It seems that many Android devices won't safisfy the requirements, even when using a device approved by Google:

> MEETS_STRONG_INTEGRITY also includes the requirement that the device has received a security patch _within the last 12 months_

Good luck with that.

> He is probably closer to 0% within the demographic he is trying to conscript.

To be fair going against the demographic where you have a 0% approval rate does not lose you much.

At some point you need to be nice to your children or they'll not help you when you get old and senile.

> Localization files for every language on Earth - [...] - Samsung really wanted to make sure everyone on the planet could experience this suffering equally

Why are you considering localization as bloat? I bet your reaction wouldn't be positive if your native language(s) were missing instead.

Zero percent of users require 100 percent of languages at all times.

Sure, let's go back to the old days where you had to download language packs for windows and office.

The alternative would be the installer only installing the languages that match the system settings. Which yes is imperfect, but not nearly as bad as separate downloads or god forbid the two tier base language and modification pack system Microsoft came up with.

> So doesn't sound like a big deal for users, this is more of a datacenter sort of vulnerability.

If I understand it correctly though this can be used for priviledge escalation though, since it allows access to arbitrary memory.

> Nobody was reviewing protoc generated code

Are you seriously comparing LLMs with a deterministic code generator?

I don't think that's standardized, it probably only has some heuristic to detect a subscription's associated payments and rejects them. It will not integrate in any way with merchants to cancel the subscription on their side, and in fact they suggest to first trying to cancel the subscription on the merchant side.

To be honest the limited popularity of F-Droid also helps it be less targetted by bad actors. If it was more popular I would bet the situation would surely be different

This argument can be refuted by considering Debian repositories. No malware exists there despite it being a good target. It's the FLOSS that solves the malware problem, with a bit of moderation.

I'd argue OSS isn't sufficient on its own and that I suspect moderation only plays a small role. I think it's primarily the separation of roles. For a complete outsider whose only interest is exploiting users publishing a sufficiently popular piece of software and also gaining the ability to add things to the debian repos is a huge barrier. You'd have to invest years of work to do both of those things and then hope that no one happened to notice anything before it was too late.

Of course the FLOSS aspect adds an additional hurdle that this popular piece of software will have to somehow avoid having much of a contributor community around it since that would greatly increase the risks of your malicious changeset being reviewed. I guess what happened with XZ was about the best case scenario that an attacker could realistically hope for.

There were a few mishaps with PyPI and npm - including in the past week and even today. Not sure if those meet your criteria of FLOSS, but if it does I wouldn't call it solved.

Yeah but supply chain attacks like that can hit literally anything. Debian repos, Play store, an individual publishing on his own website, it's all vulnerable.

> Scraping static content

How do you know the content is static?

I don't see a replacement guide link on that page, but curiously there's this note:

> The aluminum upper case and installation screws are not included.

I would assume you likely need those too, as the article also mentions.

Wouldn’t the screws in your existing generally be reusable for this replacement?

the keyboard in the current macbook pro is RIVETED.

Yes, they're not highly torqued or anything. I would reuse them even if it did include new screws.

Repeated squares is a way to implement exponentiation, not multiplication.

Oops, yes, I meant exponentiation. Which you need (mod n) in RSA.