Recommend F-Droid Basic over Neo Store #2293

jonaharagon · 2023-10-06T16:49:18Z

Changes proposed in this PR:

Recommend the first-party F-Droid Basic client now that it supports unattended upgrades.

I have disclosed any relevant conflicts of interest in my post.
I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project.
I am the sole author of this work.
I agree to the Community Code of Conduct.

privacyguides-bot · 2023-10-06T16:50:00Z

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/recommend-f-droid-basic-instead-of-neo-store/14311/2

netlify · 2023-10-06T16:51:10Z

✅ Deploy Preview for privacyguides ready!

Name	Link
🔨 Latest commit	`b69edfe`
🔍 Latest deploy log	https://app.netlify.com/sites/privacyguides/deploys/65429b6ada46a200087748ac
😎 Deploy Preview	https://deploy-preview-2293.preview.privacyguides.dev
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	4 paths audited Performance: 74 Accessibility: 91 Best Practices: 98 SEO: 88 PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

dngray · 2023-10-07T04:50:30Z

Agreed, I think the language can be softened a bit as they have made some progress according to their blog.

matchboxbananasynergy · 2023-10-07T05:03:51Z

Agree with the change, though the unfortunate thing is that the F-Droid apps don't have a way to show you an app's targetSdk, which is what I personally liked about Neo Store, since F-Droid doesn't remove or hide apps with old targetSdk levels, and as far as I'm aware also doesn't prevent them from getting on to the store/updating their apps. Being able to see what the targetSdk level is at a glance is quite significant.

dngray · 2023-10-09T12:50:42Z

@matchboxbananasynergy iirc, that was the original and main reason for not really recommending F-Droid as much as we used to initially. As F-droid allows apps with lower-API levels, that means weaker sandboxing for those apps, than if they were in Google Play etc.

dngray · 2023-10-09T12:53:26Z

docs/android.md

@@ -381,17 +381,17 @@ If you download APK files to install manually, you can verify their signature wi

 ![F-Droid logo](assets/img/android/f-droid.svg){ align=right width=120px }

-==We do **not** currently recommend F-Droid as a way to obtain apps.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications and is dedicated to free and open-source software. However, there are [notable problems](https://privsec.dev/posts/android/f-droid-security-issues/) with the official F-Droid client, their quality control, and how they build, sign, and deliver packages.
+==We only recommend F-Droid as a way to obtain apps which cannot be obtained via the means above.== F-Droid is often recommended as an alternative to Google Play, particularly in the privacy community. The option to add third-party repositories and not be confined to Google's walled garden has led to its popularity. F-Droid additionally has [reproducible builds](https://f-droid.org/en/docs/Reproducible_Builds/) for some applications and is dedicated to free and open-source software. However, there are some security-related downsides to how F-Droid builds, signs, and delivers packages:


I think if we remove the privsec link here we should mention that apps in Google Play have to target a higher API level, and therefore have stronger sandboxing. We should perhaps show this article https://developer.android.com/google/play/requirements/target-sdk

jonaharagon · 2023-10-09T20:10:30Z

A forum member pointed out that F-Droid Basic does show a warning on apps with a low target SDK. My understanding is that minimum target SDK for when this warning will appear will advance similarly to Google Play's policy with each new Android release:

The app that's being installed targets API level 29 (Android 10) or higher. (Google notes that the target API level requirement will advance in future Android versions, a policy that's in line with Google Play policy on API target requirement.)

https://www.xda-developers.com/android-12-alternative-app-stores-update-apps-background/

privacyguides-bot · 2023-10-14T17:34:20Z

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/remove-note-about-getting-f-droid-apps-from-obtanium/14440/4

dngray · 2023-10-19T12:51:11Z

that F-Droid Basic does show a warning on apps with a low target SDK

It looks like it does, but it only says that it won't auto update. I think we should mention something which summarizes:

Every new Android version introduces changes that bring security and performance improvements and enhance the Android user experience. Some of these changes only apply to apps that explicitly declare support through their targetSdkVersion manifest attribute (also known as the target API level).

jonaharagon · 2023-10-24T03:41:40Z

I really don't see that change as critical given that:

We say:

Additionally, the requirements for an app to be included in the official F-Droid repo are less strict than other app stores like Google Play, meaning that F-Droid tends to host a lot more apps which are older, unmaintained, or otherwise no longer meet modern security standards.
We also say:

You should use your best judgement when looking for new apps via this method, and keep an eye on how frequently the app is updated. Outdated apps may rely on unsupported libraries, among other things, posing a potential security risk.
F-Droid Basic displays a prominent warning on apps with a low SDK, and that the cutoff to display that warning automatically increases with new Android releases

So... I don't know how to word the additional changes you're suggesting to fit it in cleanly on the page tbh, but if you want to commit a change adding that somewhere you think is best, that's fine w/ me.

dngray · 2023-10-24T07:46:09Z

That is fair I guess.

