Announcement from the dev, in the project GitHub and Patreon:
Friends, it seems that my digital signature has been exposed. This signature protects the app from fake and malicious updates, so there is a risk that someone may try to release counterfeit versions under my name.
To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates) — the new one will install as a separate app and will need to be configured again.
Thank you for your understanding and attention to security.[1][2]
---------------
There aren't any new apk releases on GitHub yet. However, concerningly, the SmartTube website (which I won't link directly) still offers undated "Stable" and "Beta" downloads.
It sucks to deal with security breaches as an indie or solo dev, but I'll be waiting for a more detailed postmortem before assessing whether to install a future release... Hopefully one that details new security procedures to guard both the dev's key and the production build environment.
Factory resetting my Shield as a precaution, but nothing sensitive was really on there, and Android's security model did exactly what it was supposed to and limited the damage. When using a third party app like this, it's prudent to use it signed out or else with a purpose specific Google/YouTube account which is connected to nothing else critical.
> To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates)
I'm curious if this is the best idea? Like, if you don't read all the GitHub releases thoroughly or miss the HN material, and instead you just auto-install updates, you downloaded a malware-infested version which will be on your device until you learn otherwise?
I installed 30.56 from the git link on my Shield. It did not overwrite the old one, as it has the old signature. I manually uninstalled 30.48. I did not use the backup/restore option in either as I didnt want to dirty any data in the new app.
> SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware.
Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and review 100% of the changes before they deploy stuff?
I swear the more time goes on, the more I'm loosing faith in the entire ecosystem. People running random binaries on the same device they do banking on always surprised me, but now developers manages to get malware on their developer machine and are publishing random binaries to other strangers???
the malware need not actively create a release like a worm, it can just infect every build and if you don't check carefully, your next regular release will contain it.
Blocking file-based installations was never planned. It's fake news and always has been. It's all about requiring code signing for all code so that malware-spreading authors can be easily blocked by adding their signing key fingerprint to the blocklist.
It doesn't matter whether the app is installed via Play Store, Huawei's or Samsung's store etc., or from APK.
> Do not download SmartTube from any app store, APK websites or blogs; these were uploaded by other people and may contain malware or ads. SmartTube is not officially published on any app store. Sadly, the Google PlayStore does not allow ad-free Youtube apps using unofficial APIs.
Maybe should actually switch to releasing via F-Droid.
It's not just cost and ads. It's having the possibility to reduce attempts to manipulate my inner reptile brain. With various clients, you can disable shorts, recommended, you have sponsorblock, you can replace youtube-face-thumbs with actual thumbs and get crowd-sourced titles that better reflect the contents.
I also don't need to manually go set speed to 1.75x and enable subs in english, it's a one-time setting. _Further_ I can download a video locally, for whatever reason (later viewing, bw throttling, risk of deletion, etc).
As if that weren't enough, I don't have to watch videos logged in, my client is just set up to download my select channels.
Sometimes people download it because there's no alternative. E.g. the YT app is not available in the play store in their country on that specific hardware, so the only way to be able to view YT is to use an alternative app like this one.
Its such a good client. With the YT Roku app, if you change playback speed, quality will drop to 720p or lower. SmartTube lets me watch at full 1080p with 1.5x speed.
This will inevitably be used as ammunition against sideloading, but it’s really a lesson in supply chain trust.
When we move away from walled gardens (which I support), the burden of verifying the "chain of custody" shifts to the user. Installing an APK that auto-updates with root/system privileges is essentially giving a single developer the keys to your living room.
We need better intermediate trust models—like reproducible builds signed by a quorum of maintainers—rather than just "trust this GitHub release."
The official announcement is very sparse on details. If the developer doesn't know how his digital signature (and update infrastructure?) was compromised, how does switching to a new signature help? It could get compromised in the exact same way.
The article linked here brings some more details, but also, the official statement doesn't use the word "compromised". If it did, well it would be a statement with different meaning than the one that was released for us to read.
A lot of people installed malware and, to be honest, nothing really happened. They might have had to change their passwords, but it could have been much much worse if Android didn't have good sandboxing.
I hope that Flatpak and similar technologies are adopted more widely on desktop computers. With such security technology existing, giving every application full access to the system is no longer appropriate.
That's refering to Play Protect (virus scan-ish thing on Google branded Android) and whatever Amazon's equivalent is, not an app requested force uninstall of some kind.
That's exactly why I didn't want to trust this app with a google account, it's mandatory to use it. SmartTube also requires permission to install applications for it's updater feature so it's also possible if the attack was targeted for the malware to install another app to get persistance.
Announcement from the dev, in the project GitHub and Patreon:
Friends, it seems that my digital signature has been exposed. This signature protects the app from fake and malicious updates, so there is a risk that someone may try to release counterfeit versions under my name.
To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates) — the new one will install as a separate app and will need to be configured again.
Thank you for your understanding and attention to security.[1][2]
---------------
There aren't any new apk releases on GitHub yet. However, concerningly, the SmartTube website (which I won't link directly) still offers undated "Stable" and "Beta" downloads.
It sucks to deal with security breaches as an indie or solo dev, but I'll be waiting for a more detailed postmortem before assessing whether to install a future release... Hopefully one that details new security procedures to guard both the dev's key and the production build environment.
Factory resetting my Shield as a precaution, but nothing sensitive was really on there, and Android's security model did exactly what it was supposed to and limited the damage. When using a third party app like this, it's prudent to use it signed out or else with a purpose specific Google/YouTube account which is connected to nothing else critical.
[1]: https://github.com/yuliskov/SmartTube/releases/tag/notificat...
