It's remarkable how fishy the whole ecosystem around Android ROMs and flashing tools really is.

95% of the posts are in barely comprehensible English. Seemingly every guide tells you to run a random binary from a file sharing host or generic domain.

As a rule, source code is non-existent. Downloads are attributable to a forum handle in the best case. Oh and you have to run it with elevated privileges to both your host computer and the device. Even the shadier warez communities have more accountability and trust.

In my opinion Google has really done a huge disservice by dropping support for their devices so rapidly and condoning planned obsolescence by handset manufacturers. They are directly responsible for channeling a significant fraction of Android users into this mess.

Yep. It's better than it was - most XDA developers understand what a GPL violation is.

I imported my Galaxy S8+ to save over $400AUD on retail. This meant I needed to find a ROM on an obscure site to flash to the phone using a stolen (?) piece of factory software. I can only trust my phone because a Samsung in default configuration won't accept a "modified" update - only one from and signed (?) by Samsung themselves.

Is LineageOS still using "test-keys"? It's been possible to do much better for years: https://mjg59.dreamwidth.org/31765.html

> using a stolen (?) piece of factory software

If you're referring to Odin, there's an open-source alternative in Heimdall (https://www.glassechidna.com.au/heimdall/).

>using a stolen (?) piece of factory software

You mean ODIN! That's probably leaked. Many good memories of that tool.

Android is as mature as Windows XP, every vendor has their own where they customised everything and no-one has a pristine one. And also the pre-installed ROM is also often the same quality as the warez.

I trust the community on XDA composed of actual users and developers who are also users, more than the faceless corporation whose profit largely comes from extracting as much of your personal information as possible and monetising it.

I’d rather trust a faceless corporation with a reputation to keep over a bunch of faceless anonymous dudes on a forum.

They're not anonymous, they're pseudoanonymous, which also means carrying a reputation; and if anyone tries to deceive, the community is not entirely full of idiots, unlike what a lot of others in this subthread seem to imply --- all it takes is for someone to find out and provide proof, and the news will spread widely.

The fact that people seem to be scared of and are basically unwilling to make their own decisions of trust in deference to central authorities says a lot about the state of society today... "distributed trust" and communual free sharing was the norm, until companies started to herd users into their walled gardens and control them by using the "security" argument.

No matter who you choose to trust there are going to be no insurance that vulnerabilities are actually fixed. Its not a magic bullet.

We are talking about a Nexus here so I can't really say that since it's Google but otherwise there's no guarantee that the ROM you have pre-installed does not have malware either.

Well, you’re free to compile the code yourself…

Yes and I'm sure that most people have both the time and the technical acumen to go through every line of the source code and ensure that there are no security vulnerabilities

Yeah, after all there are only several millions of lines of code. When they even share the code used for their builds, which is rare.

It's android, it's entire reason for existence is to be a malware platform.