Google Play rejected Tor Browser update with security fixes
blog.torproject.org
blog.torproject.org
I get they need to keep trojans, spyware, adware, etc out of the store, but as a long time app developer it just seems like the algo says, "We have not rejected this app in a while, so let's do it this time."
They don't keep out adware. Users have that benefit only when using the iOS app store. There are tons of apps on Android that just wrappers around ad SDKs
Android, like all google products, is adware.
So that comment is illuminating uncomfortable truths?
Really?
The #1 uncomfortable truth in a year built of them? Are you sure?
People aren't going to like what they see. One that always annoyed me was a google services app pinging a geoip url everytime I connected to wifi.
If we manage to get something like the samsung a31, at a similar pricepoint, with all hardware working before 2025, I would be happy. But I am skeptical when installing yet a newer OS version on my pinephone and start writing bugreports for applications we consider trivial for a daily driver phone.
Edit; being able to performantly and robustly run Android applications in Linux could (sadly but it is a reality) help adoption a lot a well because of proprietary apps (it sucks but I need whatsapp for instance). That is not that close by either I think; anbox is slow and unreliable last I tried.
Everybody is going in sooner or later.
>Note: This update is not available on Google Play at this time because the update was rejected during the review process. We are appealing the rejection and working with Google so this update is available as soon as possible.
This was published a week ago. As of today, the latest version available on Google Play is still outdated.
So that would then be a good thing, right? RIGHT?
I think things have become a bit more saner with Android 11 in that regard (though there might still be some pain points left), but instead the next random thing Google has broken is that you can no longer replace the default camera app - unless whatever random app you might be using specifically whitelists your favourite third-party camera app, you can no longer use it other than in standalone mode (i.e. if I understood things correctly, the same hare-brained situation you were in until very recently on iOS with regards to the default browser or other default apps).
The whole setup makes installing apps from other sources obtuse and 'scary' to the average user.
I'm not sure how say an app from f-droid is more 'unknown' than an app from the play store myself. Then of course, just to install f-droid, I have to download it, allow installing apps from my file manager, which comes with some scary popups, then I have to again enable the setting for f-droid, again after some scary popups.
The goal really does seem to be do make the idea of installing software one acquires outside the 'official garden of known apps' to be something terrible and scary nobody should ever want to do.
...yes? It's not a bug, it's a feature. For the average Android user, it SHOULD be obtuse and scary to install apps from a third party source. Power users can still use a third party app store.
It's a tradeoff for freedom vs a false sense of security. On android at least, the walled garden approach hasn't seemed to stop malware, the majority of which, comes from the play store. All it's done is teach users to blindly trust apps just because they come from a supposedly trustworthy source. If anything it's taught people to think less about security and the kinds of apps they install. It's on the play store right? Must be ok.
Scary in terms of telling my mom to do it - absolutely. At least the Play Store has some (imperfect) curation, and SafetyNet.
For the layman, the walled Garden is a feature.
I've also helped other people deal with these problems before. I found that aftwr taking the time to show them how they end up inatalling that crap, the kinds of things to avoid and setting them up with some removal tools they tended not to make the same mistakes.
Jesting aside, it's not a bug in the sense that Google also gains nothing and actively loses money from making it easier. At this point it's just to avoid PR nightmares that they are keeping it in.
Not only that, but every now and then when trying to update an F-Droid installed app, Android pops up an unexpected dialog asking if I want to enable "Play Protect". Its unpredictable, breaks the flow of the update process, and seems to have no way of disabling it.
To which I say....have you seen how complex the process is on android?? I can't imagine that that is going to be a problem. They will be just sent a dodgy website link that will steal their bank details, not some app that most people won't figure out how to install.
Edit: above is wrong at least for Tor Browser, you can install over an existing Google Play installation.
And the many users who downloaded from Google Play (over 10 million installs per Google Play data) never get notified that there's a security fix being held up in review.
The opposite also applies, if you install a signed previous version, play store will update it.
It's a shame that we are now back to the times when microsoft made IE4 (or 6?) part of the OS and completely impossible to remove it.
On windows98 and later I would install windows, open IE, disable every single setting to make it completely broken (no JS, no activeX, require latest SSL or bust, etc... pretty much made it impossible to use or be exploited in the background) ... win10 still insists on opening Edge when I click a link from the settings application despite firefox being my main browser.
