If Google thinks the ability to execute arbitrary code puts users' data at risk why don't they go the full iOS route and ban everything, from scripting apps to other JS engines beside Chromium?
I am so sick of their behaviour, the only reason I am still on Android because things like F-Droid still exists and iOS is even more closely guarded.
The War On General Purpose Computing continues. Far too many business models depend on selling general purpose computers as "appliances". They presume it is possible to sell a computer that isn't Turing complete.
It's become an issue of defining "purchasing". But companies don't want us to purchase appliances, they would be much happier if we could rent them.
The rental/do not own anything model is just awful, in my opinion.
I tend to use things until they completely wear out, and I get really good life out of them. This makes them very cheap compared to the usage pattern of upgrading all of the time. Renting would be very expensive lifestyle; and my usage pattern is more environmentally friendly to boot.
It's not that I want to own or lease most random stuff I use. I want the use of a particular item. Since owning is cheaper I own a lot of stuff.
If my local library or maker space had better tool and book availability I would own fewer tools sitting in the shed used for one project and not with the effort to resell
No general computing company should be the single ingress point to running on their platform. For platforms with significant penetration, this is a market monopoly. [1]
For Apple, it's iOS and, increasingly, MacOS.
For Google, it's Android, and as has become glaringly obvious, Chrome. They shouldn't be allowed to run a browser.
The DOJ needs to stamp out this anti-competitive, anti-consumer behavior.
You can "protect" consumers with a permissions model and malware signature warnlist regardless of whether you enforce a store. Microsoft does it. Microsoft is the only company playing fairly.
([1] And no, this doesn't apply to game consoles. They're toys with lots of alternatives. You don't do business, banking, dating, note taking, drawing, stock trading, etc. on them.)
Because it's artificially made impossible. No computer should be artificially restricted – let's not keep any loopholes open for no reason.
I’ll believe it when I see an alternative to iOS devices that my dad can’t get malware on and only need a few seconds to fix by uninstalling an app or power cycling the device.
WebAssembly will be the ticket there—once it’s developed a bit more.
That being said, nothing compares to native. You could have shitty hardware by today’s standard with amazingly performant software if there weren’t so many damn layers in-between.
People are fickle with hardware though and we devs need things to slow down a bit to appreciate the nuances of each device!
With scale comes scaling issues; general purpose computing and repairability need a different commercial model that doesn't match with the currently used models.
This leaves two avenues:
- Make it worse for everyone but keep it going
- Make it worse for everyone in a different way and keep it going
I don't know of a good solution here, but I do know that it's a sucky situation and the many "good ideas" to fix it aren't actually making it that much better.
Current scenario:
- Manufacturer on the hook for most things but also controls most things
- End-users that fall within the 90% bell-curve are fine
- End-users that fall outside of that are royally screwed and they don't even know it
- Users that are not end-users are screwed, but they know they are
So far all I have seen is:
- Manufacturers still on the hook for everything but they get to control less
- Everyone gets a little better but also a little screwed now
- The 10% outside of the curve don't get as screwed as they did but they still don't really know that they are screwed
- The non-users don't get screwed the way they used to but still get screwed
To clarify:
If I were to manufacture something, express what user experience comes with my 'thing' and warrant that experience to a certain degree, I don't want to be on the hook for any service or cost outside of that. The more I get to control, the smaller I can make the risk. That means I can also plan ahead better and reserve resources, but not so much that I don't have resources for something else left over.
This also means that if someone wants a different experience (i.e. they are not my targeted audience) or if someone wants to do something I cannot verify, I really do not want to be on the hook for that.
