# The anti-f-droid take is uninformed **URL:** https://discuss.privacyguides.net/t/the-anti-f-droid-take-is-uninformed/20439 **Category:** Questions **Created:** 2024-08-30T04:55:35Z **Posts:** 57 ## Post 1 by @EvanCarroll — 2024-08-30T04:55:35Z Writing in response to the guide [Android\> Obtaining Applications](https://www.privacyguides.org/en/android/obtaining-apps/#f-droid) guide, which says, > We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above. F-Droid is often recommended as an alternative to Google Play, particularly within the privacy community. […] However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages… F-Droid is by no means perfect, but the reality is that only with a third party can you ensure that builds are secure and protect your information and privacy. There is no magic GitHub action that does this. You can either trust F-droid, or you can trust 10,000 individual developers none of which provide insights into the package, or test it for things you value – like privacy. It’s trendy to dis F-droid, but you’re talking about people in the business of stamping things as secure, and which have a universal open source and automated process they provide for every app developer. In all but the most extreme cases, it’s a value add. You can’t trust your average developer to be as rigorous as the F-Droid community and their build system – they’re not. And some of it just incorrect, for example: > Additionally, the **requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play** , meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet [modern security standards](https://developer.android.com/google/play/requirements/target-sdk). Just straight up incorrect. The vast vast majority of apps on the Play Store (99%?) would not be allowed in F-Droid. F-Droid is far more conservative. It requires FLOSS software, many of the Google APKs even if they ship everywhere are blacklisted, and all projects must provide a publicly available source repo to pull from. Here are a few cases where I’ve seen it matter. (I can’t post more than two links in my initial post). I’m a new user here. --- ## Post 2 by @EvanCarroll — 2024-08-30T04:56:09Z OSMAnd+ was for a long time delisted on F-Droid. Why? Because it sends telemetry to their own server. This is patched. But only for the F-Droid version. Get it on the PlayStore or from the developers directly, you have telemetry. [Osmand - sends telemetry to index server even if telemetry is disabled (#2747) · Issues · F-Droid / Data · GitLab](https://gitlab.com/fdroid/fdroiddata/-/issues/2747) --- ## Post 3 by @EvanCarroll — 2024-08-30T04:56:49Z Flipper Zero Android: Same story. The official Flipper Zero application provides click tracking and telemetry. The nature of the flipper inclines me to be highly concerned about that – this can actually get users arrested. [Remove Countly tracker library. · Issue #593 · flipperdevices/Flipper-Android-App · GitHub](https://github.com/flipperdevices/Flipper-Android-App/issues/593) --- ## Post 4 by @EvanCarroll — 2024-08-30T04:57:23Z StreetComplete: In this case the author didn’t even know he wasn’t using free software. In fact, **GOOGLE WAS RELEASING IT WITH A MISLEADING HEADER AND THEY DIDN’T KNOW**. This was a binary blob and there was no source code for it. Google only “open-sourced” the headers (as if they didn’t know the difference) [non-free dependency: Google AR Core · Issue #4289 · streetcomplete/StreetComplete · GitHub](https://github.com/streetcomplete/StreetComplete/issues/4289) The author assumed the binary blobs were open sourced and had community oversight… until F-droid informed him otherwise because of their build systems. --- ## Post 5 by @anon48875053 — 2024-08-30T05:32:30Z You still have to trust the developers of your apps, but now you’re just adding another party to trust, which is F-Droid. F-Droid doesn’t audit the code that they build, they just use some fairly simple automated scanning, etc. > [@EvanCarroll](#): > > OSMAnd+ was for a long time delisted on F-Droid. Why? Because it sends telemetry to their own server. This is patched. But only for the F-Droid version. Get it on the PlayStore or from the developers directly, you have telemetry. [Osmand - sends telemetry to index server even if telemetry is disabled (#2747) · Issues · F-Droid / Data · GitLab](https://gitlab.com/fdroid/fdroiddata/-/issues/2747) Telemetry is allowed on F-Droid, but if you do have telemetry in your app, then your app will be marked with an Anti-Feature. --- ## Post 6 by @EvanCarroll — 2024-08-30T05:35:17Z No, I don’t have to trust the developers. There is a system in place that checks for external IO