Now I try (and fail) to do the same with google on android: Reset my phone, disable a bunch of System apps that completely break everything (i have to press OK twice on a "google service stoped working" every time i enable wifi) And I still cannot prevent any app that want to access the web directly or via chrome "web view" and load anything they want and keep cookies no matter my say on the issue. ...not to mention that it makes it a pain to get updates to the bloatware apps I still have to run to make the phone minimaly functional as the app store insists on me having those Advertisement services running to get updates to the bloatware i already bought with the phone.
So, yeah, you can install APK without Google blessing and their captive store, but that is an option for less than 0.1% of users that will want to put up with that.
Same thing, different company.
I can't live without a proper SSH client, and that requires a proper keyboard where you can actually do key combinations.
Any phone with a keyboard (and not ancient) can't receive an unofficial OS. e.g. blackberry Key2
Either because they do not have unlocked/vulnerable bootloaders, or because you must have the closed source driver running to be usable. Android is not opensource and even lineage OS still requires TONS of closed source binary blobs to even boot. There is zero open source android alternatives.
https://f-droid.org/packages/org.pocketworkstation.pckeyboar... Not quite the same as a hardware keyboard, but does support key combinations with modifier keys.
LineageOS for microG fork, lineage.microg.org. Lineage refused to include it for some reason.
Personally, I usually just delete the .exe (and .dll, etc) files. The most secure code of all, that never has bugs and can't be exploited, is code that doesn't exist.
That's right, sometimes you can't publish an update because the play store description, which was approved in the past, isn't now.
Sometimes it's the opposite, the app (which is published) has a problem and you can't change a dot from the play store description unless you send a fixed version.
This would remove any problems with blocked updates because of google
Still, the main point still stands: being in there wouldn't solve the problem of keeping Google Play users up-to-date.
In settings, I see "version 10.0.7 (84.1.0-Release)."
It might be necessary to enable the Guardian project in your repository settings, then refresh in order to install this software.
Quite curious if this hitting the HN frontpage had anything to do with it. Probably, based on the timing.
How about legislation that enforces the availability of third party app stores or something?
Say Google is required to sell Chrome and/or Android. Problem is, billion people's Google accounts are signed into those devices. Solution is, you replace the "Google account" on an Android device with an "Android account" that uses Google auth for login. Then, if a user wants after that point, they can detach that, set different credentials, whatever.
Google is even more entangled than Netflix was. I suspect it would take them at least a decade to execute a split like that.
Furthermore, companies like Facebook have actually made a point to deeply integrate otherwise disparate products (Instagram), solely to later claim it'd be "too hard" to spin them off if the court orders them to.
The simple answer is to continue to fine them until they accomplish the task: If a company goes bankrupt trying to comply with the court, perhaps they shouldn't have violated the law so flagrantly in the first place.
I think people are too hesitant to admit that companies that violate the law should be eligible for the "death penalty". It's absolutely fine for a very bad company to explode and die once brought to court.
> I think people are too hesitant to admit that companies that violate the law should be eligible for the "death penalty".
I don't believe in the death penalty for people, and I don't believe in it for companies either. I certainly think that companies get away with too much, and that their leadership should be more personally accountable for fragrant violations of the law. But death is too extreme a punishment.
But at the same time it's the limited liability that allows for innovation. Companies would take far fewer risks, both good and bad, if the people running them were personally liable.
I think personal accountability for CEOs and executives would help a lot. A CEO who knew an illegal business move might land them in jail would be much more hesitant to do it than a CEO that knew that move might cost investors some stock value.
But I also think a company's behavior can be endemic and cultural, and that perhaps rather than trying to turn them around, we should just "execute" them. Shut down operations, auction off property to pay any debtors and assist employees with the transition elsewhere.
One of the things I think about with Big Tech is that they are incredibly overvalued on their "too big to fail" status... that and the current reality that their illegal gains won't be meaningfully seized. If a company could be "executed" for it's misdeeds, investors would need to be real about the value of "rulebreaker" type companies, and the additional risk they carry. We'd not be in the situation we are now, where the crimes of Google and it's executives keep racking up... but so is it's stock price.
I don't buy the claim that we need to limit liability in order to foster innovation, because our limited regulation has led these companies to squander so much innovation, it's insane. For every innovative thing one of these tech companies has done, it's killed dozens or hundreds of startups that were doing something more innovative and not focused on circling the wagons around their core stock value.
I’m a fan of doing it all.
But the best solution would be interoperable protocols.
Google's services are, and they are not Android.
