I understand that probably there is little interest if you are a device ROM maintainer to embed a backdoor into it. But it’s still possible. Lineage has a fairly simple and open build process. Should I do it on my own? Or should I trust the maintainers and not bother? What are your thoughts?

  • neuromancer@lemmy.world
    link
    fedilink
    arrow-up
    19
    arrow-down
    1
    ·
    1 year ago

    Unless you are able to read/audit the code, you would need to trust the maintainers even if you run the build scripts yourself.

  • Crazyfrog@discuss.tchncs.de
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    It’s a very valid question in my opinion and as is often the case with security, it really depends on your individual threat model and threat tolerance. As you said it seems pretty unlikely that a maintainer would install malicious code as they have a reputation to protect. And as mentioned by another commenter, even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers. Personally for my threat tolerance, I do not see the risk as big enough to warrant the extra effort.

      • ono@lemmy.ca
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        You don’t need a powerful server to build LineageOS. 16 GB of RAM and some patience was enough when I last did it.

          • h3ndrik@feddit.de
            link
            fedilink
            arrow-up
            2
            ·
            edit-2
            1 year ago

            wow. yeah, i remember trying to build lineage for my old phone after support ended and the people on xdadevelopers also stopped making inofficial builds. my notebook wasn’t up to the task. not enough ram, too much data on the ssd.

          • ono@lemmy.ca
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            1 year ago

            My LineageOS 17 (Android 10) build tree is under 200GB. Adding a ccache dir puts it just slightly over that.

            Used hard drives twice that size are cheap.

    • SmoothSurfer@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      Auditing the code may seem as a problem but such a big project is already been auditing by many developers worldwide which means it is highly unlikely they all are sus

      • FarLine99@lemm.eeOP
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        We are talking about maintainer’s backdoor in build, not in original code 🙂

        • SmoothSurfer@lemmy.ml
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers

          That is what I was referring to. What I was saying is even if you cant audit the source code you still have reasons to trust the code

          • FarLine99@lemm.eeOP
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            Yeah, I have many reasons to trust the code. Definetly. If it is in build and nothing else then we are good!

  • SmoothSurfer@lemmy.ml
    link
    fedilink
    arrow-up
    4
    ·
    1 year ago

    If you decided to use ROM, at least do it the right way. Build it, what will you lose? Couple hours you cant touch your computer? Go touch grass

  • chi-chan~@lemmy.world
    link
    fedilink
    arrow-up
    4
    ·
    1 year ago

    Trust is something only you can give.

    I tend to trust known developers that work on projects without scandals in the last 5 years.

  • NoName@lemmy.world
    link
    fedilink
    arrow-up
    3
    ·
    1 year ago

    I decided to build lineage for myself mostly because i love how it looks and I’m currently running unofficial build from XDA forums but maintainer locked the thread and I’m not sure if he is still working on build or not so why not I just build one for myself. If I manage to successfully build it without bugs I might upload it to XDA forums. If nothing I will at least learn something new.