Hacker News Reader

Comment by hooluupog | Hacker News Reader

You are allowed to install other app stores on a android device.You can even install apps from unknown sources.But you need to be responsible for your own security.

View on HN

you need to be responsible for your own security.

Or they could make sandboxing actually work.

I am not aware that anyone has ever made this work. Full VMs are escapable, iOS jails have been broken and even permissions technically allowed can be abused, etc. There is room to improve, but "just make it impossible to escape the sandbox" is massively oversimplifying. It also makes it harder to make useful apps if you reduce API surface.

if you can produce a flawless, performant, sandbox, fame and fortune awaits you.

However, you can't install other app stores from the Play Store itself. That seems pretty anti-competitive. Google also bans ad-blockers from its Play Store. Why? Because they interfere with its business model. Again, anti-competitive. No different than Verizon banning Skype from its network.

It's a shame the EC didn't hit Google over these, too.

It's kinda a chain of trust. One of the value of the Play Store is that you trust it not to include malware (if you do). If they allowed other app stores to be installed through it, google can't be confident in saying if you use our store, you won't get malware.

You trust the Google Play Store not to have malware?

It's certainly far more trustworthy than the iOS app store and Chinese app stores, all by a wide margin.

Based on what metric? Google doesn’t even pretend to review apps and the Google app permissions framework is laughable.

Based on total malware installs, where Apple has everybody beat by even just Xcodeghost alone.

Google doesn't pretend that manually reviewing apps prevents malware because it obviously (to any software engineer) doesn't. It does, however do both static and dynamic analysis of the apps in its store, unlike Apple and the Chinese app stores.

And that really hasn’t help. Xcodeghost basically affected the Chinese App Store where app authors downloaded a non Apple hosted version of Xcode.

https://us.norton.com/internetsecurity-mobile-android-vs-ios...

https://www.sophos.com/en-us/security-news-trends/security-t...

That doesn’t even consider all of the unpatched Android security holes.

https://www.esecurityplanet.com/mobile-security/how-secure-i...

Or the fact that most Android phones are running older versions that will never get patched.

https://developer.android.com/about/dashboards/

Compared to iPhones running the latest versions....

https://www.digitaltrends.com/mobile/ios-distribution-news/

There is no "Chinese app store" for iDevices. Anybody who downloaded WeChat anywhere in the world was affected.

Trying to bring uo unpatched devices is changing the subject (security-conscious people use Android devices that get regular security updates) — we were talking about app stores. It remains a fact that far more people have been infected with malware from the Apple App Store than from all other app stores combined.

People who care about security use devices that get updates - that’s true. They buy iOS devices.

Which Android devices get regular updates for over 2 years? 3 years? 5 years?

Android is insecure by design - since most devices can’t be updated. Unlike iOS devices that get updated regularly worldwide without waiting on the carrier.

And I posted links showing that Android is not as secure. Do you have any links to back up your claims?

That doesn't sound anticompetitive in the least. Alternative stores are allowed on Android; Google just isn't going to bend over backwards to do everything for you.

Google allows basically everything on the Play Store. To not specifically restrict their competition would not be "bending over backwards" at all.

You can install ad blocking web browsers just fine. The rule is that you can't publish an app that interferes with another app.

Reply on news.ycombinator.com