Damus
Zapstore profile picture
Zapstore
@Zapstore

Open, permissionless app store powered by your social graph

Download 0.2.3 for Android: https://cdn.zapstore.dev/640c736271195e0c8cd7a5425d5a49e3fb3208735e14a36b2aa051eac5efa80e

SHA-256 checksum: 640c736271195e0c8cd7a5425d5a49e3fb3208735e14a36b2aa051eac5efa80e

APK cert hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Relays (3)
  • wss://relay.damus.io/ โ€“ read
  • wss://relay.primal.net/ โ€“ read
  • wss://relay.nostr.band/ โ€“ read

Recent Notes

Zapstore profile picture
I don't know how else to say it, I don't care about whatever browsers gonna do. I don't need to wait for anything.

You're describing Web Bundle exactly, which likely contemplates gotchas you haven't thought about.

If you want to write a standard for zip files, this is what we tried with @npub1ye5pt... long time ago, feel free to create a standard that we can reference (with a proper mime type) and I'll add it to the spec
Zapstore profile picture
Fascinated by the idea of sharing Android apps offline, and specifically during internet blackouts that are an unfortunate reality around the world.

The ability to send and receive "an APK", no matter how much the sender is trusted, opens a dangerous attack vector โ€“ especially with open source software. An adversary, by means of basic social engineering, has now an untethered distribution channel to spread a malicious fork with zero verification.

Zapstore, however, has been designed from the ground up for adversarial contexts. We are able to send not only Android artifacts, but Nostr events that verify it and set up a basic web of trust check completely offline.

Won't be implemented right away, but here is the draft spec to kick it off:

https://github.com/zapstore/zapstore/issues/259#issue-3795860706
Zapstore profile picture
GM developers!

Not cool to publish an app that is not yours.

Friendly reminder for now ๐Ÿ˜˜