• Jako301@feddit.de
    link
    fedilink
    English
    arrow-up
    19
    ·
    5 months ago

    If we are talking about bigger projects with hundreds of thousands or millions of downloads, than this may be true. But smal scale projects have so few people actively looking through them that even to automatic scan done by the playstore has a higher chance of catching malware. It doesn’t even have to be bad intent, two years ago there was a virus propagating trough the Java class files in minecraft mods which reached the PCs of quite a few devs before it was caught.

    I don’t dislike FOSS, a lot of the apps I use come straight from github, but all this talk about them beeing constantly monitored by third parties is just wishful thinking.

    • Miaou@jlai.lu
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      2
      ·
      5 months ago

      I’m not sure you’re understanding the argument: you cannot monitor closed source, therefore, you have at least as many eyes looking at my random crap on github as you do on the random crap some companies are doing.

      • Jako301@feddit.de
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        edit-2
        5 months ago

        And you didn’t understand what I said. While you can not monitor closed source at the code level, you definitely can monitor the apps behaviour. Even the automatic threat protection from the playstore protect function is worth more than the measly amount of people looking through smaller projects codebases.

        I hate Google with a passion, but with all their control over android devices, they are more than capable of scanning apps for malicious behaviour and automatically removing them. These few apps in the article are the 0.01% of malicious apps that their algorithm didn’t detect.

    • Excrubulent@slrpnk.net
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      6
      ·
      5 months ago

      Okay, but that’s a different claim than that you have to personally vet and compile every single thing you use, which is what I was responding to.

      Open source isn’t perfect, but it is objectively and obviously better than closed.

      • Jeena@jemmy.jeena.net
        link
        fedilink
        English
        arrow-up
        2
        ·
        5 months ago

        My whole point is that you can not point to a 3rd party checking for you and claim that it secure because someone else already checked. And I brought two examples which contradict this claim.