• Captain Beyond@linkage.ds8.zone
    link
    fedilink
    arrow-up
    36
    arrow-down
    1
    ·
    edit-2
    3 days ago

    I’ll be “that guy”:

    F-Droid is a software repository, not an app store. The distinction is subtle but important. A software repository offers a community-curated collection of software packages whereas an app store is just a marketplace for software developers to offer products to end-users. A software repository serves the interests of its community first, whereas an app store is merely a means for developers to sell products to end-users.

    • trevor@lemmy.mlOP
      link
      fedilink
      arrow-up
      8
      arrow-down
      4
      ·
      3 days ago

      F-Droid is more of a marketplace for software developers than it is a set of community curated apps. The requirement for F-Droid software to be open source is just a guideline/rule like the minimum target API level on the Google Play Store. F-Droid is a neutral platform in my observations over the couple of years I have published there, and does not curate its content.

      • chebra@mstdn.io
        link
        fedilink
        arrow-up
        16
        ·
        3 days ago

        @trevor What are you talking about? If they can’t build it themselves without proprietary stuff, then it doesn’t get published. That’s not a mere “guideline”.

        • trevor@lemmy.mlOP
          link
          fedilink
          arrow-up
          3
          arrow-down
          4
          ·
          3 days ago

          If your app doesn’t meet the target minimum API level on the Google Play Store, then it doesn’t get published. It’s just as much of a guideline, so I don’t think this is really relevant to the point of the article.

          • chebra@mstdn.io
            link
            fedilink
            arrow-up
            6
            ·
            3 days ago

            @trevor People in lemmy open-source community not seeing the relevancy of the open-source guarantee of F-Droid… SMH

      • Captain Beyond@linkage.ds8.zone
        link
        fedilink
        arrow-up
        14
        ·
        3 days ago

        There are those who believe that F-Droid’s role as a “middle man” vetting and building packages from source instead of blindly shipping builds provided by upstream makes it a security risk, because you’re trusting F-Droid in addition to (some say instead of) the upstream developer. Perhaps telling is that none of these critics can offer an alternative solution.

        Before anyone mentions Obtainium and Accrescent, these are not alternatives to F-Droid, they solve completely different problems.

        • floofloof@lemmy.ca
          link
          fedilink
          English
          arrow-up
          18
          ·
          edit-2
          3 days ago

          It would be a single point of failure for many apps in case the curators of F-Droid were dishonest or hacked. They could insert bad things into lots of packages without having to change the public source code. But it also becomes the only point where malware or backdoors could be inserted that way, instead of having to trust every single developer to build honestly off the source code, which we’d have to do if they just stuck prebuilt binaries up there. I don’t know how rational I’m being, but it makes me trust F-Droid apps more that they build each one themselves.

        • stationary_melon@lemmy.ml
          link
          fedilink
          English
          arrow-up
          6
          ·
          3 days ago

          I personally like F-Droid’s vetting process. It’s true that updates always arrive a few days later, but you can be sure they don’t contain any malicious code. Furthermore, they specify all of the antifeatures a program has, which makes it easier to avoid them. If you want faster updates, you can always download a program through Obtanium.

          • trevor@lemmy.mlOP
            link
            fedilink
            arrow-up
            2
            arrow-down
            1
            ·
            edit-2
            3 days ago

            I am not a F-Droid maintainer, but as far as I know the code is not vetted by F-Droid after the initial app submission process. Updates are pulled in, built and distributed automatically. The long delay is just because there are a lot of apps to build, and F-Droid is a volunteer-run operation.

            • stationary_melon@lemmy.ml
              link
              fedilink
              English
              arrow-up
              4
              ·
              edit-2
              3 days ago

              I had no idea. Thanks for telling me! In that case, im going to try to use the ones from IzzyOnDroid if avaliable

              Edit: According to their docs, they do take some special security measures and I couldn’t find a case of an app offered on FDroid which had malware.