F-Droid security in simple words

GrapheneOS

secrec This is not true. You also have to trust the developers. Being able to review the source code is meaningless since no one does that and even if they did it would not provide any assurance of not having malicious code since in reality reviewing the code doesn't find all vulnerabilities and it's a ridiculous to claim that it would.

GrapheneOS

Watermelon

Nobody does that

Extensively reviewing / auditing the sources doesn't result in finding all accidentally introduced vulnerabilities let alone ones which were carefully hidden. It's ridiculous to make the claim that it does. Linux kernel has hundreds of serious vulnerabilities found each month and a large portion are very old. Some are many years or even decades old. How exactly is people reviewing the sources meant to avoid trusting the developers? It has no bearing in reality.

Watermelon

GrapheneOS FWIW I never claimed I want an app store that audits apps that I want to use but suspect that they're malware. I think that's ridiculous. If I'd truly suspect an app to be malware, I'd avoid it. Google Play Store reviews and scans apps, and Accrescent (from what I've heard) also does or aims to do that. Unless it's a thorough security audit (and even then what you said still applies), it's good as another defence but not something to rely on. I don't blindly install apps from Google Play Store because Google reviews and scans the apps on it. EDIT: And I certainly don't give every app every permission it asks for.

Do or have people blindly install(ed) apps from F-Droid thinking that they must be malware-free because F-Droid must be reviewing them?

horde

other8026

So if F-Droid doesn't actually protect us from malicious developers (or any other kind of bad code in our apps), then what is it there for?

If that's what you are looking for, then you won't find any, including Accrescent. F-Droid is FOSS app store that lists only open source apps that are free of tracking.

graphy22

So, what do we do? I have been using droidify to install apps, is it problematic too?

ryrona

graphy22 So, what do we do? I have been using droidify to install apps, is it problematic too?

Only you can decide what to do, or what is best for your situation. I have chosen to use F-Droid as my primary app store, even after having taken into account all criticism against it. I am not happy with that, but there are no realistic alternative for me in my threat model.

jem

ryrona After reading many opinions, I arrived to the same conclusion.

F-droid, with all its drawbacks, allows me to be confident enough that the app installed is a build corresponding to the published source code.

It's true that each app code is very probably not manually reviewed, but if a developer introduces malicious code in an F-droid app, at least there will be a clear proof in the F-droid tarball history. Not that this is a solution, but I bet most people won't want to damage their reputation like that. It's more difficult to release a version with hidden malicious code in F-droid and remain unnoticed for long.

Another advantage that I see in F-droid is that, if an app stops being open source (for example, if the developer sells it), future non-free versions won't reach F-droid. But I assume that Google Play will happily continue releasing new versions of the app, even if the app is not open source any more (please, correct me if I'm mistaken about this).

Nevertheless, I hope F-droid will improve its security to a higher level. But I don't see any better alternative for me right now.

This is based on what I've read so far. Please, correct me if I'm wrong with something.

GrapheneOS

jem

but if a developer introduces malicious code in an F-droid app

It is far more likely that F-Droid does it, and considering their involvement in underhanded attacks on the GrapheneOS project and community, they may choose to specifically target GrapheneOS users with it. This is not an unlikely scenario particularly considering the kind of behavior they've engaged in from cover ups of security vulnerabilities to targeting security researchers and others with harassment for talking about them.

ryrona

jem But I assume that Google Play will happily continue releasing new versions of the app, even if the app is not open source any more (please, correct me if I'm mistaken about this).

Yes, they would. Actually, all other app stores other than F-Droid are fine with apps containing closed source components or being fully closed source. Even Accrescent, unfortunately.

GrapheneOS It is far more likely that F-Droid does it, ..., they may choose to specifically target GrapheneOS users with it.

No, they would not.

The reason to use F-Droid is very specifically because they would be the ones that would never do anything like that. Doing something like that goes against everything the open source culture stands for. It is the proprietary apps and app stores we worry would do things like that. It is the proprietary operating systems and apps that are routinely violating user privacy and freedoms, both because of being mandated to do so by policies or law, or out of free will.

This is a very serious allegation you are making.

GrapheneOS This is not an unlikely scenario ...

Yes. It is far far more unlikely they would do that than that Google would do that, just to mention one thing.

GrapheneOS ... particularly considering the kind of behavior they've engaged in from cover ups of security vulnerabilities to targeting security researchers and others with harassment for talking about them.

mushix99 Are there sources to read more about this?

Yes, please do backup these statements with sources.

It is one thing arguing about F-Droids general lack of security, which I think most of us can agree with after just taking a brief look about how they are doing and handling things. It is another thing entirely to claim they are acting maliciously and have malicious intentions, something of which I have seen absolutely zero signs of.

mushix99

GrapheneOS It is far more likely that F-Droid does it, and considering their involvement in underhanded attacks on the GrapheneOS project and community, they may choose to specifically target GrapheneOS users with it. This is not an unlikely scenario particularly considering the kind of behavior they've engaged in from cover ups of security vulnerabilities to targeting security researchers and others with harassment for talking about them.