There are people attempting to take advantage of the fact that Android remains free and open source, and they need support. Perhaps I should have included that in my comment above.
It's not obvious to me that a legal solution would be better.
Android is like a club with free drinks, but Google Services are the $150 cover charge.
It's more like the Club is free to enter, and it's BYOB. The good drinks are $50 each.
AT&T was split into entirely different companies... for instance, today's Verizon is a descendent of that breakup.
What would that look like? Phone companies make some sense because they have to serve certain geographic regions which can't compete or collude with each other. Google serves the world, of which the US population is only 5%. Do you think the US government is going to split up Google such that "South American Google" is totally independent and brings back no revenue to the US? Same with "European Google"?
Or you you want it split up by US region? Maybe "US-East Google" gets to make money from Europe, "US-West Google" gets to make money from Asian countries, and "US-Texas Google" gets to make money from services provided to South America?
Is the goal to cripple Google so hard that companies like Baidu and Yandex can overtake the search market globally? Is that why the US congress should split up Google?
The only people who have a rational argument for another Google split up are governments of non-US regions that are financially invested in competing services.
I am pointing out that they haven't currently been split up at all. They are still a part of the same company.
Most people who have proposed a splitting up Google have obviously not suggested splitting it on geographical lines, because most of them understand how the internet works. Typically, the suggestions have been to split on product line -- not unlike how Alphabet has internally organized their divisions.
I would break out at least:
Ad network Web search Operating systems
And put everything else in a separate company. That would contain their other consumer services (gmail, finance, docs), whatever g-suite is called now, cloud services (until they shut down), their internet balloons and what not and maybe Waymo.
You can allow the baby-Gs to contract with each other (web search needs an ad network), but require the terms to be public and frand; maybe with some sort of second source requirements.
This doesn't eliminate any of the monopolies, but it eliminates the use of one monopoly to entrench another.
Typically when people say Google should be split up they mean different parts of Google should split. Google has search, ads, Youtube, Gmail, cloud, Android, etc. These parts would be split into different companies. Some parts "go together" like search and ads so they may be allowed to be one company, but YouTube and Search don't go together so they would be separate companies.
Gmail could charge for account features like Yahoo mail and Fastmail do.
Android could be legitimately open source, like Linux is. Or they could sell carrier specific distributions, which is something carriers are doing themselves right now but badly.
Chrome would need to operate under the aegis of some company, but that needn't be the same company that runs Google search and Google ads. If that were the case, their abusive ad experiences code may actually be good and not merely reflect a desire to destroy ad companies that aren't Google's DoubleClick. Chrome could also then allow browser login integration into other companies. I'd prefer of Chrome integrated with my Apple accounts, not my Google accounts for example.
Ads itself could be split into two companies---Google search ads (which may or may no be owned by Google search), and DoubleClick which was its own company to begin with before Google bought them.
Of course YouTube would need ads. My point was that YouTube doesn't need to be in the same company as search, not that YouTube doesn't need ads. The ad network would likely need to be split into the new companies that are formed so all the parts that need their own ad network could have it.
Chrome likely could not survive on its own unless search paid for it like they do with Firefox. I am not sure all the products/services that Google has and their individual ability to survive without Google. That is something that would need to be determined by the people involved with a breakup.
1. Entirely voluntary 2. Based around making it easier to target business objectives 3. A way to compartmentalize a bit
Not a way to reduce power and uncool exercise of "monopoly" type stuff.
Using at&t is a very bad example to use against google because under at&t consumers had 0 choice. AT&T used this monopoly to raise prices and limit choice. Google doesn’t even charge for android.
There are, and google is preventing vendors from installing them.
South Korea seems to be totally fine with Samsung running the majority of the economy, monopolies — when controlled through regulation — are not always a net negative for society.
Industrial research which operates on the 5-10 year needs stable recurring revenue and reassurances that the company will still be around to reap the benefits of said research. Monopolies provide the environment for this research to take place. I think the proper way to mitigate the harm done to the consumer by the monopoly is to closely regulate the monopoly. For example, the fee structure for AT&T’s long distance rates was regulated to not exceed certain levels which were deemed to be acceptable. Customers payed a reasonable price for long distance rates, AT&T had a stable income, and there was no threat of their business being upended so they were willing to take on long term research to improve their margins on the fixed long distance prices.
Yes, consumers could have been paying less for long distance rates, but where would society be today without Bell Labs? I think the harm AT&T inflicted upon their customers is heavily outweighed by the engineering and scientific progress they achieved.