during build, that checks for blacklisted modules, that builds without binary APKs etc. It’s a checks-and-balance system. You can call it “fairly simple automated scanning” but it’s not that simple. I’ve given you clear examples that aren’t hypothetical of it being a value add in the domain you’re most concerned about: privacy. And it still is: most of OSMAnd+ and Flipper still ship the versions with trackers on the Play Store on Github. > Telemetry is allowed on F-Droid, but if you do have telemetry in your app, then your app will be marked with an Anti-Feature. So long as the telemetry library is an SDK and not a blob (as it is in the case of Google SDKs), yes. Sure. You can ship with a notification. And that’s the ideal right – inform your users, something you can’t get with Play Store or on GitHub. --- ## Post 7 by @anon48875053 — 2024-08-30T05:36:53Z These automated scans rely on badness enumeration, you can read about it here: [Badness Enumeration | PrivSec - A practical approach to Privacy and Security](https://privsec.dev/posts/knowledge/badness-enumeration/) --- ## Post 8 by @securitybrahh — 2024-08-30T06:30:25Z I believe obtainium is kinda the best way to obtain apk’s rn if you trust the devs. F-droid can just be used to read its report because of that inclusion policy. --- ## Post 9 by @anon48875053 — 2024-08-30T06:35:03Z > [@securitybrahh](#): > > I believe obtainium is kinda the best way to obtain apk’s rn if you trust the devs. The best way to obtain apps for most people is by using the sandboxed Google Play Store. --- ## Post 10 by @Cyber-Typhoon — 2024-08-30T06:36:53Z … and if you really want to install your applications sourcing from F-Droid, Obtainium gives you this option. I wonder if some day we will see more apps available in Accrescent. --- ## Post 11 by @anon48875053 — 2024-08-30T06:38:17Z > [@Cyber-Typhoon](#): > > … and if you really want to install your applications sourcing from F-Droid, Obtainium gives you this option. And you will be pretty much DDoSing [f-droid.org](http://f-droid.org). Because Obtainium doesn’t have proper support for mirrors. > [@Cyber-Typhoon](#): > > I wonder if some day we will see more apps available in Accrescent. Yes, when Accrescent releases a stable version. --- ## Post 12 by @EvanCarroll — 2024-08-30T06:39:22Z It’s not true that it just relies on badness enumeration. - The list of external sources that you can pull from during build for example, is white listed… [fdroidserver/scanner.py · master · F-Droid / fdroidserver · GitLab](https://gitlab.com/fdroid/fdroidserver/-/blob/master/fdroidserver/scanner.py#L456) - There are checks for example that ensure you’re not stuffing Zip files with improper extensions into your APK, [fdroidserver/scanner.py · master · F-Droid / fdroidserver · GitLab](https://gitlab.com/fdroid/fdroidserver/-/blob/master/fdroidserver/scanner.py#L103) The extensions that are acceptable for the zip mimetype, are whitelisted: .zip. No one is arguing that F-Droid is perfect, but as a matter of fact it is more _restrictive_ and provides an additional checks over just downloading an APK from GitHub release which could just be malware. And I would be interested in seeing what ideas you have for the F-droid scanner that they’re rejecting. I’m showing **actual examples where they make things more secure for users and protect their privacy**. Your response isn’t a refutation, it’s a theoretical point that blacklisting isn’t good enough (which is true, it’s not all they’re doing), and it’s also silly because the alternative you’re accepting and that privacyguides is pushing is _nothing_, just blind trust for the author. Show me a PR where you have an idea for an improvement and a patch that’s rejected. I doubt you’ll find any of these tests no matter how basic in a CI on GitHub. --- ## Post 13 by @Cyber-Typhoon — 2024-08-30T06:40:56Z Didn’t know this, learned something new. Thanks :slight_smile: --- ## Post 14 by @jonah — 2024-08-30T06:42:38Z I would say that these are good points for apps on F-Droid _which are actively developed_. One of the biggest problems with F-Droid (IMHO) is the amount of abandonware. I can [search for a fairly common thing like “GitHub”](https://search.f-droid.org/?q=github&lang=en) and the first result is an app which has received no updates since 2014, just as one of many possible examples. --- ## Post 15 by @EvanCarroll — 2024-08-30T06:50:45Z Click the button on the top-right it should show a clock if you want to order by date. The first relevant result then is Octodroid, albeit there are lots of irrelevant results. OctoDroid was last updated 2 months ago. But I’m not here to defend the UI. :wink: I’m just saying the information, including the last-updated date, is presented to you. And there are **REAL CONCRETE** benefits to your privacy to use F-Droid. I provided not 1, but **3 real world cases that directly impacted me**. I’m not a maintainer. I don’t publish packages on F-Droid. I’m just a user. And this guide seems both wrong in spirit, and factually wrong in the words too “less strict” in the context of privacy, means the apps are more likely to reveal your information. Of course, probably 99% of the apps people download from the Play Store have trackers. I don’t think anyone in this conversation can show you **one** application with a tracker library and no notification on F-Droid now. And, many of the applications without trackers are **ONLY** available on F-droid (and not on GitHub). --- ## Post 16 by @anon48875053 — 2024-08-30T06:53:58Z The biggest problem is that apps can fall behind on updates for weeks, which is why I stopped using F-Droid after advocating for it for quite some time. One example: LibreTube on F-Droid is 0.14.0 and on GitHub it’s 0.15.1. --- ## Post 17 by @anon48875053 — 2024-08-30T06:57:27Z > [@EvanCarroll](#): > > And, many of the applications without trackers are **ONLY** available on F-droid (and not on GitHub). Which is a poor choice by the developers. Molly does it right and provides both Molly and Molly-FOSS on GitHub. You can find both Aves Gallery and Aves Gallery Libre on GitHub and Accrescent. --- ## Post 18 by @jonah — 2024-08-30T06:58:33Z It’s not really a question of UI, I’m just saying that Google Play **is** indeed stricter than F-Droid in some respects. In other respects, the reverse is true as you’ve mentioned. It is a legitimate problem for these ancient apps to be available and prominently advertised, the minimum SDK targets exist for a reason. --- ## Post 19 by @EvanCarroll — 2024-08-30T06:59:41Z They fall behind on updates sometimes, sure. That’s very frequently because of failures to build because of the violations we are mentioning here. (Like for example, in the case of Street Maps, mine was like 3 months out of date. But that’s because the author incorporated that Google ARCore SDK which was closed source. I’m glad they didn’t roll that out to me. It probably would not have worked anyway: I use LineageOS wo/ GApps). But sure, even in ideal conditions sometimes their builds break. It’s certainly more often then I’d like too, I just accept that forcing users to build outside of their ideal environment is something that’s required to ensure apps meet a **higher standard of privacy** , and that should be the value here too on a site called Privacy Guide. The priority shouldn’t be fast-deployments. Forcing the build in a constrained environment is more work, and more room for failure. --- ## Post 20 by @anon48875053 — 2024-08-30T07:02:52Z > [@EvanCarroll](#): > > They fall behind on updates sometimes, sure. That’s very frequently because of failures to build because of the violations we are mentioning here. It’s not just because of violations. Your MR has just been merged, but the APK did not show up immediately? That’s normal: the APK must first be built on the build server _(happens automatically when the next build cycle starts)_, then signed _(manual step)_, then a new index must be created and deployed. - a build cycle currently can take up to 72h _(hard limit)_ - apps are manually signed after that _(if not reproducible)_, and then uploaded - next build cycle starts after signing is completed So if you’re lucky, it takes 3 days _(new build cycle just started minutes after the merge)_. If you’re not-that-lucky _(merge happened a minute after a build cycle started)_, it will take 6 days. If you’re very unlucky, Murphy visits in between with some problems… So don’t panic before 7 days have passed, please. :wink: Please also note that the website is updated asynchronously – so while the index might already have reached your local client, website might still be a bit behind. > **[FAQ · Wiki · F-Droid / wiki · GitLab](https://gitlab.com/fdroid/wiki/-/wikis/FAQ#how-long-does-it-take-for-my-app-to-show-up-on-website-and-client)** > > Wiki for all things free software, Android, and of course F-Droid --- ## Post 21 by @anon48875053 — 2024-08-30T07:06:29Z > [@EvanCarroll](#): > > I use LineageOS wo/ GApps). Which is a scary thing to use if you care about security or even privacy because you need some level of security to uphold your privacy. --- ## Post 22 by @EvanCarroll — 2024-08-30T07:31:08Z > It’s not really a question of UI, I’m just saying that Google Play **is** indeed stricter than F-Droid in some respects. In other