Accrescent Store?

[ghost]

No description provided.

[endingisnight]

You smell like a bot.

This app is already on F-Droid, where apps are also "filtered" and even built from source.

[endingisnight]

Your account is a month old, your issue contains a lot of fluff and spamming your own issue with positive emojies? Well that's sus at the very least.

Well F-Droid (2014) has a 7 year headstart on Accrecent (2021) and is much better established. Also checking Accrecent's server "parcelo"'s ""security""
is just checking the signature while fdroidserver also scans for proprietary libraries with suss and exodus reports, dex classes and for gplay frosting (some devs are just lazy like that). So if the devs do trip one thees scans they will be stopped as per the strict inclusion policy (so strict that izzy made a repo with looser rules (did I mention you can add multiple app sources?)). They also have (optional) "reproducible builds" where they build and compare the resulting apk to the devs one and release it with the dev signature. So IF the devs wanted to push a release with a virus they'd be stopped while (correct me if I'm wrong) with accrecent the devs can push whatever they want.

As a bit of a meta complaint, Accrecent hosts their repos on github, which (if you didn't know) is proprietary spyware owned by a conglomerate. While not much better f-droid currently hosts their stuff on gitlab.

Although I will give Accrecent one thing, they have material3. Oh wait, fdroid has multiple clients that also have material3? Never mind.

In conclusion: F-Droid > Accrecent

[endingisnight]

How will you know if my Account is only a month old, when it is private?

I'm instead asking myself how you are so distrustful without a valid reason.

A friend sent me a pic of some guy who had made a issue on like 10 different app repos asking for the app to add be added to Accrescent, and with your profile being private, you can see how I would associate. Or maybe I'm imagining it since I can't find the pic now :P

With F-Droid or whatever Store or APK you always trust others, so it does not make much sense.

When you install an apk straight from the app developer, it (usually) has the devs signature. If you then try to install another app with the same package name but a different signature you'll be stopped. With reproducible builds the apk would be built by the app developer, verified (and indirectly signed) by fdroid. My point here being that the trust is shared, they keep each other in check. With Accrecent there is only signature pinning, no anti feature scanning, no reproducible builds. If a malicious actor were to publish a proprietary apk, it would in theory (haven't tried this myself) get through.

Anyone should have a bit Empathy, because Accrescent is still in Alpha but try their best.

Seeing new open source software is always great don't get me wrong. But as you said Accrescent is still in alpha (after 3 years? damn) so holding off until they're atleast stable or have features that are missing in fdroid that give this software a reason to exist, would be smarter.

Saying this makes absolutely no sense, because I could say too, that Play Store is far ahead of F-Droid.

In what aspect is play better? They're completely proprietary, known to distribute malware, have shit discoverability and are constantly pushing their monopolistic tendencies.

People choose Stores like Accrescent because of the Security and Privacy focus and Features.

As I said before: Accrescent has worse security than fdroid (though yes, far better than play), privacy focus? eh, features? Do correct me but I know of 0 features that Accrescent has over F-Droid.

I'm more for Codeberg

I use my own forgejo instance, thank you very much.

...but you doing the exact same with publishing your App here.

I'm not sure if you think I'm the creator of Neo-Store or something, but I'm not. I don't host any apps or projects on this shit show of a git hosting platform, this is a dummy account I use to steal from epic games. I'd rather use gitee.com (Chinease spyware version of gitea) than github.com, honest.

I really don't get what your intention is with points like this. I'm speaking about Security and Privacy, but wow, Design makes so much sense to discuss about.

I was looking for features that would justify the use of Accrescent when F-Droid exists. Otherwise why bother?

you will understand yourself in the Future, why I see a big Benefit in there.

Oh please fortell the future to us mere mortals oh great one! For we could not comprehend your thoughts even if we could read them.

Some do not want to hear anything about new Stores and some don't want the effort that comes with that and they try to argue with weak points.

I want to hear FEATURES, why should I care when what I have right now is even better? WEAK POINTS? You fluffing one link into multiple is WEAK

https://accrescent.app/features I think matter for Neo-Store.

Security:
https://accrescent.app/features#signed-metadata (I don't get the point, the apk is already signed?)
https://accrescent.app/features#key-pinning (feature of android, not accrescent afaik)
https://accrescent.app/features#name-icon-verification (fdroid indexes are signed as well)

Privacy:
https://accrescent.app/features#no-remote-signing (same on fdroid if you do reproducible builds..)
https://accrescent.app/features#no-accounts (except devs, they have to use proprietary software (github) to login. Though the main point is that users dont have to, but guess WHAT FDROID DOES? GUESS WHAT THEY DO?!)

