[jsjohnst]

Further, what does it being open source help? They could publish the app source without the tracking SDKs (especially as some of them are big enough now that you have to hassle with git-lfs even if you wanted to commit it) and then build it with the tracking SDKs before submitting to the App Store.

[wruza]

Other people could build these apps at build farm and publish under trusted vendor name like linux distributions do. You don’t trust vim.deb from anyone, but e.g. vim.org and ftp.??.debian.org/debian have at least strictly no intent to abuse you.

[jsjohnst]

You realize we are talking about iOS / the App Store, right?