In the GrapheneOS forum, I encountered a claim that F-droid is insecure (and not good at privacy as well). These links (and more) were given as an evidence:

While there are some attitude against FOSS app, I think the arguments are generally sound and in good-faith. Which makes me confused, as I’ve been hearing good words about F-droid in lemmyverse.

I am not good at assessing arguments, so I want to ask you guys for more aspects and information.

Also, if not F-droid, what should I use? Is Aurora store, a frontend of play store, not fine to use as well?

  • Zak@lemmy.world
    3·
    3 days ago

    There seem to be two main arguments put forth here:

    1. F-Droid does not thoroughly audit the apps it distributes, so they might include bad behavior that is not initially obvious.
    2. It is theoretically possible to provide a package to F-Droid that does not match the source code it claims to be based on.

    To which I respond:

    1. No app store thoroughly audits the apps they distribute. You must ultimately decide if you trust the developer enough to run their app, or audit the code and build it yourself.
    2. This creates a theoretical opportunity for a developer or maintainer to upload a package that doesn’t match its purported source code, but it’s possible to check for this manually, and to automate that process. It’s likely anyone exploiting this would be caught and their reputation tarnished. It comes back to the first point: do you trust the developer or maintainer enough to run their app?

    If you have average security needs, you probably don’t need to worry about this. If you have reason to believe someone well-resourced and dangerous wants to compromise your phone, you should probably be extremely selective about what apps you install and where you get them.