F-Droid (FOSS Android App Store)

[anon28734771]

@ph00lt0

Well yeah I do not use F-droid at all. Not via obtainium either. Maybe that’s why you do not understand me.

@ph00lt0

I just don’t see any point in including them in the chain of trust. I get applications from the developers of the services I use like signal, proton etc. They can just be directly obtained from the vendor. There is no need for some middleman that should be trusted with the reputation of those vendors nor my endpoint security.

Everybody has different preferences, opinions, threat models, etc. I don’t see a point in arguing about this anymore.

@ph00lt0

Trusting and using secure standards isn’t the same. Higher SDKs simply minimize risk also for the fact that they cannot be downgraded on update. Android 14 also blocks old target SDKs for security purposes.

A higher target SDK does minimize the risk; that’s true. But again, I trust the F-Droid team, and I could give root access to their clients, just like I fully trust GrapheneOS and use their OS. At this point, it is irrelevant to me if their client has a lower target SDK.

@ph00lt0

Google cannot force a developer to add something spooky to an app. Stop the FUD or add references.

When I was writing that post I predicted that someone might mistake alphabet boys (NSA, FBI, etc) with Alphabet company but I still wrote that. I wasn’t talking about Google.

@ph00lt0

We both know malware scanners are not going to cut this issue. It’s irrelevant to the discussion.

Better than no scanning. It doesn’t hurt. There is also that event where F-Droid caught a vulnerability in Simple Gallery, I think. If they didn’t catch that, vulnerability would still be present today.

@ph00lt0

I really don’t see how FCM is much of a threat when using sandboxed play services. It really isn’t much of an issue imho. Closed source doesn’t mean it is bad. But again not really relevant to the discussion as F-droid is not the only place you can get apps without FCM.

You need proprietary Google Play Services on your phone for notifications to work, apps need to have proprietary Google code in them for this to work, and this is a proprietary service.

You’re purely depending on Google and their proprietary services for basic things such as receiving notifications, which is pure madness. They also probably see from what apps you’re receiving notifications and when you receive them.

Good luck receiving notifications with this without FCM: Release Element Android v1.6.5 · vector-im/element-android · GitHub

There are quite some apps that only provide alternatives to FCM, Google Apps, etc in their F-Droid build.