Graphene's app store is the only store that doesnt

nullable

Follow the traditional practice of informing users which permissions apps have prior to installing them. Fdroid does it. All their forks i know of do list permissions as well. Google condenses the information for Play Store apps, but they still offer a courtesey glimpse to which grouped permissions those may be.

Or am i missing something not obvious to me at the moment...?

Xtreix

nullable Which authorizations should be displayed ? In reality, it doesn't really matter, F-Droid displays them and it's misleading, you just have to set the permissions in the application settings, for example, just because an application asks for the microphone's authorization doesn't mean it can access it, you just have to revoke the authorization. As written above, applications in the App Store are only trusted; if this wasn't the case, then it wouldn't make sense to use GrapheneOS.

minipie

GOS AppStore is currently used only for Grapheneos itself (Only with the exception of mirror Acrescent and some Google apps)
All Grapheneos applications (Camera, PDF Viewer, Auditor) are modern applications using only the necessary permits.

nullable

minipie GrapheneOS is exempt then, is that what you are implying? Sorry just trying to understand .

"modern applications use necessary permits", can you explain what you mean hear pleaae? are you suggesting apps dont need to request permissions because they are modern? or that permissions dont apply to modern applications or something else enrirely?

nullable

minipie oh you mean because they're web apps right? and web apps work how users come to expect while browsing any website or document/pdf/image....

missing-root

Yeah for that store, permissions etc are not needed

Accrescent on the other hand... could need this, and metadata, and screenshots, and links, a lot

nullable

missing-root not needed? like any app can do whatever it wants if from GOS store? I would think people might want to know which data that they are consenting to. Even if they're following the grouped permissions model.

i thought users have come to expect a certain minimum standard is upkept. otherwise why bother with permissions at all? Teach futility?

missing-root

nullable the GOS store only includes apps from GrapheneOS, 5 apps mirrored from Google, and Accrescent.

Those are all either trusted or Google stuff that simply is Google stuff.

Permissions also dont matter that much, as you need to manually enable most if not all of the relevant ones, only on GrapheneOS (sensors and network)

nullable

missing-root true but we're not talking a measly 5 apps with a dozen permissions. Just one of those (play store) has well over 150 last i checked. Others like GSF enable Google to do even more than that...

IF ANYTHING, i'd hope to see more transparency into what these apps are capable of doing, but u seem to think it's generic or not worth a common courtesey practiced in EVERY other market place or app store. Apkmirror and any of the mirror sites offer it, not just fdroid.

I do understand what you are saying though.. That permissions are generic. Most people dont care. Dont look at them, or seem to understand most any of it.

That isn't advocating for privacy or security. It's enabling a bad practice, period.

nullable

Xtreix how about the standard practice of a common application/package manifest? Could step it up and add dependencies with known list of libraries too.

"Authorizations".. Why use that word in particular? Do you play/work with IAM (identity) services?

It seems like a step in a different direction to not mention ATLEAST as much as any other place is doing.. People are generally pretty DUMB when it comes to their phones.

I get it. Permissions dont really work in the sense most ppl think they do.. But if the overall intent here is to free people from the burdon of a rapidly evolving thing, it isnt doing anyone any favors...

nullable

Xtreix and if people trusted the model fully, people wouldnt switch to graphene in the first place. Doing so would have zero benefit then

missing-root

nullable the point is that the apps either have little permissions, or they are Google which is all or nothing.

It makes sense when more proprietary apps are installed.

Note that most permissions are not granted by default. Also note that the internal permissions of apps dont do anything if the external, choosable permissions are not granted. So the internal ones (like the dozens of internet permissions) may confuse people and are all disabled if the bigger external (here internet) permission is not granted.