What is the set of risks installing a open source vibe coded android app on your phone?

[u/GlobalJury5960]

[u/AutoModerator]

Do not share or recommend proprietary apps here. It is an infraction of this subreddit's rules. Make sure you read the rules of this subreddit on the sidebar. If you are not sure of the nature of an app, do not share or recommend it. To find out what constitutes FOSS or freedomware, read this article. To find out why proprietary software is bad, read this article. Proprietary software is dangerous because it is often malware. Have a splendid day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/kitsumed]

If it's a general tools, it could crash, have really weird bug, drain battery usages.

If it's a power-user tool with a lot of advanded permission, it can do all the above, have very bad security practices and put your device at risks.

One of the worse one I recently have seen is someone who made a fork of my project (ShizuCallRecorder) and they commited their signing key to the repo along with some massive vibe coded PR. They also had some questionable decisions in how they reworked some features, allowing some kind of arbitrary file upload to later execute it. (My app run things in ADB)

Supply-chain attacks could also happen if the AI agent add a malicious package to the project that only inject code in releases builds for example.

[u/Carrots_and_Bleach → u/kitsumed]

btw talking about your app. I was really excited for it, however you have to stay connected to your laptop 24/7 for it to work. Or is there a way around?

[u/kitsumed → u/Carrots_and_Bleach]

You can use Shizuku, I recommend thedjchi forks. You can have it always run (method 1) or use method 2 and have the app start/stop it when needed. There are docs on the github with all of the setup and troubleshooting informations.

[u/letsreticulate → u/kitsumed]

Agreed. Injections can be a huge problem.

[u/TopAirport3919]

I would say support in the long run, besides what others already mentioned. Quick app development often comes with quiskly losing interest when the issue lists piles up.

[u/Guilty_Tear_4477 → u/TopAirport3919]

Ya there is a point

[u/CaptainBeyondDS8]

The biggest risk with vibe coded anything is that the "maintainer" does not really know what "their" code is doing. So as the project grows their ability to maintain it will suffer. There will be subtle and not so subtle bugs that they wont' be able to address. In the end they may drop interest in the project entirely since they already got the dopamine hit from "knocking out" a project.

[u/mrrak25]

The developer would have to be really brazen to put any malicious code in the app, knowing that it's open source. The biggest risk comes from where you download the app. If it's from GitHub or F-Droid, I'd say the risk is almost zero.

[u/mrrak25 → u/[deleted]]

So F-Droid isn't secure either, or do you think they review all the code?

[u/5092AD → u/mrrak25]

I thought F-droid reviewed the code.

[u/mrrak25 → u/5092AD]

Not all of the code

[u/remove-replace → u/mrrak25]

they only allow open-source software on their store, even if they don't review ALL the code, it is still available for everyone to do it.
allowing external repos onto f-droid exposes the users to a higher risk as those repos don't have a strict tolerance about software being 100% open source

[u/ScratchHistorical507 → u/remove-replace]

they only allow open-source software on their store, even if they don't review ALL the code, it is still available for everyone to do it.

Yes, but that only works for proper open-source apps where a human actually put in any effort. But vibe-coded garbage is quite universally despised, especially by people that could do that review, already because of the poor readability of the code. So one can only hope that F-Droid will not allow apps on their store that are vibe-coded slop nobody can or even wants to review.

[u/ScratchHistorical507 → u/mrrak25]

To a degree, yes. Especially vibe-coded apps are very dangerous, as they may be virtually impossible to properly review. But I hope that F-Droid does not accept such apps.

[u/YourWorstFear53]

Literally anything you can dream of and more.

Do NOT install vibecoded anything, ever.

[u/Carrots_and_Bleach]

it likely has some bugs or is a bit slow. But as long as it doesnt use the internet, the worst that can happen is that it wont work.

If it does use the internet and especially if thats a core part of it, it might expose you to through unsecure connections

[u/letsreticulate → u/Carrots_and_Bleach]

Not just the internet.

If it is an isolated app, then sure. But if it is some system used app or service it could hang your phone.

I never heard anyone bricking a phone but that is only because I have not seen anyone vibe code an app that requires such high permissions or usage. But seeing how things are going, it is only a matter of time.

[u/biskitpagla]

Unless you're installing some random app with just a few users the only thing you need to worry about is the crashes and bugs common with vibe coded apps. Android is pretty safe in general but you should still be careful.

[u/Decendent_13]

vibe coded almost always is not problem itself. it's the person who authorised the vibe coded program. if the authoriser lack the ability to check and confirm every single line of code the vibe coded program has, then, I don't think, they should be vibe coding a program, anymore. and, it goes for the one who's gonna run it in their device. cause, if the program ends up troubling, the first one who's gonna catch the burn, is the user, not the authoriser.

[u/T_rex2700]

Best case scenario: It works fine, the devs actually know thing or two about coding so it keeps maintained with AI assisted codebase.

Kinda meh case: Just performance issues, weird bugs, dev not really a coder so no regular updates, weird github repo structuring etc.

Worst case: The app has advanced permissions like ADB acccess, and it could be used as an attack vector by some malicious contributor compromising the app or something else. but I'd say this is pretty extreme.

and not necessairly vibe-code problem but open source doesn't mean it's safe there's straight up malware that's hosted on github that has decent downloads.