Also, putting the devs up to higher standards with a strict inclusion policy is a good thing. Asking for standards like not including proprietary tracking libraries like firebase or google mobile services, is a good thing.

TLDR; Personally, I don't see the problem that Accrescent is trying to fix.

[endingisnight]

On second thought, why did I go on this long tangent when I could just ask:

F-Droid Main Repo is not secure, it has Security Issues and filtering is not the same, as having more Security and Privacy Features like with the Accrescent Store.

Not secure? Security issues? Worse filtering? Prove it. Show some bloody sources.

[boredsquirrel]

Hi there, trying to loosen this up a bit.

The user is not a bot but probably rather new, in the "echoing GrapheneOS devs" phase.

The thing has pros and cons. You are right, accrescent doesnt scan anything. There is a proprietary app on there that includes all kinds of tracking, while they have now warning or even tags.

The issue is, that GrapheneOS people are very much against F-Droid for various reasons, which indeed are kinda hypocritical.

Pro F-Droid

• long established, tons of apps
• very minimalist and secure client
• efficient updates and mirror support, compared to Obtainium for example
• features, like screenshots, links, metadata etc
• it is a control instance, scanning apps and building them, finding issues and allowing reproducible builds

Contra F-Droid

• using the same key for every app puts huge trust in them. You already need to trust the devs (that their FOSS code is safe) and so you also need to trust F-Droid
• scanning can be tricked, like obfuscating a library. I dont think this is really done, but in theory it can, so "security purists" call the scanning "security theatre" while I think it works and is very valid
• targetting old Android phones.
  • The main client is using an old SDK, only "F-Droid basic" has a high min SDK. 3rd party clients like yours exist though
  • afaik their build system also targets old devices, so all apps are built with lower than possible SDKs with potential security issues as well as performance and functionality

This is simply not black/white. If F-Droid would have a repo with apps only built reproducibly, and on recent (currently Android 15) SDKs, it would tick all the boxes.

For the time being though, it may in some cases be better to use other methods, if you fully trust the devs.

XZ was exactly the attack vector that F-Droid (and other repos building from source) tackle, Accrescent doesnt. This is an important point.

[boredsquirrel]

@GrapheneOS it would be great to have a constructive discussion on this topic. You cant neglect that attacks like xz are no issue when fully trusting random developers. Also opensource apps need to be built reproducibly, which can only be guaranteed with a standardized build environment. I assume 90% of the apps on Github releases and also on Accrescent are not built reproducibly.

[endingisnight]

@boredsquirrel

The user is not a bot but probably rather new, in the "echoing GrapheneOS devs" phase.

What? How did you drag GrapheneOS into this? Is Accrescent the default store there? I'm clearly not that familiar with it and have only heard that the lead dev is mean.

The issue is, that GrapheneOS people are very much against F-Droid for various reasons, which indeed are kinda hypocritical.

Source? I tried searching but couldn't find any beef. Actually I found this on the GrapheneOS Wiki page:

In March 2022, writing for How-To Geek Joe Fedewa said that Google apps were not included due to concerns over privacy, and GrapheneOS also did not include a default app store. Instead, Fedewa suggested, F-Droid could be used.

I guess that Accrescent then would've only been a year old, so would've been a really bad idea to recommend it.

@PrivacyAndSecurity

But if everyone supports Open Source Projects,

But this is not a perfect world...

Even if I would send you the Article, you would say that it is outdated, so makes no sense.

You're telling me that ONE article made you love Accrescent so much and have a distain against all things F-Droid? That just makes me more curious to read it myself! Please, please DO SEND IT! If it's good, I'll join your side, if not we can clean up any misconceptions that you might've gotten from it!

Also as a side-note: recently Licaon_Kter on the fdroid matrix channel:

Imagine escaping the centralized store to run to the other centralized store: https://xcancel.com/tuxpizza/status/1864319206897995975#m

Another person that has some random hate towards f-droid for no real reason. He even talks about some vague notion of security (p.s fdroid also supports unattended upgrades since 1.19 on Android 12+)!
I really do believe that F-Droid's method of having to EARN the use of your own key is really better for holding app devs to higher standards.
And yeah! Accrescent is more centralized as well since it can't add multiple app sources.