In total that means:
- If what I want and what my customer wants is similar enough, we're both happy
- If a small percentage wants something else, I cut my losses and simply don't serve their needs as soon as the cost of maintaining that deviation is bigger than what I would make off of it (short term and long term)
- If someone does something I don't have control over, but they do come to me to fix their problem, I don't want to be responsible for that, and I don't want to do any research on the possibility that something I made happened to break at the same time the customer broke something else; I just want a blanket "I am the captain of my UX" rule and be done with it
Now, I'm not saying this is ideal, or that I am an actual manufacturer, or that this is specifically what Google is doing (or Apple is doing for that matter), but I am saying that you can't have it both ways. Want something cheap and abundant? Gotta have scale. Can't have scale if you make a bunch of risk, add a lot of differences and support more than your middle-of-the-bell-curve. This sucks, but it's also not easy as saying "let me do what I want", because what happens to you and your device has side-effects, and I really don't want to get affected by something someone on the mobile network (or wifi network) I'm on did to their 'personal' and 'owned' and 'freedom' and 'muh righz' device.
Or in a high contrast (black-and-white/good-or-evil) line: If you want to be on a shared service, play by the rules or get out. (reality isn't that high of a contrast obviously, but it drives the point of externalities home a lot quicker)
1 - I'm not sure I've encountered anybody that universally falls within the 90% 'ideal' coverage. The more hostile things are to outliers, the more difficult everyone's life becomes.
2 - As far as I can tell, the slack that allows the bottom and top vigesimile (? 1/20th) to survive is also what allows the flexibility to foster the discovery of novel technical and societal configurations that are materially better than the status quo. That's how a kid from a family of coal miners has a path to making significant contributions to NASA.
As for point 2: that should indeed be how it works, but the circumstances have changed, especially for large scale general purpose computing, and for various reasons and stakeholders as well. This is also the (wrong) fuel on the (wrong) fires in the current discussions on ownership, repairability and shared systems; it often tries to compare the "now" with a chosen "back then", and leaves out externalities causing the whole comparison to be useless.
For example: it used to be that you could run whatever code you wanted and you didn't need anyones permissions and nobody could stop you. Now, at scale, that means everyone from teenagers at schools circumventing the implementation of a usage policy to state-level actors extracting information would run whatever they want. They are of course already doing that to some degree, but this would be so much bigger and so much easier when you just 'run whatever code appears at the JMP', we might as well not have an internet.
This, in turn, means that you have to have some form of control, and some form of distribution or supply of such control as neither the will, nor the skill exists at the required scale to have everyone do this individually. How does one assert such control? Cryptographically. And now you're in PKI hell, or you're in DRM hell with DRM servers that go offline and render systems unusable. Oh, and you get DMCA and Legal requirements for free too.
It would be amazing if we could figure out a way to operate shared systems, and have some form of delegated control without having a PKI-like authority as the only way to ensure it. But I haven't seen it yet :-(
And this is just one of the many issues.
Take hardware for example; you can do plenty of nefarious things with hardware, and the user would never know about it. Want to backdoor an audio module so it constantly streams what the microphone picks up to an actor of choice (a social media company, advertising company, your abusive spouse, the government of a state that will hurt you on detection of dissent), you can do that and no normal user would ever notice. How would you then prevent such modification? Well, you could make hardware hard to access or hard to modify without visible marks. That's one area (slightly) covered, but then there is the software, imagine hacking that remotely. So how would you do something about that? Perhaps signing the software and checking the signature. Bam, back in PKI hell.
And if you were to make hardware hard to access, now you have a bad UX when someone comes to your service department and gets presented with a huge bill because your device had to be rebuilt because your kid put puke in the microphone hole. But if you make it unsafe you have the other problems again. No winning deal there. Or what if you use seals, now you have no idea why the seals are broken. Did someone tamper with it? Was it just a service call that's not registered in your system because it was done elsewhere? Who can you trust? What if you fix the reported issue but now something else breaks and you don't know if you did it or the previous tech did it? Guesses everywhere, everyone is sad, nothing works. yay.
Again, no real solution here. Say you do the (not very often implemented) secure boot method where you insert your own CA; that's great for yourself, not great for a shared system, because now everything else that requires you to be securely booted needs to trust that CA too. This, hoever, is an area where you can do a partial fix: if you just want local verification and you have the CA and CT you can at least know for yourself. But that doesn't work at scale. We can't expect billions of people to be PKI experts. And we can't expect them to understand the ramifications of the lack of verification either. (which includes effects on them, but also effects on everyone else they are in contact with by proxy) So now you still need that 'magic' central authority making a policy and a verification for that policy and enforcement. PKI hell all over again!
