Android now allows apps to block sideloading
arstechnica.com
arstechnica.com
yooooooo shhhhhh
Don't give them any ideas :(
Also it's not like insane security ideas around banking access compliance are unprecedented, see e.g. South Korea's insane Internet Explorer deal (transitively caused by US's ITAR on encryption)
https://en.m.wikipedia.org/wiki/Web_compatibility_issues_in_...
There is no limit whatsoever to what a bank feels is justified in doing when it comes to preventing fraud, money laundering or whatever else that impacts their bottom line. They literally believe they are entitled to any and all access.
Many banks in the EU require a smartphone for that at this point (or a dedicated authentication device).
But instead of using actually secure technologies like Android’s protected confirmation (which couldn’t care less about running on a rooted phone, as it runs in a trusted HW enclave), they usually just settle for (often very spoofable) “root detection”. It’s quite sad.
Needless to say, I am happy I have a second work phone I keep disconnected from WiFi while not working.
Manufacturing a low-volume, open device isn't going to be cost-competitive without the hardware being a commodity.
I think we're getting closer to that point, though.
The vast majority of the market isn't in flagship phones, and even in those the last few generations of flagship features have been mostly based around software anyway.
I'm guessing we're one or two more big nudges away (i.e. - EU regulation/gigantic privacy kerfuffle/Google breakup) from a standard open-source phone software stack being a viable standalone business model almost by necessity. App stores currently take something around 30%? Maybe in the future you'll pay $25 up front for the phone software, and this open source software stack will take a 15% cut from the developer side instead.
Or maybe I'm just dreaming.
The hardware is too slow to use as my main phone (it's like 10 years behind normal phone HW), but I assume that as the performance needs of average users plateaus "10 year old hardware" will be more than enough eventually. Look at how modern phones have not changed much in the past 5 years.
> Because the world today is not the world of yesterday. A capitalist oligarchy runs the world and forces us to consume in order to keep the gears of this rotten society on track. As such, the biggest market for video game consumption today is the mobile one. It is a market of poor souls forced to compulsively consume digital content in order to forget the misery of their everyday life, commute, or just any other brief free moment they have that they are not using to produce goods or services for the ruling class. These individuals need to keep focusing on their video games (because not doing so will fill them with tremendous existential angst), so they go as far as spending money on them to extend their experience, and their preferred way of doing so is through in-app purchases and virtual currency.
> But what if someone were to find a way to edit the saved games and assign the items and currency without effort? That would be terrible, because it would help players consume the content much faster, and therefore run out of it sooner than expected. If that happens, they will have nothing that prevents them from thinking, and the tremendous agony of realizing their own irrelevance would again take over their life.
> No, we definitely do not want that to happen, so let's see how to encrypt savegames and protect the world order.
This is why "computers" like Chromebooks are useless as well, I wouldn't even let pupils have them if the goal is to teach digital and technical competence.
I don't believe these restrictions will be successful on a PC to such a degree. Remote attestation does exist though and I recommend to leave it for remote machines managed by yours truly.
Usually phones are technically quite capable, but the OS landscape seriously inhibits innovation.
People say this, but I don't know if it's actually true. It would've just done a triopoly instead of a duopoly - especially when you consider the fact that the third player would've most likely been Windows Phone, which was also very closed off back when it existed, and Microsoft has only gotten more anti-consumer since.
What we really need are better laws and policies.
Why stop at 3? Let's have 100 so that app developers can spend all their time porting to other platforms.
I hope it doesn't become a slippery slope where for "security" Google would start blocking undesirable or ethically/politically inconvenient apps, too.
For example, there are some medical apps that improve people's health outcomes (like custom blood glucose CGM apps and insulin pump closed loop apps for type 1 diabetics). Google does not seem to want them on the Play Store. They are undesirable apps from a business perspective – a liability with no upside.
The tech we speak about today provides the infrastructure to block these undesirable apps, as I understand. This lays the foundation of not allowing software to be installed on many consumer Android phones without Google's approval. I do hope it never comes to Google overstepping like that, but it could be optimism or naivety.