[ghost]

Can someone please delete the posts about Discussion in here? It needs to be moderated.

[endingisnight]

omg, I was right, you are a bot! @PrivacyAndSecurity
microg/GmsCore#2637 (comment)
Droid-ify/client#815 (comment)
WrichikBasu/ShakeAlarmClock#86
tutao/tutanota#7976
mastodon/mastodon-android#936
Divested-Mobile/DivestOS-Build#186
(darkmoonight/Rain#93 why is OP recommending people use a store that IS WHITELIST ONLY? Give it some time to grow and smooth out bugs ffs.)
LibChecker/LibChecker#1403
(just in case, I've saved thees on web.archive.org)

zhanghai/MaterialFiles#1348

I would recommend you to get the F-Droid build in that case. But I don't have the time to maintain another store release that I don't use personally.

LMAO, even the author is calling you out!

LibChecker/LibChecker#1409
Wait what? You already use fdroid but just not the main repo? EXPLAIN YOURSELF!

Though you have provided some German translations, good on you! soupslurpr/AppVerifier#181

Please, please DO SEND IT!

"Please cite your the source of your claims"

Can someone please delete the posts about Discussion in here? It needs to be moderated.

"OMG, PLEASE DELETE! He needs to be moderated! Free speech is a sin!"

Wait.. did you just DELETE all your comments? Too bad for fucking you, I have email notifications enabled so I'm just gonna leave a file containing all your comments here for anyone to see~
PrivacyAndSecurity.txt

[ghost]

@endingisnight You are such a creep and annoying. You have nothing better to do, than wasting your time with others. That you listed these, shows your real face. It's none of your Business what others do, since you have no authority over others. And good for you saving all of these, since you have no life, because it must be so sad, that you waste it with bothering others with these senseless and rude behaviour. You told before that you stole a Account and I'm not surprised that you did lie before, by saying your friend did send you a pic...Such a bad lier. And no one is calling me out. But you being narrow minded and a troll in here. And I don't need to explain anything to anyone. Not every one who uses the right of free spech, does it in a good way, which helps others. People like you only bother others. And yea, I did delete my Comments and what now? I don't have time or energy to waste it anymore for you. And you are fucking no one, that's the sad reality of your life. You are fucking only your own life, with wasting it to these nonsense things. Good for you that you enabled it. Wow! You archived such big thing here...Never saw such a childish Behaviour.

[ghost]

@endingisnight You talk like you want to learn or know why I see Benefits in Accrescent Store, but you are only a Troll, because if Github is shit as you told before, why are you here then? What is your intention then? To annoy or bother others? Can you not accept other Opinions? You can't accept if anyone does not want to discuss and not have the time or energy for that. My Opinion was even not far away from yours, but with your Behaviour, why should I explain my view? You are just a creep, which came out of no where. You take everything personal. I'm not even against F-Droid, which you learned yourself, by stalking me, which is a sick thing to do and post. How did you even know my Posts, if my Profile is private? And saying still that I'm a Bot...Please don't discuss anymore, accept that.

[nubesurrealista]

This guy is spamming all over Github. He seems to be missing something: yes, you like Codeberg, Accrescent, etc. But in the end it is a sole and exclusive decision of the dev where he wants to host his code and apps, it is easy to understand. Github is a standard, Codeberg is a niche, developers will always choose the option that allows them to be relevant and reach more people.

[ghost]

This guy is spamming all over Github. He seems to be missing something: yes, you like Codeberg, Accrescent, etc. But in the end it is a sole and exclusive decision of the dev where he wants to host his code and apps, it is easy to understand. Github is a standard, Codeberg is a niche, developers will always choose the option that allows them to be relevant and reach more people.

Spamming is another thing. I'm asking normally instead, but it is not a bad thing to ask the own Apps. That makes no sense to say. I know that it is the devs decision, but it is my right too, to ask whatever I want. And I know the thing about Github, but I don't loose anything with just asking.

[endingisnight]

Dearest @PrivacyAndSecurity,

if Github is shit as you told before, why are you here then?

As I've said before, I am here because I wanted to do something with UnrealEngine which epic games only gives you if you link your github account to their epic account.

What is your intention then? To annoy or bother others? Can you not accept other Opinions?

