Hacker News Reader

Comment by orf | Hacker News Reader

> Epic Games will be launching its hit game Fortnite for Android on its own website, and fans will only be able to download the game there, not on Google Play ... while the setting that blocks third-party installations can be disabled on Android phones.

If they are talking about disabling it system wide vs disabling it for a single application, is this not pretty irresponsible? Lots of kids play Fortnite, saying "hey to play your favourite game just disable this security setting" to millions of them seems risky.

View on HN

You're right that it's a bad situation for millions of kids to be told to turn off security settings, it seems like that's a bad situation for Android/Google/Samsung than it is for Epic Games. It's kind of Google's own fault for tying their 'security' into a huge tax. If Google offered certification for a fixed cost then this wouldn't be an issue - you could distribute certified apps yourself and not have the problem. The problem is they tied certification into a tax and appearing in the appstore.

> The problem is they tied certification into a tax and appearing in the appstore.

If you were more profit motivated, you might argue the problem is allowing externally installed software. Granted they foolishly obtained too large of a market share to have any say in that anymore.

If you care about users though, yes, the cost barriers for devs are a problem no matter who puts them up. Ideally the cost is in the phone purchase, not the continued use.

Hopefully these kids will be exposed to the idea that they can choose what software they use rather than being limited to a curated store.

They will most likely be scammed into downloading spyware.

Which is a valuable lesson - a lesson in learning to be a rational, critical, grown-up human being. Or we could educate them and it might never happen. Also, let's not forget that many closed system are spyware already.

Many of us became deeply involved in tech because some person (thanks Pat Volkerding!) or organization gave us a system were we could do whatever the hell we wanted.

> Which is a valuable lesson - a lesson in learning to be a rational, critical, grown-up human being.

Well... you can phrase it like some life lesson, sure. In reality 1% of 3 million kids clicking on 'Free vbux!!' and converting is 30,000 kids having malware ridden phones, doing god knows what to god knows who.

Is increasing the profits of malware distributors by so much really worth some hand-wavy "teach kids to become a grown up" lesson?

Also, it's not just the kids. By any margin.

In reality 1% of 3 million kids clicking on 'Free vbux!!' and converting is 30,000 kids having malware ridden phones, doing god knows what to god knows who.

Well, most of those kids will run outdated Android versions with many known vulnerabilities. And they cannot update their phones, because they have locked firmware and walled-garden OS, largely put in place to make them buy new phones.

Again, the proper solution beyond a good security baseline is to educate people.

> ...they cannot update their phones, because they have locked firmware and walled-garden OS, largely put in place to make them buy new phones.

This is one of the biggest problems with the mobile landscape, with Apple, Google, and OEMs culpable to various degrees. It's deeply unethical, selfish, and wasteful.

> Again, the proper solution beyond a good security baseline is to educate people.

"The beatings will continue until your security improves!"

I'd rather my kids get a few bruises than be slaves to The Man.

>Many of us became deeply involved in tech because some person (thanks Pat Volkerding!) or organization gave us a system were we could do whatever the hell we wanted.

Surely you can understand why letting people do whatever the hell they want might not be the best thing when people's personal and financial data is on the line.

Surely you can understand why letting people do whatever the hell they want might

As a default no. But there should always be an option (with appropriate warnings) to do with your device what you want to do with it.

might not be the best thing when people's personal and financial data is on the line.

Even on a walled garden device people will open phishing mails and log in to phishing websites. There will always be attack vectors. Beyond a reasonable baseline in security (sandboxing between applications, etc.), the most important thing to do is to educate people on proper security practices.

The burned hand teaches best.

Yeah, agreed.

A lot of computer knowledge comes from trying something, failing, and then learning how to recover.

I learned a lot from bricking my laptop in my early teens downloading roms and warez, and then understanding whats safe and what's not, and with little long term consequences.

Having grown up in the time of Windows being very malware-heavy, it was not the children getting scammed.

And much of the bad behavior, such as simple apps bombarding people with ads, is standard in programs found in mobile app stores now anyway.

Darn, this is really "think of the kids" all over.

You don't need to download spyware with virtually any mobile phone, pretty much everyone out there is doing already(recent ref: google maps)

I think Google Maps is in a different league when we're talking about actual spyware that means to do you harm. Google just wants to track your location, while this other crap will spam you phone calls and try to brick your phone for money.

I'm all for more freedoms when installing apps, but Google Maps isn't the same as this other shit.

Think of the kids has always been an excuse to restrict people.

Not an Android nor Fortnite user, but I believe from other reports there is a prompt to re-enable the setting after installing the app.

It's possible they're using the uncomfortable security risks as a play to get better terms out of Google.

> If they are talking about disabling it system wide vs disabling it for a single application, is this not pretty irresponsible?

It's not a system wide setting, it's an app-specific setting (that is, it's for the app you wish to be able to install other apps.)

Setting it to “allow” for the default browser and leaving it that way is something of an issue, though.

So in this case Chrome or Firefox? Does not seem any better. In fact, way worse.

I don't think this is how it works, at least not from my past experience with Lineage. A browser isn't an app installer, as when you download an APK from it, the APK is staged through the phone's integrated file manager (aka "Downloads" app), and is treated as having no real source.

As far as I know, real "app installers" are purpose-built programs such as Amazon Appstore and F-Droid.

Hmm, you might be right, but I installed an APK recently (also on Lineage) and it asked me to authorize Firefox, it had the Firefox logo and seemed to suggest that future installs would be authorized. I cancelled it and opened it through the file manager.

Hmm, that might be one of the changes made in Oreo. Weird, I don't think it's a very good change either.

In my experience its only an app-specific setting on Samsung devices. Their phones give you a prompt for disabling the setting "just this one time".

It's app-specific for any phone running Oreo or newer.

Android doesn't have system wide sideloading anymore, if I allow sideloading for one app its still disabled for other apps.

This is not much of an issue with newer versions of Android. see Tim Sweeney's tweet about the situation: https://twitter.com/TimSweeneyEpic/status/102553539172465049...

IIRC, the setting only needs to be disabled temporarily to allow the installation of a third party app. If you re-enable the blocking setting after you install the game, I don't see any reason things can't work and be secure.

How will they handle updates?

Installing a downloaded APK means you miss out on Google's identity verification process, and maybe on Google's malicious code scanning -- but Google Play Protect says it will scan all apps on your device, and may upload your apps to Google[1], so it might not be that big of a difference in practice, if you get linked into the appstore by a shady website, you can get a shady app.

There's a bigger difference on iOS, if a similar setting was even available, because Apple curates much more strongly than Google.

[1] https://support.google.com/accounts/answer/2812853?hl=en

Unless there's a different app store doing the same thing. (Such as Amazon app store for Android or F-Droid)

Is it not irresponsible for the platform to force the choice to be that coarse-grained?

Reply on news.ycombinator.com