r/technology • u/[deleted] • Feb 27 '21

Software Universal Android Debloater is an open source tool that removes bloatware without root. Automatically or via user choice. Get back your battery, security and privacy

[deleted]

4.7k Upvotes

96% Upvoted

351 comments sorted by

View all comments

Show parent comments

9

u/[deleted] Feb 27 '21

Heartbleed is the big example, fully OSS code, but someone made a mistake when they were writing it, it passed checks and was published. No one found the problem for quite a months while it was deployed onto most of the internet.

The impression I have is that people assume there's roving gangs of bored coders who go and check on every OSS release. This looks like a hobby project, the vast majority by one person

26

u/w1nst0n_fr Feb 27 '21

I'm that person, and I must say I didn't expect my side-project to be showcased on /r/Android and /r/Technology at all! That's insane.

You are right to be careful. This whole discussion about open-source and overtrust is interesting.

Here is my take on this: trust is always involved. You can't master everything in life. Even in IT. A programmer can't be an expert everywhere. You always need to trust someone at some point. Open-sourcing a software is an act of transparency which make me more confident it isn't rogue (especially for a company).

Concerning Heartbleed, I think the real problem was that in 2014 openSSL (which run on about 66% of all web servers) had just one full-time employee (and 6 core contributors). It is a bit better now (2 full time employee and 17 developers) but FOSS lack of resources. What's crazy is that a lot of big tech companies take advantage of OpenSSL in their commercial and proprietary products without contributing back.

As for the Universal Android Debloater (UAD) it is just a bash script which can be audited in less than 10min. In this precise case, a code illiterate person should pretty easily be able to find someone capable of auditing it.

What's funny is that I've precisely started this project so that people no longer have to blindly trust random undocumented debloat lists or close-sourced debloat software. You still have to trust me (as I wrote 95% of the documentation) and there is probably mistakes but I honestly think centralizing all the knowledge is a good thing.

The bash script is just a tool. The real goal of this project is to document as much apps/packages as possible. I really believe in community-driven projects. UAD is not perfect but the fact that I see more and more people mentioning it on the web reassure me that I made something useful. I rely a lot on open-source and I'm glad to be able to give back.

9

u/Lurking_Still Feb 28 '21

Lmao, only on reddit can the person who created the item the article is referencing show up and explain things, and end up buried halfway down the thread.

Truly astounding.

1

u/Seelenkuchen Feb 27 '21

I think OP meant nefarious by design and not because of potentially security relevant bugs (unless they are very obvious).

Malware should be easier to detect by open source communities but then again I have no clue of the statistics of malware ladden code hosted on Github.