4 ms·

Genuine question: what are you basing these 'trust' judgements on, especialy in the case of the Android apps? Open source, or something else?

by mft_ 4y ago

sneak 4y ago
For me, it's where the apps send the credentials or usage information off to. Most apps in the iOS App Store are chock full of spyware that reports on everything you do in the app. Many of the Apple system apps function the same way too (even with analytics disabled).
- mft_ 4y ago
  Again, totally genuine question: how do you know this? From a (my) relatively uninformed perspective, I'd have expected the opposite - that the iOS App store was more of a 'controlled' environment, and the Play store more like the wild west. But maybe this is just me believing Apple's marketing...
  - smoldesu 4y ago
    Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most apps becomes limiting the amount of personally identifying data that can reach that runtime in the first place. Both Android and iOS now do a fairly good job sandboxing the filesystem, but both cannot protect against advanced fingerprinting/data processing. Apple can outline acceptable data processing terms in the App Store, but that doesn't stop bad actors from taking data and processing it remotely. In Facebook and TikTok's case, this is almost certainly what's happening - and why the government is the only one capable of holding them in check. The "alternative" is restricting the amount of entropy a user can generate to near-zero, which isn't really useful for app developers. Suffice to say it's an unsolved issue, even with a singular App Store.
  - sneak 4y ago
    Most apps disclose this in their app privacy label in the app store.
IceWreck 4y ago
All applications on fdroid's main repos are a) open source b) built by fdroid's CI from source without depending on external executable binaries.
- MagicMoonlight 4y ago
  That's irrelevant when you're never going to read the source code. It's like saying that you can trust a chinese chemical plant to make good chicken because if you pay for a flight over there they'll let you read their recipe. Unless somebody actually puts that effort in to check that out and conduct a huge factory-wide audit in their own time for free then you are getting zero benefit from that.
  - commoner 4y ago
    F-Droid maintainers vet every app before inclusion in the official repository: https://f-droid.org/en/docs/Inclusion_Policy/ https://f-droid.org/en/docs/Inclusion_Policy/ One of the reasons I trust F-Droid more than Apple's App Store and Google Play is that F-Droid prohibits proprietary ad and tracking libraries. F-Droid reviewers are also more technically proficient than Apple's App Store reviewers and less likely to err in judgment.
29083011397778 4y ago
Developers don't get paid for information, ads, user data, or per-install / purchase on F-Droid. As a very general rule, apps are uploaded to F-Droid because people made something fun or helpful, and they want to share. Their incentives ("I made something fun!") align with my incentives ("I want something made by a dev that can at least pretend to give a shit about the user"). Apps are not inherently user-hostile, or made for an ulterior motive. Proprietary app stores are... nearly as much of an exact opposite I can think of, regardless of who sponsors them; Microsoft, Amazon, Google, or Apple, devs are putting apps there to get paid. Sometimes it's user data, sometimes it's "Free" with in-app purchases pushed by dark patterns, sometimes it's to push for consumer lock-in, and sometimes it's straight up malware, like most flashlight and cleaner apps on Google Play. Regardless, the incentives don't align, and that is what I'm on about when I use the word trust here. People don't like it when a UX change is made by and for the company that just so happens to screw lots of users, or break or slow their usage. That's exceedingly rare on apps made by devs in the first category, and depressingly common for the latter group.

Genuine question: what are you basing these 'trust' judgements on, especialy in the case of the Android apps? Open source, or something else?

by mft_ 4y ago

Genuine question: what are you basing these 'trust' judgements on, especialy in the case of the Android apps? Open source, or something else?

sneak 4y ago

For me, it's where the apps send the credentials or usage information off to. Most apps in the iOS App Store are chock full of spyware that reports on everything you do in the app. Many of the Apple system apps function the same way too (even with analytics disabled).

mft_ 4y ago
Again, totally genuine question: how do you know this? From a (my) relatively uninformed perspective, I'd have expected the opposite - that the iOS App store was more of a 'controlled' environment, and the Play store more like the wild west. But maybe this is just me believing Apple's marketing...
- smoldesu 4y ago
  Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most apps becomes limiting the amount of personally identifying data that can reach that runtime in the first place. Both Android and iOS now do a fairly good job sandboxing the filesystem, but both cannot protect against advanced fingerprinting/data processing. Apple can outline acceptable data processing terms in the App Store, but that doesn't stop bad actors from taking data and processing it remotely. In Facebook and TikTok's case, this is almost certainly what's happening - and why the government is the only one capable of holding them in check. The "alternative" is restricting the amount of entropy a user can generate to near-zero, which isn't really useful for app developers. Suffice to say it's an unsolved issue, even with a singular App Store.
- sneak 4y ago
  Most apps disclose this in their app privacy label in the app store.

IceWreck 4y ago

All applications on fdroid's main repos are a) open source b) built by fdroid's CI from source without depending on external executable binaries.

MagicMoonlight 4y ago
That's irrelevant when you're never going to read the source code. It's like saying that you can trust a chinese chemical plant to make good chicken because if you pay for a flight over there they'll let you read their recipe. Unless somebody actually puts that effort in to check that out and conduct a huge factory-wide audit in their own time for free then you are getting zero benefit from that.
- commoner 4y ago
  F-Droid maintainers vet every app before inclusion in the official repository: https://f-droid.org/en/docs/Inclusion_Policy/ https://f-droid.org/en/docs/Inclusion_Policy/ One of the reasons I trust F-Droid more than Apple's App Store and Google Play is that F-Droid prohibits proprietary ad and tracking libraries. F-Droid reviewers are also more technically proficient than Apple's App Store reviewers and less likely to err in judgment.

29083011397778 4y ago

Developers don't get paid for information, ads, user data, or per-install / purchase on F-Droid. As a very general rule, apps are uploaded to F-Droid because people made something fun or helpful, and they want to share. Their incentives ("I made something fun!") align with my incentives ("I want something made by a dev that can at least pretend to give a shit about the user"). Apps are not inherently user-hostile, or made for an ulterior motive. Proprietary app stores are... nearly as much of an exact opposite I can think of, regardless of who sponsors them; Microsoft, Amazon, Google, or Apple, devs are putting apps there to get paid. Sometimes it's user data, sometimes it's "Free" with in-app purchases pushed by dark patterns, sometimes it's to push for consumer lock-in, and sometimes it's straight up malware, like most flashlight and cleaner apps on Google Play. Regardless, the incentives don't align, and that is what I'm on about when I use the word trust here. People don't like it when a UX change is made by and for the company that just so happens to screw lots of users, or break or slow their usage. That's exceedingly rare on apps made by devs in the first category, and depressingly common for the latter group.