In particular, validating privacy policies is an unsolved area. How would one enforce that an app is allowed to access health data but doesn't forward it to the internet? One might envision some language environment that can track taint-style the flow of data through an application, but this seems beyond state-of-the-art.

Second this. The existing trust system of the web is much preferable to inventing closed store. Plus the web isn't going anywhere.

Here's what should happen:

Some site says "get our app". Click. A banner shows up showing the app name, icon, screenshots?, highlights the domain.

It declares what capabilities it needs, but most permissions are temporary and on-demand. Apps that have sensitive perms (mic, camera) are highlighted whenever they use it.

Aggregators, blogs, (heck even governments), trust pilot can all have their own ad hoc review systems and warn against whatever, for those that want. You could even have a pre-installed whitelist for extra safety for non-techies for all I care.

Ready to download? Just press get app. There can even be an option to run the app once if it's something stupid that should have been a web page. Once downloaded, the signature is verified against a tls cert.

Something like that.

> I would prefer first-class support for self publishing. Want to install some app, open some-app.com in a browser, and click "download" button.

Self-publishing, web-style, is suboptimal, because developers are never concerned about anything but their precious software. They're essentialy primadonnas who think that world revolves around them and computers around their "app". The results are predictable, resource utilisation of js-heavy websites is tested on high-end boxen with a single tab opened and various "self-publishing" bundles like Flatpack have 200× size vs normal deb packages. Well, I want to open more than 1 tab and install more than 1 software package, not necessarily on maxxed out machine.

And this is just technical issues, because after them there are social ones. DFSG and Social Contract are there for a reason, because far too many times software authors had in mind something other than user's best interest (two days ago there was a thread which started with lenovo, but quickly filled with plenty of other examples).

Maybe it's a good time to remember that PC stands for Personal Computer, not App Developer's.

Since the parent mentioned Debian: this is the model that Debian provides (and yum as well), and Ubuntu extensively uses: https://help.ubuntu.com/community/AptURL

Open some-app.com in a browser, click the apt:// button, and the system will not only install the requested app, but also use the configured channel for updating your apps.

There are numerous improvements to be made in this area, for example to automatically pin a package to an origin, or to limit third-party origins to only installing in /opt/$origin, but the mechanism has been available for two decades.

However there are other issues than security ones. Some stuff is not allowed, like for example doing some grown-up things (sorry to be so vague). Self-publishing only works if a third party efficiently controls forbidden things.

And that's an app store.