This sounds worrying tbh.
Are there sources to read more about this?

gMan

GrapheneOS It is far more likely that F-Droid does it, and considering their involvement in underhanded attacks on the GrapheneOS project and community, they may choose to specifically target GrapheneOS users with it. This is not an unlikely scenario particularly considering the kind of behavior they've engaged in from cover ups of security vulnerabilities to targeting security researchers and others with harassment for talking about them.

absent sources, which were asked for 10 months ago, this sounds like paranoia

Eumenia

GrapheneOS It is far more likely that F-Droid does it, and considering their involvement in underhanded attacks on the GrapheneOS project and community, they may choose to specifically target GrapheneOS users with it. This is not an unlikely scenario particularly considering the kind of behavior they've engaged in from cover ups of security vulnerabilities to targeting security researchers and others with harassment for talking about them.

In reproducible builds, this could be discovered quickly and then it would be clear that F-Droid did it, which would ruin their entire project and maybe also put them behind bars (intentionally spreading malware is a felony crime in most of the world)

Eumenia

Watermelon the apps you install from F-Droid are signed by F-Droid rather than the developer.

(EDIT: As far as I understand, there's some apps on F-Droid that F-Droid reuses the APK signed by the app developer rather than building and signing their own, but you can't know which apps they are when browsing F-Droid; if you install an app from another source and find that F-Droid can update it, then it should be fine even though the F-Droid client app itself can be turned into malware.)

If the original build is reproducible, then F-Droid will use it, if not, they have tho create a reproducible themself.

Watermelon

Eumenia If the original build is reproducible, then F-Droid will use it, if not, they have tho create a reproducible themself.

Watermelon there's some apps on F-Droid that F-Droid reuses the APK signed by the app developer rather than building and signing their own, but you can't know which apps they are when browsing F-Droid

They only very recently started to show this info:
https://f-droid.org/en/2025/12/05/twif.html

Eumenia

Watermelon yrona There are no known malware on F-Droid

How do we know? (For what it's worth, I have some F-Droid–signed apps on my phone that I haven't gotten rid of yet, and Google Play Protect doesn't detect them. But that's not proof of anything.)

Since 99% of F-Droid appls are reproducible, you can compile the .APK yourself and check if the hash matches the APK pushed by F-Droid.
Then you have assurance that the binary you are using is the result of the official source code and that F-Droid hasn't added anything

Watermelon

Eumenia Then you have assurance that the binary you are using is the result of the official source code and that F-Droid hasn't added anything

I have no use in matching built form apps to their source code if I don't check their source code anyway (and I'm not gonna do any of this for all apps/updates every time)

Eumenia

Watermelon I have no use in matching built form apps to their source code if I don't check their source code anyway (and I'm not gonna do any of this for all apps/updates every time)

Not everybody has to do this everytime.
But anybody can do it at anytime, and therefore F-Droid can't hide malware inside the binaries

Watermelon

Eumenia anybody can do it at anytime

Not for an app with a modest amount of code.

Eumenia F-Droid can't hide malware inside the binaries

I believe it was discovered that people can upload APKs that would be accepted for serving by the F-Droid server, despite not matching the source code linked in the F-Droid page of the app. Don't quote me on that, though.

SilverCat38

Does this apply to droidify as well?

gMan

SilverCat38 Does this apply to droidify as well?

Droid-ify is just another front-end for the F-Droid apps repo, so if you're asking if exploited apps from F-Droid would be caught by Droid-ify, i believe the answer is no

lackofhumor

GrapheneOS
Eumenia
SilverCat38
gMan

Throwing out some ideas.
I would like someone to challenge these ideas, please.

I'd like to underline (as someone already said) that the first store we have in GOS is the official App Store to install/update the applications mantained from the GOS dev team.

Why is this working? Because over time the developers gained our trust, so much that I suspect (almost) none of us actually go and see the diff of every update.

The only fact we are using GOS is based on trust.

So, suddently trust become a big part of our deciding factors.
This trust must be gained and maintained over time.
If trust is lost, people will stop to update/use/install software.

The same comes with the rest of the apps.
Installing new apps directly from the developers requires us to have some trust (in the code, in the developer, in the community or something else tied to the app).
If we see things happening like the Simple suit, Organic Maps or F-Droid behaviour over time, we might lose trust and decide to not use those software anymore.

People who still decide to put trust on F-Droid in spite of their history in security practices will still use their software.
Once we understood the implication of this, we might decide that cost/benefit (in terms of effort and other things) is good enough for us.

Anyway, there are probably some middle grounds we can still consider.
For example F-Droid clients can have more than one repository, making it a little bit more secure to install (and update) apps on your smartphone.

For example if you like Molly, there is an official repo for that.
You don't like molly and prefer SimpleX? There is an official repo for that.
If you like CollaboraOffice, and so on...

The same concept applies also for larger repositories.
For example the official Guardian Project repo contains all the apps developed by the same team.

In the same way, even more broader repositories exist, like Izzy-on-droid.

These repositories are a collection of a lot of apps signed by their respective developers and allow people to install and update them.
This is the equivalent of installing the apps directly from their respective developers without giving up on automatic updates.
In my understanging, it's pretty much the equivalent of installing them with Obtainium, with the main difference being someone needs to update the repositories before you could download the update.

I would like to have your toughts on this topic to see if this middle ground is considered somewhat ok and/or if there are some pitfalls I didn't take into account.

Of course, all of these options (directly from the developers / obtainium / izzy-on-droid) require us to trust the code/dev/community and there still is the chance that evey app we use between us and the developer (obtanium / droi-ify / f-droid / aurora / play store) might mangle with the first installation.

Your chance of getting killed by a cow are low, but never zero.

SilverCat38

gMan thanks for the reply... what is the recommended way to get foss apps then ? Obtainium only? Direct apk?

« Previous Page Next Page »