[2]: https://www.patreon.com/posts/important-144473602
> To completely eliminate any threats, I’ve decided to stop using the current signature and switch to a new one. Because of this, the app’s identifier will also change. You don’t need to delete the old app (but it will no longer receive updates)
I'm curious if this is the best idea? Like, if you don't read all the GitHub releases thoroughly or miss the HN material, and instead you just auto-install updates, you downloaded a malware-infested version which will be on your device until you learn otherwise?
from my understanding, https://github.com/yuliskov/SmartTube/releases/download/late... links to 30.56, which the newest clean version. Old app stopped at 30.48.
I installed 30.56 from the git link on my Shield. It did not overwrite the old one, as it has the old signature. I manually uninstalled 30.48. I did not use the backup/restore option in either as I didnt want to dirty any data in the new app.
> SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware.
Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and review 100% of the changes before they deploy stuff?
I swear the more time goes on, the more I'm loosing faith in the entire ecosystem. People running random binaries on the same device they do banking on always surprised me, but now developers manages to get malware on their developer machine and are publishing random binaries to other strangers???
the malware need not actively create a release like a worm, it can just infect every build and if you don't check carefully, your next regular release will contain it.
I really hope Google doesn't pick this out (and similar events) as further justification for getting rid of APK-based installation.
Blocking file-based installations was never planned. It's fake news and always has been. It's all about requiring code signing for all code so that malware-spreading authors can be easily blocked by adding their signing key fingerprint to the blocklist.
It doesn't matter whether the app is installed via Play Store, Huawei's or Samsung's store etc., or from APK.
> Do not download SmartTube from any app store, APK websites or blogs; these were uploaded by other people and may contain malware or ads. SmartTube is not officially published on any app store. Sadly, the Google PlayStore does not allow ad-free Youtube apps using unofficial APIs.
Maybe should actually switch to releasing via F-Droid.
It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.
It's not just cost and ads. It's having the possibility to reduce attempts to manipulate my inner reptile brain. With various clients, you can disable shorts, recommended, you have sponsorblock, you can replace youtube-face-thumbs with actual thumbs and get crowd-sourced titles that better reflect the contents.
I also don't need to manually go set speed to 1.75x and enable subs in english, it's a one-time setting. _Further_ I can download a video locally, for whatever reason (later viewing, bw throttling, risk of deletion, etc).
As if that weren't enough, I don't have to watch videos logged in, my client is just set up to download my select channels.
I now see zero use of a youtube account.
It has a far better user interface than the official YT interface. And that interface can be heavily customized to your exact preferences.
My wife has YT Premium, and we find ourselves watching YT in SmartTube just because the interface is so much better.
The cost of being brainwashed by ads and sponsor slots is also high.
Even with YouTube Premium you don’t get the feature set you get with SmartTube. The sponsor block integration on my TV is brilliant.
I think it's more shocking to people how much YouTube Premium costs.
Sometimes people download it because there's no alternative. E.g. the YT app is not available in the play store in their country on that specific hardware, so the only way to be able to view YT is to use an alternative app like this one.
Its such a good client. With the YT Roku app, if you change playback speed, quality will drop to 720p or lower. SmartTube lets me watch at full 1080p with 1.5x speed.
No ads is of course a big plus too.
I really couldn't care less about me youtube account
Google Account.
Not Youtube account.
Why?
This will inevitably be used as ammunition against sideloading, but it’s really a lesson in supply chain trust.
When we move away from walled gardens (which I support), the burden of verifying the "chain of custody" shifts to the user. Installing an APK that auto-updates with root/system privileges is essentially giving a single developer the keys to your living room.
We need better intermediate trust models—like reproducible builds signed by a quorum of maintainers—rather than just "trust this GitHub release."
The official announcement is very sparse on details. If the developer doesn't know how his digital signature (and update infrastructure?) was compromised, how does switching to a new signature help? It could get compromised in the exact same way.
The article linked here brings some more details, but also, the official statement doesn't use the word "compromised". If it did, well it would be a statement with different meaning than the one that was released for us to read.
A lot of people installed malware and, to be honest, nothing really happened. They might have had to change their passwords, but it could have been much much worse if Android didn't have good sandboxing.
I hope that Flatpak and similar technologies are adopted more widely on desktop computers. With such security technology existing, giving every application full access to the system is no longer appropriate.
Why do you need Flatpak for sandboxing?
I really dislike Flatpak for installing multiple identical copies of the dependencies.
Just give me some easier to use tools to configure the access that each application has.
Really hate this "something was found" announcements
Which channel distributed the compromised apk? What is the signature of the payload injected? What is the payload, what does it do?
>>"It is likely the presence of this malware that caused Google and Amazon to forcibly uninstall SmartTube on some devices, ... "
Where can I read more about *unrequested uninstalls*? Google search only shows results about how impossible it is to remove phone default apps.
That's refering to Play Protect (virus scan-ish thing on Google branded Android) and whatever Amazon's equivalent is, not an app requested force uninstall of some kind.
Thought it was worth mentioning the developer is Ukrainian. If it was a targeted attack, certainty could be state-sponsored by Russia
Happy YouTube Premium customer here
What can malware in an apk do?
In an article about not downloading malware: "You can use my downloader! It's totally safe, bro!"
Yeah, I'll pass.
[dead]
[dead]
So we all agree google is probably behind this, right?
That's exactly why I didn't want to trust this app with a google account, it's mandatory to use it. SmartTube also requires permission to install applications for it's updater feature so it's also possible if the attack was targeted for the malware to install another app to get persistance.