I understand that probably there is little interest if you are a device ROM maintainer to embed a backdoor into it. But it’s still possible. Lineage has a fairly simple and open build process. Should I do it on my own? Or should I trust the maintainers and not bother? What are your thoughts?

  • Crazyfrog
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    It’s a very valid question in my opinion and as is often the case with security, it really depends on your individual threat model and threat tolerance. As you said it seems pretty unlikely that a maintainer would install malicious code as they have a reputation to protect. And as mentioned by another commenter, even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers. Personally for my threat tolerance, I do not see the risk as big enough to warrant the extra effort.

      • ono@lemmy.ca
        link
        fedilink
        arrow-up
        5
        ·
        1 year ago

        You don’t need a powerful server to build LineageOS. 16 GB of RAM and some patience was enough when I last did it.

          • h3ndrik@feddit.de
            link
            fedilink
            arrow-up
            2
            ·
            edit-2
            1 year ago

            wow. yeah, i remember trying to build lineage for my old phone after support ended and the people on xdadevelopers also stopped making inofficial builds. my notebook wasn’t up to the task. not enough ram, too much data on the ssd.

          • ono@lemmy.ca
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            1 year ago

            My LineageOS 17 (Android 10) build tree is under 200GB. Adding a ccache dir puts it just slightly over that.

            Used hard drives twice that size are cheap.

    • SmoothSurfer@lemmy.ml
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      Auditing the code may seem as a problem but such a big project is already been auditing by many developers worldwide which means it is highly unlikely they all are sus

      • FarLine99@lemm.eeOP
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        We are talking about maintainer’s backdoor in build, not in original code 🙂

        • SmoothSurfer@lemmy.ml
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          even if you compiled the code yourself, unless you can audit code yourself you still have to just trust the developers

          That is what I was referring to. What I was saying is even if you cant audit the source code you still have reasons to trust the code

          • FarLine99@lemm.eeOP
            link
            fedilink
            arrow-up
            1
            ·
            1 year ago

            Yeah, I have many reasons to trust the code. Definetly. If it is in build and nothing else then we are good!