3 ms·
As I've mentioned elsewhere: this is why you audit the apk, not the claimed source.
by lvh 8y ago
As I've mentioned elsewhere: this is why you audit the apk, not the claimed source.
- craftyguy 8y agoThis is why you only use app stores that support reproducible builds.
- lvh 8y agoThat only works if you trust the store, and you somehow only know how to audit from source. Neither is true for professional audits: you'd generally start from the APK anyway, even if it's minified, and in many cases you'd actually get the source (which is an optimization only, e.g. to make bug descriptions better/faster).