alt Hacker NewsWhat stops a bad actor from buying a bunch of these apps on fdroid adding malware to them and then having fdroid handle the distribution for you? I people did something similar with a bunch of plugins in the wordpress plugin archive.
What stops a bad actor from buying a bunch of these apps on fdroid adding malware to them and then having fdroid handle the distribution for you? I people did something similar with a bunch of plugins in the wordpress plugin archive.
F-droid doesn't simply distribute build apps. It requires the source to be open and will build the apps itself. This does not guarantee there will be no bad actors trying to slip in malicious code. I do believe they also do initial audits before an app is allowed in their repos. It also often takes a while for an app update to show up in F-droid, I am not sure if that is due to auditing updates or something else though.
More here:
- https://f-droid.org/en/docs/Inclusion_Policy/
- https://f-droid.org/en/docs/Security_Model/