Classic Strawman argument:
http://en.wikipedia.org/wiki/Straw_man
My statement:
The statement you are countering:
My statement:
The statement you're countering:
How is it my opinion that the ROMs are posted by random guys?
Do you personally know them?
If so, is it verifiable that they work for Samsung/Google...whoever?
What makes you believe what they've posted is from a Samsung leak, because they told you?
Even if it were an official link, how do you know they haven't added something malicious to the code after receiving it, because they told you?
How do you know the link you're downloading is the same link the 100 people before you downloaded, which they claim is safe, because they told you?
Even if it's the same link, how do you know the 100 people before you, who claim it's safe, are real accounts? Because you can't believe that hackers would make 100 fake usernames?
How hard would it be for a hacker to make a new ROM, make a name for him/herself for a year, then put a Rootkit key logger in the newest release for a new phone? *How hard would it be for that person to silently switch the download link they are pointing to, only for a few minutes a month, long enough to infect 10 or so users, then switch back?
Forums get hacked all of the time, how can you verify that the username you've been trusting for new updates to the ROM hasn't been compromised, and the new download really is from them?
Many phones out there have custom ROMs posted by relatively new people, how can you verify them?
Our devices have a huge amount of personal information on them, including email passwords (which are stored
in the clear on Android), credentials to our bank, old emailed tax returns, credentials to our Paypal/Ebay/Amazon/AppStore...etc. accounts. Someone could easily find your social security number and address (tax returns) and go to town.
This is very big business, there is an unfathomably huge financial incentive for someone to gain access to our phones. I suggest checking out
http://krebsonsecurity.com/ - he's written stories of "Kingpins" who have built a fortune consisting of hundreds of millions of dollars through digital identity theft. Some groups have hijacked a a combined worth of over $1 billion.
Some of these people actually have websites where you can buy stolen credit cards/Paypal accounts...etc
in bulk. Heck if you buy enough they even give you a discount.
This is why big businesses don't allow rogue devices on their network.
UK banks incur nearly $5 million loss from Zeus Trojan
Arena firm loses $217,000 from a key logger installed from an email attachment.
KrebsonSecurity has a separate link specifically for attacks on small business
Here's a common example of a hacked email address leading to bank fraud
Furthermore, it has already been documented that the process of rooting your phone to add a custom ROM, can inherently make your phone less secure:
New Android Malware Attacks Custom ROMs
Considering the recent rise of
Malware in the Google Play store, and rise of people downloading
fake versions of Instagram, which end up installing a Trojan, it's clear there are people out there trying to infect our phones, what makes you think they wouldn't try to slip something into a custom ROM that people are downloading in large numbers?
Think about it, an entire group of people, who will download unverified copies of an operating system, from an easily anonymized source (a web forum) to put on the one device that has access to literally
everything they do online?
When there was a large demand for the RC version of Widows 7,
that's exactly what happened.
And your entire argument against that, is that they claim to be working with Samsung leaks, and they claim to not have modified them maliciously, and since I personally wouldn't do it, it constitutes my opinion?
My statement:
This is purely a technical argument. Technically, you are more at risk of Trojan Horses, Rootkits and undetectable Malware, when replacing your entire operating system with rogue code, than when running a .exe file. Yet, if a random guy posted a .exe file to a forum, claiming it will unlock cool new Windows features and you've got to try it, it wouldn't fly. The post would probably be deleted by the mods, since they already prohibit uploads of .exe files for that very reason.
Literally nothing you responded with is relevant to my statement, but you ended it with: