Hacker News Reader

Comment by kipchak | Hacker News Reader

Disabling by default but allow sideloading with some disclaimers and warnings seems like a fair compromise, similarly to how Windows will put up barriers and warnings if you try to install software from unknown sources.

The downside is that you don't protect those who enable sideloading and see the warnings when installing Facebook sideload and tap through anyway.

View on HN

I wouldnt necessarily encourage it, but if its not illegally anticompetitive, and Apple wants to retain control of devices, they could make it where "enable sideloading" disables the Apple App Store, and prevents any app from the Apple App Store from running, including cancelling all subscriptions. If they really wanted to get nasty, they could force a full device reset before going back to Disable Sideloading. The latter part is almost exactly the route Microsoft went with Windows Mode S.

They could let you have your phone in either mode, but refuse to allow "hybrid" App Store + Sideloading configurations.

Imagine if an automaker said "if you ever install a non-OEM part in your vehicle, none of our dealers will ever sell you any OEM parts or perform any service on it." Or if Keurig said "if you ever use a third-party K-cup, you'll never be able to use any of ours in that machine ever again."

We are talking software though, where a factory reset can restore originalness.

Okay, how about "if you ever install any non-OEM parts in your vehicle, none of our dealers will sell you any other OEM parts or perform any unrelated service on it until you pay to have them all re-replaced with OEM ones again?"

How is that at all the same as "we wont let you use our apps if you have unsourced apps on your phone."

There's no cost to wiping the phone. It doesnt require you to drive to an apple store and have them do it.

This also isnt a phone part. It's not "you cant have a new battery until you wipe your phone."

"Install our game via sideloading now: Just ignore all the warnings (we promise it's just as secure) and we'll give you $100 of our in-game currency as a thank-you!"

And who would be able to resist? There's even a little shield icon!

The problem with all of these arguments is that literally no one is doing this at any scale on Android where sideloading has existed since the very beginning. There's literally zero reason to believe that if sideloading was allowed on iOS this would suddenly become a problem.

It's not common, but Fortnite is a notable example of a game which eschews the Play Store in favor of sideloading.

Fortnite is the biggest example, and still they struggle to encourage installs. People just went to PUBG Mobile instead. Fortnite has the support of the second biggest android stores (Galaxy Store), and still their android revenue isn't great.

Fortnite is basically the only such app with any significant user base, right? So it doesn't make allowing sideloading a bad thing any more than the ZFS-on-Linux situation makes copyleft a bad thing.

Google has however also been very careful about parity in functionality between the Play Store and sideloaded apps form the beginning.

Only very recently have they started cracking down on third-party in-app payments and subscriptions, and otherwise I think they have basically approved everything that's not either outright malware or illegal, significantly including third-party browsers, VMs and emulators and other things that Apple bans by policy.

I would not say zero. I visited a jailbreak store early on and this is exactly what I saw. However, it was not the developer. The store had pirated versions of popular games hacked to create fake in app purchases. I foresee numerous headaches for developers trying to prevent cheating, piracy or fake purchases.

Dji

I would agree if you can't do it all on the device itself, the unlocking/sideloading initial warning bypass. The idea would be to prevent those who can barely work their phone from "accidentally" enabling sideloading and then downloading some random app off the internet or other app store by accident or being talked through it with a scammer.

Maybe requiring approval from the iOS account that manages the device, signed in to some other device? I'm imagining something somewhat similar to the "ask to buy" feature for child accounts. That could also help with child or elder accounts if they're managed by someone else holding the keys. Downside is not everyone would have someone to manage their account for them.

Having to call into Apple to confirm maybe?

Doesn't the Android process still involving tapping 7 times in a row on the build number in the About Device screen? There's definitely ways to create a feature that can't be found accidentally.

You're probably thinking of activating developer mode. Sideloading doesn't (yet) require that, at least not on my Pixel (Android 12).

Yes that's what they're thinking of (activating developer mode).

Sideloading does require several clicks though. First you download the APK, then you "open" the file in the installer. Then you have to allow "installation from unkown sources," then allow for the app that you downloaded it with (for me that's usually firefox, but for most it's probably Chrome), then you can install it.

Sure, vetting apps can be quite efficient at preventing malware.

But if a sideloaded app can do significantly more harm than just visiting a malicious website (which a scammer can already direct a victim to do), maybe the OS is providing too dangerous (or coarsely-controllable) permissions via its APIs?

Warnings won't suffice when Facebook, Google, and increasingly ByteDance make apps that are necessary infrastructure for modern life.

People will be forced to choose between clicking through an explanation & accepting risks they don't understand, and participating in society.

For apps that are genuine but behave as malware in terms of data collection I'm not sure it will be possible to build walls high enough to keep them out short of regulation, or that currently users aren't already unknowingly accepting those risks. As is for iOS apps while the user can opt out of their IDFA being shared other tracking methods other fingerprinting methods can still be used, Fingerprint.com/demo has a good demonstration. If sideloading stays prohibited I'm not sure what would stop Facebook from migrating to a browser only version.

Over the long term I'm not sure there's a good solution other than legislation arriving at some "acceptable" level of tracking, given how crucial expanding tracking is to social media companies.

None of those companies make you sideload their apps to use them on Android.

Reply on news.ycombinator.com