VideoLAN @videolan App Stores were a mistake. Currently, we cannot update VLC on Windows Store, and we cannot update VLC on Android Play Store, without reducing security or dropping a lot of users… For now, iOS App Store still allows us to ship for iOS9, but until when?

      • delirious_owl@discuss.online
        link
        fedilink
        arrow-up
        4
        arrow-down
        11
        ·
        7 months ago

        Thats not secure. Isn’t the pount of the Windows Store that packages are signed by developers and verified when downloaded?

        • 4am@lemm.ee
          link
          fedilink
          arrow-up
          28
          arrow-down
          2
          ·
          7 months ago

          No, the point of the windows store is that Microsoft gets more control over your machine.

          Code downloaded from websites can still be (and is) signed; when it’s not you get that box where you have to click “Run Anyway”

          • dev_null@lemmy.ml
            link
            fedilink
            arrow-up
            5
            ·
            7 months ago

            You can pay a one time fee if $25 to get Microsoft to sign your app on the Microsoft store, or you can pay $400+ per year to buy your own certificate. So Microsoft Store is sadly the cheap way to release apps on Windows. (Without users getting scary warnings from Windows and AV about installing unsigned aoftware)

              • dev_null@lemmy.ml
                link
                fedilink
                arrow-up
                3
                ·
                7 months ago

                The certs are sold by certificate authority companies, and Microsoft doesn’t get a share of that, though I’m not sure.

                Yeah, software being signed says nothing about it not being malicious or insecure, but it does prove the author is what it says, and if it is malicious then the responsible party is clearly visible.

                For non-commercial hobby/open-source software the certificate price is prohibitive, so the only 2 options are Microsoft Store or accepting that users will see the scary warnings, and of course complain to the developer about it.

              • WetBeardHairs@lemmy.ml
                link
                fedilink
                arrow-up
                1
                ·
                edit-2
                7 months ago

                The assumption is that legitimate companies who sell software will sign it and that signature proves it came from that company who you trust because of their publicly known legitimacy. It’s a bit of circular reasoning. But it does round back towards that legitimacy - if it is found that they violate your trust, they lose public trust and thus lose sales.

                Luckily new OSes (cough NOT WINDOWS) are able to sandbox applications and prevent them from accessing resources without declaring the need to access it.

                And as for the signing certificate, I think the MS Store will allow any signed app. They just offer the cheaper signing service.

          • masterspace@lemmy.ca
            link
            fedilink
            English
            arrow-up
            1
            ·
            7 months ago

            Come on man, every single software developer in existence uses package managers. It should not be complicated to understand the point of the store.

        • TWeaK@lemm.ee
          link
          fedilink
          English
          arrow-up
          5
          ·
          7 months ago

          Pretty sure they’re signed by Microsoft instead? At least that’s what other app stores do.

          It’s all a game of shifting the point of trust around. Personally, I’d trust most small time developers more than the likes of Microsoft and Google, however I’d trust Fdroid more than unknown developers (but still go direct to the developers I do trust).

          • delirious_owl@discuss.online
            link
            fedilink
            arrow-up
            4
            ·
            7 months ago

            The good ones are signed by the devs, otherwise there’s a risk of malicious modifications at upload or on the publishing infrastructure. This is how Maven works. All packages MUST be signed with PGP by the devs.

            Apt isn’t signed by the devs but its signed by the package maintainers, whose job it is to verify the packages that they prepare (devs can’t upload software in Debian)

    • massivefailure@lemm.ee
      link
      fedilink
      arrow-up
      8
      ·
      7 months ago

      How about winget or the other commandline package managers? winget does have VLC according to winget-pkgs. This is the kind of “stores” we need, ones that emulate Linux repositories instead of locked down smartphone garbage.