Rewrite Obtaining Applications: Recommend F-Droid over Obtainium and the Aurora Store

[Privium]

@Cyber-Typhoon

What about Google Play from GrapheneOS? How do we rank it?

Alongside the Aurora Store.

@hashcatHitman

If you’re worried about too many people making requests to F-Droid’s servers, Obtainium is actually the solution. Many open source apps have APK releases right on their repository (as in, GitHub, GitLab, Codeberg, etc, not the F-Droid repo). You can (and should) be using Obtainium to download directly from the developer whenever possible.

1. DDOS attacks are only a problem with unofficial clients. This is why PG only recommends F-Droid Basic and not Neo Store or Droid-ify anymore.
2. APK releases downloaded from Github aren’t usually verified and independently reviewed. You have to verify the app yourself.
3. As SkewedZeppelin pointed out, getting random APKs from Github repos sets us back a decade in security. It’s not much different from downloading .exe files off websites and installing them.

There are advantages of using Obtainium, primarily faster updates, but some developers host their own F-Droid repos with up-to-date packages. Additionally, IzzyOnDroid delivers reasonably fast updates while reviewing each app for security.

A lot of the stuff in PrivSec’s article might be outdated now.

@TheDoc

Could you substantiate this claim? This is the crux of the issue. If F-Droid addressed most of the security concerns, I assume people here would be more open to recommending it so long as there wasn’t a fatal unresolved issue.

• The anti-f-droid take is uninformed - #15 by EvanCarroll
• How do you obtain your Android applications - #16 by jonah