updating apps through Obtainium for faster updates?

Duct9143

I use Google Play Services on my GOS phone, including the Play Store with a Google account. However, since the Play Store often takes a long time to actually release app updates, I was wondering:

Wouldn't it make more sense to get the latest app updates (for example for browsers such as Brave) straight from Github, by using Obtainium for example? Rather than waiting until the update actually shows up on the Play Store, often many days late?

I've heard that the Play Store offers a more secure update mechanism for apps, but is it worth it, considering the delayed releases?

UndercoverBozo

Only reason to choose Play Store over Obtainium is google functionality with certain features IMO.

Ex. Proton-Mail won't get push notifications.

Duct9143

UndercoverBozo This doesn't make any sense. Whether or not push notifications work has nothing to do with the place you download the app from, assuming the apk is identical.

UndercoverBozo

Duct9143 ok buddy

N1b

Duct9143 I think what he means is that if you install Sandboxed Play Services for notifications, it's reasonable to use the Play Store as source for installation (since it's already there and adding another source increases the attack surface).

If you use Obtainium anyway for apps unavailable on the Play Store and you don't require Sandboxed Play Services (or Play Store as source e.g. for banking apps to work), it's an obvious choice to fully replace Play Store with Obtainium.

In the end it's all about trust: Do you trust multiple devs to always release untampered updates on their channels or GitHub (and do you trust GitHub)? Do you trust yourself to always set up and maintain Obtainium correctly? Or would you rather trust Google to do the screening and validation for you at the expense of slightly delayed update times? If both share the same level of trust from you, then yes whatever way gets you quicker updates is the more secure one.

That's all my opinion, I'm not speaking for the project and I'm sure project members will have better and more elaborate answers than me.

Duct9143

N1b No, that's not what he meant. He literally said you wouldn't get push notifications if you choose a different apk source, which is not how it works. It's just a case of a troll writing things to feel smart, without actually knowing what they're talking about. No matter where you get your Proton Mail apk from, it won't change a thing about its push notification functionality. It doesn't matter, though, I'll just ignore it from now on.

I don't think the choice of using Obtainium is obvious at all. If you read the GrapheneOS twitter account, for example, you often see them talk about how the Play Store offers a more secure app installing and updating process in general, compared to stuff like Obtainium. The only other app store I ever saw recommended from GOS staff was Accrescent, which unfortunately is not useful for me because it doesn't have the apps I want.

I think I'll just stick to the Play Store for any installing and updating of apps whenever possible, despite delays.

N1b

Duct9143 It's just a case of a troll writing things to feel smart, without actually knowing what they're talking about

Not perfectly worded maybe, but throwing insults at random people here is not in alignment with the code of conduct. What helps me is to assume that everyone is here to help, as that's usually the truth.

As for the Play Store vs Obtainium question regarding security, I'll try to get an expert here to verify or falsify your theory. It's an interesting topic and useful knowledge to have as a GOS user.

[deleted]

Duct9143 It's just a case of a troll writing things to feel smart, without actually knowing what they're talking about.

Please refrain from using insulting language or making personal attacks.

3zlgi8vre

Obtainium doesn't download apk's from Google Play Store what attack surface are you talking about?

N1b

3zlgi8vre what attack surface are you talking about

Any added app (especially those you allow to install more apps) increases the overall attack surface. What I mean is having Obtainium plus Google Play Store provides an increased attack surface compared to having only one of the two.