F-Droid is an app store for Android where only open source applications are available for free. It provides an alternative to the proprietary Google Play Store, which is where most Android app distribution currently takes place. Because the Google Play Store is where most users go to find and install apps, this gives Google the power to exercise control over Android app developers. In this blog post, I describe the design, mechanism and results of this control from the perspective of a long-time Android app developer.
There are those who believe that F-Droid’s role as a “middle man” vetting and building packages from source instead of blindly shipping builds provided by upstream makes it a security risk, because you’re trusting F-Droid in addition to (some say instead of) the upstream developer. Perhaps telling is that none of these critics can offer an alternative solution.
Before anyone mentions Obtainium and Accrescent, these are not alternatives to F-Droid, they solve completely different problems.
It would be a single point of failure for many apps in case the curators of F-Droid were dishonest or hacked. They could insert bad things into lots of packages without having to change the public source code. But it also becomes the only point where malware or backdoors could be inserted that way, instead of having to trust every single developer to build honestly off the source code, which we’d have to do if they just stuck prebuilt binaries up there. I don’t know how rational I’m being, but it makes me trust F-Droid apps more that they build each one themselves.
I personally like F-Droid’s vetting process. It’s true that updates always arrive a few days later, but you can be sure they don’t contain any malicious code. Furthermore, they specify all of the antifeatures a program has, which makes it easier to avoid them.
If you want faster updates, you can always download a program through Obtanium.
I am not an F-Droid maintainer, but as far as I know the code is not vetted by F-Droid after the initial app submission process. Updates are pulled in, built and distributed automatically. The long delay is just because there are a lot of apps to build, and F-Droid is a volunteer-run operation.
Oh man I see so much criticism of F-Droid’s policies incoming…
Is there anything controversial about them?
There are those who believe that F-Droid’s role as a “middle man” vetting and building packages from source instead of blindly shipping builds provided by upstream makes it a security risk, because you’re trusting F-Droid in addition to (some say instead of) the upstream developer. Perhaps telling is that none of these critics can offer an alternative solution.
Before anyone mentions Obtainium and Accrescent, these are not alternatives to F-Droid, they solve completely different problems.
It would be a single point of failure for many apps in case the curators of F-Droid were dishonest or hacked. They could insert bad things into lots of packages without having to change the public source code. But it also becomes the only point where malware or backdoors could be inserted that way, instead of having to trust every single developer to build honestly off the source code, which we’d have to do if they just stuck prebuilt binaries up there. I don’t know how rational I’m being, but it makes me trust F-Droid apps more that they build each one themselves.
I personally like F-Droid’s vetting process. It’s true that updates always arrive a few days later, but you can be sure they don’t contain any malicious code. Furthermore, they specify all of the antifeatures a program has, which makes it easier to avoid them. If you want faster updates, you can always download a program through Obtanium.
I am not an F-Droid maintainer, but as far as I know the code is not vetted by F-Droid after the initial app submission process. Updates are pulled in, built and distributed automatically. The long delay is just because there are a lot of apps to build, and F-Droid is a volunteer-run operation.
For those who don’t like them, yes.