Well, this is pretty concerning all on its own: > Instead of adopting the fixes we proposed, F-Droid wrote and merged their own patch [10], ignoring repeated w

Well, this is pretty concerning all on its own: > Instead of adopting the fixes we proposed, F-Droid wrote and merged their own patch [10], ignoring repeated warnings it had significant flaws (including an incorrect implementation of v1 signature verification and making it impossible to have APKs with rotated keys in a repository). This concerns me more than the vulnerabilities themselves. It's a pretty serious failure in leadership and shows that F-Droid is still driven by egos, not sound software engineering practices and a genuine interest in doing right for the community. F-Droid has numerous issues: * glacially slow to release updates even when security patches are released * not enforcing 2FA for developer accounts * no automatic vulnerability or malware scanning ...and more problems: https://privsec.dev/posts/android/f-droid-security-issues/ https://privsec.dev/posts/android/f-droid-security-issues/