LLM certainly used Bitwarden’s source code to make the Sailfish app. It is highly likely that this app violates the GPL.
3 Likes