Post by @network_is_reliable@mastodon.social

2025-01-28 06:52 UTC

@normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange That's the biggest problem with Accrescent I see. You can not ensure that an app you want to install is not really malicious one submitted by someone else. Also if there are multiple flavors/builds (foss/with proprietary blobs) you can not check which one you are going to install. You have to trust that Accrescent reviewer does their job well. So personally I would still prefer Obtainium over Accrescent. #obtainium #accrescent #fdroid

Replies (2)

@network_is_reliable@mastodon.social 2025-01-28 07:54

@normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange If you can find any link on the official website of the app you want to install to the Accrescent store then it's probably worth to trust (like NeoStumbler does https://github.com/mjaakko/NeoStumbler in their repo). If official website/repo has no reference to the store, I would suggest to stay away even if the app is listed in Accrescent app.

Open ##3251251
@lberrymage@infosec.exchange 2025-01-28 08:26

@network_is_reliable@mastodon.social @normplum@fosstodon.org @celenity@infosec.exchange @accrescent@infosec.exchange For what it's worth, Accrescent does require domain ownership verification for all new apps now so that you can verify the app ID is published by its respective developer. It is also possible to verify that an app's signing key matches the developer's and is thus cannot be modified by someone else. However, I do acknowledge that it's not very transparent in the UI where an app came from or who submitted it, and that's something we hope to change eventually. We also intend to have more strict and clear policies about impersonation.

Open ##3251252