No signing also means that the workflow for developing malware for the platform is exactly the same, too. :)
My issue with the Apple ecosystem is not the cryptographic protections - it's with the fact that the keys aren't mine.
My issue with the Apple ecosystem is not the cryptographic protections - it's with the fact that the keys aren't mine.
For the librem it's just like a desktop computer, don't install software from untrusted sources, keep your stuff updated and you should be fine.
They don't do any instrumentation and often the developers themselves don't even understand what all the binary dylibs they're including do.
At any rate my general point still stands I think, it doesn't really matter whether librem apps are signed or not, what matters is where you put your trust. I'm sure some package managers (first party or otherwise) will be able to provide a curated experience if the platform is successful, like what linux distros offer.
Platforms that only run signed code permit that.
Like GNU/Linux repositories?
As for malware installation on Librem, that is a separate question. If you don't give apps root access and only install from the repos, you're about as secure as on Android or iOS. Once you start installing from unknown sources, however, it's true that you're screwed - but that's because of the permission system, not signing.
https://www.techradar.com/news/apple-app-store-is-apparently...