As a tool for app developers... where app developers make the decision... in this limited situation, it might be still somewhat okay. It's okay in the sense that the apps are their intellectual property and they might be entitled by law and common understanding to choose how it is distributed. But if Google ever decides to ban apps this way against the developers' wishes, it would be a massive overstep.
No, it isn't. AFAICT, this "feature" only prevents you from sideloading apps that don't want to be side-loaded. It's not going to prevent you from installing your favorite open-source apps from Fdroid or APKs.
>For example, there are some medical apps that improve people's health outcomes... Google does not seem to want them on the Play Store.
Then it would be very, very stupid for these apps to add this anti-side-loading feature, wouldn't it?
Google isn't the one preventing side-loading, it's the individual apps (and their makers) themselves.
I'd delete the original comment as my late edit skewed the discussion but HN doesn't let me do that. Apologies.
Anyway, I'm not sure how much potential for abuse there is here. I don't see anything too horribly wrong with app makers being able to restrict their app to Play Store installation (though I think it's annoying, and sucks for e.g. GrapheneOS users). I'm not really sure why app makers would want to do this anyway, but I guess they have their (dumb IMO) reasons.
But to be abused, that probably means Google, or the handset maker, using the feature to prevent any apps from being sideloaded or installed from app stores they don't like (like Fdroid). That would be terrible for sure, but I don't really see how this particular technology would allow that. I mean, if Google wanted to prevent sideloading, it seems like it would be relatively trivial for them; why would they need something like this? Installing from APK is built into the system (you can do it with "adb"), and could just as easily be removed or restricted. Same for the handset makers: they don't have to distribute Android as-is, and usually don't. It seems they could easily disable apk-loading and adb in general.
This is a bit hyperbolic—the core differentiator provided by sideloading is that you don't have to distribute through Google. That's still very much intact. What's changed is that apps can opt themselves out of being sideloaded.
F-Droid and the FOSS ecosystem in general are entirely unaffected.
How so? You are still able to sideload apps. The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. The decision to use that is on the developer and the user has the choice to move to other apps or succumb to using the Play Store in those cases.
If anything, the article suggests that the actual erosion came about a year ago with other integrity check features, such as helping the developer figure out whether the app is being used on a rooted phone. Or with the increased difficulty in using customized versions of Android over the years.
I don't want the app developer to have that power. The developer does not get to subvert my control. If I want to make the app believe it's running on a stock phone, that's what it should believe, and that's what it will believe.
It's my machine. What the developer wants or doesn't want is completely irrelevant to me. Only what I want matters. They should count themselves lucky if I trust them enough to allow their software to run without poking at its innards to see what it's really doing.
> The decision to use that is on the developer
Every developer making apps for a proprietary app store will make the decision to use remote attestation. It's a power struggle. They want to own our computers.
If they don't want others to "tamper" with their code, they should run it on their computers. Keep them safe and secure on their servers. Code that runs on our machines is and should be completely under our control. Anything that enables them to usurp this control from us is an attack on computing freedom and should be illegal.
What apps are doing these days is like if all the major grocery store chains decided you can only drive there using a BMW and said "just buy a BMW or shop somewhere else" to everyone that complained, ignoring the fact that 1) there's nowhere else to shop, 2) BMWs are expensive and 3) many people have needs that a BMW isn't suitable for.
Adversarial interoperation. It should be our right, as the owners of the computers, to do this.
https://www.eff.org/deeplinks/2019/10/adversarial-interopera...
https://www.eff.org/deeplinks/2019/06/adversarial-interopera...
I absolutely can. I think building certain types of software should be straight up illegal. And not the copyright infringement kind either.
These days our computers come pwned straight off the factory. The only difference between this and malware is that the company consented to it. In other words, from our perspectives as users and owners of computers, there is no difference whatsoever between their software and illegal malware. The entire purpose of those softwares is to usurp control of your computer and make it do somebody else's bidding.
Creating malware is already illegal. I think it should also be illegal to sell a computer to a person with such malicious DRM "integrity checking" software included. It should also be illegal for corporations to require it. And so on.
This isn't about markets anymore, it's about politics. If a politician shows up and proposes to enforce what I am saying above by force of law, they will have earned my vote.
