RelaxedFalcon
Lots of bad information in there. Lots of claims on the Arthur website without proof. I think everyone here must not be aware of the days when Daniel micay bundled F-Droid into his OS. (GOS)
F-Droid maintainers also reuse package IDs while signing apps with their own keys, which is not ideal as it gives the F-Droid team ultimate trust.
By that logic, we shouldn't trust Unix distros nor the Google play store.
[F-Droid] adds a single point of failure for compromising its users by building and signing the apps it distributes.
GOS is a single point of failure 🫨
(I'm pointing out how silly this statement is.)
Besides, the above quote is wrong.
"F-droid's own keys" is false with this statement from 3 years ago:
... but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer(s). Which proves to you that the developer confirmed: „this is what I intended to publish, this was built from my code“. And that it’s distributed by F-Droid tells you: „F-Droid confirms, too, that this is the APK built from the very code the developer provided“. So neither of the two could have „sneaked in“ something not contained in the app’s source code repository.
-https://f-droid.org/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html
F-Droid will download the developer's app -- exactly like obtainium -- build the app from source, compare what they built from github vs the developer's apk, if they match, distribute the app made by the developer -- same result as obtainium but with extra security.
If you're just downloading github apks (obtainium), you're trust a single point of failure. The apk published could be different from the source code you read.
Verification at F-Droid, again in easy terms, happens this way: the app is built from the source code on F-Droid’s build servers. Then the corresponding APK built by the developer is fetched, and compared against it. The only differences should be the signature files – as the APKs from the developer was signed using their private key, which F-Droid has no access to. If this is the case (i.e. the two APKs match), it was proven to be the very same „binary“ – and F-Droid can distribute the one signed by the developer.
-https://f-droid.org/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html
To test this, install something like pipepipe from F-Droid then use the app's notification of an update to download the app straight from the developer and successfully install it. GOS's app installer won't allow mismatched signatures.
Aurora:
You aren't avoiding Google Play or hiding the details of your device from them with it.
Google prevents certain devices from installing a portion of their apps. I can open aurora and install the app even though I do/don't have a tablet or whatever the requirement is.
There's lots of misinformation out there including this forum. The same information gets regurgitated. The F-Droid situation was fueled by a grudge blown out of proportion. Don't trust something just because it says "security" in the title. "Security advice from aruthur" last updated 1 year ago was incorrect 1 year ago, maybe even when it was first written.
According to the above lists and accurate facts, F-Droid is the next best thing after the Google play store -- above obtainium. (Due to the aforementioned source code check.)
If you hear anyone say F-Droid has abysmal security, feel free to ignore what they're saying -- they aren't being honest. They should be slamming debian repos and obtainium with the same hate.