3 ms·

I don't think that this will convince you but it's open source (https://github.com/altstoreio/AltStore https://github.com/altstoreio/AltStore), and you could a

I don't think that this will convince you but it's open source (https://github.com/altstoreio/AltStore https://github.com/altstoreio/AltStore), and you could a separate Apple ID specifically only for signing (https://faq.altstore.io/getting-started/troubleshooting-guide https://faq.altstore.io/getting-started/troubleshooting-guid...). This is probably the least clunky way of doing it since that Apple still doesn't allow sideloading.

nicce 4y ago
Open-source does not mean anything in the context of privacy if the distributed package or binary is not made in reproducible ways, and the distributor is not proving the checksum. There is no way to guarantee that the shipped software uses the claimed source otherwise. Just saying, since people so often use open-source as argument in privacy context. But it requires reproducible builds to mean something. In security context, the source alone helps a bit more, but does not prevent intentional backdoors.
- jeroenhd 4y ago
  In this instance the open source-ness refers to being able to inspect and compile the application you enter your Apple ID into. It doesn't protect your device from malware you install through an open source app store, obviously. This is why I appreciate the F-Droid process. F-Droid is the most popular open source app store for Android and it insists that app developers publish their source, which then gets built by F-Droid, rather than upload binaries. You still have to trust F-Droid and I'm sure there are injection risks involved somewhere, but it's heaps better than Google Play's/Samsung Store's/Amazon's approach of "upload a binary and we'll send it to your users". However, this trust problem is a factor everywhere. Every mobile app store carries malware. Apple had malware published for ages that was all injected by the same infected, redistributed compiler. Google Play takes down malware all the time. Which stores you trust and how you can distinguish the useful apps from the malware is all up to you, but unless you're building all apps yourself after inspecting every single source file (including every single dependency, and possibly reverse engineering the operating system libraries while you're at it), you'll always run the risk of installing malware. You can mitigate this by installing your emulators and other such apps through the App Store if you don't like this one, but the risk model isn't very different.
  - nicce 4y ago
    Seems like I had misunderstanding how AltStore works. I thought you could install it from App store and you sideload only the other apps with it, but that is not the case. Obviosly Apple would not like that.

nicce 4y ago

Open-source does not mean anything in the context of privacy if the distributed package or binary is not made in reproducible ways, and the distributor is not proving the checksum. There is no way to guarantee that the shipped software uses the claimed source otherwise. Just saying, since people so often use open-source as argument in privacy context. But it requires reproducible builds to mean something. In security context, the source alone helps a bit more, but does not prevent intentional backdoors.

jeroenhd 4y ago
In this instance the open source-ness refers to being able to inspect and compile the application you enter your Apple ID into. It doesn't protect your device from malware you install through an open source app store, obviously. This is why I appreciate the F-Droid process. F-Droid is the most popular open source app store for Android and it insists that app developers publish their source, which then gets built by F-Droid, rather than upload binaries. You still have to trust F-Droid and I'm sure there are injection risks involved somewhere, but it's heaps better than Google Play's/Samsung Store's/Amazon's approach of "upload a binary and we'll send it to your users". However, this trust problem is a factor everywhere. Every mobile app store carries malware. Apple had malware published for ages that was all injected by the same infected, redistributed compiler. Google Play takes down malware all the time. Which stores you trust and how you can distinguish the useful apps from the malware is all up to you, but unless you're building all apps yourself after inspecting every single source file (including every single dependency, and possibly reverse engineering the operating system libraries while you're at it), you'll always run the risk of installing malware. You can mitigate this by installing your emulators and other such apps through the App Store if you don't like this one, but the risk model isn't very different.
- nicce 4y ago
  Seems like I had misunderstanding how AltStore works. I thought you could install it from App store and you sideload only the other apps with it, but that is not the case. Obviosly Apple would not like that.