(keep in mind, I don't name PKI hell a hell because PKI is bad, I think it's great and I love me some hashing, public-key cryptography and root-of-trust chains -- it's just that there is no solution right now where you don't end up having an authority that can use it for good and bad at the same time)
There are a lot of scenarios where we could mitigate 'some' of it:
- Authenticated core but leave peripherals alone (your mainboard and CPU and AV chain would be on its own, but your keyboard can be key logging you as much as you want)
- Unauthenticated mode but no interaction with shared systems (would work great for things like farming equipment)
- Offline or do-it-yourself mode (again, no interaction, but you'd be offline anyway)
But then you're still in the realm of real-world abuse (want to know your ex'es password? backdoor the keyboard! steal your boss's documents? backdoor the printer!).
I don't know how to fix all of this, but removing all forms of authentication and still having shared systems isn't the way.
I'm old enough to have used the internet with a computer running Windows 98SE. As far as I can tell, besides data throughput, only webmail, maps, and media streaming have gotten materially better since that time, and even those peaked in an era when people were still running Windows XP SP3.
Despite all this froth about how we need to lock stuff down within an inch of its life with manufacturer-specified code verification, (North American) banks still seem to mostly be using the same terrible authentication policies they were 10, even 20 years ago.
The hardware problem isn't new; phone taps have been easy to install for decades. The world didn't end, nor did we shut down the telephone network.
In re software, we could easily strengthen owner trust in systems without having manufacturers ensnare us in straitjackets. Trust on first use could allow an infrequently-updated chain loader to verify subsequent components without depriving the owner of using the system as they desire. Hardware tokens, or physical buttons with dedicated circuitry could prevent certain system functions from being configured / updated without direct user intervention. 'Trusted' execution environments could be used to run software of particular significance to the device owner. We have an enormous quantity of tools in our tool box to improve the security of systems without relinquishing ultimate control.
Ultimately, though, liberty will always have some irreducible risk. It's not obvious to me why we should be valuing status-quo business plans to its detriment.
Even technically skilled users won't benefit from a construction of 'trust on first use', when was the last time you verified the host key of a system you SSH'ed into for the first time? How do you trust a system purely on something like that? And even then, when you got an error that the host key no longer matched, did you go on a research run to figure out how this might have happened, or did you just replace the key in your local known hosts cache and went on with your day?
What about websites, do you disable all CA's and just use local key pinning on all the websites that you visit? This is something you could do right now. But you won't, and neither will anyone else because it is far too inconvenient. It makes the entire thing useless. And every time you send an email, are you going to verify the fingerprint of the supplied certificate as well?
While it might not obvious to you, the feasibility of this at scale is something you can figure out by simply talking to users, looking at A/B test, comparative research, and looking at the security configuration of various user's systems and asking why they might have chosen the configuration as it is, and what the impact to them, the people they interface with and the internet as a whole might be.
wrt phone taps: it's possible and not the point (and not useful; the Americans did plenty of local and global taps and almost none of the broad taps yielded anything useful over 10 years, it was only the highly targeted taps that yielded real results). It's also not froth, "locking up stuff" and "straight jackets". It's about a hard problem, with everybody having an opinion but nobody having a solution. And the only thing people seem to want to do in such a scenario is apply a scorched earth policy which besides the obvious destruction doesn't yield a solution either. With the current devices and services there is so much personal data, proximity and interaction that the value and impact is much higher than your landline at home. The point isn't to make it perfect or perfectly secure, but to make it hard enough that it isn't an attractive broad-spectrum target anymore. Making it cryptographically hard to hack into a baseband, a bootrom or kernel is a very effective method to make this protection a reality, and so far there has not been a successful alternative presented by anyone, anywhere.
Ultimate absolute liberty is a fallacy, externalities exist, and society doesn't work in anarchy (but doesn't flourish in strict hierarchy either). Until you can manipulate time and space, and modify matter at a subatomic level, you are and will always be dependant on externalities, and as such you have to work with those. How hard you make it for yourself or others depends on the degree of society and civilisation you can live with. You don't control the BGP tables on your ISP's routers, but that seems to be fine for all the millions of users. But all of this is straying away from the topic at hand quite significantly.
