Questions about Obtainium

Clark

So I'm considering switching over from Fdroid to Obtainium because to my understanding you can also install Fdroid apps with it if no Github apk is available?

I tried out Obtainium and the App Verifier with Organic Maps but the verifier couldn't verify it for some reason, like no information was given where the source came from. I could still install it but it seemed to be an older version. Is there a setting that caused this maybe?

Also, if I switch over from Fdroid to Obtainium, is there a way for me to keep the data I have on the Fdroid apps or do I need to set up everything manually?

Lastly, and it's not that relevant to the topic but, I've been considering stopping using Aurora store and use Google Play for the (few) apps I need it for. I know some people say Play apps are packed with trackers, but how true is this? It feels like a bit of a gambit using Aurora and I dont want to get my account blacklisted, which is why I'm considering using the official Play Store. Thoughts?

Stewart

I think that for privacy and security reasons, it's best to use Accrescent (Organic Maps) first, then Obtainium, the Play Store and finally F-Droid.

AlphaElwedritsch

Stewart then you can directly use fdroid

Clark

Stewart my goal now is kind of to only use Obtainium and Play Store so I don't have to use Fdroid and Aurora (again, worrying about the risk my account might get blacklisted). Do you think that setup sounds okay?

Stephan-P

Expect app builds to differ between F-droid and the github releases that obtanium fetches, in which case you will have to uninstall the app first and reinstall afterwards.
In order to keep your data, you will need the app's export/import if available.

(I went this route when replacing F-droid with Obtainium)

Aeon

Clark

Not a recommendation as i dont know your setup or Thread model:

on my phone I am using Play Store and Obtanium to get my Apps.

Most apps I installed with Play Store. I have the Fossify Apps I am using installed with obtanium as when they first released on github they where not on the Play Store yet.

For me it works just fine.

Clark

Aeon what kind of threat model do you have that makes you use Play and Obtainium? Personally I care more about security than privacy (hence using Play > Aurora), also why I'm considering Obtainium instead of Fdroid.

Aeon

Clark

I am using banking Apps on my Phone, so security is most important. Right after that comes Privacy and then Add Blocking. Thats why i installed Play Services and Play Store to install the apps.

Yes I could do my online banking via vanadium, but all the banking apps I am using have one important function: Card control: This enables me to deactivate and reactivate specific payment functions of my Debit cards such as Online Payments, ATM withdrawals, or completely deactivate the Card until I reactivate it. This function only works with the apps.

And as I have the playstore, I install most of my other apps also with it. My Play Store Account is without my real Name or Address. The Google Account for Play Store I only use that account on my phone and only for the Play Store. I dont use its associated gmail address nor do I use the google drive with it.

I am using Obtanium for apps i do not get on the Play Store. I have the Fossiffy Apps I am using installed with Obtanium as I got them when they first released on github and at the time they where not yet on the Play Store and i needed them as they replaced the Simple mobile Tools Apps I was using before and those got sold to an Add-Tech company.

Clark

Aeon you sound just like me and now I'm done reinstalling all my apps via Github/Obtainium, feeling better than using Fdroid.

AlphaElwedritsch

Are there any users here who have ever had problems because they used fdroid?
Is there any solid evidence or solid reports that it has ever happened to anyone?
Or is this all just hypothetical assumptions?
I'm asking this seriously. You read about the fear everywhere. Everyone advises against it. But no one can name it with real examples.
I used fdroid. And I will continue to use it.

Clark

AlphaElwedritsch that is a valid question. And to be honest, I can't point you to any concrete evidence. But to me, it makes sense that it's more secure to download apps from the original source rather than using a third party repository. Fdroid isn't bad. I just think it depends on threat models.

[deleted]

AlphaElwedritsch

I've never heard of a problem with F-Droid and, until there is a documented case, it's hypothetical.
I also continue to use F-Droid.

On the other hand, it seems every week or two there is another news article about malware infected apps on Google Play. I'm reading an article now about how Google Play had over 600 million cases of malware in 2023.

There are far more dangerous sources for apps than F-Droid.

jackFang

Haven't used obtainium but it seems all you do is reference link to follow app updates? Curious what happens when a repository is deleted and then reused with the same name https://github.com/orgs/community/discussions/131258. Does that raise any concerns?

23Sha-ger

jackFang
How would that happen? Depends if a developer of a particular app got compromised, or handed it over
the repository to a 3d party. Those are different cases . Already happened with "Simple Mobile Tools" suite:
https://github.com/SimpleMobileTools/General-Discussion/issues/241

A fork came a month later, but that's not the scope of the question.

When it happens to a popular project, the community on Github might respond to it quicker.
I don't see how F-Droid will push an update to blacklist a 3d party repository. They do build the project
on their obscure build systems hosted on Hetzner which adds another potential 3d party. I do see how Obtanium
will possibly take this route in order to protect users. The F-Droid project is just a stagnating, "too big
to fail" thing from the early 2010s and many things changed since then.
Personally when I see the donate button on their site I know they will never run out of resources, just because people trust them historically, without apparent reason to do so, they were never transparent about their project.

Dumdum

jackFang Does that raise any concerns?

I don't think so? Any app distributed in a "recycled" repo would have to somehow be signed with the same keys that the original repo used. As long as the keys are different, then Obtainium would reject the update and inform users about a mismatch.

Clark

Another question about Obtainium:
Is there a major difference in adding an app with an apk link, searching for it on Github, or first finding it on Obtainium's website? Or is it all the same source they are using?

Clark

Clark bump

Another question about Obtainium:
Is there a major difference in adding an app with an apk link, searching for it on Github, or first finding it on Obtainium's website? Or is it all the same source they are using?

AlphaElwedritsch

I'm going to get everything from fdroid. Only the apps, I cannot get there, I use playstore (3 Apps). The less, the better...

There are other aspects too.
davx5, for example, costs money in the play store. Not on fdroid.... And there are many more...

Clark

Clark Clark bump

Another question about Obtainium:
Is there a major difference in adding an app with an apk link, searching for it on Github, or first finding it on Obtainium's website? Or is it all the same source they are using?

bump 2x

ErnestThornhill

Clark Is there a major difference in adding an app with an apk link, searching for it on Github, or first finding it on Obtainium's website?

I'm not sure what you're asking here. If an app's APK is available on GitHub, all you need to do is copy the link/URL to the release page, paste it in the Obtainium app to add it and then click on "Install."

Clark

ErnestThornhill I know. I'm asking if there's any difference between the way you add apps to Obtainium i.e. via the Github link or Obtainium's website.