Hacker News Reader

> No one needs them for discovering new software.

There's also people that don't know that they need "Firefox", they just want a browser. Or a tool to print envelopes or crop an image. So they search in the app store and they know it'll probably be okay.

If you search for this online you'd get a bunch of SEO spam sites, shady tools among other things. At least due to the developer fee and reviews there's at least some barrier of entry (Also if it's not perfect).

> App stores leave me with all sorts of unwanted properties, namely Google / Apple throwing their unwanted opinion around. Search for Instagram in the iOS App Store: the top UI element is “InstaMap”, thanks Apple!

Apple's search is notoriously bad and the perfect case to apply Hanlon's razor.

In what sense will it be ok? Isn't a lot of the stuff in appstores spyware nowadays?

While there is generally always some small percentage of apps that don't do what they promise and slip through the review I think I can be reasonably sure that if I download something from the macOS / iOS app store it'll do what they say.

I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere. For the average user it's probably the better option than downloading the top Google result and just executing it.

> I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere.

The current migration towards more sandboxing also helps. For instance, Android has restrictions on how much an application can do in the background without showing up as a persistent notification, and xdg-app's sandboxing can restrict how much of the content of your computer an application can access without using a file open dialog.

Uh, what are you talking about? Phoning home with your data (mainly phonebook and location data) is exactly what a lot of apps are doing.

Sure, they wont do crypto mining, but that's because it would drain your battery quickly, and people would notice and uninstall.

As I said, it can happen but I'd assume it's done a lot less than on the "open" internet where there's no repercussions. At least in the App Store the developer would get thrown out, people would post it in the reviews or report to the App Store moderators.

Isn't the whole point of sandboxing and the permission systems exactly preventing phonebook and location data misuse? Especially location tracking prevention was a pretty big part of the iOS 13 announcements.

The permission system does work and is a great achievement. Along with battery monitor and the ability to easily and cleanly uninstall any app.

I don't understand why we keep falling back to uneducated users in this discussions. "Oh we're tech heads; we're not the standard audience..." ... maybe the standard audience should bother to learn something.

I live in a city now and no longer have my own tools/garage, but I know enough about my car to know the shop down the street was trying to screw me when they did a bait in switch, wanting to charge $950 for an alternator repair (and claimed my battery; less than a year old was bad). I called around, towed it to another shop and paid less than half of that...and the battery was perfectly fine.

I should have checked the reviews on the first shop because they were some pretty bad ones. Now I know better, but there are a ton of people who just accept it, maybe because they're car was already towed there and they simply don't know any better.

> I don't understand why we keep falling back to uneducated users in this discussions.

Because that is the majority of the users and because it's hard to find reliable information on the internet even if you're willing to do the research into this sort of thing. I'm certain there are plenty of things that you are probably not knowledgable about and don't put the time to learn about as well.

> So they search in the app store and they know it'll probably be okay.

Bad plan, both on iOS and Android. You should not be installing random apps unless you vet them first.

People keep going back to the "users are stupid" argument, but (particularly on Android) the app store does not protect users. Installing random apps or trusting the first app that shows up is a terrible thing to teach dumb users to do.

If you want to protect users to the point where they don't need to think at all, you need to be way more locked down than iOS/Android currently are -- you need Nintendo Switch levels of moderation, vetting, and sandboxing. The problem is that very few people (dumb users included) want that level of vetting for a smartphone.

>Ugh, app stores! >No one needs them for discovering new software

I so badly wish I could agree with you :)

Sadly, observing the non-tech folks around me, some of which don't even know what an app is, and some of which think the only apps they'll ever use on their phone is the ones it came loaded with ... it's not true.

What is needed is an android app. store that is decentralized / distributed, where the "trust" of an app is a consensus-based score and that has the popularity of whatsapp.

I agree with this. What I'd ideally like is to keep the Play and Apple stores, but also make it possible and easy to use 3rd party stores - kind of how you can add alternative package repos in the Linux world. Unlikely to happen without legislation, mind.

> All I really want is an OS facility that only executes code that has been installed explicitly by me, and always in a sandbox.

Androids app sandbox is pretty leaky. It has a massive surface area, and the chances of finding exploits to get out of it to find root are high. Also, even from within the sandbox, there are lots of evil things you can do (for example, start on boot, and go fullscreen and use all the ram so the back and home button SystemUI process gets killed and your app is unkillable.).

The 'badness' of the android app model is a big chunk of the reason Google wants to be gatekeeper - otherwise android apps could just load and unload like webpages do. That and profit.

You say this, but rooting attempts for flagship Android phones have failed at many recent pwn2owns. The grey market price for a root exploit on flagship Android is comparable to iPhone.

The most popular third party rooting services don't seem to support past Android 8.

Clearly it isn't easy to root these things.

I wonder if part of that is that a lot of flagships seem to have unlockable boot loafers now, with a force wipe to do so. Does that have a measurable impact on the number of people trying?

It doesn't seem that way. There are still people attempting pwn2owns. The grey market value of a root exploit is still in six figures and likely higher on the black market.

Code Signing and HTTPS are two completely unrelated concepts...

Yes, but their point is: Why would you need code signing if https is working correctly when downloading software?

The product is built in a very controlled and secure environment at the core of a company's competency ... code-signing here stamps the product as authoritative and representing the company's efforts.

The website from which you, the customer, download the software often is built and managed under less controlled and more vulnerable circumstances, often with third party involvement. Any bad actor in a long chain of internal caretakers and potentially external hackers can replace the to-be-downloaded artifact HTTPS with malicious junk. Code-signing mitigates this.

For example, code signing can protect against an attacker that can swap the application, but not the signing certificate. It can allow retroactive disabling of a certain application by revoking the cert that signed it. In short: HTTPS ensures the integrity of the download at the time the app is downloaded, code signing at the time it runs.

Because somebody might’ve changed the files on the distribution servers. We’ve been signing executables for decades?

As a matter of fact, APKs are signed anyway using the pubkey of their developers, the signature is embedded in the package, regardless of whether it's in the app store of not. You cannot use a package with a different signature to replace the existing one, the system will warn you about a conflict.

If someone has changed the files on the distribution servers. A Hacker News reader will have no problem recognizing it and stop installing, another one will compare the signature and keep it as evidence.

Of course, the overwhelmingly majority cannot recognize it though.

Semi off-topic, but anyway, I have an supportive argument for you: APKs are signed anyway, the signature is embedded in the package, regardless of whether it's in the app store of not, it the signature has changed, you cannot use a new version to replace the previous version without manual reinstallation, it's an effectively safeguard against phishing.

But only the readers of Hacker News can recognize it. I think it's one of the most powerful argument for a walled garden. Not that I support it, but I acknowledge it's still a powerful argument.

Street Joe and Jane lack the technical skills to understand https://firefox.com/ from https://firefox,.com/, or what installing an app means.

"Isn't just clicking _next_ until the app starts?"

Hear Hear. I'll take that in a non-phone version too please.

SSL during download really isn’t a substitute for code signing.

But we have fdroid and the GNU/Linux ecosystem is going to eat android’s lunch anyway.