So why would someone release malware in f-droid, when the user base is not your average joe and would likely know how to counter or detect any attacks?

This is the second person in this thread to think using an open source repo as an example carries weight. There are less users, therefore less malware is released here in the first place and then there’s less load for the malware filters for that that does get through.

Your argument does not hold for GNU/Linux repositories. There are plenty of good targets there.

Oh sure, that’s why I didn’t include it. But we have historically seen issues with those repos haven’t we?

My comment stands, why target f-droid?

Because it's technically the same as GNU/Linux repositories (i.e. relies on community and FLOSS). Therefore, one can expect that when it grows, and average Joe starts using it, there will be no huge inflow of malware in it.

> But we have historically seen issues with those repos haven’t we?

Care to elaborate?

The two being open source is an apples to oranges comparison.

Here’s one issue we’ve had with these repos:

https://lwn.net/Articles/295406/

Then there’s things like NPM that’s broken quite a few production deployments in spectacularly public ways.