respects, the reverse is true as you’ve mentioned. _stricter_ in what sense though? Define it without an example. It’s stricter because F-Droid has worse searching. I’ll give you that. There are 2.4 M packages on Google Play. There are 4,400 Apps in F-Droid and another 2,800 in the Archive. I’m just not following. F-Droid has old ones, and probably more old ones by percent. But the only problem there is searching. Of the ones in F-Droid how many of those 4,400 have undisclosed trackers by percent? (0%, or close to it) How many of them in Google Play have undisclosed trackers by percent? I just don’t understand how we’re using _stricter_ in the context of privacy. --- ## Post 23 by @anon48875053 — 2024-08-30T07:33:25Z > [@EvanCarroll](#): > > There are 4,400 Apps in F-Droid and another 2,800 in the Archive. A significant percentage of these 4,400 apps are abandonware. > [@EvanCarroll](#): > > How many of them in Google Play have undisclosed trackers by percent? Read the privacy policy and/or check the source code of the apps that you’re using. > [@EvanCarroll](#): > > I just don’t understand how we’re using _stricter_ in the context of privacy. Higher target API level = more security and privacy, sometimes even more or better functionality. --- ## Post 24 by @Niek-de-Wilde — 2024-08-30T07:47:56Z While the OP makes some interesting points, I do think its funny how people can barge in here like the Koolaid man calling our takes uninformed while it may just be that we are informed, but of a difference in opinion :slight_smile: --- ## Post 25 by @securitybrahh — 2024-08-30T10:14:22Z > [@anon48875053](#): > > sandboxed Google Play Store. Paid apps maybe (I’d prefer Aurora with compartmentalized gmail) non-FOSS apps? maybe. I’d still prefer Aurora. Banking Apps? Definately! --- ## Post 26 by @bigdzi — 2024-08-30T10:24:16Z Im a bit confused: is it OK privacy-wise to use FDroid or not? --- ## Post 27 by @redoomed1 — 2024-08-30T18:06:02Z 6 posts were merged into an existing topic: [Aurora store not secure?](/t/aurora-store-not-secure/19692/4) --- ## Post 29 by @Tech-Trooper — 2024-08-30T10:49:05Z I completely agree with the OP. Sandboxed Google Play is not Silver Bullet. It’s not a magical or sacred thing. Still you are using Google and you must have a G account. I have a pixel which I don’t use any GAFAM apps or accounts. So, each way has their pros and cons. Regarding abandonware, we are not talking about average joe searching on Fdroid. Average Joe will not also use Sandboxed GPlay. As long as you know the app you install I don’t see any problem here. --- ## Post 30 by @anon48875053 — 2024-08-30T11:09:52Z > [@Tech-Trooper](#): > > Still you are using Google and you must have a G account. What’s the problem with that? You barely need to provide any information to have one. --- ## Post 31 by @asanyan — 2024-08-30T12:35:02Z Also, to be on fdroid the app must actually be buildable from source, so “fake open source apps” won’t make it to the repo --- ## Post 32 by @tomasz86 — 2024-08-30T12:49:58Z > [@anon48875053](#): > > What’s the problem with that? You barely need to provide any information to have one. Depending on the country, you may need to provide both your birthdate and a valid phone number to create a new Google account. This is quite a bit of information :wink:. --- ## Post 33 by @anon48875053 — 2024-08-30T12:52:44Z > [@tomasz86](#): > > birthdate Provide fake birthday information. > [@tomasz86](#): > > phone number That is only required when your IP reputation is low. I have created dozens of Google accounts without a phone number using all major VPN providers or just public Wi-Fi. --- ## Post 34 by @tomasz86 — 2024-08-30T13:04:52Z > [@anon48875053](#): > > That is only required when your IP reputation is low. I think this depends on the country/language as well. For example, if you try to create a new account using the Google’s website in Korean, it seems to always ask for a phone number. You’re right though that it doesn’t necessarily do that when using the English site. --- ## Post 35 by @Niek-de-Wilde — 2024-08-30T13:20:36Z Accept that some people don’t want to agree with google’s privacy policy and simply choose something else even if that comes with a tradeoff. --- ## Post 36 by @Tech-Trooper — 2024-08-30T14:22:10Z You’ve got to be kidding me. If you are using VPN all the time, you won’t be able to get any Google account. Since we are privacy conscious users, it’s really normal that I don’t want to share my IP address and apps I use, etc. --- ## Post 37 by @asanyan — 2024-08-30T14:36:29Z Not to mention that by using Google Play, Google can now track and correlate the apps you install with