Hacker News Reader

I understand your point, but to add to the discussion:

With android, you can use the F-Droid app store, which have "source builds". Source builds are apps built (and signed) by F-Droid, so you only need to trust the F-Droid team instead of each OSS app developer (and you can use alternative repositories if you don't).

So OSS can be the solution.

Sadly such solution is not available on the locked-down iOS ecosystem...

View on HN

Adding to this:

f-droid also encourages reproducible builds: https://f-droid.org/en/docs/Reproducible_Builds/

This means you can verify the APK on the f-droid store matches what's in github by building it yourself and comparing the signatures.

And if you want to do this, f-droid has an automated way: https://f-droid.org/en/docs/Verification_Server/ Of course, you still have to trust the verification server source code, but that runs locally on your hardware and is auditable.

Reply on news.ycombinator.com