• digger@lemmy.ca
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    Something worth noting is that F-Droid is both an app to download other apps but they also maintains a repository of apps. You can use alternative store apps (like Droid-ify) with the F-Droid repository OR you could use the F-Droid app with a different repository (like IzzyOnDroid). You can mix and match to meet your needs.

    I use the Droid-ify app with the F-Droid, IzzyOnDroid, microG, NewPipe, and Collabora repositories.

    Once you start down this rabbit hole, give Obtanium a look.

  • qyron@sopuli.xyz
    link
    fedilink
    arrow-up
    2
    ·
    1 year ago

    Been using Fdroid to the point where my first boot into a new phone is:

    Open chrome > download fdroid > open settings > uninstall/disable every single application I can > open fdroid > install all the relevant apps I require for making my phone useful

    I’m just waiting for a small life upgrade in order to be able to support some app developers; it will be money better spent than using the standard google apps.

  • eric@lemux.minnix.dev
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    I can’t use F-Droid without the Play Store but I tend to check there first to see if there is something available there before installing something from the Play Store.

  • lejsh@lemmy.ml
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    1 year ago

    Are they planning on modernizing the app for Material You? It feels out of place in my phone in 2023.

    edit: all the people who suggested Droid-ify know what’s up. Thanks, guys!

      • SirEDCaLot@lemmy.fmhy.net
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Newpipe - A YouTube client without ads.

        Literally can’t say enough good stuff about Newpipe.
        Everything YouTube SHOULD be, this is. LISTEN TO A VIDEO IN THE BACKGROUND!!!11. Playback speed infinitely adjustable- good for lectures, interviews, etc. No ads. No bullshit.

  • elbowgrease@lemm.ee
    link
    fedilink
    arrow-up
    0
    ·
    1 year ago

    I’ve always had a niggling worry that downloading apps from 3rd party app stores came with a higher risk of getting apps with viruses and spyware.

    any truth to this?

    • qyron@sopuli.xyz
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      Not really.

      Fdroid is a secure repositorie and the applications are reviewed before being made available for end users.

      The repository is also highly focused on privacy and security and will warn if applications have security flaws or depend on non free services.

      As an example, I use NewPipe instead of the standard YT app and it has a warning it depends on non-free services.

      One other example I can give is Librera. It’s a very feature rich ebook/pdf/etc reader. At some point, a security flaw was discovered and the app was instantly flagged has having such problems and users were advised to not install it.

      • karlthemailman@sh.itjust.works
        link
        fedilink
        arrow-up
        0
        ·
        1 year ago

        Fdroid is a secure repositorie and the applications are reviewed before being made available for end users.

        Reviewed by who though? Malicious apps even get through apple and Google’s screening. I can’t see how fdroid can match the capabilities of those guys.

    • MrSqueezles@lemm.ee
      link
      fedilink
      arrow-up
      0
      arrow-down
      1
      ·
      1 year ago

      Even small companies have to deal with, “supply chain”, attacks, criminals putting code into open source repositories to steal data and get access to servers. App stores are major targets too.

      There have been weather apps that need your location to show you weather and oops we also send your location history to our data center in China and sell that data.

      There have been, “document scanner”, apps that help you take pictures of things like credit card statements and did we not mention we send those images to Russian servers?

      Do use a major brand phone like Samsung, keep your OS up to date, and don’t expose private info to these apps or give them special privileges, especially, “accessibility”, or, “screen reader”, and you should be okay.

      • c0mmando@links.hackliberty.org
        link
        fedilink
        arrow-up
        0
        arrow-down
        1
        ·
        1 year ago

        Doesn’t affect the end user… beyond diminished security. Are you implying I should trust Fdroid devs as much as I would trust Google devs?

          • c0mmando@links.hackliberty.org
            link
            fedilink
            arrow-up
            0
            arrow-down
            1
            ·
            1 year ago

            The diminished security resulting from the increased likelihood of a (single point of failure) supply chain attack.

            Yes its possible for malicious devs to trojan apps, but due to apk signing it is much more difficult for a third party entity to induce a supply chain attack, which is my real concern when it comes to phone security.

            If you have a lower threat model, this post isn’t for you…

    • Possibly linux@lemmy.zipOP
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 year ago

      I actually would go for the main repo as all the software in the main repo is reviewed by the main Dev team

        • Possibly linux@lemmy.zipOP
          link
          fedilink
          English
          arrow-up
          0
          ·
          1 year ago

          The author of this article completely misses the point of F-droid. They clearly are used to a world of proprietary software that takes “security” over freedom

          So yes I did read the article and no it doesn’t change anything. If your going to make an argument you shouldn’t just link to someone else’s work. Part of the problem with the internet is no one thinks for tuemselves

          • c0mmando@links.hackliberty.org
            link
            fedilink
            arrow-up
            0
            arrow-down
            1
            ·
            edit-2
            1 year ago

            Sure, I’ll spell it out for you since apparently the point went right over your head. Fdroid devs are a single point of failure by signing every application themselves. This introduces a potential for supply chain attack, not to mention Fdroid running on EOL servers.

            When you use an individual dev repo, you can avoid any trojanized apps from Fdroid because the developers maintain their own infrastructure and sign their own apks.

            That’s called… D I S T R I B U T E D T R U S T

            • Captain Beyond@linkage.ds8.zone
              link
              fedilink
              arrow-up
              0
              ·
              edit-2
              1 year ago

              The reason F-Droid builds from source is to ensure that they can enforce their inclusion criteria. If you go outside F-Droid you lose that guarantee. For example, self-published apks in github or google play may contain anti-features or proprietary code that are forbidden by the F-Droid standards.

              From another point of view, what you call a single point of failure is a third party that represents the interests of the user community, independent from individual developers. This is the same model used in GNU/Linux distributions, and Drew DeVault explains here the role that software distributions play in the free software community.

              Of course, this represents a trade-off, in that you are placing trust in the software distribution instead of or in addition to the upstream developer. The question is, how can you solve the problem without foregoing F-Droid’s inclusion standards? The answer is reproducible builds, where F-Droid builds from source and compares to the developer’s apk, and publishes the developer’s apk with their signature if the build reproduces successfully.

              Until Reproducible builds are the norm in the Android free software world, I accept the trade-off because I value having software freedom in my computing, and I know I can’t trust upstream developers to care about that as much as F-Droid or I do.

              • c0mmando@links.hackliberty.org
                link
                fedilink
                arrow-up
                0
                arrow-down
                1
                ·
                1 year ago

                Sure, atleast you admit there’s a trade off (security) for (FOSS) and maybe some additional privacy.

                People should be made aware of the risks and choose according to their threat models, which is why I’ve highlighted some of these issues to begin with.

  • Meowoem@sh.itjust.works
    link
    fedilink
    arrow-up
    0
    arrow-down
    1
    ·
    1 year ago

    I went through a phase where I played every game on there, most were gloriously unfinished or ported from the zx spectrum. There were some real gems too.

    That was years ago, what’s it like now? Is there android wesnoth? Did any of the RPGs ever get to a fished state?