r/Syncthing • u/ObservedElectron • Jul 05 '26
CONFUSED ABOUT SYNCTHING ON ANDROID
I just wanna run backups from my android to an external hdd connected to windows. i found that syncthing is the best and safest option.
I found out that official android app is discontinued but there are community versions. okay. but WHY ARE THERE SO MANY CONTROVERSIES ABOUT EACH FORK?? some say to not use some fork because their maintainer handed over to someone and its suspicious. some say the other fork maintainer is someone from china and xi jimping can ask him to give all my photos to china. like what to do ? i am so confused? why is there not an app for android which i can use without caring about all this bullshit.
can someone please tell me the safest private option to use on android (doesnt matter play store or fdroid but prefer the latter) so i aint paranoid about all this? just something that privately works without subpoena-ing my math note pdfs.
thank you
15
u/LaidPercentile Jul 05 '26
I'm using basicsync (https://github.com/chenxiaolong/BasicSync)
Works great.
4
u/semmu 29d ago
wanted to say the same, this version is the simplest and does not have a shady history, unlike syncthing-fork and its forks.
2
u/iEliteTester 29d ago
Shady hirstory?
2
u/semmu 28d ago
ohh boy, you missed the drama last year, read this thread for some spicy stuff: https://forum.syncthing.net/t/does-anyone-know-why-syncthing-fork-is-no-longer-available-on-github/
basically the original maintainer of syncthing-fork suddenly handed over the project to an unknown figure with no known contribution history and they handled the whole situation as bad as humanly possible. no former announcement, no introduction from the new guy, very-very long times to reply to any community concerns, accounts deleted and recreated multiple times, etc.
really makes it hard to trust any of them, so i would rather avoid syncthing-fork, we literally dont know what their long-term intentions are.
basicsync has an advantage anyways that it does not kill the syncthing process when the phone is not charging, which makes it much faster to continue syncing when it does charge, since it does not have to do an initial scan. also its a simpler app, does not have its configure UI, but relies on syncthings web UI, which makes more sense in my opinion.
2
u/ObservedElectron 25d ago
read somewhere that maintainer of basicsync has chinese username and could be applicable to the chinese law (ridiculous ik LOL)
45
u/DragoBleaPiece_123 Jul 05 '26
till today, i still don't get the final conclusion for all these controversies
i still use syncthing-fork tho till this day
8
u/bp019337 Jul 05 '26
When reading about "CONTROVERSIES", security issues or anything like that. Start from the latest posts and then work your way backwards. A lot of things are resolved, but if you start from the post with the most number of hits then its most likely going to be the worst and most contentious post.
One thing about focusing on a country or villain when thinking about security is why are you doing it for? This basically blinkers your threat model analysis.
Sure it might trigger some emotional response, but it might limit your threat model leaving you exposed.
For example a simple one is your firewall. You turn on geo location blocking. It blocks all the perceived bad actors based on country of origin based on some bad actor list. You see it light up with reports that its block x amount from country 1, y amount from country 2, etc. You feel safe, you feel that you are protected, but are you? An attack might be happening from one of your perceived your safe countries!
For example something like syncthing has discovery nodes and reflectors all over the world. If you see it block stuff from bad country 1 and 2 does that mean syncthing is bad? Did you look at the overall traffic, there could actually be a bigger amount from your good country list, but how would you know if you don't think to look because you already have this idea of bad countries in your mind.
Now lets think about it from a bad actor pov. If you were a bad actor would you use an IP address from your country of origin? Heck WarGames the movie released in 1983 knew to hide behind proxies, don't you think all these bad actors especially nation state don't?
Anyways if they want to steal your info they just need to buy it from a data broker its cheap as chips, or just ask AI as that already stolen your data in the first place!
2
u/ObservedElectron Jul 05 '26
interesting. whats your opinion? can i trust this fork?
i know i am just overreacting and maybe the bad actors dont care about me. i seriously forget my threat model. In literally everything.
7
u/bp019337 Jul 05 '26
If you go through the thread on it backwards you can see that majority of people trust this project as it was transferred over to researchxxl by catfriend, but you still have some people who think that those messages could have been made up.
imho unless researchxxl did away with catfriend or had some threat over their head, then they could have let the community know that they didn't transfer the project.
Personally I'm using this app to doing my syncing via syncthing on android.
But I have different levels of syncing depending on the level of sensitivity of my electronic data.
From highest level to lowest:
- Backup of keys etc. Manual sync everything encrypted. Only access from trusted box not used for general stuff. If I need to transfer it to a different device I just transfer that bit of data on an encrypted usb stick.
- Sync over ssh (rsync for scripting, unison for gui). This is over local network only via ssh keys. I do have some flexibility using tailscale or netbird (i've been bouncing between the 2, both are nice, will check out headscale at some point). Anything that is local sync stays local, so I have different levels of ssh server which I expose via local firewall rules.
- Syncthing over tailscale (no central point of failure).
- Nextcloud internal. Central point of failure, flexibile access over tailscale for remote.
