What keeps someone from doing the same thing to f-droid?

Fewer people run it so it's not as desirable a target.

"Security via unpopularity"

Aka, the Linux anti-virus.

Sometimes it certainly seems that way, but there was also period of time when Apache dominated the web and yet Microsoft's IIS was having a lot more exploits despite Apache having more market share. Marketshare isn't the only factor, but it probably is a factor.

I wonder if that might have been due to Windows market share? Windows was everywhere on the desktop, and those Windows desktops provide a good intermediary vector for attacking instances of IIS on Windows Servers.

Also, thinking back to the bad old days and the script-kiddie-eseque of many viruses of the early 2000s (iloveyou, et al), I suspect it may come down to attacking what you know: Windows was more prevalent and better understood so that's what people tried to break.

Not my field though, so all just speculation.

We're the exploits helped out in any way by Windows itself or were they solely exploiting IIS alone? Never used it but I assume at least before it may have been pretty integrated into Windows.

It's a factor, but is it really that big of a factor for Linux? I'd've thought that its usage on servers would make it a sizeable target (both as powerful machines to use in a botnet and as a way to compromise company information).

Attacks on servers are of a different nature. No one runs Linux desktop, so it is not a valuable target for trojans or other attacks like that.

If it were popular we'd see just as much malware for linux.

Desktop Linux just as well has software repositories, which are similar to app stores, but human beings look over each application that's included. And you find essentially all popular software in this trusted repository.

So, this strategy would barely work, as users would only look on the internet for a download, if it's not in this trusted repository and then it's gonna be a really unpopular application. (Theoretically, it's possible for your grandma to go on the internet before checking this trusted repository, but that is really just so much more effort.)

Linux user base also has an effect. It's all people who know what they're doing or someone having a newbie relative using it just for browsing the web.

If Linux was 90%+ of the market, getting people to download some stuff with a curl command promising some BS or having people download and run sudo would only need to touch a fraction of users to be highly valuable. That's just a random example off the top of my head. And also because I don't use Linux on desktop so I don't fully know how everything works there.

You're spot on.

And if someone thinks regular people would be "too scared" of CLI to pipe curl into sudo sh, remember that people are "too scared" of developer tools in browsers too, and yet Facebook and others have to implement self-XSS protection measures in there, because it turns out there's nothing too complicated in computing when it stands between a person and fulfilling their desire (as promised by a scammer).

Yeah for sure about the "too scared" to do any CLI or any other different sort of thing. I've had some Mac friends just copy paste homebrew stuff in. Without any knowledge of how popular it is or if they are for sure on the correct site. They just knew I said homebrew [cask] is good and installed it. They could've easily gone to a wrong site and gotten screwed over. Half these people are people into gadgets and electronics, but probably will only open terminal once a year on their Macs, if that much.

> similar to app stores, but human beings look over each application that's included

I'm sure that's not true for all Linux repositories. But humans certainly do look at all apps going to the App Store.

You can't put up a wordpress site with more than 4 plugins selected at random on a linux box that is secure. I even experienced a THEME that was hacked.

That’s more a PHP problem than a Linux problem; a lot of the Wordpress hacks don’t care about compromising your system at large as long as they can just take over your www-data user.

Can't that also be because that's easier to do and already lucrative enough for the hackers? Not the only reason, but a big reason? Add on that a ton of [hacked] wordpresses are in jailed settings.

> No one runs Linux desktop

roughly 3% of the world internet users. Sure, 3% is not much, but it's still multiple hundred of millions of people

You're off considerably. The world population is only 7.6 billion, if every single person on the planet used the internet and 3% were using Linux to do so it would barely multiple hundreds of millions (228 million).

The actual number of users is closer to 3 billion, so even if your 3% is correct (it isn't) that's not even 100 million.

That's also assuming that every user of the internet is a laptop or desktop to access the internet, but that isn't case. More and more people are only using a smartphone or tablet, especially in emerging markets.

> so even if your 3% is correct (it isn't)

The netmarketshare stats have been hovering around this for a few months, and all the "global internet usage" stats that I could find were closer to 3.75 billions.

Even then, assuming 3 billion, it's still 90 million users... that's most than the inhabitants of any country in the european union

Universities and teams within corporations run Linux desktop, though. Maybe they'd make for specialized targets?

There is ransomware in the wild for Linux desktop now, iirc propagating through Flash.

The existence of desktop Linux malware is not at issue here.

isn't it more like Apple anti-virus?

"Security via obscurity" is the popular phrase.

That’s something different, though.

Or (seriously) one of the reasons I use a windows phone!

Still? I love Windows Phone relative to other mobile OSes and I clung to webOS for as long as possible. But seems like clinging to Windows Phone still has to be tough at some point. The ecosystem is gone.

Agreed. At least with Google, we have something big to blame on.

Besides assuaging feelings of rage what does this accomplish exactly?

Blame, nothing. But a single app store means only one place to remove offending apps from.

Potential for class action lawsuits?

Maybe they have package vetting process with an actual human inside?

You're basically saying that f-droid is better because it's small. Nothing to do with its selling point of being FOSS.

(And for the record I'm an f-droid user)

1) What does it matter? If it's better by being small, it's still better.

2) The F-Droid maintainers manually build the apps on F-Droid from the respective code repositories. They will notice when something like that is off. This has to do with it being FOSS.

And if you're wanting to tell me that this doesn't scale, not really, no, but it's the same thing that Linux distros have been doing for a long time and Red Hat, SUSE, Canonical actually do have a crapton of users, especially on the server side.

