Hi. I have just become aware of F-Droid. Is this something I should be looking into or downloading? What are the cons to doing so? Is it bad/dangerous in any way?

  • @AudalinEnglish
    5•1 year ago

    I’ve been using F-Droid for some years. The things you should know:

    • the main repository hosts free and open source apps, you can see the source code if you’re unsure if you can trust this particular app. The packages are compiled on F-Droid’s servers from the source code, and are signed with F-Droid’s signatures (which makes those apps incompatible with versions distributed in Google Play or directly as apk: if you decide to switch, you’ll have to figure out how to backup and restore app data for this particular app);
    • it also partially protects from developers inserting malware in minor updates;
    • app updates occasionally take a week or two to get into the main repository, app developers can do nothing about that;
    • various projects host their own F-Droid repositories, which you can add in settings, to release updates quicker and maybe offer beta/nightly builds for testing, and maybe publish something the main repo wouldn’t. Before adding one, ask yourself whether you trust this repo;
    • F-Droid automatically marks anti-features: ads, tracking code, non-free addons/network services/dependencies/assets, weak signatures, known vulnerabilities. For example, Stealth, a Reddit client, is marked as promoting a non-free network service, Reddit;
    • while the apps in the main repository might not represent some niches, some are represented very well and the general signal-to-noise ratio is way higher than in Google Play.

    TL;DR: it’s not bad at all, and not dangerous unless you do something unreasonable like blindly trusting every app and repo without looking at their website at least once. Your responsibility to determine whether something is trustworthy isn’t abstracted away from you - but you’re given tools to make your choices easier.