Hello everyone, I know that on the website it is recommended to use the APK files provided by the developer on github over f-droid due to security reasons but I talked to someone about this topic and they said that it is better to download apps from f-droid because on github the dev can just put anything not on the source code to the APK file on releases while f-droid builds straight from the source code. I’m quite confused on whether I should get apps from f-droid or use something like obtainium. What do you guys say?
Here you go:
1 Like
Thank you but what about the possibility of the developer putting something unrelated to the releases apk? Is it still better then f-droid in that case?
1 Like
And that’s why its recommended to only use the apps and from devs you trust or care about. Not install anything willy nilly.
3 Likes
I see thanks. Well I don’t have any apps from untrusted devs but I think there is still chance they could get hacked or something like that, or is that overthinking it?
If you use select apps and are intentional about what you install on your device and know what you’re doing, then you’re fine. Just continue being mindful is all.
1 Like
Yes there is always a chance they get targeted and hijacked. Using f-droid will prevent this in only two scenarios, assuming f-droid itself is not hijacked:
- The developer contacts f-droid via a non-hijacked channel, prove their identity, and stop next update from being delivered.
- The malware used by the hijacked is trivial enough to get detected by the simple scanner f-droid uses.
If it is the second case, virustotal, Google play protect, and other malware scanning/prevention measures will perform similar/better.
So you can always just depends on play protect, scan apks with virustotal, etc. to get similar level of scanning as f-droid.
The best way would be to use reproducible apps and then build them yourself to compare with delivered apks, or use a repo that creates reproducible builds like izzyondroid, and trust they don’t get hijacked.
You could also build the apps on your own, and bypass all this. But then you depend on hijacker not pushing malicious code (like xz backdoor) into the repo or contribute code that is malicious but accepted by the maintainer.
Secure software delivery is hard.
1 Like
This is the main reason why I use F-Droid.
F-Droid ensures that the .apk 100% corresponds to the source code and that this can be verified.
How do you decide which devs you trust?
For most people this would mean just what their stomach tells them