>The exception is of course in case of market failures, there it is legitimate to intervene
Can't think of a bigger market failure than big techs building digital fiefdoms where they own the users and their data, where users don't have private property, where the corporations sell their users to other corporations and to software developers, dictate the developer's working conditions and control their futures, collect taxes on their earnings, enforce border controls on "their" devices so that software that didn't pass their customs clearance can't get installed.
> If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it.
The only reason why they are even able to "check integrity" to begin with is Google gave them the ability to do so via their attestation nonsense. They deployed hardware cryptography against us to deny us control over what was supposed to be our devices. The ones who have the keys own the machines, and it sure as hell ain't us.
The truth is these apps should not even have the ability to do any integrity checks at all. They should run on whatever device we put them on. And they should be happy that they get to run at all.
This certainly isnt true in the US. There are thousands of banks and thousands more credit unions.
The medium sized city I live in easily has more than a dozen options, and the county probably has nearly 100 if not more.
And on a more serious note, banks have a lot of explicit and implicit lock-in power. Switching is a an annoying process, you might have loans or multi-year deposits with your bank that mean you can't just close your account...
Use apps that respect your privacy and are open source. For example FairMail developer recommend to install app from github instead of PlayStore.
I still gotta use WhatsApp though. In my country, to not have WhatsApp is to be ostracized. And there is no such thing as an open source WhatsApp client. They ban your number if you try. It's in the terms of service.
I can't build a free software app to interface with my bank's systems either. I actually tried asking my banks about this once... How naive I was.
Can you be more specific? I never used WhatsApp.
- app to interface with my bank's systems
Why do you need app for that?
my landlord, teachers, parents of my kids classmates, colleagues at work, even government institutions or some family. whatever they use, i have to use. no choice. be it whatsapp, wechat or something else. they make the rules, and they could not care less if i join them or not. but if i don't it's my loss, not theirs.
-app to interface with my bank's systems
my bank requires an app (either mobile or windows) to approve any transfer, and login to the webinterface.
That is premise to give companies and governments control over everything. If collectivism is more valued to you than right for privacy, nothing stop them to steal all of you data piece by piece.
If someone really care about being in touch with you, they listen.
I never used app for verification of bank transaction. Smartphone is not condition to run their business.
that goes both ways. if i care to be in touch with them, i need to listen. the groups of people i mentioned don't care to be in touch with me. but i depend on being in contact with them. therefore i have to be the one to listen. the alternative is isolation. there is no other way. i have been there. i would not be able to travel around the world as i do now, if i stuck with that attitude.
for example my current landlord lives in a different country, that means i use his chat app or expensive international SMS or phonecalls, which would result in much more difficult communication.
teachers share photos from their activities only on whatsapp/wechat. they will reach me in other ways for important stuff, and in fact the directors of one school told me that they hate it too, but many parents are only reachable that way, so the parents force the school which would end up forcing me, at least if i want to get the photos and casual information, and not just communicate for emergencies. by insisting on a different way i would be the only one that everyone else has to make an exception for. and for many that means they would rather not bother.
also in many cases people do care about me but do not have the technical capacity to understand different communication tools. they barely can use wechat or whatsapp. and on top of that in china all good alternatives are blocked anyways. many matrix servers, for example. the only workable alternative would be deltachat because it works with email. but only if i get them to install the deltachat client, because most people read their regular emails only once a day or even less frequently.
in any group the choice is usually forced by the majority. and it would take a lot of energy to explain and convince everyone to change their preference. i do have more important things to worry about.
Required communication with your landlord via chat app is a part of lease contract?
also in many cases people do care about me but do not have the technical capacity to understand different communication tools
I was able to convince my closest family to use matrix. Sure, it require some teaching and maintaining but it is up to you. If you care, you can manage it.
i am not in the EU. and even there, i probably would have. it's a group for all the parents so i don't see the problem there, and even if there wasn't such a group, the teachers could send pictures privately to each parent. but not per SMS.