(Edit;) As to the 'value status-quo business plans': that is not something we value, but something the producers of some large-scale hardware and software manufacturers value. They aren't society's friend, but they do need it to buy its products. And if the USP of the product is something you want to remove, then the manufacturer is probably going to try to prevent that. This would be 'fixed' by you getting what you want and they getting what they want, but that is not technically feasible (or: has not been shown to be technically feasible yet), hence the long blocks of text describing that problem.
The Internet is a good example. The threat model has been far too trusting, historically. We're paying for that in a variety of different ways. Burning it all down and starting over is impossible, so we're stuck in a mess. Maybe we can do better in the future.
This is also something that feeds the 'it used to be better back in the day' feeling, because some aspects might actually have been better because too many possible threat actors back then wouldn't take internet seriously and as such weren't an actual threat. So it wasn't safer, it was just less-attacked. As a result where was less pressure to make hardened clients and servers, and as a result of that, it meant that things like digital signatures were extremely optional (and computationally too expensive to include for the sake of it).
On the other hand, it's also the openness that brought its success, and may very well cause its downfall. (that said, nobody has been able to come up with a worthy replace ment so far) Having no single owner makes it better in that regard, but also worse.
The end state is for apps on Android to be either pointless fluff that basically do nothing useful, or mega apps written by big corps where the rules don't apply. Hobbiest coders are not wanted, or accommodated.
At some point it just doesn't make economic sense to do that.
I also mind when things like my tractor or my car are locked down to prevent my ability to use a 3rd party repair shop, repair it myself, or make changes so the item better suits me: The person who fucking owns that computer.
I think there's a very real risk that the concept of "ownership" is going to die if we continue in this fashion.
Do you own a thing if you're prohibited, intentionally - by the manufacturer - from making any changes? I'd say no.
Do you own a thing if it has to check in to an online service controlled by someone else before it works? I'd say no.
Instead you're just renting, and these companies are intentionally rent-seeking (in the worst possible way).
Most people simply are unable to properly handle private keys. All of the systems with the highest levels of consumer satisfaction have third parties that manage (or at least can override) keys on the user's behalf. Systems that do what you're suggesting are notoriously plagued with issues surrounding key management to the point where they never reach mainstream use. i.e. PGP, bitcoin, etc.
Think John Deere implementing software lockouts in the tractor ECU. That is nothing more than forcing their business model onto the end user through digital logic.
You are renting it from Apple. They control what you run, when you run it, what you can install, what you can remove.
By default, they're shipping you a device where you're literally not the root user. I can't possibly think of a clearer argument that you're renting, and entirely at the whim of Apple (which does have root access, and actually owns the device you happen to be using).
The issue to me is that ownership implies the right to modify and change a thing, especially in ways that the original manufacturer doesn't support or agree with.
If the manufacturer is still calling all the shots on your device, you don't own the device!
The question is, do we have a good solution to enable the average user to own their device while also ensuring security and availability?
We have two options with cars, either intentionally implement a security hole, or let the manufacturer "own" it. Because the other option -- tell the customer they're SOL when they lose their private key, is not a solution that is practical (grandma will lose hers) or possibly even legal (manufacturers' obligation under lemon law).
That key disables all the security measures to stop the car from moving and lets the user drive it.
Why should the same key not also allow 3rd party parts to be installed, or disable any other security feature the user would like to disable?
The user has already been given a device the compromises the entire security system, why do you think they need to do anything as complex as store a private key (it's embedded in the physical key).
Same question for phones - The user's pin/password already removes essentially all functional security from the system. I'd add a requirement for a physical switch to be toggled in the case of the phone (a tiny toggle header, or a certain combination of presses on the available buttons should do just fine) to rule out network based access.
In general though, security measures added by the manufacturer always fail, because the user has to actually use the thing at some point.
