What do you think of Accrescent app store?

gta3

Eirikr70 in that case f-droid may aswel be default
It atleast offers detailed write up of each app and its flaws

Accresent and G play do not

AelwennBZH

gta3
You missed the most important point :

because the devs of GrapheneOS have established that it can be trusted as secure.

F-Droid still targets SDK 30. How could an app store that uses Android 11's security and privacy mechanisms be trusted ?
Accrescent is in alpha, but it's being developed with security as a priority.

vlad

AelwennBZH f-droid basic targets android 15, i believe.
https://f-droid.org/packages/org.fdroid.basic/
not propagating it, just noticing.

vlad

boarim i'm aware of this.
I'm ok with features bring developed, however i see no marks about "alpha" or "early access" status in the gos appstore:
"Accrescent is a private and secure Android app store built with modern features in mind. It aims to provide a developer-friendly platform and pleasant user experience while enforcing modern security and privacy practices and offering robust validity guarantees for installed apps."

Also, as i remember, at a some point there was an app including some google and huawei blobs in accrescent store, without clear indication about that.
https://github.com/accrescent/accrescent/issues/637
Is it still a thing?

As for me, if i want to install proprietary software with some vendor blobs, i come to google play store, apple app store, ms store etc, depending on platform. Any of those are not advertised as "private ... app store" though, i believe.

Eirikr70

vlad @lberrymage answered to that. Accrescent is not dedicated to FOSS but to privacy-respectful apps.

vlad

Eirikr70 yup, i know. “some horribly written opensource apps and some good proprietary ones”.
Simply doesn’t match with my personal vision of privacy and security.
Also there is small amount of apps being present overall, including very few i could use in my daily life. And i already told about ux that i doesn’t like.
So i see no reason to potentially increase an attack surface and adding inconveniences by installing just another app store for a couple of apps that anyway could be installed from other sources i already use. Even if it claims to be private and secure.
Thats what this thread is for: personal opinions about the topic.

missing-root

Eirikr70

Whatever that should mean. In what sense is QLango "privacy respecting" and other (FOSS and well known) apps that are not accepted are not?

It is in alpha so these are all just guesses. It makes little sense as a primary appstore

Eirikr70

vlad i see no reason to potentially increase an attack surface

Right, don't install Accrescent! No one wants to force you.

Novalissoide

vlad No, the main goal isn't personal opinions, the goal should be to close in on truth.

missing-root

vlad

No that is not really what this thread is for

AelwennBZH

vlad
https://f-droid.org/en/

The main app is on 30. So it doesn't matter, In 5 years, this "basic version" will be still stuck at 35.
The developers have publicly stated that the SDK level of an app is irrelevant if it's open source. They clearly don't understand what the SDK level is for. As an app distributor, it's quite embarrassing in every way.

AelwennBZH

https://social.librem.one/@eighthave/109545306371981727

missing-root

lberrymage

I know several apps that requested inclusion but are still waiting. "Stop asking us to be in Accrescent" has become a meme.

The Apps in Accrescent are random. To disproof this, please show me what criteria are used for allowing them

lberrymage

missing-root The criteria used are https://accrescent.app/docs/guide/appendix/requirements.html, the developers being willing to tolerate the issues described in https://accrescent.app/docs/guide/getting-started/new-app.html#creating-an-account, us having the time to dedicate to reviewing new apps, and the servers being a state that allows new apps to be submitted without causing us further maintenance work later on.

The apps included in Accrescent are not random.

missing-root

raccoondad you didnt read the post I assume...

People install these stores as they need a trusted source. Google Play isnt that.

And even just for harm reduction, including stores in the store verifies them with the OS root of trust and removes TOFU

missing-root

userofgos

It is included in the preinstalled appstore, making it an extended part of the OS

userofgos

missing-root https://xcancel.com/GrapheneOS/status/1983709785959879105#m

Our App Store makes it easy to securely install Accrescent or the sandboxed Play Store. There are other app stores beyond those. Accrescent is the one we have the most hope for in the long term. It uses official signed builds from app developers with standards for what's allowed.

https://xcancel.com/GrapheneOS/status/1923779934666752463#m

It's generally best to use builds from developers since you're going to be trusting them anyway. App stores including F-Droid and the Play Store do not avoid trusting app developers, but they add another trusted party. Accrescent only has developer signed builds signed by devs.

There's the misconception that app stores avoid nearly fully trusting developers due to their review processes and automated checks but it does not truly avoid trusting them and would not catch a nearly any competent attempt to ship something malicious, including for open source.

https://xcancel.com/GrapheneOS/status/1983946155919544429#m

Our recommendation is obtaining apps from Accrescent which provides developer builds signed by the developers. This can be easily verified after the initial installation. It does implement useful requirements for the apps enforced via static scanning of the manifest, etc.

It minimizes the app store being an additional trusted party.

missing-root

boarim

Which makes the choice even weirder. Accrescent might be great (even though many indicators like the lack of transparency and inclusion of proprietary apps are opposite of that), but it is not complete.

People will install a real appstore, and seriously using Google Play? Harm reduction.

Eirikr70

missing-root Here is the response of Accrescent.

What kind of checks will Accrescent do on submitted apps?
Accrescent has strict quality control measures to ensure the security and privacy of all submitted apps. For specific details on what these measures are, see the requirements section of the developer documentation.

Whether Accrescent has refused apps that meet these criteria and for what reason, that would be @lberrymage to answer. I remember a moment I asked him whether I should ask FOSS devs to join Accrescent and he told me that the store wasn't ready to accept new subscriptions. I think that period is over but I couldn't tell precisely.

vlad

missing-root
"What do you think of Accrescent app store?"

"Wondering what everybody thinks about Accrescent app store from the default GOS app store?"

ok, if you say so.

23Sha-ger

Unfortunately after 3+ years still in alpha.
Not the version "name" but the overall state.

The design and idea are nice, but there are less than 3 apps in the whole repo that are actually useful at least to me, to justify
an additional app store.

This seems that lack of interest from developers is the main
reason, they are just fine with F-Droid and have no plans to do anything about it. And let's be honest, around 99% of FOSS users are fine with F-Droid as well and run LineageOS of some sort, they don't verify apps or care much about security.

Maybe if Accerrescent will start making reproducible builds of
popular FOSS apps on GitHub and sign them with their keys it
will change it. But then it will be just F-Droid 2.0 with better approach.

lberrymage

23Sha-ger

This seems that lack of interest from developers is the main reason

We actually have dozens of developers (including several companies) who have reached out to us asking if they can publish their apps in Accrescent and are waiting to do so. We are artificially limiting them on purpose because our servers aren't yet prepared to make submissions generally available. They still need, e.g., account limits, rate limiting, more scalability, bug fixes, and other changes.

So for more context, developer interest is very visible from inside Accrescent. But I think there are other fair criticisms of it.

« Previous Page Next Page »