4 ms·

> F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open sou

> F-Droid compiles open-source apps on their own servers, so the source code they receive is the source code the compiled APK uses. Even if your app is open source, there's no way to upload a precompiled APK to the F-Droid website. This makes introducing malware without anyone noticing quite difficult. This is a common model, and is basically how most Linux distros work, but it only scales (safely) with people actually paying attention. How many people does F-droid have reviewing the apps that update that they build? I agree it will be hard to introduce malware without anyone noticing in a strict sense, I'm just not sure they have enough resources to notice before it becomes a problem given how I assume that must work, but I would be happy to be wrong.

jeroenhd 3y ago
You're right, of course; being open source does not automatically make apps safe. There's a vetting process by the F-Droid devs before an app gets added ot the repo, but after that changes get picked up without an in-depth review. With F-Droid it's almost impossible to hide the infection. Once your malicious code has been found eventually, you're one quick scan of every other app away from getting all of your infected apps kicked from the store. You can obfuscate your source code, but that makes any app with obfuscated source code suspect immediately. This is a lot harder with precompiled apps, especially those loading native libraries. With the tens of thousands of vague shadow companies that hobbyists and small dev shops have left behind over the years, it's impossible to find out which apps to reverse engineer if you're looking for similar infections. Obfuscating compiled code is quite normal as well, whereas open source projects stand to gain very little from obfuscating their source code. You still need a certain level of trust (and a certain amount of hobbyists/security researchers to go through the apps) but that's inherent in any modern computer system. The days of the VIC-20 where one person could understand the entire system from top to bottom are long behind us, for better and for worse.

jeroenhd 3y ago

You're right, of course; being open source does not automatically make apps safe. There's a vetting process by the F-Droid devs before an app gets added ot the repo, but after that changes get picked up without an in-depth review. With F-Droid it's almost impossible to hide the infection. Once your malicious code has been found eventually, you're one quick scan of every other app away from getting all of your infected apps kicked from the store. You can obfuscate your source code, but that makes any app with obfuscated source code suspect immediately. This is a lot harder with precompiled apps, especially those loading native libraries. With the tens of thousands of vague shadow companies that hobbyists and small dev shops have left behind over the years, it's impossible to find out which apps to reverse engineer if you're looking for similar infections. Obfuscating compiled code is quite normal as well, whereas open source projects stand to gain very little from obfuscating their source code. You still need a certain level of trust (and a certain amount of hobbyists/security researchers to go through the apps) but that's inherent in any modern computer system. The days of the VIC-20 where one person could understand the entire system from top to bottom are long behind us, for better and for worse.