F-Droid Security Flaws (updated 1.3)

F-Droid is an app store for FOSS applications and a protocol for Android app repositories. It has several serious design flaws, documented below, which their leadership shows no intention of fixing. They seem to be obsessed with their own image above all else and lure their users into a false sense of security.

They've also tried to spread the idea that Android sideloading will completely die next year (through Keep Android Open), which is false (you can sideload "unverified" apps after a 24h wait) and doesn't affect AOSP. F-Droid is not a suitable replacement for Google Play, and you should check out Accrescent instead.

Privsec.dev - F-Droid Security Issues X/Twitter - Uncaught Wireguard Self Update Change Codeberg - IronFox Comment on F-Droid Security Issues Openwall - F-Droid Certificate Pinning Bypass PoC (Github) Github - CatimaLoyalty Reproducible Builds Issue Gitlab - Outdated AGP On Makes Builds Fail Github - F-Droid Recommendation On Vulnerable Game