The software is installed from repositories (Cydia is a package manager), and those that come by default are supposedly the most reliable. We could differentiate between private repositories, where only administrators upload their software, and public ones where any user can propose an application.
I recently had contact with one of these public 'by default' repositories, and I was quite amazed by the very little control I had over the packets sent by users.
Full content in SdB

