Hacker News Reader

Comment by leppr | Hacker News Reader

I've long wished there was a more encompassing alternative to F-Droid, which would include the same payment facilities as Google Play (paid app, in-app payments, subscriptions), allow proprietary apps (but still give FOSS as a search filter and show it as a prominent feature on the app page), and offer plenty of user curation features ala Steam and make filters optional (which would allow communities of independent reviewers to vet apps for child-safety, not being COVID-related, etc... and users to chose whether to restrict themselves to that selection or not).

It's quite amazing when you think about it, that two US companies have absolute power over deciding what 99% of people in the world can do with a device that many would describe as an extension of themselves.

View on HN

Epic games tried to side step google:

> When Fortnite launched on mobile in 2018, Epic Games very notably sidestepped the Google Play Store and pushed users to download the title directly from their website, an effort made to avoid the substantial revenue cuts that Google takes from in-app purchases of Play Store downloads. After 18 months of harsh rhetoric regarding platform gatekeeping, Epic Games says that Fortnite is now available for download on the Google Play Store, though it will still be downloadable from fortnite.com moving forward.

> Google puts software downloadable outside of Google Play at a disadvantage, through technical and business measures such as scary, repetitive security pop-ups for downloaded and updated software, restrictive manufacturer and carrier agreements and dealings, Google public relations characterizing third party software sources as malware, and new efforts such as Google Play Protect to outright block software obtained outside the Google Play store,: an Epic Games spokesperson said in a statement. "Because of this, we've launched Fortnite for Android on the Google Play Store."

And Epic conveniently forgot to mention the part about the security warning being well deserved when it came to Fortnite...

https://www.cnet.com/news/fortnites-battle-royale-with-andro...

So while the app was on an alternate store a security lapse was detected and fixed.

Isn't that actually proof that something doesn't need to be on google play to be checked and improved?

That really doesn’t help if there is a 0 day exploit.

Hmm... Well deserved, or a poor security choice for Android? The vulnerability appears to be that any app can overwrite an APK downloaded to external storage with a FileObserver. How is that not pathologically bad security on Android's part?

> Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified. This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK.

Android offers app-local storage that no other app can write to. Epic simply failed to use it. The alternative would be no shared filesystem at all, but then people would complain about that as well since things like file browsers wouldn't function and sharing things like photos between apps becomes tricky.

Notably, all operating systems that allow programs to write to files have this "pathologically bad security". Download a .exe file on Windows and check its hash before installing and you have a TOCTOU bug where malware can sub the file after you've checked the hash.

Another alternative is to not permit any application to be installed unless it is signed by the OS manufacturer or some other finite trusted list of signers - but then we are right back at the app store model that pisses people off.

"sharing things like photos between apps becomes tricky."

That's a solved problem. Apps on iOS can request access to the photo library. Why Apple still doesn't allow write access to the music library is frustrating.

It would be nice if you had a universal "folder picker" where multiple apps could be given access to a user created folder on ios, admittedly.

Definitely Well deserved.

That's not Android fault: you're asking Android to give you access to an unrestricted storage area (e.g. because you want to edit photos shot with your Camera app), and the fact that other apps can read/write to it, is the whole point of that storage. Hence you need to treat it as untrusted, and validate that you're going to install the APK that you thought you were going to install.

The flaw appears to be that there is no way to validate in external storage, since the contents can be changed after validation.

Which, yes, is a reason to not use external storage. But for large downloads it's undeniably the norm, since internal storage is frequently limited. Since Android doesn't appear to provide a way to use the SD card and also prevent this, that part of it is an Android flaw IMO.

As evidence, note the external storage options say "can another app access it? yes, if it's in external storage": https://developer.android.com/training/data-storage

They shouldn't have used external storage while using API for silent installs, full stop.

https://developer.android.com/guide/topics/data/data-storage...

The fact that the norm is different is a good point, but the norm is also not to implement your own app stores.

In fact, if internal storage is so limited that you don't have space for the APK, you'll get errors due to lack of space even while installing apps from the Play store

Sure, normally you need about 2x to install anything (both apps are kept until the new version is done and validated). But that's less than the 3x, if you also kept the download there.