So given we already have the hole, the only reasons I can come up with for continuing to forbid the owner of the device from actually owning it are
1. It adds cost to the product
2. It removes future revenue from the company (because that pesky owner might choose a cheaper repair shop if they actually own the device... however will the company maintain their monopoly on parts/service?!?!? Think of the children!)
There are some (mostly older) where you can directly reprogram the eeprom but those cars are easier to steal, because anyone can also do this.
So many people complained about not being able to run their on firmware on the TiVo that it caused the GPL to be updated to version 3.
While Turing machines are universal, there are practical limitations of the hardware. A tiny embedded microcontroller with kilobytes (or less) of memory is not an attractive target for customization or repurposing. Today it is probably easier/cheaper to simply buy a Rasberry PI or similar.
Also, some companies understand that they are in the business of selling hardware and don't particularly care what you do with it.
Do you mean that literally? There is daylight between "appliances shouldn't exist" and "there's nothing wrong with appliances." I mean, I agree that microcontrollers and smartphones/PCs are different. There's obviously something wrong if problems emerge at some point along a scale. There's no real defining line between GPCs and microcontrollers.
I also don't think it's a problems if someone somewhere has a locked down PC. It is a problem if most people do.
YOU do not complain about those.
I complain about my TV showing me ads. I complain about my car not resetting one annoying light when i change the oil. I complain about the proprietary connectors on my generic batteries that restrict me to one brand of power tools (that get's discontinued for new proprietary connectors every 2 years).
It's fine if you love exploitation capitalism. But don't go assuming crap about others.
Google messing around with their app store is peanuts compared to the government banning or restricting 3D printers because they could be used to evade gun control for example.
Just buy some cheap SOC from the market and load the software, close it in a blackbox and call it a day. It's going to be the future now. God forbid they also talk to internet and runs an OS version from 2014 and never gets patched. It's a botnet paradise.
It's not just regulators who are nervous! What if someone modifies the firmware in their self-driving car and introduces a bug that causes the car to crash and kill someone?
If I'm a network engineer at a company, I need full control of the network to ensure security. As just a user of that network, I would have to understand that I don't have full control for security reasons. But it's not my network.
When it comes to consumer devices, there's no reason why security requires locked down devices that the so-called "owner" of the device can't control. The end-user should always be in charge. If the manufacturer chooses to put escape hatches in front of features that could lead to security compromise, then that's fine. But those escape hatches should exist, and I refuse to buy a general-purpose computing device that doesn't have them.
The Google vs. Apple argument here is specious; the locked-down nature of Apple's devices is not necessary for their better (but honestly still not great) security, and the less-locked-down nature of Android is not what makes it a security minefield.
But, the "freedom is indivisible" take is not always useful, particularly not on its own. There are practical realities to contend with and the world of appliance-computing is big and complicated. A lot of issues relate to back competition, or lack thereof, for example.
>> an Internet that transmits any message over any protocol between any two points, unless it upsets us?
Look... The problems coming to fruition today have been talked about on HN/etc. for decades. They're hitting the political stage, and all those discussions have near zero impact. The ideas were never translated to general consumption form. We always prefered to be right over effective.
The average politician has never stops to think about how www, linux, email, gnu, wikipedia and such are possible, what that means. If they did, they don't have the vocabulary for it. We didn't give it to them. Just let them read "cathedral & bazaar" or somesuch. Instead of working we snarked our incomprensible principled platitudes. Worse, we arrogantly assumed we'd win anyway. The internet couldn't be locked down. A country who tried to make Great Firewall would fail. Property rights would be redefined^ because digital copyright is impossible and the internet is more important than Beatles royalties. How wrong we were. How seldom we remember it.
Classic ideologies like Marx, Rand & such tend to fall into this exact arrogant trope. I am so right about everything that it's all inevitable. History will conspire. The arrogant fools. Us too.
Think of all the pull that Disney, EMI, etc have. Every politician can recite the case for copyright verbatim, along with the other talking points. Protecting their interests is literally one of the main things the US uses its might for. It's always a non negotiable demand in trade relations. Every politician or hack commentator knows to cite "stealing intellectual property" as a complaints against china or whatnot. Major digital legislation (eg DMCA) was written by and for them, along with other laws.
