[lukeschlather]

All apps should be open source and subject to verification by nonprofit repositories like F-Droid which have scary warnings on software that does undesirable things. For-profit appstores like Google and Apple that allow closed source software are too friendly to scams and malware.

[hasperdi]

I don't think that's a realistic suggestion as as the quantity of applications are huge who are going to spend time reviewing them one by one. And and even then it's not realistic to expect that that undesirable things can be detected as these things can be hidden externally for instance or obfuscated

[lukeschlather]

F-Droid exists and they have a much better track record than Google. I'm not actually serious, I just think if there's a single app repo that should be allowed to install apps without a scary 24h verification cooldown, it's Google's proprietary closed-source app store that needs the scary process, not F-Droid.

[silver_sun]

Users don't have to wait 24 hours because Google Play store already has registered developers. Scammers can be held liable when Google knows who the developer of the malicious app is.

[xp84]

Really though? Who is in jail right now for Play Store malware offenses? Or are we just talking about some random person in China or Russia who signed up with a prepaid card and fake information had their Google account shut off eventually.

[silver_sun]

I'll give you that, enforcement of the rules can sometimes fail. But scamming & malware is a global industry, definitely not limited to state-funded actors in those two countries (which is what I think you're referring to).

[collabs]

I think compared to the alternatives, this is the best answer.

Even if you are a bank or whatever, you shouldn't store global secrets on the app itself, obfuscated or not. And once you have good engineering practices to not store global secrets (user specific secrets is ok), then there is no reason why the source code couldn't be public.

[staticassertion]

That's absurd.

[RobotToaster]

No more absurd than letting a megacorp control what I install on my own device.

[staticassertion]

Instead the megacorp forces open source licensing, which doesn't solve any of this shit anyway lol

[array_key_first]

It's also true, the best way to audit software is source-code and behavior analysis. Google and Apple do surprisingly minimal amounts of auditing of the software they allow on the Play Store and App Store, mostly because they can't, by design. It should shock absolutely nobody then that those distribution methods are much more at risk of malware.

[staticassertion]

No one is auditing. Behavior analysis works on closed source software too.

[array_key_first]

Most open source repositories do have eyes on the code. Debian often has separate maintainers who maintain patches specific to Debian.

It's not a coincidence that Linux distros are much less susceptible to malware in their official repositories. It's a result of the system. Trusted software currated and reviewed by maintainers.

The play store will always have significant amounts of malware, so this entire conversation is moot.

[staticassertion]

A lot of dubious claims here.

1. "Most open source repositories do have eyes on the code"

Seems basically impossible that this is true.

"Debian often has separate maintainers who maintain patches specific to Debian." does not support the previous statement. Debian cherry picks patches, yes.

2. "It's not a coincidence that Linux distros are much less susceptible to malware in their official repositories."

Not only is it not a coincidence, it seems to not even be true.

3. "The play store will always have significant amounts of malware, so this entire conversation is moot."

This seems to just be "a problem can not be totally solved, therefor making progress on this problem is pointless to attempt". I... just reject this?

[tosti]

Refusing or rejecting the claims don't invalidate them.