Hacker News Reader

Comment by mjg59 | Hacker News Reader

> Why are the developers at Google acting in such boneheaded ways?

(I'm a developer at Google, but I'm not on the Android team and am definitely not providing any sort of official response here - this is personal opinion and may be inaccurate)

If apps can download arbitrary code and then execute it, they can bypass the validation that's done as part of the Play Protect program. My understanding is that there's plenty of evidence of malware in the wild that presents as a harmless app and then downloads the actual payload after being installed on the user's device.

View on HN

Okay, can I just get a big popup on the Play Store saying "this app requires the following functionality that could harm your device:

- Run and use other applications without your consent

Unless you know precisely that this behavior is necessary for this application's main functionality, we recommend you do not proceed". And use some design pattern to make "Cancel" the "go-to" action for the user.

Or even more palatable for whoever's behind Play Protect: Forbid these apps from the Play Store, and force it be done through a 3rd party store or manually, and this can be combined with the big popup.

We know it's important to protect grandma from malware, but it's also important to give the advanced user the option to ignore this, specially for a platform like Android that has gained the favor of many technical users through providing some reasonable degree of control over their phones.

It's also important to protect non Grandma from malware.

Rugged Individualists can run TempleOS

I think you've missed my point here, this goes _way_ further than this specific individual issue.

The entire ecosystem is built on a model that turns it into a disposable toy and there's no sign that this is going away any time soon.

Why do we need hobbyist movements to produce devices that we can actually run real software on and that won't be completely useless as soon as Google decide to update the API?

Yea, phones should not be designed to be replaced after 2 years. Phones from 6 years ago would still be plenty powerful if they weren't crippled by Google Services eating more and more resources.

Google could use mainline kernels and force manufactures in the OHA to open source all their drivers, maybe even back PostmarketOS to prevent e-waste.

You can take an old Pentium 4 laptop and still put modern Linux on it and still use it for some tasks. Good luck trying to do that with any ARM system.

It makes me genuinely really angry that this isn't the case, it has me questioning why I even bother to interact with the development ecosystem when it seems like 90% of the stuff out there is this sort of closed-off 'got mine' fuck-the-environment style thinking.

Maybe it's just too much time on HN?

Like, how many times does one have to push against the bullshit bootlicker arguments before one just gives up?

Why does Google owe you this? Write any OS you want. You can use a open source base.

That Pentium will cost more in electricity than just buying a new cheap phone.

The problem is the ARM bespoke-devices ecosystem, not Google. The pre-Android "Linux on mobile" world was far worse wrt. the use of downstream patched kernels. We just didn't care as much, because a kludgy, patched BSP was better than a wholly-closed solution with no source available. Our standards as to what qualifies as "open" have simply become stricter.

Across Europe pre-paid cards and using phones until they die, are lost or get stolen is the common usage.

This excuse might hold even a little bit of water if the "validation" actually did anything. Google Play is a malware distributor, plain and simple. Go search the Play store for "flashlight" and read up on the permissions of any of the first 10 results.

https://play.google.com/store/search?q=flashlight

GPS location, full network access, prevent device from sleeping, run at startup, microtransactions, read contacts and accounts, read your filesystem... for a flashlight app. These are malware. The Play store is 95% malware, or worse.

Moves like the one that locks out Termux aren't protecting the user at all; Google has never been interested in that. They centralize power. That's what it's all about.

The other day I was trying to find a QR code scanning app in Google Play for my mother. I honestly cannot blame people for ending up with a phone full or spyware since basically all the top results were garbage. I ended up searching for "qr reader foss" which got me some decent apps.

Try F-Droid next time.

I do use that on my phone.

Doesn't Android support QR scanning in the stock Camera app anyway? You shouldn't even need to take a photo, it should detect the QR pattern and give you the option of reading/copying/browsing to it.

I thought so too since it does that on my Galaxy A50, but apparently it doesn't work on the default camera for the Galaxy S8.

Until all execution of foreign code is blocked (like Apple), then all that Android does is to add a bit of nuisance to malware, as they can no longer download the actual payload to disk but have to download the payload to memory and execute it from there. Not really a big deal for a malware author, but likely a dealbreaker for a Termux-like program.

And if Android implements a policy like Apple's to block all execution of foreign code (which is the apparently inevitable conclusion of this type of security arguments), then browsers and everything else will be gone, exactly like Apple (for the record, where every browser is just a wrapper over Webkit).

I used to think that Android was more open than iOS based on principle, but now I realize that no, it was more open than iOS just because they lacked the technical means to enforce the draconian restrictions.

Reply on news.ycombinator.com