Conversely, very few politicians or hack commentators could articulate a digital freedom case, a case against copyright militancy, or a case the against software patents. Those that can will be freestyling it. No "talking point" sheets. No consistency. No real lobby. No solidarity. No effectiveness.
How the f##k do EMI & Disney have much more influence than us, or at least Google & such? We are arrogant fools. That's how. They're entertainment industries. We're the engine of modern economies. DMCA affected the tech business just as much as Disney. We even had status quo on our side, so all we needed was a hung jury. How did we lose this? It's a joke. Like Mike Tyson losing to McBride.
Right to Repair should have been long won. We should be battling for OS mandates on the back of it by this point.
So... where are we now? Politicians and journalist-types are literally starting to think of regulating social media as a "common carrier." Concepts recycled from early 20th century Telcom sagas. Not "neutral" carriers. Not "open" networks. No "free as in freedom." In fact, it seems like no idea from the personal computing age has influenced anything. No one who understands FOSS or how the www works is even in the room... the room where decentralising an internet-based communications network is being strategized. Do we realize how big a failure this is?
^No shade intended. I agreed ATT. I still do in the abstract. But, the lack of "what we need to do" was a mistake, IMO. History does not drive itself: http://www.paulgraham.com/property.html
https://github.com/termux/termux-packages/wiki/Termux-and-An...
I don't think that I am ok with not being able to easily run my own executables since I rely on running a few Go utilities in the Termux CLI.
Here is a popular CLI app to manage passwords. I use it on my desktop, laptop and phone.
And that was just one example. You can also use python as a much better calculator, share files over wifi with a web server etc.
https://developer.android.com/ndk/guides/stable_apis
> Starting in Android 7.0, the system prevents apps from dynamically linking against non-NDK libraries, which may cause your app to crash. This change in behavior aims to create a consistent app experience across platform updates and different devices. Even though your code might not be linking against private libraries, it's possible that a third-party static library in your app could be doing so. Therefore, all developers should check to make sure that their apps do not crash on devices running Android 7.0. If your app uses native code, you should only be using public NDK APIs.
Taken from https://developer.android.com/about/versions/nougat/android-...
- iSH: an Alpine Linux shell environment, powered by an x86 to ARM JIT emulator
- Scriptable: an iOS automation tool using Javascript, it can even integrate with native iOS APIs like photos and calendars, create native UIs, etc.
- Pythonista: a Python IDE, you can create 2D games, use it as a REPL, integrate with native APIs, and much more
And of course, there are the 1st party apps, Playgrounds and Shortcuts.
It is.
Even mozilla firefox is banned on the premise that it can run arbitrary code and yes, that is the official apple instance.
The fact that they apply it when they see fit and allow other times, and that it is totally arbitrary and opaque based on their own private interests, is exactly what everyone with common sense tried to explain when criticizing the walled garden.
That's a huge caveat though.
How far does that restriction extend? Can I share or import Pythonista projects from other people?
What's the difference between interpreting a file I downloaded from the Internet and visiting a website?
If you want to split hair, where would you draw the line? Should pythonista go out of the way to prevent copy paste from the browser/email?
Or should apple, being non-arbitrary, also blocks adobe PDF reader since it can open PDFs from the web with javascript just like a browser would do?
Google just doesn't care about what your app does until they start seeing click fraud, upon which they ban your app, delete your Gmail, and ghost you. They've even done this to paying GSuite customers, game studios they were working on, and their own employees' spouses. As far as I can tell, antispam is at the top of the org chart and can overrule all other layers of management. I would never trust Google with anything I can't backup or migrate to another service.
The console tab of Chrome's developer tools allow arbitrary code execution. That example is not a security violation, ergo arbitrary code execution is potentially but not necessarily a security violation.
A valid remediation requires more than just arbitrary code execution, such as privilege escalation or leaking containment.
The difference is that fdroid is actually helping users through being transparent about it. The other stores and their policies usually are not transparent, and therefore nobody knows whether there were financial motivations involved in the decisions.
What I don't like is google claiming droidscript harms Android through a malicious AdMob ID. Even if that were the case, what happens to the 100.000+ installs that are rolled out already? And the Apps built with DroidScript?