Anyway. Yeah, silent installs make this dangerous, no disagreement there at all (tho they're always more dangerous. I'd prefer to never have them). But there's also no reason that Android can't provide a protected external store, except that they've been self-destructively hostile to external storage in any form. It won't work if you remove the SDCard and manipulate it elsewhere, but that's not the attack vector here - it's entirely possible to protect from things on-device, just like they do for internal storage. They even partially achieve it now, with "adopted" internal storage, so it's absolutely possible.

That article reads like propaganda for Google Store.

> That's because Fortnite isn't available through Google's Play Store. Epic instead chose an unorthodox -- and more dangerous -- route for the game's fans. Rather than download it through the official Google app store, players need to download the game and "sideload" the app on their Android devices instead. That Epic is allowed to do this underscores why Google's Android often gets knocked for its security chops.

No wonder they ultimately folded and came back into the “protection” [racket] offered by Google Play with PR like this coming to bear.

Those security issues would have been rendered moot by the sandbox if they went through the Play Store.

But really? That's the card you're going to play? That "every app has security issues" so this is okay?

The way I see it, a well-funded and very popular entity tried to bypass Google’s stranglehold (and high taxes) on app distribution. Even they ultimately failed to maintain independent distribution.

They probably invested quite a few engineering hours to devise a solution, as there’s a lot of code / Google services that need to be replicated. It’s unsurprising to me that there were some bugs in this code, and I think generally companies that respond to bug reports and issue patches should be commended.

Where I would disagree is if you are claiming that we should be treating Google Play akin to a low-level cryptographic library in the vein of a “don’t ever roll your own” approach. Allowing independent software distribution is usually considered a positive differentiator for Android. For this to be a viable distribution channel it’s actually extremely important for large and popular entities to be using side loading in order to build recognition and trust in its use. Ideally it results in open-source sideloading frameworks and best practices that the larger community can build upon.

Are you as forgiving about security issues with Zoom?

It’s OT but I will totally forgive Zoom for their security issues. Their CEO openly admitted they were wrong, promised to fix it, made real changes fairly quickly to better lock down default settings, have upgraded their ciphers, and made a major acquisition to build-out their security chops (Keybase) to address the larger problem of easy to use key management.

Personally I’ve relied on Zoom to get meetings running quickly (without wasting precious time fighting with hard to install client software) many times on meetings where I would gladly trade ease of use for security posture.

I think Zoom messed up but has shown they can admit fault and course correct.

They are—as far as I’m aware—an entirely content neutral communications network that lets me pay for a service, doesn’t try to analyze and data mine my content, isn’t operating as a middleman between me and my customers, and isn’t at risk of becoming my competitor if it detects my product is becoming successful. They aren’t leveraging a monopoly position to maximize rent seeking and crushing the little guy through arbitrarily enforced content moderation policies. They aren’t exploiting cheap labor or phish a business to intercept their customers.

So as far as growth-hacks go, playing some API tricks on Mac and Windows to get their client ridiculously easy to install and running in a meeting — which risked you entering a meeting without an extra prompt, or potentially provided a pivot for unsigned code....

Frankly they seem about as un-villainous as they come in terms of publicly listed tech companies or venture-backed unicorns.

You mean “API tricks” like surreptitiously installing an always running web server on Macs so that it could reinstall itself when the user uninstalled it?

They aren’t sorry for doing it. They are sorry for getting caught....

Yes, exactly. I believe they used the localhost server to be able to quickly install and launch Zoom with zero extra clicks when you joined a meeting.

It wasn’t used to track their users, or serve ads, or nag users to come back to Zoom or monitor anything on your machine. It was used so that when you wanted to join a meeting, it would get you into the room completely effortlessly.

Again I just feel like compared to the innumerable ways that big and “well respected” companies are regularly screwing their customers, using a technical hack only to make your product easier to use is in some ways commendable even.