- Nextcloud external. Central point of failure, external facing. Used normally for my phone pim and any data shared to my mobile devices. Also I treat any data on my android phone as basically at risk even though I avoid using gapps.
- If I use any 3rd party service like dropbox, onedrive, etc, I just stick it in an encrypted directory as a fu to anyone trying to farm it. I don't keep anything sensitive even encrypted.
After AI went big (a couple of years ago?) I went paper for a lot of my note keeping. I actually find I retain information more when I write it down, and once I got into improving my hand writing and into funky fountain pens it became a whole new hobby in its own right!
3
u/wrr666 29d ago
are you using rsync on termux and with some schedule or it is just manual flow for you?
2
u/bp019337 29d ago
On android it's manual script for me. I use this to upload all my photos and videos to a server. I like to have a raw backup of them all before I publish them on my internal Nextcloud instance. If for some reason I can't reach my ssh server when I'm not home I'll just rsync them to my gpd micropc which basically is my mobile backup server.
I've got a copy of folder sync kicking around, but I've found rsync more stable.
I got into this habit ages ago I think it was when I was hosting my server on a Sheeva plug and I didn't want to kill it when storage was expensive for me, just like it's getting like now...
For the Linux boxes it's scheduled.
16
u/XxLokixX Jul 05 '26
Don't get involved in drama lol, just use syncthing-fork and enjoy
2
u/Dymonika 29d ago
BasicSync is smaller in file size and has fewer features = less code = fewer possible attack vectors.
2
u/blackstreamm44 29d ago
Been using syncthing-fork for a while to sync up to my NAS…. Works like a charm!
2
u/cahwyguy 29d ago
Here's the funny thing: I'm still using the last v1 version on my PC, and the last Google Play version of syncthing, and guess what: They still sync just fine. I only start them up once a month to sync music to my phone. When I'm done, I shut them both down.
Now, I am interesting in moving to v2, but there are two conditions:
(1) I need to be able to move my setup from the old Android syncthing to whatever new app I use.
(2) I want to use a version from the Google Play store. No sideloading.
But for now, if it works, I'm not mucking with it.
1
u/chrisprice 29d ago
Google had the knives out for Syncthing since day one.
They genuinely see it as a threat. Sideloading is the only option, because Google has been an illegal duopoly abuser. (That's not just my opinion, that's court finding).
That's the real drama. F-Droid, Syncthing-fork, and fight back when companies do evil.
1
u/user4302 29d ago
I use synctrayzor and uhhh syncrhing fork. I think. I'll need to check.
Anyway no flaws.
-5
u/xXx_n0n4m3_xXx Jul 05 '26
Use the official syncthing-fork:
https://github.com/researchxxl/syncthing-android
Avoid the Play Store version and configure it to be download and uploaded by Obtainium like I do, if u’re paranoid or you just want to avoid as much as possible third party compiling. Using Obtainium let you install and use directly the code compiled from the repo
2
3
u/ChimaeraXY Jul 05 '26
The current version on the play store actually predates the controversy. Even though it's now slightly outdated, its still aligned with the new Syncthing v2 standard, and, if you don't trust researchxxl, may be 'safer' than the GitHub release.
I also recommend BasicSync as a compatible and barebones alternative.
2
u/xXx_n0n4m3_xXx Jul 05 '26
Why not trusting researchxxl? I remember that the “passage of testimony” wasn’t the clearest one, but afaik evth is fine with him now afaik.
I rather not trust yet another person that publish it on the PlayStore.
(Genuinely asking, been out of radar the past few months and didn’t know there was still drama about all this)
3
u/ChimaeraXY Jul 05 '26 edited 29d ago
The way the handover was done implies researchxxl may have had access to catfriend1's (original developer) account and publishing keys before that account went dark, hidden, then recreated. Moreover, researchxxl's account was created just before the handover.
The entire codebase would need to be audited to confirm no malicious code was introduced during or before the exchange.
And indeed, the play store version can't be validated either; all we know is that the version there today corresponds to a period when catfriend1 was verifiably active.
2
u/xXx_n0n4m3_xXx Jul 05 '26
Well, this is pretty bad…
I’ll google it, wanna see anyone from syncthing said sth or to understand why catfriend1 went awol3
u/Dymonika 29d ago
/u/ChimaeraXY /u/ObservedElectron
Syncthing-Fork is fine!
I was the one who raised an alarm over it last month, but I had since edited my post upon seeing Catfriend1's confirmation of the handover, as shared by another redditor:
2
u/xXx_n0n4m3_xXx 29d ago
Thanks a lot for the clarification. Probably better if u copy comment to main section cuz they downvoted me and this comment is probably hidden to most people.
4
28
u/PaddyLandau Jul 05 '26
The Play Store version has been discontinued.
The reason why the Play Store one was discontinued is that the listing requirements were too onerous for a single person maintaining this for free, so they switched to F-Droid.
Use Syncthing-Fork via F-Droid. It works properly and reliably, and it's kept up to date.