7 ms·

> F-Droid builds are custom signed and can be made by random parties without proper auditing after initial review. F-Droid follows a similar model to tradition

> F-Droid builds are custom signed and can be made by random parties without proper auditing after initial review. F-Droid follows a similar model to traditional linux package managers which has shown time anda gain the they are both trustworthy and secure (or at least, they offer the user the freedom to choose the level of trust they have in the package signers). When installing from a Debian repo, I'm typically installing a package that is not build/signed by the upstream developer. I am implicitly (in the case of a default install) trusting the Debian developers signing practices or explicitly (if you add a third party repo). This means you trust both those in charge of the building/packaging/signing as well as the upstream developers. The same is true of F-Droid. Of course, the notable exception is that F-Droid also supports upstream packages signed by the developer if the builds are verifiably reproducible.

nosedief 5y ago
There is a difference in your Linux desktop workstation and your most private device. Desktop systems are not nearly as secure and should not be seen as such, and Linux surely at the tail end. People using F-Droid might not be aware that they are trusting a third party as they think it is a trusted distribution channel, relying on the information stated on the client app or website.
- lolinder 5y ago
  In order to get started with F-Droid you have to jump through several hoops with strong warnings from Android about allowing third party apps to install applications. Here's the exact text of the warning: > Your phone and personal data are more vulnerable to attack by unknown apps. By installing apps from this source, you agree that you are responsible for any damage to your phone or loss of data that may result from their use.
- toastal 5y ago
  > your most private device What? A smart phone is just a computer—they are the same thing. Everything from private chats to TOTP tokens are on both my phone and my laptop. The only difference is my bank cries if I’m rooted on my phone and says nothing about it on my laptop.
  - themacguffinman 5y ago
    A smartphone is a computer that is more involved in your private activities. For example, a phone is likely to be on your body when you move around the city and talk to other people so it is exposed to more private information about you than a stationary desktop will be.
    - toastal 5y ago
      You haven’t met me but my laptop basically goes everywhere with me and has for the last dozen years. It also has cameras and mics I have to deal with. And with 5G coming to laptops and how to get those speeds the signals have to target your device, we will always be tracked as long as we touch cell networks... just as you can being on WiFi or having an IP address. I don't feel my phone is closer to me in any way.
    - hansel_der 5y ago
      not to disagree, but imo the main point here is that almost everybody has a smartphone but only a minority has a desktop computer, so it makes sense to care mostly about the phone thingy.
    - amatecha 5y ago
      Right, it's in your pocket while you are having private conversations, it's on the bedside table while you're... well, in bed. Surely this gets the point across. You probably don't ever want to be running some malicious actor's software on it.
    - kuschku 5y ago
      So don't keep location services on and don't give microphone/camera permissions to apps you don't trust? You'll very likely have much more personal data (personal emails, tax returns, banking data, etc) on your PC than on a phone that's just got a few social media apps on it.
- upofadown 5y ago
  Surely a desktop running a well respected Linux distribution is much more secure than any smartphone. It will be locked for much of the day, possibly with disk encryption. There are few services (any?) exposed to the network. The software can be all open source, both OS and applications. The only weakness would be the web browser, and there are web browsers used on smartphones.
  - PausGreat 5y ago
    Desktop operating system are less secure than mobile devices. Linux is also the worst of desktop operating systems. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
  - NateEag 5y ago
    I think iOS devices are much more secure than a Linux desktop. Any iOS device that has not been registered with Apple for use on a dev team or rooted can run only built-in apps and ones instslled from the iOS Store. That means it can only run apps explicitly approved by Apple. Sure, Safari has had some zero days, as has iOS generally, but as Heartbleed, Shellshock, and Log4Shell have shown, open source is not magical fairy dust that makes things secure. Overall, my bet's on the team at Apple being better at securing their systems than the random collection of individuals and overworked maintainers that have assembled the parts in a modern Linux desktop.
    - kuschku 5y ago
      > Any iOS device that has not been registered with Apple for use on a dev team or rooted can run only built-in apps and ones instslled from the iOS Store. Can't you run any app you want if you install it through XCode for up to 7 days, even without registering as developer? I thought that's how several of the unofficial iOS AppStores for apps that break the rules of the regular sandbox work
      - NateEag 5y ago
        I've never heard of this ability. Do you have a link describing it? I've been maintaining an iOS app generation framework at $DAYJOB, and I've never found a way to run Xcode builds on physical devices short of actually registering the device with Apple for that purpose. If there's a way to work around it, I'd be shocked and delighted.

