Hacker News Reader

Comment by grogenaut | Hacker News Reader

This post for info purposes only having worked with the Amazon app store team and does not reflect my opinions at all, I haven't spent time thinking about if it's good or bad:

The resigning stuff is because they alter the apps to fix dependence on Google play apis and gsuite apis. Developers were not interested in rebuilding their apps for fire and other devices without those apis baked in and this was a good solution to ease uptake for fire/Amazon app store.

Also note that ms will control this android os, so they already control the signature verification method. They could do this without you knowing very easily by just with something like carrying a second sig and hash of what they modified and the original partial sums from the original app. Google and amazon or any os supplier can.

Signature verification is only as strong as the verifier code.

Glad to burn karma to put data out there.

View on HN

> The resigning stuff is because they alter the apps to fix dependence on Google play apis and gsuite apis.

Except the article clearly states:

> Amazon wraps your app with code that enables the app to communicate with the Amazon Appstore client to collect analytics, evaluate and enforce program policies, and share aggregated information with you. Your app will always communicate with the Amazon Appstore client when it starts

Now, the original reason to do this might have been benign and well-intentioned, but the result is bad already. This is for now, who says they don't simply add ads like Google [0], or even without the developers knowledge like SF [1] once did? Ubuntu tried to only implement a search and it backfired badly [2], I hope this goes down a similar path.

As a side-note: Of course I'm very happy that competition to the PlayStore is getting some love. This is direly needed. But Microsoft could have gone with F-Droid easily. Trading a bad thing for something worse does not fill me with joy.

[0] https://news.ycombinator.com/item?id=27643208

[1] https://arstechnica.com/information-technology/2015/05/sourc...

[2] https://nakedsecurity.sophos.com/2012/11/01/ubuntu-search-am...

> But Microsoft could have gone with F-Droid easily.

Slipping that in at the end really hurts your argument. Microsoft opting to use F-Driod would be worse than starting from scratch and only benefit F-Droid.

Presenting F-Droid as an equivalent to any of the large stores is like trying to say a lending library in someone's front yard is the equivalent to Barnes & Noble or Amazon.

It's borderline delusional to compare F-Droid to the big players in much the same way it's silly to compare FOSS apps like GIMP to Photoshop. Sure it performs the same core function but they're in completely different classes.

They aren't equivalents unless you willfully ignore a lot of differences and that is just dishonest.

I did not read Sebb767's comment that way. I read it as one user thinking about alternatives and stating what is technically possible. Technicaly no one needs an "app store", i.e., middleman, to run a program on a computer; meantime, F-Droid works. I think the strange analogies you make are just abstractions you have created in your mind. The comment you replied to offered no such bizarre analogies. HN is a site for intellectual curiosity. Trying to censor or bully free-thinking users into accepting the narrow-minded marketing of large corporations like Microsoft and Amazon is arguably not this forum's highest and best use.

> I read it as one user thinking about alternatives and stating what is technically possible

You're exactly right; my thought process was "if they want to go with an existing store, F-Droid might be an option".

> Trying to censor or bully free-thinking users into accepting the narrow-minded marketing of large corporations like Microsoft and Amazon is arguably not this forum's highest and best use.

I think cptskippy just wanted to say that F-Droid is in no way a suitable replacement; since he read my comment in a different way, he just emphasized this more than necessary :)

As 1vuio0pswjnm7 already correctly pointed out, my suggestion was based on the fact that if they wanted to go with an existing infrastructure, F-Droid would be a possibility.

> It's borderline delusional to compare F-Droid to the big players in much the same way it's silly to compare FOSS apps like GIMP to Photoshop. Sure it performs the same core function but they're in completely different classes.

I disagree with that. The software itself is clearly irrelevant in this case as they will hardly run the actual store app on windows and the required infrastructure is not a big problem for Microsoft. The existing app base is what matters.

To be fair, though, I wasn't aware of how alive the Amazon app store actually is.

F-Droid is just way too small, it has ~4000 apps vs ~500000 for Amazon's appstore.

Have you actually spent time in the Amazon android ecosystem?

It's absolutely terrible. Total amount of available apps is not a good metric for quality.

Agreed. 95% of all those apps are useless and rehashes of existing apps in some way. And the only reason the whole thing doesn't fall over is because of semi-random search that "spreads" some portion of user downloads to lower quality (or less popular) apps, thereby incentivizing the spaghetti-throwing-at-the-wall ecosystem that is the app stores.

Curation models are better in that sense, because they have a limit that forces a quality filter. The alternative is just an evolution of the spam model. You see it with Google turning the web into blog spam, YouTube with videos, ebay/Amazon/aliexpress with "products", and the app stores with their 5million "apps".

My guess though is that most of these apps haven't been updated for years.

> Your app will always communicate with the Amazon Appstore client when it starts

One of the consequences of this is that apps refuse to start if they haven't been able to connect with the Store in the past `x` days.

I mean, we could also ask Apple to officially support Homebrew while we're at it. The bottom line is... well, the bottom line. Microsoft is very willing to diversify it's partnerships as it's heading into a new decade, and I bet Amazon wasn't adverse to shaking some money their way for routing it all through their services.

It's not great, but it's significantly better (imho) than if they had exclusively chosen the Play Store. It's a creative way to gently pressure developers to publish to additional marketplaces, which indirectly pressures Apple since the Microsoft Store now doesn't force developers to route payments through their system (thusly reducing Microsoft's "cut" to 0% for many apps)

Sure, there are any number of ways Microsoft could break their own security model. For example, they could stop verifying signatures entirely. The fact that they're not doing worse things doesn't make what they are doing less bad.

If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? Sure, some devs might be too lazy to do it, but how does that justify forcing everyone to give up control over their signatures?

> If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves?

I would imagine the tool rebinds the Google APIs to Amazon's equivalent APIs rather than neutering them. Since Apps are relying on the API responses. I don't imagine Amazon wants Apps distributed outside their Store using their APIs and getting a free ride.

Am I missunderstanding things? Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers?

I understand there's a chain of custody and a developer can upload their App, then download it from the store and be confident it's what they uploaded. But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.

> But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.

In fact, Google is planning to soon force app developers to use this model, just like Amazon. Yes, it removes the ability for developers to know/control what code is running with their name attached to it, and it's bad regardless of who's doing it.

> Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers?

The primary (or at least original) purpose is to verify that app updates (or in some cases extensions/companion app that can directly access each other's data) are signed by the same key as the already installed app.

Though I supposed that these days PlayProtect will likely indeed check the signature against Google's database on first installation, too.

Huh - the signatures are for the store and store client to verify things.

And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing.

I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.

> And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing.

As I said in another comment, it's not any better when Google is doing it instead of Amazon.

> I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.

If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf.

Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?

The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures.

Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc.

Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior).

This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out.

This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats.

Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.

Given the choice between an Amazon app store and a Google one, running on my Windows machine...Amazon does seem the lesser of the two "evils".

Reply on news.ycombinator.com