6 ms·

Should developers come together with a foundation for software distribution ? An appstore, members are individual or corporations, governance through election o

Should developers come together with a foundation for software distribution ? An appstore, members are individual or corporations, governance through election of a board by the members (see Debian and Openstreetmap)... And a little help from the European Comission who'll be happy to have a neutral channel to impose on the monopolists !

karmelapple 4y ago
Sounds neat. How will you help ensure malware doesn't show up on there?
- counttheforks 4y ago
  How does HTTP ensure malware doesn't show up on there?
  - rrix2 4y ago
    all the major browsers ask google if the URL you are trying to visit is "safe" https://safebrowsing.google.com/ https://safebrowsing.google.com/
    - charcircuit 4y ago
      That is reactive, and not proactive prevention
    - klabb3 4y ago
      Sandboxing of the browser is much more important than that. Apple and Google built their own sandboxes for mobile, I think personally we should take the best open sandbox env and expand. Wasm is a great start, does multiple languages and easy to port to new platforms. Human friendly higher level capability wrappers / ACL could be built around it.
- liotier 4y ago
  Apple and Google are excellent at moderating against malware, and that is a serious barrier to entry. But a bunch of publishers fed up with paying Apple and Google might be motivated enough to invest in an equivalent community infrastructure.
warkdarrior 4y ago
Time to nationalize F-Droid!
Const-me 4y ago
I don't like another app store. Not as a user, nor as a developer. I would prefer first-class support for self publishing. Want to install some app, open some-app.com in a browser, and click "download" button. The security issues should be solved with technical measures on the OS side. Modern phones have sufficient resources for proper sandboxing at the OS level. Modern ARM CPUs even support hardware-assisted virtualization. Virtualization might be an overkill for the problem though, there're simpler ways, like abusing multi-user nature of all modern OS kernels. Modern phones have sufficient resources for verifying digital signatures. We already have relatively decentralized global infrastructure for that, not too expensive to buy a signing certificate from verisign/comodo/digicert/etc. Can be optional, as long as end users see a clear warning "you're installing an app of unknown identity. Continue?" Software updates don't need to be centralized either. When a user installs 100 apps from 100 publishers, I think it's OK to run 100 small HTTP requests to web sites of different publishers, couple times a month when checking for updates.
- m-p-3 4y ago
  I personally like the idea of repositories that F-Droid uses. Each app vendors could have their own repos that users subscribe to, but one of the strength you give up by moving away from a centralized app store is discoverability, but that didn't stop us from having great desktop softwares in the past, all distributed by the vendor/developer.
  - ncr100 4y ago
    I wonder if F-Droid can be a basis re-distribution to e.g commercial and other-managed app stores, today? IDK enough about F-Droid.
    - m-p-3 4y ago
      F-Droid (the service) is focused on providing apps that are compiled by them using the original source code (they can redistribute the developers' APK if the build process is reproducible). F-Droid (the client) is simply a way to easily access the F-Droid repository (which is there out of the box), but anyone can create a repository and male it available to be registered in the F-Droid client as another source, completely independent from the F-Droid service.
ocdtrekkie 4y ago
Join Epic's Coalition for App Fairness.
ncr100 4y ago
Yes. It would not have to be a public-facing destination (for downloads / marketing info). I would encourage this: it could operate instead like a repository, from which it could republish to other app-stores. So that way one would avoid the varying security and cost differences of each app store destination.
naasking 4y ago
We wouldn't need an app store or any kind of walled garden if the operating system were actually designed with proper security in mind. As it is, apps need to run with too many privileges which is why filtering out spam and dangerous apps from a store is a "value-add".

karmelapple 4y ago

Sounds neat. How will you help ensure malware doesn't show up on there?

counttheforks 4y ago
How does HTTP ensure malware doesn't show up on there?
- rrix2 4y ago
  all the major browsers ask google if the URL you are trying to visit is "safe" https://safebrowsing.google.com/ https://safebrowsing.google.com/
  - charcircuit 4y ago
    That is reactive, and not proactive prevention
  - klabb3 4y ago
    Sandboxing of the browser is much more important than that. Apple and Google built their own sandboxes for mobile, I think personally we should take the best open sandbox env and expand. Wasm is a great start, does multiple languages and easy to port to new platforms. Human friendly higher level capability wrappers / ACL could be built around it.
liotier 4y ago
Apple and Google are excellent at moderating against malware, and that is a serious barrier to entry. But a bunch of publishers fed up with paying Apple and Google might be motivated enough to invest in an equivalent community infrastructure.

warkdarrior 4y ago

Time to nationalize F-Droid!

Const-me 4y ago

I don't like another app store. Not as a user, nor as a developer. I would prefer first-class support for self publishing. Want to install some app, open some-app.com in a browser, and click "download" button. The security issues should be solved with technical measures on the OS side. Modern phones have sufficient resources for proper sandboxing at the OS level. Modern ARM CPUs even support hardware-assisted virtualization. Virtualization might be an overkill for the problem though, there're simpler ways, like abusing multi-user nature of all modern OS kernels. Modern phones have sufficient resources for verifying digital signatures. We already have relatively decentralized global infrastructure for that, not too expensive to buy a signing certificate from verisign/comodo/digicert/etc. Can be optional, as long as end users see a clear warning "you're installing an app of unknown identity. Continue?" Software updates don't need to be centralized either. When a user installs 100 apps from 100 publishers, I think it's OK to run 100 small HTTP requests to web sites of different publishers, couple times a month when checking for updates.

m-p-3 4y ago
I personally like the idea of repositories that F-Droid uses. Each app vendors could have their own repos that users subscribe to, but one of the strength you give up by moving away from a centralized app store is discoverability, but that didn't stop us from having great desktop softwares in the past, all distributed by the vendor/developer.
- ncr100 4y ago
  I wonder if F-Droid can be a basis re-distribution to e.g commercial and other-managed app stores, today? IDK enough about F-Droid.
  - m-p-3 4y ago
    F-Droid (the service) is focused on providing apps that are compiled by them using the original source code (they can redistribute the developers' APK if the build process is reproducible). F-Droid (the client) is simply a way to easily access the F-Droid repository (which is there out of the box), but anyone can create a repository and male it available to be registered in the F-Droid client as another source, completely independent from the F-Droid service.

ocdtrekkie 4y ago

Join Epic's Coalition for App Fairness.

ncr100 4y ago

Yes. It would not have to be a public-facing destination (for downloads / marketing info). I would encourage this: it could operate instead like a repository, from which it could republish to other app-stores. So that way one would avoid the varying security and cost differences of each app store destination.

naasking 4y ago

We wouldn't need an app store or any kind of walled garden if the operating system were actually designed with proper security in mind. As it is, apps need to run with too many privileges which is why filtering out spam and dangerous apps from a store is a "value-add".