Remember people, if newpipe give error when try to play a video, just turn your phone horizontally and vertically until the error leave. Is really easy

  • tetris11@lemmy.ml
    0·
    15 days ago

    not the best resource, but:

    we don’t audit every single app that makes it into the store. But we do make sure that everything is free software, and do test/investigate to a certain degree.

    From what I understand, F-droid regularly audits a few new apps for malicious code, and always makes sure that the source built the binary.

    With Github releases, maybe some of these binaries are generated by CI, but I’m betting more that they’re generated locally in dev and then uploaded to Github as direct releases. That is, the source you see on a repo on Github is not neccesarily the same source used to generate their binaries.

    To me that’s a wide angle of attack, and that’s why I stick with F-droid, even if it’s minimal checking.

    • N0x0n@lemmy.ml
      0·
      15 days ago

      From what I understand, F-droid regularly audits a few new apps for malicious code

      That’s a good point, but how can a malicious code be add to a source code from github? I mean if you only use trusted applications repos (most of them are already on f-droid anyway) there shouldn’t be any concern right?

      But reading from the link you posted there’s some chance of a MITM attack and send a malicious payload directly to Obtainium? (Correct me if I’m wrong).

      Github is not neccesarily the same source used to generate their binaries.

      Didn’t knew that :/

      Thanks for sharing your knowledge !