Comment by matthberg | Hacker News Reader

Comment by matthberg | Hacker News Reader

Two things that stood out to me:

> 8. If you haven’t used an app that you installed on your device in a while, you may not want it to keep accessing your data. Android will now “auto-reset” permissions for your unused apps and notify you accordingly. You can always decide to re-grant the app permissions the next time you use the app.

> 9. With additional Google Play system update modules, even more security and privacy fixes can be sent to your phone from Google Play, in the same way your apps update. So you’ll get these fixes as soon as they’re available, without having to wait for a full OS update.

8 seems like a rather wise and user friendly privacy concern (which might be annoying to power-users who set things up proactively and don't want their configurations messed with, yet overall a great improvement).

9 has me worried about variants of android like Lineage or ParanoidAndroid where the play store isn't included automatically. This forced reliance upon the play store for security sensitive updates is devastating for de-googled device feasibility. It will make more sense for developers to not support devices without Google Play, effectively shoehorning alternatives out of the usable, secure devices realm.

It becomes a problem when Google decides to keep those security fixes to themselves. I can very much see microG (a GMS reimplementation) provide the same service using their own compiled patches, kind of like Linux distributions provide packages and kernel updates developed by Intel, Microsoft, Red Hat, etc, which end up publicly available.

MicroG development is pretty much in limbo right now, with only one developer who has very little time to spend on it.

It's a shame because it is an amazing project.. It only started fully supporting Android 10 last month.

It's not in limbo - it was in limbo.

9 is part of google's attempt to deal with carriers and manufacturers who don't send out updates in a timely fashion. It may have side effects that make it harder for others to build de-googled android but that isn't the publicly stated main goal.

9 won't FORCE updates via Play Store, it enables them. Other Android distros can still update code in their own methods.

Lineage has its own update mechanism, why would it need the play store?

If the code is in GMS it's not necessarily open source. The more apps rely on GMS, the less they can run on ungoogled devices.

micro-g attempts to emulate whatever is necessary.

If Google ports changes both to that and AOSP it's not a problem

> It will make more sense for developers to not support devices without Google Play

Almost like that was the plan and Google employs some smart people isn't it.

If it was OK to wait for an OS update before, why would it be less OK to to still wait now, just because some devices get fixes further?

Why does Google owe priority updates to unrelated third parties who aren't interested in patching their own code?

Because too many vendors won't push security updates at all, or wait a very long time, or discontinue support after a year.

If it was OK to wait for an OS update before, why would it be less OK to to still wait now

Because there are more and more threats, and they come faster than ever before.

While increased control of the platform is one motivation, I don't think it's the main one.

Google's been forced to go in this direction by vendors who put out Android devices and never update them, even for the most serious issues. The only way to get security updates deployed is via Google Play.

Aye, I didn't say it was the sole reason and I agree.

Flagship devices with 18mths-24mths of support when Apple routinely does 5 years was damaging as well.

I typically buy mid/low-range android devices and AndroidOne has been great, I'm still getting monthly security updates on a must be 2 year old-ish Nokia 6.1 that is still a perfectly fine phone for my needs and it cost me 150 quid sim-unlocked.

It looks like the user disable the automatic permissions rest on an app-by-app basis. If you navigate to the permissions page for a single app, there is a toggle at the bottom to disable this.

It seems like any improvement Google makes to the play store would have your worried

Reply on news.ycombinator.com