The suggestion is usually correct, though. Google does a terrible job of vetting Play Store apps, but they do still have some automated safety checks, and they kick out known malware once it's found.
If you allow sideloading, you give up all of that. It's still perfectly safe if you trust what you install, but you have to make that assessment. Google can't save you.
This is exactly how I wish iOS worked. It's also basically how the Mac works nowadays, except replace "App Store" with "Apple notary service."
How would you suggest Google correctly communicate the risk?
But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data.
This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it.
But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.
In theory, you could request broad permissions, and have an interpreter sitting inside your app, dynamically loading its own code over the wire, so you'll never have to update from the app store (unless you want more permissions granted). But as far as I understand, this is forbidden by the Play Store policies (e.g. Facebook got told off for doing this https://arstechnica.com/information-technology/2013/04/googl... ). Although I'd imagine it's easy to slip such code past reviewers, unless your app is very popular and worthy a more thorough review that can catch it.
Also I'd imagine there is some grey area there, e.g. your whole app could be a webview simply displaying web frontend -- surely it's okay to dynamically load javascript? Not sure how the policy works in such cases.
I switch between streaming services based on the content they have. I have Steam, Epic Store and Origin on my PC because of the games and deals each have. Why would I not load a new app store (if I used my phone for anything other than a phone, camera and note-taking device)?
Oh, wait. It’s what we all did and do with computers. This isn’t some mystical unknown.
(besides, last time I checked my macOS machine is neither virus ridden nor covered in toolbars)
Yes, if you go back in time you find OSes with hideous security models that made things like keyloggers possible. Mobile OSes today do not have those problems, and have strict permission prompts that gatekeep functionality.
Yeah, I’m sure there would be some shitty experiences if people could install whatever they want on their phones, it’s the price of giving everyone that freedom. But if desktop OSes in 2020 are anything to go by, it’s really not that big of an issue.
The feature I recall liking most was the integrated software center. When I wanted an app, I just had to search the center, not comb through random websites. It was nice.
Of course, I could and did also install programs from random websites, as I saw fit. It never occurred to me that some day, I'd be forced to rely entirely on a built-in store...
And windows has a scary sounding checkbox when you download an .exe from the internet. So what? In the old days, it never warned you, and people were CONSTANTLY getting malware by downloading random stuff from sketchy sites.
I hope what you mean is that someone else would be making the argument that the checkbox is necessary: claiming a crowd of people are a single inconsistent argument is disingenuous.
What do you mean by "held liable"? It can't be in the legal sense, because Microsoft has never been held legally liable for Windows malware, and Apple has never been held legally liable for Mac malware.
"In 2014 the US Federal Trade Commission ordered Apple to pay out $32.3m (£24.6m) to reimburse American parents for unauthorised app purchases made by their children."[0]
https://www.theguardian.com/money/2020/mar/11/my-kids-spent-...
If Apple isn't the payment processor, they're off the hook.
https://arstechnica.com/gadgets/2018/08/fortnites-android-vu...
The next question is though, given the incentives in place are entirely due to Apple, is that anti-competitive?
I think it is. It is also ruthless smart business to make money. Given societies rules about "make money" for corporations I can't blame them.
But I am allowed to wish it were otherwise.
It's hilarious to see people rooting for Apple as if they're the little guys.
The company that makes so much money here is Apple, not Epic. They should be willing to compromise. They gouge app developers and in turn its end users by charging a 30% ransom.
Smaller developers will be the casualties of a multi-store situation because they will be forced to support the them all.
There will therefore be no competitive pressure on benefits for developers.
This is all about more middlemen making money.
At worst, they continue their business as usual. At best the competitive pressure allows their business to stay the same but with higher margins. Most likely they would eke out a bit more money than the status quo by using another App Store competitor alongside the App Store if they choose to do so.
30% in pure profit would means a lot to regular companies/folks as well, not just the "big and greedy" ones. Just because you don't feel the pain doesn't mean other ones do.
And ultimately, some of this cost is burdened by the end user purchasing the app which is obviously harmful to everyday users such as myself.
Artists, on the other hand, only have to deal with a 10% to 15% cut when they sell their music digitally or physically through Bandcamp.
I'm a small and modest developer, and I feel like 30% and $99/year is too much. Mind you, Apple is a trillion dollar company that will take a 30% cut whether you're a worker in the 3rd world or a kid in college. I'm not sure I follow your "big and greedy" rhetoric at all here.
A large part of the security model on both systems is the ability to constrain what apps can do, and by ensuring those have happened.
The various privileged (in the security sense) sandbox entitlements on iOS can't be used by a malicious app because the malicious app can't get through the App Store. That significantly increases the bar for any malware. I assume the Google Play store similarly limits access to privileged system features, and I would fully expect the 3rd party stores do not.
Also personally: The Epic store is a terrible app, and signing up for it requires providing vastly more information to them than I ever wanted to, especially for only a single company's games, from a company that has no stated intent of reducing data collection and improving privacy. A company that also engages in scummy tactics like loot boxes, virtual currency, etc
What about macOS?