the rest of your web activity and use that to further profile you. It’s a tradeoff between privacy and security. --- ## Post 40 by @EvanCarroll — 2024-08-30T14:54:43Z > A significant percentage of these 4,400 apps are abandonware. Again, if this site was called AntiAbandonware Guide, I would say you have a point. But it’s not called that. Aside from that, I’m not even sure if your assertion is correct. F-Droid scans libraries and they report vulnerabilities they’ve found in dependencies. When those are discovered the app is delisted. Like [Simple FileManager (look up issue 656)](https://github.com/SimpleMobileTools/Simple-File-Manager/issues/656) But other than that, why does anyone care if an app isn’t updated if it’s not known to be insecure? > Read the privacy policy and/or check the source code of the apps that you’re using. 99% of the Apps on Google Play don’t have the source available, and the I don’t want to _trust_ their privacy policy. You’re asking me to trust something inferior to technologically-generated advisories of F-droid. > Higher target API level = more security and privacy, sometimes even more or better functionality. But there is nothing stopping you from using an app that targets a higher api level. You can upload an app built on any api level to F-droid. I’m not sure what you mean when you say it’s stricter? F-droid and Google Play both allow hosting older less-secure API levels. That’s also just part of Android, developers have to change their app to adapt to the new API level and there is a lag. But all of this is silly. You’re speaking of theoretical points and using peacock language “stricter”. I’ve given you three concrete examples of the most popular apps with examples of F-Droid making their distribution more private, transparent, and anonymous. And I just gave you **another** example (SimpleFileManager) of F-Droid identifying vulnerable dependencies that GitHub would not have discovered automatically. But we’re telling people direct download from GitHub is better in the context of a discussion on privacy. --- ## Post 41 by @yipii — 2024-08-30T16:21:38Z In this thread, I learned that fDroid has more than just building and singing. Reading on the privacy guides, fdroid was only adding delay for new release and resigning with their own keys. Here I learned tjat fdroid does much more, like detecting whitelisting external dependencies sources, blocking application with known vulnerability, detecting and preventing external blob / injection of prebuilt application library. It would be nice to have a little more advantages and disadvantages of fdroid in the page, so that people make their own choice. Or perhaps this information could be written in fdroid website ? I think I did read it at first, and did not know about that. If there are some expert of fdroid here, I have a question/comment. Is there a way to easily know the status of a new release ? Like straight in the frontpage of the application. When people see a release is x days late, they might get frustrated. But if they see a small status - new version detected, build scheduled - build completed, signing scheduled - build error detected - build error detected - bad external blob detected - bukld… - vulnerability detected - … - external library prevent build. --- ## Post 42 by @anon48875053 — 2024-08-30T16:27:36Z > [@Tech-Trooper](#): > > If you are using VPN all the time, you won’t be able to get any Google account. That’s incorrect, but I will give you the benefit of the doubt and will ask you to prove your claim. > [@Tech-Trooper](#): > > Since we are privacy conscious users, it’s really normal that I don’t want to share my IP address and apps I use, etc. You don’t have to share your IP, just use a VPN or Tor. If you want to go with the Tor route, then you would first have to create an account using a VPN or a public Wi-Fi, and only them you could use it with Tor. As for apps, if your app list is something that you consider sensitive, then that’s fair enough. But you should know that any app you install on your device can see your app list. --- ## Post 43 by @anon48875053 — 2024-08-30T16:34:40Z I would love to hear how exactly Google would do that. --- ## Post 45 by @asanyan — 2024-08-30T17:17:50Z Google learns about your web activities via Google analytics/ads that are built into most websites on the internet. If you use Google play, then Google also becomes aware of what apps you install on your device, and other device information that they cannot obtain only via browser js. edit: [relevant wikipedia page](https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Google#Tracking) --- ## Post 46 by @anon23293884 — 2024-08-30T17:34:24Z > [@yipii](#): > > When people see a release is x days late, they might get frustrated. But if they see a small status > > - new version detected, build scheduled > - build completed, signing scheduled > - build error detected > - build error detected - bad external blob detected > - bukld… - vulnerability detected > - … - external library prevent build. Implementing such statuses would be useful, the question is realization and resources. as they say, `uncertainty is worse than war.