Where to get apks from?

andeluehlo

I was using f-droid website to download apks (no auto-update, only apks, from main repo) but heard it wasn't recommended. Then i read some articles and discussions and i'm left with some questions still:

Should it matter if they sign with their own keys if theres the source code available corresponding to that signature?
Arent all apps signed by a centralized team so if they shipped a malicious app that would be a big deal, no? (has this ever happenned?).

What is the better alternative, other than obtainium, but i dont see how blindly trusting random apps github releases is better. Or am i missing something?

Probably9857

andeluehlo Should it matter if they sign with their own keys if theres the source code available corresponding to that signature?

This is only true if it is a reproducible build. My understanding is that most apks on F-Droid are not.

andeluehlo but i dont see how blindly trusting random apps github releases is better. Or am i missing something?

You are trusting the app developers in both cases, by running their code on your device. With a release signed directly by them, you know no one else has modified it. With F-Droid, you also have to trust an additional party (F-Droid).

andeluehlo

Probably9857 This is only true if it is a reproducible build. My understanding is that most apks on F-Droid are not

"It is built and signed by F-Droid, and guaranteed to correspond to this source tarball. (link)"

This is the statement that I think you see on all APKs you download from f-droid. Compared to GitHub releases where you don't have the source code for the apks and the developer could upload anything. Or am I missing something?

NetRunner88

Fdroid is OK only if you use the repo provided by the developer of the apps you are interested in. Like SimpleX, Molly, Briar for example.
Other depos imho are ok too, those from Izzy, Guardian and Divest.

Using Obtainium isn't that bad, you trust each developer of apps you use instead of trusting Fdroid (speaking of the main repo, not those I cited above) with their bad manner (bad and outdated minimum SDK target for example)

Otherwise use what is recommended from the GrapheneOS team, Play Store or Accrescent.

doublefree

andeluehlo you miss the fact that F-Droid could also upload anything and write this statement on their website. It about who you trust to upload the correct apk for a source. Not about technical guarantees.

wonder75

The zero trackers policy of F-Droid is a big plus in my oppinion. No matter which app you install from F-Droid, you can be sure it has no trackers. The same app directly from the dev via Obtainium could very well have a dozen.

treenutz68

wonder75

I didn't realize "zero trackers" is a guarantee f-droid makes, that is pretty cool! I've been relying on obtanium for all my apps recently, but perhaps its time to uninstall and switch to f-droid.

Do you know if there are some benefits to using something like neo-store instead of the original f-droid app?

Dumdum

treenutz68 I've been relying on obtanium for all my apps recently, but perhaps its time to uninstall and switch to f-droid.

For the record, you can still install Fdroid apps using Obtainium.

https://github.com/ImranR98/Obtainium

Currently supported App sources:

Open Source - General:
GitHub
GitLab
Forgejo (Codeberg)
F-Droid
Third Party F-Droid Repos
IzzyOnDroid
SourceHut

xxx

treenutz68 I didn't realize "zero trackers" is a guarantee f-droid makes, that is pretty cool! I've been relying on obtanium for all my apps recently, but perhaps its time to uninstall and switch to f-droid.

Just keep it as it is - most foss apps havn' t any trackers or telemerty. A modern f-droid client would be better. There' s F-droid Basic.

wonder75

treenutz68 Do you know if there are some benefits to using something like neo-store instead of the original f-droid app?

Better interface, faster update checking. A more modern app in general. Downside: Another party you have to trust for something as basic as your central app store.

BTW. You can check easily the trackers in your apps with "Exodus Privacy" - also available on F-Droid. Might be a simple way to identify Obtainium-apps with trackers and exchange them for F-Droids build.

ErnestThornhill

wonder75 BTW. You can check easily the trackers in your apps with "Exodus Privacy"

No. You should not be recommending that to others. Exodus Privacy has inaccurate information how app permissions work and highly misleading information about what they call trackers.

Please see https://discuss.grapheneos.org/d/9358-using-apps-with-known-trackers-with-no-google-play-services/5 and various other threads on here for more information on how and why it's an inaccurate and misleading thing to use and recommend to others.

wonder75

ErnestThornhill I guess most people are able to Google to find out what the app has found and judge if they like it or not. For example I found Google Analytics in some of my apps. Happy to know now. Didn't know before using the app. I feel the app helped me to improve my privacy. Can't say anything about the permissions feature, haven't used that yet.