There is no guarantee that the released app is exactly the same as the source code when getting it on Google Play. You’d have to decompile or compile from source and try to compare.

Using F-Droid is good alternative.

If we are talking about bigger projects with hundreds of thousands or millions of downloads, than this may be true. But smal scale projects have so few people actively looking through them that even to automatic scan done by the playstore has a higher chance of catching malware. It doesn’t even have to be bad intent, two years ago there was a virus propagating trough the Java class files in minecraft mods which reached the PCs of quite a few devs before it was caught.

I don’t dislike FOSS, a lot of the apps I use come straight from github, but all this talk about them beeing constantly monitored by third parties is just wishful thinking.

Yes, opensource doesn’t magically fix all vulnerabilities. But it is for sure way better then closed source, where you don’t have a way of auditing the code

Neckbeards love to pretend open source magically has no security vulnerabilities

Who does? Feels like you’re just talking about inexperienced “btw i use arch” kinda skiddies

I have never seen anyone make that claim.

Lots of arguments saying it’s an improvement, but never that it magically fixes everything.

Another classic lie. ‘Open source’ misses the point of libre software. Anti-libre software [malware] bans us [everyone else] from removing malicious source code.

Yes, but we don’t know what we don’t know. There are many problems like that in open source too, and even if we can look nobody does.

Therefore I find it problematic to say that just because you use open source programs you’re safe like the parent tried to.

Yes, that is true, but let’s not pretend that just because some one is theoretically able to, that all source code is constantly monitored by 3rd parties.

With the new changes to the repo management, that’s not going to remain true for much longer.

Very disingenuous of you to fight a strawman and proclaim victory by claiming that I said things which I never did. But if that’s what floats your boat. But for everyone else, try to find any mention of anti-libre software in the original claim.

It was invented to derail libre software.

.

Contributing isn’t the point. AGPL helps us keep control of our own computing.

Then why is this the subtitle:

The apps identified have since been removed from Google Play, but make sure you didn’t install one.

He’s being condescending because he believes as a developer nothing is actually fully secure. If I spend 100 hours building and securing something, that’s not going to stack up very favorably vs the 1,000’s or even 1,000,000’s of hours attackers and communities can spend trying to break my security layers.

Basically, he’s a dick in how he answered the question, but the truth every software engineer learns, is that there is no fully secure system. There’s always an angle/attack vector you didn’t think of and secure.

They actual report does say it just displays a fake login page. It’s just phishing.

For a real answer here’s the Zscaler blog write up: zscaler.com/…/technical-analysis-anatsa-campaigns…

It looks like they are doing it after app install with a malicious patch. This patch asks for SMS and accessibility access to gain privileges necessary to get into the banking apps. I haven’t thoroughly read it but just looking at the attack chain that’s what I gleaned.

As an Android developer that comment makes me sad. Then I remind myself that Lemmy is full of people who migrated from Reddit.

There’s no such thing as perfect security… unless your application is trivial and doesn’t do very much. Android is designed to collect data from the dozen plus sensors on your phone in order to get money from app vendors to push ads.

Android as a system has too many moving parts. You not only have to worry about various device manufacturers compiling their own versions of AOSP, you have to worry about how manufacturers package unremovable apps like facebook, candy crush, etc.

The backdoor is actually the front door… and it is app vendors who are actually the customers… not the phone owners.

The main reason smartphones took off is that business people were salivating at an always on, always listening device with 10+ sensors collecting data on this whole world. And we pay for the privilege.

Android has to be designed to collect data and show you ads. Is it really surprising that security here is just security against free access to this data from outsiders… and not caring about your security?

Physically? So the dev has to come ask you in person?

It does, you have a full screen scary warning when an app asks for these accessibility permissions. Clearly many people just give it to a random QR code reader app for some reason.

“Accessibility service permissions” is a higher level of permissions than most apps get and Android will be all like “bro, are you sure you want to grant this app that kind of access and control? You really sure?” I’ve got a few apps on my phone with that level of permissions including one written by Google. They’d simply be unable to do their job without that level of access, jobs which have been straight-up good for my physical health. Ultimately there’s a balance between security and letting the user do what they want.

Yeah, sure, where to? I live in the Netherlands, one of the wealthiest countries. I’ve seen many parts of the world in my time in the navy. There aren’t many places better then here, honestly. Only Norway scores higher, they have a lot of things worked out much better then the rest of us. But paying with plastic is very common there too. Also, digitalization doesn’t have to be bad. Look at Estonia, I think many countries can benefit from their system. See here a video on it by Kraut. There’s a difference between digitalization and a system like China has. But my expenses should be private at least, so cash would be best. They just make it harder every day. We used to be able to say “I’m not interesting, no one cares what I do, no one is going to check me”. But now we have AI, now every one of us indeed IS interesting. And everyone is being checked to teach the algorithm. Countries with few laws to protect privacy and welfare of it’s inhabitants, like the US for example, can turn to a totalitarian control state in no time with just one crazy idiot as a leader. At least the US never had idiots as president 👀. At least the US doesn’t have a history of wanting to collect everyone’s data 👀. At least they are not actively doing anything with the data, like China or Russia does 👀.

But on your point of living in a dystopian world: Yeah, we fucking do. But it doesn’t matter where we live. It’s dystopian everywhere. We live in World War III while we have to fight to get the bare minimum of privacy, we must work our ass off for the bare minimum of living standards and we buy products we do not own. Difference between the rich and poor has never been as high as now and the military strongest countries are run by idiots and dictators. Mass amount of people see Elon Musk as our savior for a better future, the biggest narcissistic hypocritical scam artist our there. At least Trump isn’t president anymore. Oh wait… Seriously, the movie Idiocracy isn’t a comedy, it’s a documentary. I seriously think the US would benefit if it had Dwayne Elizondo Mountain Dew Herbert Camacho as president over Trump.

While the rest of the world turns more extremist every day (especially right wing) with rising world tensions.

So if I plan on moving it will be out of the world of the living at best.

If that actually happens money is literally just paper at that point.

The $1 in my account actually grows. Sorry you don’t understand basic finance.