Multiple apps installed via Accrescent are significantly outdated

graphoux

Several apps installed via Accrescent are significantly behind their latest releases on GitHub: Molly, DNSNet, Aves, etc.

Do you experience this too? Does this pose a security concern?

Thanks!

xbxbz

graphoux

You can use Obtainium instead of relying on Accrescent. However, I personally don't use Obtainium. For convenience only, I recommended it. I always try to download manually from GitHub.

The-Man

security of your device is your priority. Don't fall for convenience and let an app do it for you.
It is a security concern out of date software is not security, its taking a chance at best.
Do it yourself then you know its done, no ifs or buts...

graphoux

schweizer oups you're right, sorry about that Molly is not outdated in Accrescent I spoke too fast ! The other two applications I cited are though

xbxbz Yes, I already use Obtanium for all apps not available in Accrescent. I prefer to use Accrescent whenever possible, primarily because it's officially supported by the GrapheneOS team; or at least that's what I infer from it being available in the default GOS App Store. However, the fact that Accrescent can take weeks or even months to roll out app releases makes me wonder if there's something concerning about it that users should know about, or whether it's still a reliable option for getting apps.

DohnJoe

xbxbz I always try to download manually from GitHub.

May I ask why you prefer to do it manually instead of automating it through Obtainium?
If it can help, I also use APKUpdater for some apps from github.

schweizer

First of all I would not be surprised if that happened because Accresent has a very tiny user base compared to other apps stores.

That said, no i.e. Molly came out yesterday with v8.2.2-3 and it is already in Accresent. That's pretty fast, isn't it? Which version would you get if you downloaded from Accresent?

@The-Man : Do you hold an official role? I have trouble understanding your post. Outdated versions can be a security concern and most people do not have time and knowledge to supervise all the sources and verify the latest builds are reproducible.

The-Man

schweizer Do you hold an official role? I have trouble understanding your post. Outdated versions can be a security concern and most people do not have time and knowledge to supervise all the sources and verify the latest builds are reproducible.

no
never mind
Outdated version of software is a security concern
most people make their security model too complicated, see it all too often, go too far down the rabbit hole and security becomes too restrictive, unusable and the real problem.

schweizer

The-Man i read your first post as "Don't use an app store use an RSS reader for source code update alerts and do the code review yourself. Don't rely on Accresent for that." The second posr says the opposite: Too complicated. So how should the OP get his apps? I use obtanium because it eliminates one trust party - the store.

@1qkv9ddu3so2irvz Yes. But if true that speaks both against Accresent and the app developers.

1qkv9ddu3so2irvz

Could be the devs if those apps simply forget to put the update on Accrescent. Happened to the Auxio dev, for example.

Johnnyloans

schweizer

The man is saying: if you can't get updates for an app via accrescent, then take matters into your owns hands and find a way to get updates or maybe even don't use the app.

Don't just sit idle. Your security is your responsibility.

gristle-cause

OrganicMaps also appears to be some weeks out of date

xxx

gristle-cause OrganicMaps also appears to be some weeks out of date

This is not as important as molly or the unified push distributors.
You can expect a delay with the stores updates. Sometimes minor updates are not released. Not every update includes important stuff.

Remember it is in alpha stage.

gristle-cause

At any rate, this would appear to be a massive security risk: users cannot rely on timely security patches

Is this a fault of Accrescent, or the individual app developers? Somebody is failing to push updates

Dumdum

gristle-cause Is this a fault of Accrescent, or the individual app developers?

https://accrescent.app/docs/guide/getting-started/

Similar to the Play Store, all apps in Accrescent are submitted and updated by their developers.

More info: https://accrescent.app/docs/guide/maintenance/updates.html

VEECCdYKYi

gristle-cause Accrescent is in alpha, so relying on it and expenting a 1.0 experience in on the user.

However should GrapheneOS include and alpha state app store in their own App Store. I think not, and GrapheneOS app store doesnt warn the users about its alpha state.

GrapheneOS should either remove it until its in a mature state or claify for the users it's in alpha state.

MetropleX

Apps on accrescent not being up to date is a dev issue.

See the response to this issue from Aves:

https://github.com/deckerst/aves/issues/1960

schweizer

It is the same old discussion if a store makes sense or not.
Pro

a store can be a trusted party that checks the quality of the code
a store can be a curated list of trustworthy apps.

Contra

a store increases the number of parties that need to be trusted by one.
a store that is not up to date can be a security risk even without bad faith.

Ammako

For what it's worth, Molly tends to push updates as beta first (pre-release on Github), before transitioning them over to stable (release on Github) a little while after, once it's been tested. I'm 99.9% sure they aren't going to be immediately pushing each new version to accrescent as soon as they are available in pre-release, because the default behavior when you install with the apk directly is to only check for and install stable versions, and accrescent doesn't have the option for separate stable and beta update tracks.

The previous stable for Molly was from February 7th, last week 8.2.2 was published as beta and it wasn't moved over to stable until two more revisions over the course of the week. The latest one sat in pre-release for a day or two before being marked as stable.

So in the future, if you see that the Github has several newer versions that aren't on Accrescent yet, if the new versions on Github are all marked as Pre-release, that's probably why.