Vela Maps - Alternative front end for google maps.

basic-channel

Hey everyone, I really like this app, especially the design, the traffic data and the inclusion of POIs that alternative non-google apps seem to be lacking. Another big plus for me is the privacy aspect. I was wondering though how secure this app is. Since it seems to be pretty much vibe coded I am worried that it might provide an entry point for malicious actors. Especially with the advent of AI agents on the horizon. That is something I worry about in regards to other open source apps as well. I am not that tech savvy, so would appreciate some thoughts and assessment from others here on this forum.
Thank you in advance!

DeletedUser1181

basic-channel A fair concern. It's important to preface that security is a never ending pursuit. What matters most to me, even for transparently vibe coded applications, is that the author has configured server-side security checks for easy to spot bad code (under the .github folder), has a SECURITY.md for a formal vulnerability reporting policy (else, real vulns get lumped in with random bug reports and feature requests), and ideally would also report a software bill of materials to audit the licenses and dependency vulnerability scanning. In the former, you want to make sure the project isn't violating other's software licenses and the latter is useful in identifying supply chain vulnerabilities.

I'm not as familiar with phone apps as I am with SAST tools for the same for more traditional scientific computing languages, so others would need to comment. But a quick scan of the ci.yml doesn't strike me as running SAST and other insecure code sniffing tools server-side. Just scanning the comments of the file. They could be doing this locally but we can't really know.

The effort seems genuine here and the developer is a user here, I think these are simple enough additions they'd be willing to make.

I use it with Obtainium and add a 30 day delay on updates.

becomeparmesan

DeletedUser1181 @PimpinPumpkin : can you comment on this? Would be great to know how you make sure it does not contain any severe bugs, loopholes etc.

Tbf, I would nowadays rather trust a very good AI (like Claude) to spot these things, as they can also find bugs that people missed for years.

DeletedUser1181

becomeparmesan This is true, AI has improved a lot. But the pace of it makes careful review of web requests, supply chain CVEs, etc. pretty difficult. That's where traditional CI tools excel!

Norman

The app is pretty good, but a big critique I have is operating it while zoomed-in. Some locations/businesses don't show up on the map until you zoom way in, but taps and actions generally are super buggy and not responding. It seems half my taps and squeezes are nulled input when zoomed in. Its also quite laggy.

DeletedUser1181

I will say, in a very popular touristy US metro area... the Vela data from Overture hallucinates the entire neighborhood across from me into a commercial area with business names that Google doesn't find when clicking on them. Overture may not be a very reliable source in my area. Roads are correct though. Errors are fully resolved by switching "Places come from" to Google. I'd recommend switching to Google sourcing for any travel, regardless of destination.

Slurp

Does this have waze police reports by chance? If not any chance for future?

PimpinPumpkin

DeletedUser1181

becomeparmesan

DeletedUser1181

As of today the repo has: private vulnerability reporting switched on, with the policy in SECURITY.md; a security workflow that scans the source on every push and pull request; Dependabot alerts on the libraries the build actually resolves, with the bill of materials exportable from the repo's Insights page; every GitHub Action pinned to an exact commit; and an OpenSSF Scorecard run. On the app side, device backups no longer include the Google web session or location history, and the embedded web pages cannot read files. SECURITY.md lists all of it, including what is still open. Scanners miss things, so if you read the code and something looks wrong, report it there.

I am using Claude Opus and Fable for audits of Vela perodically (basically when I feel I've done enough work to warranty it) if that helps at all. Another thing to note is that by design Vela has no backend, so data exfiltration is less of a concern. Of course, being open source, I encourage you all to look at the code. I'm pretty new to Android development as I've mentioned in the past, so if you have suggestions I am all ears. Thank you to all who have contributed so far!

PimpinPumpkin

Norman Working on this.

DeletedUser1181 Please submit a bug report of the general area you were seeing this issue. Bear in mind that if you search for a business or address it will use Google regardless, so "Places come from" is only changing what source the business icons come from on the map. I think I need to rename the way this works because people seem to be confused about this in general.

Slurp Waze, no. It's a closed API and I don't see a way I can scrape from it for the time being. But, if someone else does that legwork, then I'm open to adding it if it's possible. I was/am exploring adding a system for our own reporting and alerts though on OpenEventsDatabase, which is related to OpenStreetMap. I haven't put energy into it (yet). I don't think there are many apps that actually make use of this backend which is a shame, since it's a chicken and egg game. No users reporting = no users using, etc. If Vela gets it, it would benefit any other apps that chose to adopt it.

