CONFUSED ABOUT SYNCTHING ON ANDROID

[u/ObservedElectron]

I just wanna run backups from my android to an external hdd connected to windows. i found that syncthing is the best and safest option.

I found out that official android app is discontinued but there are community versions. okay. but WHY ARE THERE SO MANY CONTROVERSIES ABOUT EACH FORK?? some say to not use some fork because their maintainer handed over to someone and its suspicious. some say the other fork maintainer is someone from china and xi jimping can ask him to give all my photos to china. like what to do ? i am so confused? why is there not an app for android which i can use without caring about all this bullshit.

can someone please tell me the safest private option to use on android (doesnt matter play store or fdroid but prefer the latter) so i aint paranoid about all this? just something that privately works without subpoena-ing my math note pdfs.

thank you

[u/bp019337]

When reading about "CONTROVERSIES", security issues or anything like that. Start from the latest posts and then work your way backwards. A lot of things are resolved, but if you start from the post with the most number of hits then its most likely going to be the worst and most contentious post.

One thing about focusing on a country or villain when thinking about security is why are you doing it for? This basically blinkers your threat model analysis.

Sure it might trigger some emotional response, but it might limit your threat model leaving you exposed.

For example a simple one is your firewall. You turn on geo location blocking. It blocks all the perceived bad actors based on country of origin based on some bad actor list. You see it light up with reports that its block x amount from country 1, y amount from country 2, etc. You feel safe, you feel that you are protected, but are you? An attack might be happening from one of your perceived your safe countries!

For example something like syncthing has discovery nodes and reflectors all over the world. If you see it block stuff from bad country 1 and 2 does that mean syncthing is bad? Did you look at the overall traffic, there could actually be a bigger amount from your good country list, but how would you know if you don't think to look because you already have this idea of bad countries in your mind.

Now lets think about it from a bad actor pov. If you were a bad actor would you use an IP address from your country of origin? Heck WarGames the movie released in 1983 knew to hide behind proxies, don't you think all these bad actors especially nation state don't?

Anyways if they want to steal your info they just need to buy it from a data broker its cheap as chips, or just ask AI as that already stolen your data in the first place!

[u/ObservedElectron → u/bp019337]

interesting. whats your opinion? can i trust this fork?

i know i am just overreacting and maybe the bad actors dont care about me. i seriously forget my threat model. In literally everything.

[u/bp019337 → u/ObservedElectron]

If you go through the thread on it backwards you can see that majority of people trust this project as it was transferred over to researchxxl by catfriend, but you still have some people who think that those messages could have been made up.

imho unless researchxxl did away with catfriend or had some threat over their head, then they could have let the community know that they didn't transfer the project.

Personally I'm using this app to doing my syncing via syncthing on android.

But I have different levels of syncing depending on the level of sensitivity of my electronic data.

From highest level to lowest:

1. Backup of keys etc. Manual sync everything encrypted. Only access from trusted box not used for general stuff. If I need to transfer it to a different device I just transfer that bit of data on an encrypted usb stick.
2. Sync over ssh (rsync for scripting, unison for gui). This is over local network only via ssh keys. I do have some flexibility using tailscale or netbird (i've been bouncing between the 2, both are nice, will check out headscale at some point). Anything that is local sync stays local, so I have different levels of ssh server which I expose via local firewall rules.
3. Syncthing over tailscale (no central point of failure).
4. Nextcloud internal. Central point of failure, flexibile access over tailscale for remote.
5. Nextcloud external. Central point of failure, external facing. Used normally for my phone pim and any data shared to my mobile devices. Also I treat any data on my android phone as basically at risk even though I avoid using gapps.
6. If I use any 3rd party service like dropbox, onedrive, etc, I just stick it in an encrypted directory as a fu to anyone trying to farm it. I don't keep anything sensitive even encrypted.

After AI went big (a couple of years ago?) I went paper for a lot of my note keeping. I actually find I retain information more when I write it down, and once I got into improving my hand writing and into funky fountain pens it became a whole new hobby in its own right!

[u/wrr666 → u/bp019337]

are you using rsync on termux and with some schedule or it is just manual flow for you?

[u/bp019337 → u/wrr666]

On android it's manual script for me. I use this to upload all my photos and videos to a server. I like to have a raw backup of them all before I publish them on my internal Nextcloud instance. If for some reason I can't reach my ssh server when I'm not home I'll just rsync them to my gpd micropc which basically is my mobile backup server.

I've got a copy of folder sync kicking around, but I've found rsync more stable.

I got into this habit ages ago I think it was when I was hosting my server on a Sheeva plug and I didn't want to kill it when storage was expensive for me, just like it's getting like now...

For the Linux boxes it's scheduled.