I understand that probably there is little interest if you are a device ROM maintainer to embed a backdoor into it. But it’s still possible. Lineage has a fairly simple and open build process. Should I do it on my own? Or should I trust the maintainers and not bother? What are your thoughts?
Unless you are able to read/audit the code, you would need to trust the maintainers even if you run the build scripts yourself.
I am more okey with trusting LineageOS team. Less with some random maintaner from internet.
You can verify the official builds were signed with their key.
Fair point!
It’s a very valid question in my opinion and as is often the case with security, it really depends on your individual threat model and threat tolerance. As you said it seems pretty unlikely that a maintainer would install malicious code as they have a reputation to protect. And as mentioned by another commenter, even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers. Personally for my threat tolerance, I do not see the risk as big enough to warrant the extra effort.
Agreed, too much hussle and money to rent powerful server.
You don’t need a powerful server to build LineageOS. 16 GB of RAM and some patience was enough when I last did it.
hmm, good news. but REALLY much disk space available, 300gb ~ 😁
wow. yeah, i remember trying to build lineage for my old phone after support ended and the people on xdadevelopers also stopped making inofficial builds. my notebook wasn’t up to the task. not enough ram, too much data on the ssd.
My LineageOS 17 (Android 10) build tree is under 200GB. Adding a ccache dir puts it just slightly over that.
Used hard drives twice that size are cheap.
👍
Auditing the code may seem as a problem but such a big project is already been auditing by many developers worldwide which means it is highly unlikely they all are sus
We are talking about maintainer’s backdoor in build, not in original code 🙂
even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers
That is what I was referring to. What I was saying is even if you cant audit the source code you still have reasons to trust the code
Yeah, I have many reasons to trust the code. Definetly. If it is in build and nothing else then we are good!
If you have the free time and the technical expertise, go for it!
💯
If you decided to use ROM, at least do it the right way. Build it, what will you lose? Couple hours you cant touch your computer? Go touch grass
Fair point.
Trust is something only you can give.
I tend to trust known developers that work on projects without scandals in the last 5 years.
Good approach!
Don’t do it for security reasons. Do it because you can😎
I decided to build lineage for myself mostly because i love how it looks and I’m currently running unofficial build from XDA forums but maintainer locked the thread and I’m not sure if he is still working on build or not so why not I just build one for myself. If I manage to successfully build it without bugs I might upload it to XDA forums. If nothing I will at least learn something new.
👍😃
