5 ms·
That argument goes for every floss app. If you download their binaries from a play store (that is not f-droid), there's no guarantee that what you get is the sa
by craftyguy 8y ago
That argument goes for every floss app. If you download their binaries from a play store (that is not f-droid), there's no guarantee that what you get is the same as what the source code would produce. f-droid is not a 100% guarantee either (e.g. not all apps support reproducible builds), but it's certainly better than the mainstream play stores.
- lvh 8y agoAs I've mentioned elsewhere: this is why you audit the apk, not the claimed source.
- craftyguy 8y agoThis is why you only use app stores that support reproducible builds.
- lvh 8y agoThat only works if you trust the store, and you somehow only know how to audit from source. Neither is true for professional audits: you'd generally start from the APK anyway, even if it's minified, and in many cases you'd actually get the source (which is an optimization only, e.g. to make bug descriptions better/faster).