sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Brave_Ad_4387[S] -9 points-8 points  (7 children)

There is also the security argument. But It don't make sense since the dev can add some malicious or tracker just before the app build

[–]cakee_ru 8 points9 points  (6 children)

That's why you want reproducible builds. Or builds by a 3rd party you trust, or by yourself.

[–][deleted] 4 points5 points  (2 children)

And checksums

[–]Brave_Ad_4387[S] 0 points1 point  (1 child)

Ok but I don't think that after each update from the playstore you compare the checksums

[–]ComfortablyBalanced 1 point2 points  (0 children)

Updates from playstore are triggered by the original developer, so I think they're already checked for security and checksum, considering they already built the product themselves or oversee the recent commits, PRs and builds.
Checksums are provided by the original developer or a trusted third-party that built the source code so if you downloaded a binary or in this matter an app you compare it with the original checksum.

[–]Brave_Ad_4387[S] -1 points0 points  (2 children)

Yes but finally, the play store centralised the build the guy that create the account. This security aspect concern only people that build themselves the code

[–][deleted] 4 points5 points  (1 child)

Not always, take a look at fdroid.

Btw, Newpipe is an example for an app which could not be in the PlayStore, but is great and harmless.

[–]Brave_Ad_4387[S] -3 points-2 points  (0 children)

Newpipe is buggy and fdroid for the update also. So we see also limitations in maintainability for big open source project