Comment on Nextcloud cries foul over Google Play Store app rejection

• sommerset@thelemmy.club ⁨2⁩ ⁨months⁩ ago

  What is the point of obtainium ? Over fdroid?

  source

  • Wispy2891@lemmy.world ⁨2⁩ ⁨months⁩ ago

    You get apps a couple days earlier

    But it comes with a huge downside: if dev goes rogue or gets hacked, you could install a malicious version of the app that doesn’t match the source

    source

    • 9488fcea02a9@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

      “If dev goes rougue”

      Isnt that a risk for all app stores?

      source

      • Wispy2891@lemmy.world ⁨2⁩ ⁨months⁩ ago

        For fdroid the app is compiled on fdroid servers when dev tags a new release on GitHub. So the app matches the source, it’s not possible to put a tainted APK to download

        Now, if the malicious code is slowly added to the source over the course of an year like it happened with the xz utils, this won’t change the result, but it’s easier to do so with a compiled binary. Release clean source and infected binary, it will take a longer time to get caught

        For the closed source app stores, on iOS there’s the manual inspection (which is not infallible especially if they timebomb or geofence the bad feature) and for Google there’s the automated inspection (which fails often seeing the news) that should find problems

        source

        • -> View More Comments