Hacker News Reader

Comment by horsawlarway | Hacker News Reader

Good - There's a clear theme in the motivations of both major mobile OS companies here:

You, a 3rd party developer making custom software products for a mobile platform, are no longer allowed to have customers yourself.

Instead you must grovel and beg and pray that our lords Apple/Google consent to allow you to rent their customers.

This consent can be revoked at any time, you will pay through the nose for it (20%+ of total mobile revenue), and for basically all but the largest of customers - this consent is machine based and you will never be able to get a living person to so much as glance at any content you put into the process.

---

Fuck em both.

View on HN

What's currently stopping some third party from creating a fork of Android with a better store? Are there closed-source parts of Android that can't be easily replicated? Is it the difficulty of getting any major phone manufacturers to agree to install it? Or something else or all of the above?

The Google play framework is closed source and used by most apps.

A competitor would have to get most/all of the phone manufacturers to all at once drop Google Play and use their ecosystem instead, otherwise no one would bother publishing apps for it. There's no way to ramp up a competitor because users won't tolerate a subpar app selection. See Amazon's Fire Phone launch for what happens when one manufacturer tries to start their own ecosystem.

It's actually very easily possible. Apart from Samsung, the largest phone manufacturers are all Chinese, and currently under sanction by the US government, with more soon on the way. Out of the Chinese bunch, the majority are Huawei. Huawei has been forced to move into a non-Playstore Android OS.

I use a burner Huawei for non-essential Android stuff. Every time I click the "Rate App" button on apps, it redirects me to Huawei store instead of Play Store. Every time I click the "Download" or "Install" button on the browser, it sends me to Huawei store. I think we can expect to see more changes in the coming two years as Android keeps updating. Huawei phones up until 2018 are allowed to use the Google SDKs but none are allowed from 2019.

The only one left behind is Samsung, which has the wherewithal to create its own (Apple clone) app store. If they go ahead with that, Google Play will be a fucking joke at that point.

Galaxy store is alive and well on Samsung phones.

But they aren't taking a hard stance like Huawei. Like redirecting to their store.

When I click a play store link, it asks me which store to open it with. And I can set galaxy store as default.

i cant see how using a chinese based app store is any better than google/apple

if anything,you're more open to potential exposure of your data ,bad verification practices and CCP intelligence gathering

I didn't say that Huawei is the gold standard. Just that Huawei has already begun its own app store, and if Samsung does it too (and pushes it aggressively like Huawei does), Google Play will be done in no time.

The new Huawei phones don't have Play store or any Google services.

> What's currently stopping some third party from creating a fork of Android with a better store?

A huge piece of it is the network effect of starting with a store that lacks a significant number of apps available on the Play store. Sure, a competitor could, over time, grow their store to be competitive, or they could fail to tread water and go the way of Windows phones.

On Android there are 3rd party stores. F-Droid being a popular one with FOSS apps.

Major difference is that only the Play Store can install apps in the background. That is, unless you root your phone.

Amazon tried and even with giving away hundreds of dollars in free apps every year they still failed. People just don’t want to use an alternative that has warnings of security holes.

Yep, these content aggregators have become consumer aggregators. They make money by controlling our attention in the webverse

Me, a customer, is very happy that they play a regulatory role and are taking steps to prevent surveillance of the form GP is proposing.

I’m glad that I don’t have a direct relationship with shady 3rd party developers.

When it's an explicit feature your argument is a difficult one to hold.

It amounts to not being able to use features that are available in the API.

They aren't preventing surveillance at all, they're monopolizing it.

Google is LITERALLY a fucking ad company.

Apple is tracking the exact time and location you use any piece of software on their systems (Don't worry guys, it's just for security purposes! /s)

----

I'm no longer sympathetic to the "They're securing my device from the boogeyman!" argument.

It has the same overtures as "Won't anyone think of the children!!!!" in policy debates - It's rhetoric designed to obfuscate the true intentions of the parties involved, and short-circuit real discussion with an immediate emotional response.

> Apple is tracking the exact time and location...

Source?

A few months ago it came out that MacOS was constantly making unencrypted calls over the internet to check signatures of non-Apple software; such calls were thus feeding back to Apple (and anyone sniffing the connection) the time and IP address of each application's being opened. (Technically, only the company, but each company usually only has a few apps.)

https://news.ycombinator.com/item?id=25074959

This "came out" at least 8 months ago.

https://news.ycombinator.com/item?id=23273247 https://news.ycombinator.com/item?id=23281564

I appreciate the further context, but am not sure that it was necessary to mock my phrasing.

(I wrote a giant response to this explaining why I was frustrated and who I was frustrated with and how it meant we were just screwed as a society, but I have decided to just suffice it to note that I am not mocking your phrasing--that is the correct phrasing for the demoralizing thought--and that, FWIW, I don't think iOS does this in the same way, even for the "enterprise"-signed software where one would expect it would work identically, which is a bit hilarious.)

Ah okay, sorry for overreacting.

And it wasn't true as stated (it didn't happen every time, the server didn't keep any logs, etc.)

>it didn't happen every time

True, but it didn't make much difference, since the reports from the thread showed it had a bizarrely short cache time.

>the server didn't keep any logs

Well, that's the rub isn't, it? Part of privacy-centric design is that you shouldn't have to risk such information being exposed or trust such reassurances; if they don't need the information, they shouldn't get it at all. There are privacy-respecting ways to do what they wanted to, which are also more efficient. For example, periodically update the machine's local revoked cert list, and check signatures against that (as several users recommended).

>etc

Was there anything substantively different from my characterization?

Short retention according to who? That server only? No copies to the NSA? I’m a trust but verify kind of guy and with just the word of Apple I assume somebody is keeping the data and using it in some way.

Agree with such skepticism but what are you replying to there? My comment was saying that it cached the cert check for a bizarrely short time (necessitating frequent network calls), not that the logs were retained for only a short time, which I agree is a bad defense.

Thanks for the clarification. I confused the cert cache with the apple server logs.

https://sneak.berlin/20201112/your-computer-isnt-yours/

Apple is using an industry standard protocol to check and see if an application's developer certificate has been revoked.

>To make sure the certificate hasn’t been revoked, macOS uses OCSP—short for the industry standard Online Certificate Status Protocol—to check its validity.

https://arstechnica.com/gadgets/2020/11/mac-certificate-chec...

There is no information tracking the application that is sent.

The protocol is only used to check and see if the developer's certificate is still valid, if the app hasn't been run in some time.

https://blog.jacopo.io/en/post/apple-ocsp/

> I’m glad that I don’t have a direct relationship with shady 3rd party developers.

To enable background locations update, a sales rep has to open a check-in screen, wait 10 seconds to see their location on the map and then press the big check-in button. Because people were often forgetting to check-out, my customers requested auto check-out feature which requires background location updates. Once a sales rep leaves the check-in area, background location updates are stopped. Managers and employees see exactly the same time reports. And if some sales rep is suspicious then it is always possible to disable that GPS icon in the quick menu settings after work hours. It is almost like using your batch card to open doors in a workplace.

A popular alternative solution to my app is to use GSP devices which are installed in all corporate cars. And there managers see their employees background location updates 24/7.

Android already has a very fine grained permission system that allows blocking such behavior, you simply revoke an apps right to access location data.

So the argument then becomes an appeal to protect less knowledgeable users that would be tricked to enable advanced features for some eye candy. It has some merit; but there has to be some compromise there for advanced users, short of relegating then to APK install with no security updates, like in the Windows days.

Reply on news.ycombinator.com