- cross-posted to:
- askandroid@lemdro.id
- cross-posted to:
- askandroid@lemdro.id
I understand that probably there is little interest if you are a device ROM maintainer to embed a backdoor into it. But it’s still possible. Lineage has a fairly simple and open build process. Should I do it on my own? Or should I trust the maintainers and not bother? What are your thoughts?
It’s a very valid question in my opinion and as is often the case with security, it really depends on your individual threat model and threat tolerance. As you said it seems pretty unlikely that a maintainer would install malicious code as they have a reputation to protect. And as mentioned by another commenter, even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers. Personally for my threat tolerance, I do not see the risk as big enough to warrant the extra effort.
Agreed, too much hussle and money to rent powerful server.
You don’t need a powerful server to build LineageOS. 16 GB of RAM and some patience was enough when I last did it.
hmm, good news. but REALLY much disk space available, 300gb ~ 😁
wow. yeah, i remember trying to build lineage for my old phone after support ended and the people on xdadevelopers also stopped making inofficial builds. my notebook wasn’t up to the task. not enough ram, too much data on the ssd.
My LineageOS 17 (Android 10) build tree is under 200GB. Adding a ccache dir puts it just slightly over that.
Used hard drives twice that size are cheap.
👍
Auditing the code may seem as a problem but such a big project is already been auditing by many developers worldwide which means it is highly unlikely they all are sus
We are talking about maintainer’s backdoor in build, not in original code 🙂
That is what I was referring to. What I was saying is even if you cant audit the source code you still have reasons to trust the code
Yeah, I have many reasons to trust the code. Definetly. If it is in build and nothing else then we are good!