In short: in order for Accrescent to continue advancing, we need $5,800/month in recurring donations to fund its full-time development. This work includes adding features to the Accrescent app and developer console, building new subprojects and tooling, and making improvements to Accrescent’s architecture and server infrastructure — work we currently have limited resources to do, as I can no longer afford to work on Accrescent after October with its current funding.
For the next 3 months, development will continue according to a short-term roadmap we plan to publish in a follow-up blog post next week. Also in that blog post, we will include an extensive development progress update and long-term roadmap for how we hope Accrescent can develop beyond the next 3 months.
After October, feature development will cease unless we reach our funding goal. Maintenance will continue regardless of funding on a best-effort basis, including dependency updates, security patches, and bug fixes. Accrescent will continue operating as-is since recurring donations still cover all existing server infrastructure, so apps will continue to update as usual and developers will still be able to manage and update their apps. New app submissions are unlikely to be accepted to Accrescent for the time being.
Yeah. It sounds like what they need is an actual business model. They are building a centralized app store.
FOSS projects that rely on servers like F-Droid and Mastodon don’t get attention and support because of the merits of their codebase, they get support because they are frontends for networks that are larger than just themselves and their own developers. Accrescent has always explicitly eschewed this model. That makes them a single point of failure that a lot of people will unfortunately find challenging to support, as much as I wish FOSS devs to be fairly compensated for their work. (This is exactly one of the many reasons I always wanted them to position themselves as a true F-Droid replacement with support for external app repos.)
If you insist on building a centralized service, usually the only sustainable business model is to obtain as many users as possible, then charge businesses/orgs for the privilege of using your service to distribute their content to all your users. Basically, Accrescent needs developer fees.
It is also going to be a hard sell to people when they say their costs are currently around $50/month yet they need $5800/month without providing a bit more in depth reasoning as why their costs will rise by 100x in the next 3 months.
We are currently spending $53.53/month on our services.
supporting third-party repositories breaks the Android security model.
Another reason Accrescent doesn’t support third-party repos is lack of available security features. The chain of trust between Accrescent and the signed repository metadata would be weakened since Accrescent can’t reasonably maintain a list of hardcoded keys for all third-party repos. TLS certificate pinning is also impractical to implement for third-party servers.
Accrescent aimed to be the more secure replacement for F-Droid and Google Play and ultimately it’s the one failing.
It’d be great if Accrescent supported paid applications and took some percentage as a cut. Their situation is similar to some other FOSS projects (in that it’s difficult to make money) and both Accrescent and some FOSS app developers could benefit from it.
I know paid distribution isn’t the most common method of monetizing FOSS, but it’s sometimes the only possible option for certain applications such as Cryptomator and InviZible. (I believe they technically use a key licensing system which I assume could be removed from the app, but this would be a convenient alternative.)
I think I read that F-Droid was not interested in this so I believe they’d be the only FOSS app store around supporting paid Android apps.
But why in three months? Did they just realize they need to switch to full time development immediately, this month? Why not try to do this incrementally and set a more realistic fundraising goal?
If you think about it for more then a few minutes it does not make sense at all to tell users costs will rise by 100x in 3 months and if they don’t get the money the project is basically dead.
It sounds to me like rising costs are basically them saying that they need more money to account for labor and feature development. Maybe their infrastructure and related expenses are about $50/month, but labor is probably huge. My guess is that the devs need more money or they won’t be able to focus the same amount of time as they have been. Which is understandable - everyone has to eat.
I tend to think that there is probably some other opportunity for the dev, that they have to make a decision on, that will require to much time for this to be a side project, so they are trying to see if this project can be their full time job instead. Pure speculation on my end..
I’m fully aware of the reason they give for not supporting it. It just isn’t a good reason. Of course, it is easier for them to do it the way they’re doing it instead of building the tools that would be required to make this system secure from scratch, so I don’t blame them, but I’m not exactly applauding their approach to security either.
Around a decade ago Moxie Marlinspike was working on a project to tackle a similar centralization problem—except with HTTPS/SSL—called Convergence. Unfortunately it never took off and we all decided to centralize on Let’s Encrypt instead, but a similar system could be deployed here.
It’s very unfortunate that they can’t properly fund feature development currently, and, although improbable, I really hope they can reach their goal. It is a fantastic app store.
I’ve been wondering why they have been telling developers that they currently can’t accept new app submissions, but I guess this explains it (I know both CoMaps and Syncthing-Fork wanted to be added, for example).
It’s not as much about verifying the security of the apps themselves, although there’s that too, but rather verifying that you are downloading the app you said you wanted to and not malware instead. Essentially ensuring that nobody tried to MITM the download process, as well as things like letting devs sign their apps securely themselves rather than signing it for them, which ensures that the integrity of the app is intact straight from the developer until it gets to your phone.
They have the submission process in their documentation:
A reviewer will be assigned to your app after you submit it. To increase its chances of being accepted, please review the app requirements later in this guide before submitting.
Edit: Forgot to add, but they also have their requirements here.
The only reason I currently use Accrescent for like 2 apps is because its in the GrapheneOS store. Its not a hard requirement for me to use it, but I have found some interesting projects just looking at the app list. I might throw a couple dollars their way, but I don’t have a reason to support them on a monthly basis. Maybe that will change as the app list grows
This is absolutely absurd.
Even back when GrapheneOS had a goal, theirs was still $5000, despite doing 100x the work.
Their approach is completely incongruent with typical FOSS model.
They need an actual business model if they want to earn a comfy $70k a year for this offering.
Their monetary approach might be different or not as good, but as far as their approach to privacy and security for an app store, their approach of following textbook best security practices is unmatched compared to other FOSS app store attempts, which is what sets it apart from others. It’s the reason I care more about this succeeding that I normally would personally otherwise.
See that would be my main concern is someone uploading an app that says one thing and does another. MITM wouldn’t be the first thing I would worry about because it would be much easier to write some code maliciously than it would be to MITM. If a bad actor were to write an app and hide a few lines of code in there (which wouldn’t be hard) and so to me at least it’s really important how these apps are verified. Small unknown app store is a nice place to target and I’m sure people have tried, if they already have malicious app coded and tried to upload it to other repos, there’s no harm in trying again at smaller ones. Obviously they want to cast a wide net but and getting it into the play store would be ideal and personally I’ve never even heard of this app store before and I am sure that’s true for a lot of other people but after seeing how the spending is drastically increasing makes it more skeptical now than ever.