I’ve wasted 15, even 20 minutes on some hour long conference calls just trying to get everyone dialed in and able to hear and talk. I actually chose Zoom because of how hard they worked to make it “Just Work”. I guess I feel like they had their heart in the right place, and didn’t actually abuse their users’ trust like almost every other company I’m forced to put up with.

I think Fortnite is even more ethically clear cut than Zoom though, because Fortnite tried to develop a feature that they have every moral and technical right and justification to do.

I see self-distribution along the lines of self-hosting. It’s feature that we want to be able to exist and be well tested and understood how to “do it right” for strong competitive and anti-censorship reasons.

Fortnite just happened to screw up a specific aspect of the implementation. In some cases you screw up, you patch it, you write a blog post explaining what you got wrong and how you fixed it, and you’re a hero for helping the community learn from your mistake!

I don’t understand why Fortnite got pilloried instead of the community wanting them to succeed so that they could blaze the trail for independent developers in the future?!

Why wasn’t the pressure on Google for not having better documentation and support for what they were trying to do, and for imposing arbitrary technical limitations like not allowing developers to keep the sandbox enabled for side-loaded apps?

Wasn’t it Google that actually found and disclosed the bug in Fortnite’s installer? That’s some serious gray hat level hacking.

If Fortnite had succeeded in mainstreaming the concept of side-loading it might have made it much more popular and pressured Google into not making side-loading technically inferior. That put the fear of God into Google and gave them a massive financial motive to undermine that effort.

It’s not like Google hasn’t badly screwed up many times with Android security in the past.

Why would they not allow you to sandbox non-play store apps?

Everyone wants their phone to be just as open as their computer and without restrictions - you have that with Android. The minute apps are forced to be in a sandbox, you forgo “openness” and “choice”.

I don't think there's any relationship except an inverse one between user choice and app sandboxing.

QubesOS, Snaps, Firejail, Sandboxie, browser tabs to some extent, restrict user-freedom in only the most technical way, with no bundled choice traps. On the contrary, a good sandbox allows users to forego human curation/proprietary malware detection services and execute any code they want.

But once you have a sandbox, you limit what the app can do. Would the outspoken users on Android be happy if the sandbox for side loaded apps restricted functionality they wanted?

Yes, the issues highlighted in the thread stem not from the technical limitations of Android sandboxing but political censorship by Google. Covid-19 isn't transmitted through apps. This is a stereotypical false dilemma fallacy, where users are artificially forced to chose between security and censorship.

And government wouldn’t try even harder to censor? The big thing in the early 90s was the government going out of its way to try to force the record labels to censor hip hop groups like NWA (F the Police) , 2 Live Crew, and Ice T (Cop Killer).

Do you remember all of the moral panic about violent video games after Mortal Kombat came out?

That depends on who controls the sandbox. I certainly would like to limit what apps can do. The sandbox should give me control of the software on my device.

>new efforts such as Google Play Protect to outright block software obtained outside the Google Play store

Wait a sec, does this affect F-Droid as well?

Someone needs to take this to the EU courts and force google (and apple) to allow the use of alternate app stores that are not technically hindered.

It was done with Windows and Explorer so I don't see why this is any different.

Alternate app stores have been allowed on Android since day one.

But only if you set a security flag to "allow anything to be installed". I want a security flag that says "allow apps from sources signed by the following keys", where I can import app store keys from the app store(s) of my choosing. So I'm still protected, as long as I trust those app stores that I import.

That has changed somewhat recently (android O I believe?). Now, when an app tries to start an installation, Android will bring you to that app's setting page where you can toggle an option "Allow this app to install other apps" or something along those lines. It's a lot more straightforward than it used to be.

That said, auto-updates are still not possible without root access, I believe.

If anything, new Android is killing termux, one of the best apps for devs:

https://github.com/termux/termux-packages/wiki/Termux-and-An...

Yeah, that's going to work really well for the average consumer....

"Allow this app to install other apps" and behind the scenes this means it adds the store's public key to "known sources."

Just because the parent is talking about the implementation doesn't mean the user-facing UI will actually expose any of it.

