5 ms·
What keeps someone from doing the same thing to f-droid?
by eli 9y ago
What keeps someone from doing the same thing to f-droid?
- thriftwy 9y agoMaybe they have package vetting process with an actual human inside?
- avodonosov 9y agoThey have software dev process with actual human, inside.
- nolok 9y agoThey don't. More exactly, they try to vet things, after the fact, and not covering anything. Source : their own faq.
- disconnected 9y agoI skimmed their docs and I don't see any sort of language that corroborates what you are claiming. They DO seem to have some sort of review process in place: https://f-droid.org/en/docs/Inclusion_How-To/ https://f-droid.org/en/docs/Inclusion_How-To/ See: Application Review Process. I don't know how exhaustive it is or how effective it is in practice though.
- Sylos 9y agoThey don't do a thorough code review, but they are human beings and they manually build the software from its code repository, so they will notice these kind of discrepancies.
- orblivion 9y agoYou're basically saying that f-droid is better because it's small. Nothing to do with its selling point of being FOSS. (And for the record I'm an f-droid user)
- Sylos 9y ago1) What does it matter? If it's better by being small, it's still better. 2) The F-Droid maintainers manually build the apps on F-Droid from the respective code repositories. They will notice when something like that is off. This has to do with it being FOSS. And if you're wanting to tell me that this doesn't scale, not really, no, but it's the same thing that Linux distros have been doing for a long time and Red Hat, SUSE, Canonical actually do have a crapton of users, especially on the server side.
- Godel_unicode 9y agoManual code inspection and FOSS or closed is entirely orthogonal to typo squatting of package names. Every one of those distros gets around volume of desired apps by allowing the inclusion of third-party repos (e.g. current Python or docker) which in turn introduces typo squatting as a vector. You're asking for app store maintainers to slow everything to a crawl and never get popular. No entity which wants to be successful will do that, corporate or otherwise.
- kenaiphatdu 9y agoAgreed. At least with Google, we have something big to blame on.
- Teever 9y agoBesides assuaging feelings of rage what does this accomplish exactly?
- Apocryphon 9y agoPotential for class action lawsuits?
- Godel_unicode 9y agoBlame, nothing. But a single app store means only one place to remove offending apps from.
- gnarbarian 9y agoFewer people run it so it's not as desirable a target. "Security via unpopularity"
- phalangion 9y agoAka, the Linux anti-virus.
- ljk 9y agoisn't it more like Apple anti-virus?
- stordoff 9y agoIt's a factor, but is it really that big of a factor for Linux? I'd've thought that its usage on servers would make it a sizeable target (both as powerful machines to use in a botnet and as a way to compromise company information).
- staticassertion 9y agoAttacks on servers are of a different nature. No one runs Linux desktop, so it is not a valuable target for trojans or other attacks like that. If it were popular we'd see just as much malware for linux.
- Apocryphon 9y agoUniversities and teams within corporations run Linux desktop, though. Maybe they'd make for specialized targets?
- coding123 9y agoYou can't put up a wordpress site with more than 4 plugins selected at random on a linux box that is secure. I even experienced a THEME that was hacked.
- 9y ago