Avatar
Zapstore
78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d
The open app store powered by your social network Download 0.2.7 for Android: https://zapstore.dev/ SHA-256 checksum: 800b9048974dfcac4e1e1b9afe0812d15e42a08264ba0b8877e22c2e6d2221ae APK certificate hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320 Technical support: https://signal.group/#CjQKIK20nMOglqNT8KYw4ZeyChsvA14TTcjtjuC2VF6j6nB5EhDLZ7pQHvOeopr36jq431ow (do not use Nostr DMs)

The option is adding your app to apps.yaml in our repo https://github.com/zapstore/releastr and sending a PR (or let us know). It only supports github as source right now.

I know, it's not great. We're working on supporting more sources and after that, developers self publishing.

"Cypherpunks for three decades have been trying to create cryptographically secure webs of trust, and what nostr figured out is we just need people to shitpost to bootstrap them" - nostr:npub1qny3tkh0acurzla8x3zy4nhrjz5zd8l9sy9jys09umwng00manysew95gx on the latest RHR

🎯

If you want to better understand zap.store's web of trust checks, here is a web version to play around with:

https://trustgraph.live

Interesting. Should be fixed when we check version codes. Planned for next release

Yes, but support for more sources coming soon

We're creating an app store in an adversarial permissionless environment. "Delisting" is only possible today because we have control during this bootstrap phase.

Closed source apps, malware and everything in between is coming. We don't want to become yet another "benevolent" dictator - and ultimately we can't as nostr is a permissionless censorship-resistant protocol.

We will become the best tool for users and developers to find each other with the highest fidelity possible in such an environment.

nostr:npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8 how can I add an app to the store?

Also, do you vet all the versions of the apps on the store before they become available to install?

For now, while we bootstrap, send a PR with an updated apps.yaml at https://github.com/zapstore/releastr

No we don't vet any version. We simply index select repositories and pull the APKs. Curation will come in due course.

I believe Fedi is currently the only closed source app indexed in zap.store , and this was by mistake. Their source repository only has a README file.

We will eventually support proprietary software but need to work on the appropriate warnings.

What should we do now? Leave the misleading repository or delist the app? Both options sound bad.

It was a proof of concept for what we're building. It's not fully functional on CLI yet, but it will come.

You can install bitcoin core from many package managers but often have no idea who built it. You may need to trust one entity and a random maintainer for your distro and there's no easy way to change that.

If we can make package hashes be cryptographically linked to nostr pubkeys, we can leverage trust signals in the nostr network and do curation to increase confidence in what we're installing.

Web of trust is not the one and only solution to this problem, or a perfect one, but a powerful tool in the toolbox. Our goal is to maximize signal and minimize noise while operating in an adversarial permissionless environment.