4 ms·

IOS really needs something like F-Droid that provides reproducible builds of FOSS. Everything on F-Droid is compiled straight from GitHub <3

layer8 4y ago
> Everything is compiled straight from GitHub For some reason, that instills terror in me.
- MrStonedOne 4y ago
  its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public's eye on it. People keep forgetting this, because they spend most their time thinking about security in the terms of a enterprise system, but for a personal usecase, an app extracting data to their servers that i was not expecting is a info leak security breach. Its just that acknowledging that fact requires treating most operating systems (ubuntu, (but not debian) android, and ios included) as malware and this is a uncomfortable position.
- MacsHeadroom 4y ago
  Most apps are compiled straight from some dev's laptop with a largely undocumented environment consisting of many unvetted tools capable of injecting themselves into the build process. But it's reproducible builds that scare you?
  - fxtentacle 4y ago
    I'd guess rather "builds on Microsoft infrastructure".
- wutangisforever 4y ago
  Why? It is only Microsoft, they gave us internet explorer!!!
- GekkePrutser 4y ago
  This is the Apple mindset, glossy features and apps but forgetting that these apps are made by people that aren't perfect. Looking at code almost feels 'dirty' to many Apple users. Like first class passengers on a cruise ship being horrified at the oily smell of the engine room :) It's part of the glamour that Apple has built around its products, but it is mainly a marketing thing. After all Cellebrite and Pegasus manage to break through just fine. The big benefit though of reproducible builds is that what you see in the code repo is actually what you get on your device. There is no reason to hide this code like Apple do, it's not 'magic' and having visibility helps against apps abusing the users' data.

layer8 4y ago

> Everything is compiled straight from GitHub For some reason, that instills terror in me.

MrStonedOne 4y ago
its a plus and a minus. Verifiably open source packages are a net positive to security because it ensures the code running is the same code that has the public's eye on it. People keep forgetting this, because they spend most their time thinking about security in the terms of a enterprise system, but for a personal usecase, an app extracting data to their servers that i was not expecting is a info leak security breach. Its just that acknowledging that fact requires treating most operating systems (ubuntu, (but not debian) android, and ios included) as malware and this is a uncomfortable position.
MacsHeadroom 4y ago
Most apps are compiled straight from some dev's laptop with a largely undocumented environment consisting of many unvetted tools capable of injecting themselves into the build process. But it's reproducible builds that scare you?
- fxtentacle 4y ago
  I'd guess rather "builds on Microsoft infrastructure".
wutangisforever 4y ago
Why? It is only Microsoft, they gave us internet explorer!!!
GekkePrutser 4y ago
This is the Apple mindset, glossy features and apps but forgetting that these apps are made by people that aren't perfect. Looking at code almost feels 'dirty' to many Apple users. Like first class passengers on a cruise ship being horrified at the oily smell of the engine room :) It's part of the glamour that Apple has built around its products, but it is mainly a marketing thing. After all Cellebrite and Pegasus manage to break through just fine. The big benefit though of reproducible builds is that what you see in the code repo is actually what you get on your device. There is no reason to hide this code like Apple do, it's not 'magic' and having visibility helps against apps abusing the users' data.