Manual code inspection and FOSS or closed is entirely orthogonal to typo squatting of package names.

Every one of those distros gets around volume of desired apps by allowing the inclusion of third-party repos (e.g. current Python or docker) which in turn introduces typo squatting as a vector.

You're asking for app store maintainers to slow everything to a crawl and never get popular. No entity which wants to be successful will do that, corporate or otherwise.

They don't. More exactly, they try to vet things, after the fact, and not covering anything. Source : their own faq.

I skimmed their docs and I don't see any sort of language that corroborates what you are claiming.

They DO seem to have some sort of review process in place:

https://f-droid.org/en/docs/Inclusion_How-To/

See: Application Review Process.

I don't know how exhaustive it is or how effective it is in practice though.

They don't do a thorough code review, but they are human beings and they manually build the software from its code repository, so they will notice these kind of discrepancies.

They have software dev process with actual human, inside.

>they can save me from a typo in the web search, but can't in the Play store.

Besides machine intervention, this seems like a company the size of Google could easily help (if not solve) while creating a lot of good will by hiring a few at-home workers to better flag or check in on certain applications. Off the top of my head, this wouldn't require a ton of training and you could even provide burner-like phones for folks to download the apps to and play a bit on.

It could easily be hooked it into their existing opinion rewards program. Every time a new app is published on the play store or the name of an existing app is changed, just ask a half-dozen real verified humans if it matches the name of an app they've heard of before. I'd be happy to do it once a week or so for ten cents of play store credit.

> They can save me from a typo in the web search

Well, I'm not so sure. For example, if you search, in French, for the correctly spelled phrase "Avez-vous aidé quelqu'un aujourd'hui" they suggest the wrong spelling "Avez-vous aider quelqu'un aujourd'hui", which is a grammatical abomination.

https://i.imgur.com/em6t9qS.png

> That's another reason to switch to F-Droid.

But if you need to download WhatsApp to communicate with loved ones, you can't get it from F-Droid, right?

The best way to download whatsapp is to search for it on google and click the top result to go to the official website. Then click download from there. It turns out the age-old method of installing shit is the best.

Usually there is no download link (nor is there in the case of WhatsApp, as far as I can see), but a link to the Play store web interface.

Yeah a link to the play store is what I meant. That's guaranteed to point to the genuine app.

In a way, you can: https://f-droid.org/app/com.javiersantos.whatsappbetaupdater

The method the other commenter suggested also works.

But yes, these are anecdotal for WhatsApp, which I presume was just an example on your side.

You'd have to mainly use F-Droid and then make some exceptions for those apps. You could also use Yalp store (which interfaces with the Play Store) or Aptoide to get those apps, if you don't want to keep the Google Play Services around, though I cannot make any claims of these being more secure.

If your loved ones require you to install crap on your phone to communicate with you, do they really love you?

If you won't install what you call crap and they call good or great on your phone to communicate with them, do you really love them?

Great reply.

Your question demands an answer, for real. As does mine.

I used to begrudge my friends when I was depressed and isolated (self-sabotage). Why weren't they communicating with me in my ways? They were, but not frequently enough to satisfy me. But in the end, them reaching out multiple times when I was available in only one or two spots, was very commendable and I appreciate the friends that did.

There has to be a middle ground. In this case, unfortunately, besides close friends or family who know something about tech, you will have to be the one to compromise and use their apps. Plus, I've seen getting people to move to your communication methods which are less popular usually leads to less talking. Not always, just something I've noticed isn't uncommon. I end up talking to people more if we just use FBM or iMessage or something.

Don't be dense. Not everyone has the technical skills to decide which is the best app to message others. People just go with the popular ones or the ones their family/friends use.

Google has no incentive to police the store or protect it’s user’s devices. They only care about getting more people on the Android platform so they can increase their search and advertising revenue. They could give 2 shits about the Play Store.

The fact that android is such a mess is the reason I use an iphone. If and when they start caring about the quality of the android experience, including the play store, I may be tempted back.

Meanwhile: https://news.ycombinator.com/item?id=15627880

That seems like a rare occurrence. My macOS install is screwed up. I'm not entirely sure if it's something on my end, the hard drive, MacOS or something else. But I'm not going to straight up just blame macOS or Apple MacBook hardware for the issue when maintenance others do not seem to be having the issue. That seems far too assuming and rash.

So you won't blame Apple, but will blame Google? :)

But that's counter intuitive. I for one don't use android simply because of the play store. If you take care of the developers, they'll take care of the apps which will bring the people in.

One incentive to police the store is that quality is a draw for users.

What's the alternative, iOS? That's great for people with financial stability in developed nations, but that leaves out swathes of those in developing nations.

Old & new previous-gen iPhones are available at Android prices, including “free with contract” (in the US at least).

They aren’t cutting edge, but neither are the equivalently priced Androids.

I have an Android dev phone that cost £19, no contract, about half-to-a-third the price of a then-equivalent second-hand iPhone. In third world countries even a £19 device is worth stealing, as a friend of my partner experienced.

Wow, that is cheaper than I expected. What brand?

Vodafone sold it (pay as you go, no contract) with only their brand visible, but I think it’s an Alcatel device under the paint. The model is no longer being made, but their current cheapest model is almost as cheap.

Old iPhones are still prohibitively expensive in developing countries. Brand new low/midrange Android phones usually cost half or less.

Good catch. Didn't even think about that.

F-Droid