Required communication
there is required communication, and there is convenient communication. convenient communication helps keep the mood more friendly. also, you didn't read, international SMS and calls are expensive. and i am travelling a lot. i am not reachable under my home number all of the time, so i would have to tell my landlord my new number every time it changes because i am in a different country. (forget roaming. the cost for that is atrocious)
matrix
i use matrix. the experience is horrible. at least if you are trying to use encrypted chat. half the time it breaks. the key management is way to complex for a normal person. i have a technical friend who switched to matrix because of me. he threw it away in disgust when our chat broke for the third time. he got me to switch to signal (which now fortunately allows me to hide my phonenumber, so it became an acceptable option.)
compared to IRC, xmpp/jabber and deltachat, matrix has the worst usability among FOSS tools. i don't have the patience for the amount of teaching i would have to do, especially as it would all have to be remote. i live on a different continent from the rest of my family.
Yes. I am from Brazil. Everyone in Brazil uses WhatsApp. Over 90% of brazilians have WhatsApp installed. It's news here when the WhatsApp messages of government employees and politicians are leaked. There is no such thing as a phone number anymore, people ask you for your WhatsApp. They even shorten it to "zap", as in "what's your zap?". Phone numbers are just a thing you need to have a WhatsApp. If you do not have a WhatsApp, you're just not going to communicate with people. There's just too much friction for it to happen efficiently.
I have Signal and Matrix installed. Zero people use it to message me. Everyone who ever sent me a message through Signal went back to messaging me over WhatsApp shortly afterwards because that's where all of their other contacts are and there's just less friction that way.
It is what it is.
> Why do you need app for that?
Because the banks want to do things like prevent fraud and money laundering, and apps let them do things like "verify device integrity" as well as suck up as much identifying information about you as possible, letting them know that it's really you and therefore that the transactions you are trying to do are legitimate and shouldn't get blocked.
Here in Brazil I have to go to a bank agency and have them "authorize" specific devices. I'm not kidding. It actually used to be worse. We used to have "bank security plugins" for browsers which were basically rootkits and you could not log into a bank's website without these things installed. Many years ago I poked at one of those things and caught it intercepting every network connection. There's a package for one of these "modules" in the Arch Linux AUR right now. Who the hell knows what that thing does.
Personally I think they should just suck it up and eat the losses. Fraud and money laundering do not justify the sacrifice of our computing freedom. I literally do not care if they're losing billions of dollars, just write it off as a business expense or something. But compared to banks I am poor and powerless so all I can do is try to convince others that I'm right, thereby spreading my ideas.
If you resign from your right of privacy and excuse it with collectivism, nothing stop companies and governments to steal everything from you piece by piece.
For verification of bank transaction, I never used any app. Banks business is not built on smartphones and apps. Its not condition for using their services. If so, I would quickly find competition.
I am committed to developing all of my projects as AGPLv3 free software. However, the fact that I even get to do this at all is something of a miracle. Governments don't generally allow non-engineers to erect big buildings. So why is it that we get to make software at home?
Individuals developing software is a deeply subversive action. It heavily contributed to the democratization of cryptography. The publication of PGP source code as a book defeated the US government's attempt to keep the cryptography to itself. Someone writes a little software called bittorrent and it threatens to wipe out entire industries, wipe out entire classes of business model. Somebody invents a bitcoin thing and now US presidential candidates speak of strategic bitcoin reserves. Somebody invents stable diffusion... We're all living to see the aftermath of that. It's hard to describe just how powerful and subversive computers are. Computers can literally reshape society.
It's all enabled by free computers. General purpose processors which run the code you input into them, no questions asked. And what we are witnessing here is the destruction of those free computers. For the sake of corporate interests. The computer is not free anymore. It only runs the code the corporation allows it to run. Because if it could run the set of all programs, it means it could run code that negatively impacts the corporation's profits. Their solution is to allow execution of the programs the corporations like and nothing else. Could be worse I guess. It might have been the government making that decision. Perhaps one day it will be.
Software freedom is not the same thing as computing freedom. There cannot be free and open source software without free computers. Focusing on free software as a solution to this is missing the forest for the trees. There is no point whatsoever to free software which we can't run, free software which can't interface with the services we need, free software which gets us ostracized. Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services.
We need home computer fabrication technology so that we can make the computers themselves in our homes. Our own free hardware designs, one hundred percent free from their control, fabricated by ourselves.