Maybe we should say:

modern security standards.

blacklight447

Looked it over, everything looks perfect.

Signed-off-by: Daniel Gray <dngray@privacyguides.org> Signed-off-by: blacklight447 <github.ef27z@simplelogin.com>

privacyguides-bot · 2023-11-21T06:22:01Z

This pull request has been mentioned on Privacy Guides. There might be relevant details there:

https://discuss.privacyguides.net/t/v3-17/15136/1

jonaharagon added a commit that referenced this pull request Oct 6, 2023

Recommend F-Droid Basic over Neo Store (#2293)

95e44a0

jonaharagon force-pushed the jonaharagon/fdroid-basic branch from 8053654 to 95e44a0 Compare October 6, 2023 16:52

jonaharagon requested review from freddy-m, dngray and blacklight447 October 6, 2023 17:50

dngray approved these changes Oct 7, 2023

View reviewed changes

dngray added the c:software self-hosted/decentralized software and related topics label Oct 7, 2023

dngray requested changes Oct 9, 2023

View reviewed changes

jonaharagon added a commit that referenced this pull request Oct 9, 2023

Recommend F-Droid Basic over Neo Store (#2293)

8028958

jonaharagon force-pushed the jonaharagon/fdroid-basic branch from 95e44a0 to 8028958 Compare October 9, 2023 21:14

jonaharagon requested a review from dngray October 10, 2023 05:55

jonaharagon added this to the v3.17 milestone Oct 14, 2023

jonaharagon added a commit that referenced this pull request Oct 14, 2023

Recommend F-Droid Basic over Neo Store (#2293)

6bc2c5e

jonaharagon force-pushed the jonaharagon/fdroid-basic branch from 8028958 to 6bc2c5e Compare October 14, 2023 17:31

heeresbach approved these changes Oct 20, 2023

View reviewed changes

dngray approved these changes Oct 24, 2023

View reviewed changes

jonaharagon mentioned this pull request Oct 24, 2023

Elaborate on some of the issues with F-Droid #1851

Closed

blacklight447 approved these changes Nov 1, 2023

View reviewed changes

jonaharagon added a commit that referenced this pull request Nov 1, 2023

Recommend F-Droid Basic over Neo Store (#2293)

ebce060

jonaharagon force-pushed the jonaharagon/fdroid-basic branch from 164df35 to ebce060 Compare November 1, 2023 18:38

Recommend F-Droid Basic over Neo Store (#2293)

b69edfe

Signed-off-by: Daniel Gray <dngray@privacyguides.org> Signed-off-by: blacklight447 <github.ef27z@simplelogin.com>

jonaharagon force-pushed the jonaharagon/fdroid-basic branch from ebce060 to b69edfe Compare November 1, 2023 18:39

jonaharagon merged commit b69edfe into main Nov 1, 2023

jonaharagon deleted the jonaharagon/fdroid-basic branch November 1, 2023 18:40

privacyguides-bot temporarily deployed to github-pages November 1, 2023 19:04 — with GitHub Actions Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Recommend F-Droid Basic over Neo Store #2293

Recommend F-Droid Basic over Neo Store #2293

jonaharagon commented Oct 6, 2023

privacyguides-bot commented Oct 6, 2023

netlify bot commented Oct 6, 2023 •

edited

Loading

dngray commented Oct 7, 2023

matchboxbananasynergy commented Oct 7, 2023

dngray commented Oct 9, 2023

dngray Oct 9, 2023

jonaharagon commented Oct 9, 2023

privacyguides-bot commented Oct 14, 2023

dngray commented Oct 19, 2023

jonaharagon commented Oct 24, 2023

dngray commented Oct 24, 2023 •

edited

Loading

blacklight447 left a comment

privacyguides-bot commented Nov 21, 2023

Recommend F-Droid Basic over Neo Store #2293

Recommend F-Droid Basic over Neo Store #2293

Conversation

jonaharagon commented Oct 6, 2023

privacyguides-bot commented Oct 6, 2023

netlify bot commented Oct 6, 2023 • edited Loading

✅ Deploy Preview for privacyguides ready!

dngray commented Oct 7, 2023

matchboxbananasynergy commented Oct 7, 2023

dngray commented Oct 9, 2023

dngray Oct 9, 2023

Choose a reason for hiding this comment

jonaharagon commented Oct 9, 2023

privacyguides-bot commented Oct 14, 2023

dngray commented Oct 19, 2023

jonaharagon commented Oct 24, 2023

dngray commented Oct 24, 2023 • edited Loading

blacklight447 left a comment

Choose a reason for hiding this comment

privacyguides-bot commented Nov 21, 2023

netlify bot commented Oct 6, 2023 •

edited

Loading

dngray commented Oct 24, 2023 •

edited

Loading