How big of a concern are proprietary libraries in open-source apps?

DeletedUser88

Many open source apps have releases on Github that include proprietary Google libraries such as for billing or interacting with Play Services. The only way to ensure apps you install do not have these libraries is to install them from F-droid. As a result, this becomes a question of whether one prioritises privacy (not having the libraries installed) or security (downloading from a more secure source). For me to be able to make this decision, I want to understand what compromises in privacy happen when I have the libraries installed. Can the libraries make network connections by themselves if the app is granted network permissions? Can the libraries between apps communicate with each other? What risks are there to having the libraries installed?

de0u

DeletedUser88 Can the libraries make network connections by themselves if the app is granted network permissions?

Yes. If the app makes a call into a library contained in it, the library code operates with the authority of the app, so if the app can make network connections then the library can.

DeletedUser88 Can the libraries between apps communicate with each other?

Yes.

Without reading the source code, it's hard to say, but if a library sounds like it's designed to share your actions or identity with some Google service, it may well be.