nosedief 5y ago

There is a difference in your Linux desktop workstation and your most private device. Desktop systems are not nearly as secure and should not be seen as such, and Linux surely at the tail end. People using F-Droid might not be aware that they are trusting a third party as they think it is a trusted distribution channel, relying on the information stated on the client app or website.

lolinder 5y ago
In order to get started with F-Droid you have to jump through several hoops with strong warnings from Android about allowing third party apps to install applications. Here's the exact text of the warning: > Your phone and personal data are more vulnerable to attack by unknown apps. By installing apps from this source, you agree that you are responsible for any damage to your phone or loss of data that may result from their use.
toastal 5y ago
> your most private device What? A smart phone is just a computer—they are the same thing. Everything from private chats to TOTP tokens are on both my phone and my laptop. The only difference is my bank cries if I’m rooted on my phone and says nothing about it on my laptop.
- themacguffinman 5y ago
  A smartphone is a computer that is more involved in your private activities. For example, a phone is likely to be on your body when you move around the city and talk to other people so it is exposed to more private information about you than a stationary desktop will be.
  - toastal 5y ago
    You haven’t met me but my laptop basically goes everywhere with me and has for the last dozen years. It also has cameras and mics I have to deal with. And with 5G coming to laptops and how to get those speeds the signals have to target your device, we will always be tracked as long as we touch cell networks... just as you can being on WiFi or having an IP address. I don't feel my phone is closer to me in any way.
  - hansel_der 5y ago
    not to disagree, but imo the main point here is that almost everybody has a smartphone but only a minority has a desktop computer, so it makes sense to care mostly about the phone thingy.
  - amatecha 5y ago
    Right, it's in your pocket while you are having private conversations, it's on the bedside table while you're... well, in bed. Surely this gets the point across. You probably don't ever want to be running some malicious actor's software on it.
  - kuschku 5y ago
    So don't keep location services on and don't give microphone/camera permissions to apps you don't trust? You'll very likely have much more personal data (personal emails, tax returns, banking data, etc) on your PC than on a phone that's just got a few social media apps on it.
upofadown 5y ago
Surely a desktop running a well respected Linux distribution is much more secure than any smartphone. It will be locked for much of the day, possibly with disk encryption. There are few services (any?) exposed to the network. The software can be all open source, both OS and applications. The only weakness would be the web browser, and there are web browsers used on smartphones.
- PausGreat 5y ago
  Desktop operating system are less secure than mobile devices. Linux is also the worst of desktop operating systems. https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html
- NateEag 5y ago
  I think iOS devices are much more secure than a Linux desktop. Any iOS device that has not been registered with Apple for use on a dev team or rooted can run only built-in apps and ones instslled from the iOS Store. That means it can only run apps explicitly approved by Apple. Sure, Safari has had some zero days, as has iOS generally, but as Heartbleed, Shellshock, and Log4Shell have shown, open source is not magical fairy dust that makes things secure. Overall, my bet's on the team at Apple being better at securing their systems than the random collection of individuals and overworked maintainers that have assembled the parts in a modern Linux desktop.
  - kuschku 5y ago
    > Any iOS device that has not been registered with Apple for use on a dev team or rooted can run only built-in apps and ones instslled from the iOS Store. Can't you run any app you want if you install it through XCode for up to 7 days, even without registering as developer? I thought that's how several of the unofficial iOS AppStores for apps that break the rules of the regular sandbox work
    - NateEag 5y ago
      I've never heard of this ability. Do you have a link describing it? I've been maintaining an iOS app generation framework at $DAYJOB, and I've never found a way to run Xcode builds on physical devices short of actually registering the device with Apple for that purpose. If there's a way to work around it, I'd be shocked and delighted.