2 ms·

Google’s Android and Chrome extensions are a sad place

18 points by elorant 3y ago

lern_too_spel 3y ago
The Play Store does static and dynamic analysis of published apps in addition to manual review. The Chrome Web Store has access to the unminified source code. Both require the publisher to deanonymize themselves with payment. If these have a severe malware problem, just imagine how bad other app sources that do even less are, like the Apple App Store. Prefer open source software with reproducible builds. F-droid with a larger security analysis ecosystem is probably the right way to go.
- bitwize 3y ago
  The App Store has always had far less of a malware problem than Google Play. Apple actually has skin in the game. They stake money and their reputation as a brand on making their platform a joy to use and as free of malware and spyware as possible. Android is sort of the default choice to enable carriers and handset vendors to roll their own smartphone platform. It's a hedge, it exists because without it, Apple coukd take Google's search monopoly clean away. Neither Google nor the handset vendors nor the carriers give a shit about UX, they've structured things so that you're kind of forced to go with them anyway.
  - bezier-curve 3y ago
    > Neither Google nor the handset vendors nor the carriers give a shit about UX, they've structured things so that you're kind of forced to go with them anyway. Carriers don't really contribute much to the UI or force you to use a particular phone. This comment doesn't make any sense.
    - bitwize 3y ago
      > Carriers don't really contribute much to the UI or force you to use a particular phone. Carriers in the USA are whitelisting phones now. They can indeed force you to use one of an approved list.
  - lern_too_spel 3y ago
    > The App Store has always had far less of a malware problem than Google Play On the contrary, it has always been worse, not doing any dynamic analysis of its published apps and possibly not doing any static analysis either. Everything else is the same as Play Store. Xcodeghost infected a significant fraction of all iOS devices via Angry Birds 2, WeChat, and Didi Chuxing back in 2015, and Apple relied on outside security analysts to report the infected apps. There is no evidence that the App Store has improved since.

18 points by elorant 3y ago

The Play Store does static and dynamic analysis of published apps in addition to manual review. The Chrome Web Store has access to the unminified source code. Both require the publisher to deanonymize themselves with payment. If these have a severe malware problem, just imagine how bad other app sources that do even less are, like the Apple App Store. Prefer open source software with reproducible builds. F-droid with a larger security analysis ecosystem is probably the right way to go.

bitwize 3y ago
The App Store has always had far less of a malware problem than Google Play. Apple actually has skin in the game. They stake money and their reputation as a brand on making their platform a joy to use and as free of malware and spyware as possible. Android is sort of the default choice to enable carriers and handset vendors to roll their own smartphone platform. It's a hedge, it exists because without it, Apple coukd take Google's search monopoly clean away. Neither Google nor the handset vendors nor the carriers give a shit about UX, they've structured things so that you're kind of forced to go with them anyway.
- bezier-curve 3y ago
  > Neither Google nor the handset vendors nor the carriers give a shit about UX, they've structured things so that you're kind of forced to go with them anyway. Carriers don't really contribute much to the UI or force you to use a particular phone. This comment doesn't make any sense.
  - bitwize 3y ago
    > Carriers don't really contribute much to the UI or force you to use a particular phone. Carriers in the USA are whitelisting phones now. They can indeed force you to use one of an approved list.
- lern_too_spel 3y ago
  > The App Store has always had far less of a malware problem than Google Play On the contrary, it has always been worse, not doing any dynamic analysis of its published apps and possibly not doing any static analysis either. Everything else is the same as Play Store. Xcodeghost infected a significant fraction of all iOS devices via Angry Birds 2, WeChat, and Didi Chuxing back in 2015, and Apple relied on outside security analysts to report the infected apps. There is no evidence that the App Store has improved since.