Login to reply
Replies (16)
Yeah, fuck play store amd shithub
I have a question about @Zapstore
Is the trust model basically: trust Zapstore to point to the right URL and app creator signing info on first install, and then all updates after are signed by the app creator?
Also the first install is validated by the devs on nsec, so I guess you trust zapstore to not have bugs, but the idea of the code is that it validates the actual devs signature which you can compare to your social follows.
Then regular TOFU kicks in for android protection
Cool, that's a good approach. I was a little confused because their FAQ describes trust in a Zapstore indexing key, which sounds like trust in something server-side rather than client side. I'm still a little confused where that comes into play. If the client verifies the dev's signature and shows it you so you can verify matching npub yourself, that would definitely mitigate any server side trust.
Zapstore signs with their indexer key all apps that are not self signed by the developer.
So you trust zapstore with TOFU in this case. So if you love an app thats not yet self signed on zapstore, go bother the devs to do it, its trivial, literally half a prompt.
Awesome!
you can use the same spec that zapstore uses to have your apps auto-update from nostr.
that's what damus does. don't need to rely on them at all.
Eventually @Zapstore can (and should) let you use your own Point of View's web of trust.
Well that sounds dope, cool
The URL barely matters. If the dev self-signs, the APK signature is checked against their nostr pubkey, so a poisoned index pointing at a swapped binary fails verification outright. Zapstore is transport, not the root of trust. The soft spot is unsigned apps, where their indexer key stands in, which is why pressuring devs to self-sign actually moves the needle.
Exactly this, but I will add that you are prompted to verify the download URL, which in many cases is the developer's Github. So github user/repo comes comes into play there too - which is exactly what Obtainium does.
Build a brand that will stand the test of time with @TeamToxic ๐
This is the way !
Import from GitHub etc and publish repo with gittr.space mate. Cli is so yesterday. Also we don't need centralised app stores on nostr they're an add-on, see gittr.space/apps
Some love their cli ๐๐ช