` --- ## Post 47 by @jonah — 2024-08-30T21:45:44Z > [@EvanCarroll](#): > > _stricter_ in what sense though? > [@EvanCarroll](#): > > F-droid and Google Play both allow hosting older less-secure API levels. Sorry, I wasn’t aware that you weren’t aware of this policy when I explained earlier, hope this clears it up for you: > **[Target API level requirements for Google Play apps - Play Console Help](https://support.google.com/googleplay/android-developer/answer/11926878?hl=en)** > > Starting August 31 2025: New apps and app updates must target Android 15 (API level 35) or higher to be submitted to Google Play; except for Wear OS, Android Automotive OS, and Android TV a --- ## Post 48 by @Gnarleyeh — 2025-02-01T00:27:06Z When Google Play signals that a download of FDroid is allowing an older and insecure app to function, is that a true issue or is this Google being brutish ? My device is Android 13 … --- ## Post 49 by @anon99163603 — 2025-02-01T02:52:42Z > These Play Protect warnings will show only if the app’s `targetSdkVersion` is lower than the device API level. > **[Expanding target API level requirements in 2019](https://android-developers.googleblog.com/2019/02/expanding-target-api-level-requirements.html)** > > In a previous blog we described how API behavior changes advance the security and privacy protections of Android, and include user experience improvements that prevent apps from accidentally overusing resources like battery and memory. > > Since... Technically true. --- ## Post 50 by @anon99163603 — 2025-02-01T03:18:54Z I want to add my own take on this. It is kind of funny that this thread started so close to this happening but the Fennec/Mull browser on F-Droid has a period of 3 months where it didn’t receive updates at all between August 21, 2024 and November 3, 2024. gitlab\<2 links for new user huh\>com/fdroid/fdroiddata/-/commits/master/metadata/us.spotco.fennec\_dos.yml [F-Droid forum discussion](https://forum.f-droid.org/t/28877) I get that F-Droid is FOSS first, but if a browser does not get updated on time, then I would argue that no one should use it at all. I would take proprietary bits over an [actively exploited](https://thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html) browser anytime. At the time, I migrated to DivestOS’s repo but it has since shutdown. --- ## Post 51 by @anon39279085 — 2025-02-01T06:49:45Z Yeah Divested Computing Group has been shut down, this is not a good example get something better… --- ## Post 52 by @anon99163603 — 2025-02-01T06:51:31Z It is a good example. Please provide why it is not. --- ## Post 53 by @anon39279085 — 2025-02-01T06:54:16Z I already said the reason? You gotta be joking right. --- ## Post 54 by @anon39279085 — 2025-02-01T07:00:01Z If you want an example take apps like: Update Me, Dicio, LocalSend, RHVoice, App Manager (I have myself) yeah they have not been updated for the 2+ Months at least (on F-droid) :grimacing: but whenever apps are frequently updated or not isn’t the point here. --- ## Post 55 by @anon99163603 — 2025-02-01T07:21:05Z > [@anon39279085](#): > > but whenever apps are frequently updated or not isn’t the point here. You misunderstood. My point was that upstream released new build but F-Droid didn’t, leaving users vulnerable. All apps you provided are build close to upstream except Update Me (can’t find it), RHVoice (doesn’t tag updates) and AppManager (doesn’t build pre-release). --- ## Post 56 by @faxe — 2025-02-01T13:12:51Z The fact they shut down mid december doesn’t have anything to do with fdroid not releasing updates between august and november --- ## Post 57 by @securitybrahh — 2025-03-27T07:47:53Z F-droid build servers are kinda outdated [https://x.com/TommyTran732/status/1877380637549629861](https://x.com/TommyTran732/status/1877380637549629861) I’d just [obtanium](https://github.com/ImranR98/Obtainium) from github, there autoupdate is sort of slow though. F-droid “Basic” atleast fixes the client API level thing. This article raises good questions - \> [https://privsec.dev/posts/android/f-droid-security-issues](https://privsec.dev/posts/android/f-droid-security-issues)