If there's no support you can contact (at Google) and no changelog on what happened, the policies get intransparent and look more like a financial motivation rather than a decision that seemed to be beneficial for the end-users.
So, technically, from the perspective of a company like Facebook, fdroid is a walled garden they cannot enter without open sourcing their code.
(I'm not saying fdroid's policies are bad. I'm just trying to make an argument for the counterside and am playing the devil's advocate here.)
PS: I know about third-party repositories. That's not the point, it's differences in policies and their effects on the ecosystem I want to discuss because I think they're more important.
Google advocates always make the argument that endusers "can just root their phones and install the APKs anyways" which is similar to f-droid with an external repository. Most non-technical endusers simply won't do that.
EDIT: Addressing the "PS" that was added...
> Google advocates always make the argument that endusers "can just root their phones and install the APKs anyways" which is similar to f-droid with an external repository. Most non-technical endusers simply won't do that.
Android skirts around the criticisms fielded towards iOS by technically allowing users to install and distribute third-party apps. The real problem with Android is that the default distribution platform (Google Play Store) is a walled-garden, proprietary app with such a massively disproportionate market share that most users don't even realize there are alternatives. And Google ensures their store will always be the default because they hold their proprietary Google Play Services for ransom. And Google Play Services is so valuable because it provides many convenient features and functions, including some which used to be part of the operating system itself.
But I think that the main issues of Android (or AOSP) are even a level deeper than just the Play Services.
There are lots of initiatives that try to create a free ecosystem for themselves (Lineage, /e/, Carbon, et al), with their own stores and sources for Apps. Most of them have varying degrees of success, due to gapps counterparts like microG [1] not being able to keep up with what Google's Play Services provide API-wise.
It's an absurd amount of features, and a lot of API workflows to consider. Bugs and crashes everywhere down the user experience...but hopefully they're getting slowly to a stable state.
Coming back to the real problem: I think it's actually the Vendor deals that Google did. Most of the manufactured devices are almost impossible to flash without reverse engineering skills, and this is intentional. Having to wait more than 3 months to unlock a smartphone's bootloader because the manufacturer doesn't give a damn about you is just one of many examples; setting aside that most of the unlock procedures are meant to be understandable by developers-only.
I think that in order to "really free Android" the creation, flashing, updating of ROMs has to be standardized in a more homogenic way (partition fatigue, anyone?), because it would allow a graphical and easy-to-use software to be built. That would allow to flash a ROM without e.g. losing all /data and more importantly - be usable by end-users without technical knowledge.
In my social circles I'm the guy that flashes LineageOS to their devices, because most of the terminology is so far away from the reality of most users that they have no single clue where to start. The amount of knowledge that is required to flash your device (and be Google-free, even in Apps with e.g. with Appwarden [2]) is absurd and as long as this is the case it will be a niche that's being ignored by politics (and potential regulation laws that would force Google's policies to change).
It's incredible what a smartphone can do given its form factor and a lot of that is thanks to their use of SOCs. I have no experience with OS development for SOCs, but I hear it is much more involved because a new version of the OS must be created for each SOC - specialized to work with the device tree supported by that chip. As I understand, Google doesn't do that work. Manufacturers have to fork Android and implement support for their SOCs on their own, then they have to maintain that fork as new Android releases keep coming. It's no surprise then that manufacturers don't want to invest addition support into other operating systems like LineageOS.
There's probably a better way to do things. I'm sure manufacturers could make information more available to OSS communities which would allow them to do the work themselves more quickly and effectively. Like you mentioned, standardization would also go a long way towards making our current smartphone ecosystem more friendly to third-party OSes. But ultimately, none of that is really Android's fault.
Even without Google's vendor deals, I doubt the likes of Samsung, Motorola, or any other major smartphone manufacturer would start supporting LineageOS. It's hard enough to even get Linux suppport from desktop/laptop manufacturers. LineageOS is a really amazing project, but I don't think it's the one paving the way for open source operating systems on smartphones. I think most of that work has to come from the hardware side with projects like the PinePhone.