Snibby Does any of these options stand out in a positive or negative way concerning security AND privacy?
All of them have pros and cons, as always.
Downloading directly from github with obtainium might lead you to rogue updates that you might have the possibility to skip if you added a "man in the middle".
The canonical example I bring is the Simple suite.
Who installed the apps through f-droid has been shielded from the rogue updates.
Who was using something like Obtainium, they couln't skip them in time, unless manually reading what was going on and removing the apps manually from the "store".
The problem with F-Droid is mainly tied to the fact that they sign their own builds, so apart from reproducible builds (which should be the standard today), there are two security concerns:
- They could add some code (and thus you have to trust them they don't)
- If keys are compromised, you should treat every app signed with them as compromised.
This last item on the list is actually true also for Google Play Store, but I would say Google might spend more money in security than F-Droid.
A secondary issue with F-Droid is that the average update takes days, if not weeks.
IzzyOnDroid is basically the same concept of F-Droid, except they use apps signed by the developers.
This means they do not have any means to add code to the builds and if some keys are compromised, your blast area is basically that one (two?) app that has been signed with that key.
I am not sure if what IzzyOnDroid does is as extensive as F-Droid, but I personally trust their work.
Also, updates are usually 1 or 2 days delayed.
In all stores except Play Store, you might end with no updates for a specific app.
This has happened for all of the 3 mentioned stores: F-Droid, IzzyOnDroid and Accrescent.
If I had to reason with a "chain of trust", I would use Accrescent before other stores.
Honestly, after years of FOSS apps, I can tell you that we easily reached the point where a lot of apps are available in github/Izzy, but not in the play store, making it mandatory to have both (if you need apps from both, that is...).
Also, the reason there is no real "priority" is that a lot of times, people tend to use different stores in different profiles, removing the need to prioritize them.
Personally, I have everything in the own user, divided roughly like this:
- Main profile with only FOSS apps installed form
GOS Store > IzzyOnDroid (through Droidify) > Obtainium
- Private space with only some proprietary app installed from
GOS Store > Accrescent > Play Store
- Work profile with only work related apps (all proprietary, alas), installed from
Play Store only.
Worth noting that on f-droid clients you can also have other external repositories, like SimpleX, Molly, NewPipe and so on. I personally prefer a private repository on Droidify over Obtainium, but there is no real advantage for this choice, just a preference.
Using a private repo and obtaiunium, will most certainly lead you to the same rogue update (in case of).
The only real difference I had in the past is that Obtainium thorugh VPN might get capped by GitHub.
If you want to get rid of this limit, you can create a disposable GitHub account (the same way you would do with a disposable Google account).
Having a GitHub account is also good for Obtainium, because you can import your starred apps.
So as you can see, every setup has pros and cons.
Accrescent, F-Droid and Play Store would probably shiled you from rogue updates, with Accrescent being the most privacy friendly of the 3, and also the most secure at least in not having them signing all the apps they publish.
It's worth mensioning also APKUpdater , which supports several sources, even if I personally don't use this app.