Welcome!
I mean if you only use trusted applications repos
Trusting an application means trusting every developer who has contributed to its codebase. The XZ attack showed that it just takes one pushy contributor to completely expose an attack surface.
The only thing you can really trust is applications that you build yourself and can personally vet the source for. No one does that of course, so we place some trust in authorized developers (e.g. archlinux-keyring) who have been vetted by their various organisations. With Github, no such vetting occurs, it’s just some guy/girl hosting their code.
MITM attack to Obtainium
I have to admit I don’t know much about the security that Obtainium uses. I’m hoping everything is TLS certified to make MITM difficult, but I don’t know those details. All I do know is that you’re getting binaries hosted by someone on github who might have zero cred in FOSS circles.
not the best resource, but:
we don’t audit every single app that makes it into the store. But we do make sure that everything is free software, and do test/investigate to a certain degree.
From what I understand, F-droid regularly audits a few new apps for malicious code, and always makes sure that the source built the binary.
With Github releases, maybe some of these binaries are generated by CI, but I’m betting more that they’re generated locally in dev and then uploaded to Github as direct releases. That is, the source you see on a repo on Github is not neccesarily the same source used to generate their binaries.
To me that’s a wide angle of attack, and that’s why I stick with F-droid, even if it’s minimal checking.
Test video:
https://www.youtube.com/watch?v=CJHB72L9UXA
I can confirm this does not work, and I get the sad face each time
But that’s patently untrue: take this 10 MB example TIFF file as an example.
PNG Compression, max compress (=quality 9):
convert file_example_TIFF_10MB.tiff -quality 9 test.png
JPG Encoding, 99% quality (=quality 99):
convert file_example_TIFF_10MB.tiff -quality 99 test.jpg
Final file size comparison:
9.7M Sep 5 13:21 file_example_TIFF_10MB.tiff
1.7M Sep 5 13:22 test.jpg
2.5M Sep 5 13:22 test.png
PNG is significantly larger, and difference in quality between them is negligible
Eh sure, if you’re within the central ring road all you really see are EVs, but my ex’s dad definitely drove his old guzzler through the other rings and was far from alone from doing so. Then again, that was over 5 years ago, so the blanket ban may have spread outwards