Hacker News Reader

Comment by scarface74 | Hacker News Reader

Epic Games wanted to enable players to sideload Fortnite directly from the Epic Games site, rather than through the Google Play store. Sweeney said that Google put up “scary” pop-ups in front of users about the risks of sideloading (viruses, malware)

https://www.google.com/amp/s/www.cnet.com/google-amp/news/fo...

As spotted by Android Central, Google has disclosed a huge vulnerability in Epic Games' original Fortnite installer for Android, one that could have taken advantage of the Fortnite installer to install and launch a rogue app, and even give that app access to your phone's data without you ever knowing.

View on HN

Perhaps, it still doesn’t make Tim’s claim false. Surely they can patch the vulnerability.

The point is, the world is pushed back into prodigy land of closed systems. Sure, it was completely wild west during the period when everything was open and that, the current state is defacto consolidation... however, innovation has its limits once kept in a sand box. From an ecosystem perspective, there are ways in which, closed systems and open world can exist.

Google and apple have for better or worse decent ecosystems, but, have they not stiffled competition in subtle yet effective ways for years?

The fact that they can patch their security vulnerability is poor consolidation for someone who gets hack.

People don’t understand how the Wild West where every program you install has full access to your computer and the consequences of it - adware, toolbarware, viruses, ransomware, etc makes people a lot less likely to install software.

And again we have two ecosystems - one where you can sideload and one you can’t. Where are all of the innovative apps that are only on Android?

Android makes sideloading difficult and scary enough that it's not really an option for the majority of users. Hence this article, and the lack of sideloaded apps.

It should be scary and the Fortnite vulnerability is a perfect example.

> Where are all of the innovative apps that are only on Android?

Because I'm on iOS, I can't reply to notifications from my Pebble smartwatch. If I was on Android, I'd be able to do that, because of the lack of Apple restrictions.

Non AMP link: https://www.cnet.com/news/fortnites-battle-royale-with-andro...

That’s what I get for using Chrome instead of Safari. That’s weird. I guess it shouldn’t be. When I navigate to the link from Safari and use the copy action, I get the link below:

https://www.cnet.com/google-amp/news/fortnites-battle-royale...

From chrome I get a link from the google domain. I forgot that Safari always copies the target url from a host.

Would going through the Play Store have prevented this?

In this case yes. The flaw as I recall was in their updater/launcher. Google play requires that you use Google play for updates

> An app distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code

https://play.google.com/about/privacy-security-deception/mal...

So Epic would of used Google’s update feature and not their own and avoided the issue completely (any update bug would of been Google’s and not Epic’s)

They probably did the math and figured out they could cover the distribution and all for less than the 30% slice of the pie to Google.

Hopefully they learned from that flaw.

Google's rules on monetization was the reason they decided to distribute outside of the play store.

And from a consumer’s point of view, it also shows why mobile app stores are valuable.

I’ll install any random crap on my iOS devices knowing that they can’t do much harm and they have a granular permission system. I’m very careful of what I install on my computer.

Even when companies aren’t acting with malicious intent, they can screw up your computer.

A Chrome update completely hosed Macs if they had System Integrity Protection turned off.

Heck, iTunes had a bug that would erase your hard drive if you had a space in its name.

Reply on news.ycombinator.com