DeletedUser1181

PimpinPumpkin I don't have a public GH account, unfortunately. It's specifically an issue with Overture placing inaccurate icons.

I don't want to provide my location but I found a good example near the National Mall in DC, USA. The FDIC building is listed correctly when icons are from Google. Setting to Vela which uses Overture, "CIA Museum" appears in the same location. This is wrong. The CIA Museum from what I could find is in Virginia, not in DC. In my residential area, Overture is placing a bunch of icons for businesses which are actually apartment buildings. Navigation isn't an issue, just a chance that "Indian restaurants near me" returns phantom results.

Address: 550 17th St NW, Washington, DC 20429

Another example: Overture says this address is an aquarium. It's actually the Department of Commerce.

Address: 1401 Constitution Ave. NW, Washington, DC 20230

I don't think it's anything you can control, it's Overture. My recommendation for Vela would be to add a disclaimer that Overture POIs may have significant errors and Google sourcing would be preferred for better POI accuracy.

becomeparmesan

DeletedUser1181 I found a good example near the National Mall in DC, USA

Could not see what you described around that place. You could share a screenshot or exact coordinates maybe?

In general I agree that Overture data seems low quality though - surprised as tomtom is steering member of it. Could be worth to limit data only to OSM, as that is at least editable and expandable by average Joe.

DeletedUser1181

becomeparmesan The rest of the post gives two specific examples and the addresses.

cdflasdkesalkjfkdfkjsdajfd

@PimpinPumpkin is there a reason to use the voices inside the app instead of use the TTSEngine_Next-genKaldi? Are voice models inside the app updated or only downloaded one time?
Thansk at keep the good work!

PimpinPumpkin

DeletedUser1181

Ok, I checked your two addresses against the data Vela ships for DC and I see what is going on. Two changes are built. An entry Overture itself is unsure about now needs a second source before it ranks that high. And the data build now removes places that Foursquare, OpenStreetMap or Wikidata list as closed. That took out a large portion of businesses that were closed for a while. Both reach the app as regions are rebuilt over the next week or so. I could not find a CIA Museum at 550 17th St in the current file; if it still shows for you after that, tell me the build number.

Additionally, I've started Vela Almanac, which will eventually be the new source for 'Vela data' (businesses and POI icons). I'm building scrapers for business licenses, liquor licenses, etc, and building on top of Overture/AllThePlaces/OSM to rank each place by likelyhood of it still being open. That's what every project I've seen thus far is missing; continuous updates. The data will be AGPLv3 for anyone to use as long as they give due credit, so other projects can make use of this. Not to jork my pumpkin stalk, but this is pretty cool stuff. For those that are not familiar with AllThePlaces, I'm basically borrowing their concept but hitting US institutional datasets in addition. Yes, this will be US only for now, and I am literally just starting work on this now, so bear with me.

becomeparmesan Vela Almanac will save our souls. It's pretty amazing the huge sponsors they have over there for having such garbage in their mix.

PimpinPumpkin

cdflasdkesalkjfkdfkjsdajfd Nope, same thing under the hood. If you already have a TTS provider installed when you install Vela, it should ask you if you want to use that one instead (it will still urge you to download Vela voice just for consistency but of course it's optional). Quality control is very important to me, so that's why I took that approach for standardization. At the moment, voice models are not updated by the app. I don't think the model I'm using is still actively developed. I am working on another project that will potentially deal with better quality voices, but I'm not ready to make that public for the amount of polish it needs.

cdflasdkesalkjfkdfkjsdajfd

@PimpinPumpkin have you planed download maps using custom servers?

https://codeberg.org/gedankenstuecke/comaps-map-distributor

DeletedUser1181

PimpinPumpkin Nice, I'll give it a go on the next release. Temporarily adjusted my release window delay to grab it as soon as it ships.

Winston

PimpinPumpkin reddit is garbage and so are most of the losers on there. Thanks for the app!

becomeparmesan

DeletedUser1181 I don't wanna bash Vela (too much) here, but both addresses return a list of results for me.. Settings are set to places 'both' and 'don't use google'.

Anyway it seems PimpinPumpkin found the issue.

dryfter

Vela actually caused me to make my first ever Github Pull request over on the Transitous Github repo to add my local transit agencies so I can see bus line info in the app directly - and it got MERGED! Like, holy crap I actually did something useful other than submit Issues on Github? Not that submitting issues isn't useful, but I can actually point to something specific and say "I did that!"

« Previous Page Next Page »