Even if the keyboard is open source, you cannot guarantee that the app that is installed by the app store is the open source version.
this post was submitted on 06 Jan 2024
26 points (90.6% liked)
Privacy
32003 readers
732 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
The same can be said about any binary as well.
Not true, you get the open source code and you compile it yourself then compare the checksum of what you compiled with app installer. If they match that means they didn't add extra code besides whats in the open source.
Yes, the binary downloaded from an open source project might be different from the binary compiled on your own computer, even if they are from the same source code. Here are a few reasons why this can happen:
-
Compiler Differences: Different compilers or different versions of the same compiler can produce binaries with variations in performance and size.
-
Build Environment: The environment in which the binary is compiled, including the operating system and its version, libraries, and other dependencies, can affect the outcome.
-
Configuration Options: Most open source projects have various configuration options which can be enabled or disabled during the build process. The pre-compiled binaries might have a different set of configurations compared to what you choose when compiling it yourself.
-
Optimization Levels: Compilers have different optimization levels and settings. The binary provided by the project may be optimized for general compatibility, while you might compile with optimizations specific to your hardware.
-
Patches or Modifications: The official binary might include patches or modifications that are not present in the source code you downloaded, especially if it's from a different branch or a snapshot of the repository at a different time.
-
Reproducible Builds: Some projects aim for reproducible builds, where the same source code should generate an identical binary, but this is a challenging goal and not all projects achieve it.
Always ensure that you trust the source of any pre-compiled binaries, as they could potentially include malicious code not present in the source.
❤️
You're right of course. But just to add - 'reproducible builds' is an ongoing attempt to make hash comparisons practical.
It’s also a lot easier to do this on a desktop/server environment. Doing this on a popular mobile device would be difficult, and would require the OS developer be involved (and I doubt Google or Apple would be that open)
There are valid reasons the checksum might differ, just depends on
Correct.
Is it even possible to run a checksum on iOS though?
While the other responses so far have good info, none has offered a useful answer. Yes, apple collects data, but thankfully don’t sell it to the world. Buying a new phone isn’t a trivial expense so some of us are stuck for a bit. As a fellow IOS user (for now), I too would like to hear some more options.
The best I’ve found so far is Typewise. They claim to be private and secure but it’s closed source so so knows. Apple gets to review their code when submitting to the app store which says that Typewise collects some data but none of it is linked to the user. It’s freemium. Unfortunately, I don’t like their keyboard. Swipe typing is my personal requirement🙂
Maybe you shouldn't be using an iPhone if you want to download alternative apps
Apple and privacy does not come hand in hand.
Apple have their own eco system that are fully closed source. If you want to install apps from another place than from AppStore and if you don't live in EU, good luck.
If you want privacy, choose a custom ROM of Android that respects your privacy (like GrapheneOS) or (better yet) choose Linux. But to be honest, Android from Google (no custom ROM) do have better privacy options compared to iOS, mainly thanks to being able to installing and using apps with no Google account whatsoever.
And to answer your second question: Is your phone’s keyboard compromising your privacy?
While not FOSS, Typfinity is a great keyboard that I've used for a long time on iPad - I assume phone version works just as well.
As the person criticizing the top level comments, I just want to say thanks. This is a straight answer and an option that I wasn’t aware of. Looking into it!
Apple gets your voice recordings which for various privacy laws they can’t resell. “Yay wiretap laws from the 50s”
As for typing, a quick search, apple support claims that the keyboard cache is only used for autocorrect purposes. How often you use a word and how you like to spell it.
Having it function as a keylogger would give them a headache, from data use, battery life, hackers exploiting it, etc.
And of course the warnings seem targeted at third party keyboards who can add on extra feature beyond IOS barebones.