That doesn't matter when companies ship their own app stores installed as systems apps like Samsung and Amazon do.

Well, everyone wanted Android to be just as open as their computer and for the “experts” to be able to install any app that you wanted. You have your wish. There are no such safeguards on computers.

Not really. You need to be root to have the same experience as playstore - namely auto updates.

So I’m going to both trust an app that is not sandboxed on my phone and trust it to update itself without my consent?

All apps are sandboxed in Android... even the ones installed externally.

Obviously not well enough considering what happened with Fortnite....

What happened to Fortnite?

https://www.cnet.com/news/just-as-critics-feared-fortnite-fo...

> For the attack to work, it sounds like you would have already needed to have a piece of malware on your phone, ready and waiting to strike. But not a particularly sophisticated one. After you ask the Fortnite Launcher to download Fortnite, Google claims that any app with the WRITE_EXTERNAL_STORAGE permission would have been able to sneakily replace the real Fortnite app with a fake one after security checks were already complete. It's known as a "man-in-the-disk" attack.

Getting F-Droid is not "hard" but it isn't easy, and IIRC Google's Android gives off warnings. (Also it isn't as refined as the Play Store).

I believe the parent was suggesting, like with Windows/IE decades ago, that Android phones may have to come with a prompt to enable alternative stores to Play.

That worked really well for Windows....

How are app stores on Android technically hindered? I thought except the additional step for installing them, there is no difference in ability?

A 3rd-party application store can't update apps silently to name one, the user has to approve every app update one by one.

At least for fdroid you can update apps silently. You need a rooted device, flash [1] and install the f-droid privilege extension [2].

[1] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...

[2] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...

It's certainly possible, but as a regular use, it's a giant pain in the ass.

Alternatively you can install the f-droid privilege extension module in magisk.

This is how it should be. You cannot trust developers to not break things. Whether that's from ignorance, incompetence, just don't give a shit attitude, it results in the same. I'm not saying don't update, but update when you understand what the update will do. It's funny (ironic) that the people that these auto-updates are meant to "protect" are the non-tech types, yet these are also the people that tend to not do backups and are most negatively affected by bad updates.

I fully agree with this for non play store apps from a security standpoint.

I think the problem is that users aren’t given the option. Hence the original question of; what technical disadvantages do non-Play stores face?

I think we agree this is a crucial technical disadvantage. Do you think it would be fair for users to be able to make this decision for themselves on devices they own?

Also I believe a third party installed app cannot do a push notification when app is not open?

XDA Labs originally set out to do a few of these things.

https://www.xda-developers.com/xda-labs/

It tries to provide an alternative to the 30% "platform charge", and offers PayPal and cryptocurrency payments (with real-time approval etc from what I recall).

It's hard to gain users on an alternative store, especially when most don't know what isn't available to them. And most also don't see the 30% fee being taken from the developer by the platform. Low cost apps are pretty much unaffordable to do at hobbyist scale when you factor in the platform charge, VAT, and taxes, and I fear for the future with app development heading down the route of only large professional outfits doing so (with their large, professional data gathering and monetisation plans).

Nowadays there is Aurora Droid that solves the curation question:

Aurora Droid supports F-Droid-like repos, you can have multiple selected, and they may include proprietary applications.

All usual issues with Android's security getting in the way still applies though.

Overall Aurora Droid is still miles away from a "proper" store, because there is no payment, there is no user feedback (so apps are still ordered by last updated or name...), and I don't think the author plans on adding such features (Because it also requires backend work). That's still a nice update to F-Droid original app.

Another F-Droid based store app is G-Droid. It is possible to write comments and apps are rated with a mix of user ratings, update intervals and github ratings.

From my understanding, most developers never see this it even know it's there.

Amazon have one but it's never really taken off outside the Fire device range.

It's not exactly what you asked for but there is the Amazon Appstore which can be installed on any Android device. It has paid apps/in-app purchases/subscriptions support.

It will 100% be filled with scammy and fraud apps instantly.

You can sideload apps on Android.

Reply on news.ycombinator.com