4 ms·

Why is it that software repositories work so much better than these app stores? Every app store on every platform is a wasteland of adware and malware, but I ha

Why is it that software repositories work so much better than these app stores? Every app store on every platform is a wasteland of adware and malware, but I have never found such a program in, say, the Debian repos. App stores manage to be simultaneously more restrictive than a repository and less trustworthy than downloading executables through a web browser.

arianvanp 8y ago
Scale. The average user has never heard about software repositories.
ppeetteerr 8y ago
This is due to the audience of a Debian repo versus the audience of an app store.
smadurange 8y ago
People using Debian repo probably check the check sum as advised unlike Google Playstore users :)
baud147258 8y ago
In addition to what other had said, I think that, since there aren't any money to be made of debian repos, unlike the app store, shady actors won't be likely to bother.
dTal 8y ago
There's an element of curation - any rando can't just upload something to Debian, there's a web of trust. But mainly I think it's that repositories are invariably built from source. Everything in a distro repository is open source software, guranteed to have been built from source from scratch. F-Droid does this, and its repositories are as clean as any Linux distro's as far as I can tell. (This is why Moxie's claim that F-Droid is somehow less secure than Google Play because it signs its own .apks is weapons-grade baloneyum. On Google Play, that .apk could have anything in it. On F-Droid, that signature is a guarantee that that app has been downloaded and built from public sources, just like any Linux distribution. If F-Droid allowed developers to sign their own apps, then F-Droid couldn't build the apps, unless every app supported reproducible builds.)
- bilkow 8y ago
  Actually, F-Droid supports using the upstream developer signature for quite some time now if the build is actually reproducible. https://staging.f-droid.org/en/docs/Reproducible_Builds/ https://staging.f-droid.org/en/docs/Reproducible_Builds/ https://gitlab.com/fdroid/fdroidserver/commit/8568805866dadbdcc6c07449ca6b84b80d0ab03c https://gitlab.com/fdroid/fdroidserver/commit/8568805866dadb...
em500 8y ago
Debian (by far the largest repo of mainstream Linux) has about 70k packages, and gives approximately $0 payout to package owners. By contrast, Google Play and Apple App store have around 2 to 3 million apps each, and aggregated payout of double-digit billion dollars. It should be fairly obvious why they attract so many bad actors. > App stores manage to be simultaneously more restrictive than a repository and less trustworthy than downloading executables through a web browser. Downloading executable through a web browser is something entirely different than Linux repos. Not sure I agree it's less trustworthy than Google Play and especially Apple App store, comparing to Windows download side. If it is, it's mostly down to the the monetary incentives.

arianvanp 8y ago

Scale. The average user has never heard about software repositories.

ppeetteerr 8y ago

This is due to the audience of a Debian repo versus the audience of an app store.

smadurange 8y ago

People using Debian repo probably check the check sum as advised unlike Google Playstore users :)

baud147258 8y ago

In addition to what other had said, I think that, since there aren't any money to be made of debian repos, unlike the app store, shady actors won't be likely to bother.

dTal 8y ago

There's an element of curation - any rando can't just upload something to Debian, there's a web of trust. But mainly I think it's that repositories are invariably built from source. Everything in a distro repository is open source software, guranteed to have been built from source from scratch. F-Droid does this, and its repositories are as clean as any Linux distro's as far as I can tell. (This is why Moxie's claim that F-Droid is somehow less secure than Google Play because it signs its own .apks is weapons-grade baloneyum. On Google Play, that .apk could have anything in it. On F-Droid, that signature is a guarantee that that app has been downloaded and built from public sources, just like any Linux distribution. If F-Droid allowed developers to sign their own apps, then F-Droid couldn't build the apps, unless every app supported reproducible builds.)

bilkow 8y ago
Actually, F-Droid supports using the upstream developer signature for quite some time now if the build is actually reproducible. https://staging.f-droid.org/en/docs/Reproducible_Builds/ https://staging.f-droid.org/en/docs/Reproducible_Builds/ https://gitlab.com/fdroid/fdroidserver/commit/8568805866dadbdcc6c07449ca6b84b80d0ab03c https://gitlab.com/fdroid/fdroidserver/commit/8568805866dadb...

em500 8y ago

Debian (by far the largest repo of mainstream Linux) has about 70k packages, and gives approximately $0 payout to package owners. By contrast, Google Play and Apple App store have around 2 to 3 million apps each, and aggregated payout of double-digit billion dollars. It should be fairly obvious why they attract so many bad actors. > App stores manage to be simultaneously more restrictive than a repository and less trustworthy than downloading executables through a web browser. Downloading executable through a web browser is something entirely different than Linux repos. Not sure I agree it's less trustworthy than Google Play and especially Apple App store, comparing to Windows download side. If it is, it's mostly down to the the monetary incentives.