Hacker News Reader

Comment by viraptor | Hacker News Reader

> but they are much less likely to contain/be malware or spyware

Is there any base for this claim? Play store has at least a system like Play Protect. Likely it's not ideal, but at least does some filtering. Does fdroid provide anything better, or is it just that it's not as popular so spyware authors are not interested?

View on HN

Depends on your definition of malware and spywayre. My definition is nothing like Google's.

I would agree that in general open source software is less likely to contain such things, since anyone who inspects the source would find the bad stuff.

Especially since F-Droid packages are mostly built from source on F-Droid infrastructure, and all source tarballs are kept forever. That way, even if something slips through, it can be tracked down.

https://f-droid.org/en/docs/FAQ_-_General/#whats-the-differe...

Most apps only require the minimum amount of permissions to work, that's a start.

But that's the author's choice. In malware/spyware scenario the author is malicious and not interested in minimal permissions.

The major huge difference is that because most apps request minimal permissions, the one that requests a lot (or an odd one) stands out against the background of the rest.

Whereas g-store apps, because they almost always request too many to begin with, train users that 17 different permissions for a 'flashlight' app is normal (made up example), and the malware does not stand out as 'odd' in that environment.

Reply on news.ycombinator.com