I liked some of the apps at f-droid, [...], but is it safe to use apps from it ?
-anandcoral
I don't have an answer to your question, but below is a bit of how I see things.
With F-Droid, IIUC, the idea is that what's there is compiled from source code which you can examine. As to whether some things haven't been tampered with, I don't know -- e.g. by the folks who are performing the compilation and making the results available. I don't think the people who are compiling have examined the source code of the various projects in detail to try to assess security aspects (e.g. for design and/or implementation errors). Deliberate holes in the original source code seem less likely, but it still seems possible.
With the Play Store, AFAIU, what's there has not likely been tampered with since release by the original developer because of the digital signature scheme (though there has been at least one significant case of the scheme not working as expected and being exploited) -- but you don't really know what was in the source in the first place nor what might have snuck in during compilation -- most folks do not have access to the source code for most of the things on the Play Store.
With recent events, I think it's not too unreasonable to be thinking that if there's some place that one can hide something, sooner or later someone's likely to think of hiding things in those harder-to-examine places. It appears that in many cases it's economical to do so.
On a side note, I had the impression that you are/were interested in developing for Android -- so I thought that F-Droid might provide source code you might examine for studying purposes.
Show Posts
