3 ms·

Not going to lie, if I were trying to infect some devices, it might be through “porting” unofficial “patches” (that no one will ever realistically inspect) for

Not going to lie, if I were trying to infect some devices, it might be through “porting” unofficial “patches” (that no one will ever realistically inspect) for 10+ year old, out-of-support devices whose users have allowed root access.

Sytten 3y ago
XDA works a lot on reputation and realistically you will infect like 1k phones none of which will be high value targets. I don't see the motivation. Those maintainers do quite a lot of work to backport patches every week/month and offer OTA. Also I dont enable root when flashing, that is not required at all.
- eli 3y ago
  think about it the other way: if someone who happens to use random ROM happens to be a target of a state security agency of course it would be trivial to infect and the other 999 users would be collateral damage.
  - jojobas 3y ago
    If state security agency is your model threat you'll be hard pressed to stay secure even with an airgap. If it's wholesale worm-like attacks you'll be way ahead of the curve by using a niche ROM from a god-forsaken site compared to any slightly out-of-date OEM distro.
- WWLink 3y ago
  Realistically, if someone makes a fringe rom that may be downloaded a few thousand times, how many people are going to bother checking for nefarious exploits hidden in there? I hate that I wrote that lol. It reeks of the kind of cybersecurity whataboutism that leads to people inconveniencing the SHIT out of themselves for the sake of security.
  - Sytten 3y ago
    I think human laziness can be counted on. Realistically I dont see any benefit in doing something nefarious and there is karma like on HN.
- woah 3y ago
  Wait... so because you don't want to be infected because you're using an out of date OS, you load OS patches of questionable provenance, but you're not worried about that since nobody would bother to infect you anyway? Why not skip a few steps there and just run an out of date OS?
  - yjftsjthsd-h 3y ago
    Every device running an old OS is vulnerable, so it's better to throw the dice on an aftermarket ROM. Edit: Though to keep things fair, it must be said that that particular argument only really applies to old devices. If you have a new device (or rather, one still getting regular security updates from the vendor) and a trustworthy vendor, a person could reasonably argue for staying on the stock ROM.
    - woah 3y ago
      Fair point

Sytten 3y ago

XDA works a lot on reputation and realistically you will infect like 1k phones none of which will be high value targets. I don't see the motivation. Those maintainers do quite a lot of work to backport patches every week/month and offer OTA. Also I dont enable root when flashing, that is not required at all.

eli 3y ago
think about it the other way: if someone who happens to use random ROM happens to be a target of a state security agency of course it would be trivial to infect and the other 999 users would be collateral damage.
- jojobas 3y ago
  If state security agency is your model threat you'll be hard pressed to stay secure even with an airgap. If it's wholesale worm-like attacks you'll be way ahead of the curve by using a niche ROM from a god-forsaken site compared to any slightly out-of-date OEM distro.
WWLink 3y ago
Realistically, if someone makes a fringe rom that may be downloaded a few thousand times, how many people are going to bother checking for nefarious exploits hidden in there? I hate that I wrote that lol. It reeks of the kind of cybersecurity whataboutism that leads to people inconveniencing the SHIT out of themselves for the sake of security.
- Sytten 3y ago
  I think human laziness can be counted on. Realistically I dont see any benefit in doing something nefarious and there is karma like on HN.
woah 3y ago
Wait... so because you don't want to be infected because you're using an out of date OS, you load OS patches of questionable provenance, but you're not worried about that since nobody would bother to infect you anyway? Why not skip a few steps there and just run an out of date OS?
- yjftsjthsd-h 3y ago
  Every device running an old OS is vulnerable, so it's better to throw the dice on an aftermarket ROM. Edit: Though to keep things fair, it must be said that that particular argument only really applies to old devices. If you have a new device (or rather, one still getting regular security updates from the vendor) and a trustworthy vendor, a person could reasonably argue for staying on the stock ROM.
  - woah 3y ago
    Fair point