Others opinions (I like to think that) I can accept, what I can't is you spreading FUD about F-Droid, calling them full of "security issues" without being able to come up with a source or any link.

My Opinion was even not far away from yours, but with your Behaviour, why should I explain my view?

Yes, and that makes me even more baffled at why we couldn't have been best buds, why could you not explain your view with facts? Why do you find F-Droid to have security issues? Why couldn't you have sent the link to the article? I really wanted to read it...

... by stalking me, which is a sick thing to do and post.

Sorry, but you and me, everyone, can use a search engine to search for site:github.com "PrivacyAndSecurity" Accrescent. I hope you find this as a wakeup call that everything you say and do will be saved and can always be used against you.

And saying still that I'm a Bot...

Sorry, this was meant to be a joke, since you copy and paste the same. script. every. time. like a bot.

I truly wish you well and hope that you can overcome your fear of spiders F-Droid. May we one day meet as friends on codeberg.org.

With love,
EndingIsNight

p.s ty 4 german translations

[endingisnight]

@nubesurrealista

But in the end it is a sole and exclusive decision of the dev where he wants to host his code and apps, it is easy to understand. Github is a standard, Codeberg is a niche.

Honestly, this makes me more mad than this entire thread.
Let me explain (this is already quite off-topic):
Yes it is the devs decision to host their projects wherever they want, but when most (fucking 90% by my stats) decide to host their OPEN SOURCE PROJECTS on a CLOSED SOURCE WEBSITE owned by a trillion-spadillion-megamillion conglomerate that has already faced monopoly trails, it makes you think "What the fuck are thees people doing??".
So advocating for OSS, privacy and security (ha) respecting solutions (even if they're a niche) and supporting the work of people who work FOR FREE and give all their work away FOR FREE (usually, let's not nitpick now) is always better than supporting or defending any conglomerate.[1]
Yes, Github has done a lot to popularize git. Yes we wouldn't be here without github. But github will never stand for freedom and OSS (atleast in my eyes).

developers will always choose the option that allows them to be relevant and reach more people.

I don't know about you, but I have (personally) (subjectively) never found a project through github. I always find that "oh, they're on github".
Friend told me to try osu? It's on github.
LibRedirect recommends using piped? It's on github. Libretranslate? github.
"Oh someone is self hosting a thing called "gitea", I wonder if they host their source o-" GITHUB.
"Oh that's a cool app on F-Droid! I wonder where the source is.." let me give you the odds: 2937/3736 (78%) of apps are on github.
It's github allllllll the way down.

[1]: F-Droid is NOT a conglomerate, PrivacyAndSecurity, It's a higher standard for devs to try harder.

[licaon-kter]

@boredsquirrel

using the same key for every app puts huge trust in them. You already need to trust the devs (that their FOSS code is safe) and so you also need to trust F-Droid

if the app is build reproducible the upstream signed APK is used, but you already know that I guess.

there are many apps not setup like this? sure, because switching users is hard, there's no automatic upgrade path, users need to individually uninstall and reinstall.

developers need to announce as such, F-Droid announces these in weekly news: https://f-droid.org/news/ but no one reads that, right?

The main client is using an old SDK, only "F-Droid basic" has a high min SDK. 3rd party clients like yours exist though

work-in-progress, come and lend a hand :)

afaik their build system also targets old devices, so all apps are built with lower than possible SDKs with potential security issues as well as performance and functionality

is this a lie or just FUD? where did you read this? 😨

@ ghost

Can someone please delete the posts about Discussion in here? It needs to be moderated.

surprisingly I agree, not useful to talk about another "store" when you want to make a case for yours.

@endingisnight

Licaon_Kter on the fdroid matrix channel:

Lies, I don't use Matrix lol

A friend sent me

not to you, but here it is:

@endingisnight next time, please do not feed the trolls, use this energy to help FOSS projects elsewhere instead

[machiav3lli]

I actually don't mind integrating other sources to get FOSS apps, but this is not the first time we had to deal with an Accrescent-troll, making the whole idea less attractive/motivating. I understand the enthusiastic "power" for some new "player", but this shouldn't turn to a bothering for other, existing projects (whether by dissing or spamming).

@nubesurrealista funny enough Neo Store, Backup, Launcher and Feed are all available on Codeberg already. So it's quiet literally only a spam.

I'll close the issue for now. If anyone involved would mind it, then I could re-open it.