But more than anything, we need to enshrine computing freedom into actual law. It should be illegal for them to lock our computers down. It should be illegal for them to refuse to interoperate with non-locked down computers. Anything short of this means free software has no future.
this argument gets repeated over and over, and i really hate it. making software is not building a house or a bridge. and i can build my own house. i just need to follow some rules. i can also construct my own car from scratch. again, just need to follow some rules and pass a few tests to see if the car is considered streetworthy. otherwise i can still use it on my private property as much as i want. same goes for software. if a company uses my software in a dangerous setting, (like someone using my unlicensed car on a public road) it is their problem not mine.
Individuals developing software is a deeply subversive action
sorry, what?? i have never heard something so preposterous. is DIY anything at home subversive too?
The computer is not free anymore
yet at the same time we are reaching the capacity to build our own computers from scratch. and if the trend continues, we will have to.
There cannot be free and open source software without free computers
so far general purpose devices are still free enough to be usable. but i agree with your point. see above. eventually we may just as well have to build our own computers.
Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services
we can build our own networks too. and we are. see freifunk and other projects. services is another issue, but so far most of those still allow offline solutions, or i will be able to use them with an isolated device independent from my home built general purpose computer.
We need home computer fabrication technology so that we can make the computers themselves in our homes.
it's already happening. and it will grow as the cost for that goes down.
But more than anything, we need to enshrine computing freedom into actual law
now that is a completely different argument, but also one i agree with.
Anything short of this means free software has no future
i would not go that far yet, but depending on how you look at it and how things develop you may be right, or not. i hope not.
It's not preposterous at all. It's the truth.
Computers are world-changing technology. Citizens having access to unrestricted computers is something corporations and governments cannot and will not tolerate. Google hates it so much they added hardware remote attestation to Android devices.
Computer freedom means we can subvert their silly "integrity checks" and do whatever we want. It means we can run uBlock Origin to kill their advertising and run things like yt-dlp to download their content and keep it forever. They won't tolerate that.
> so far general purpose devices are still free enough to be usable.
Not according to the FSF. You simply cannot find a computer today that does not require you to load some signed proprietary blob onto some chip somewhere. For that you need a CPU that must be like 20 years old by now.
We do not drive our computers anymore. The entire operating system turned into the "user OS" that gets sandboxed away from the real action. It's just user code talking to the proprietary code via some kind of hardware API.
Just look at the sad state of our operating systems. Safely tucked away into some corner, completely oblivious to all the other computers around it. All that hardware running signed proprietary code you cannot control or modify. How did things get like this?
I've pretty much given up on that. By this point I just want IOMMUs so I can isolate all those other computers and try to limit the access they have to what's supposed to be my system. I think it's pretty screwed up that my power as the owner of the machine has been reduced to this.
> we can build our own networks too
You cannot. Not successfully. If you try, you'll find that anti-money laundering laws, know your customer laws, anti-terrorism laws, all sorts of laws will compel you to become what you sought to avoid in the first place. The government got around limitations on surveillance by privatizing it. They will make you surveil in its stead, and if you fail to do so they will blame you for anything wrong that happens in your network. Either you surveil and rat out your users, or you go to jail instead of them.
> it's already happening. and it will grow as the cost for that goes down.
I hope you're right. I really do.
Also, information about the root status can be exfiltrated by the app, which is a security concern.
If in the future I would by some hardware from Google (under Google brand) for example (I would not of course, but let's pretend), like some smart appliance or similar, and for sure it won't be available again. I would not be able to bypass this bs now.
There's still a decent amount of good open source software on F-Droid of course, but so much of the Android ecosystem is proprietary software that being unable to run any of it really hamstrings you.
I was considering buying a Jelly Star as a second device to run the garbage proprietary apps I will still need.
It's a shame we've ended up here.
If this blocks me loading those apps via APKPure or similar, it's going to suck.
This situation really sucks.
At the company I work at the moment the customer base is 2-3% on web, rest is mobile. It's such an incredible waste of time and money to keep the portal functionality on par for such a low number, and I hope they shut it down soon.
To a much, much lesser degree: Samsung's Secure Folder/Android's Work Profile.
As far as I know, it is possible to fake SafetyNet data with Magisk, but there's no bypassing Google Play attestation.
a US company I worked for at a non-US office (imagine it was e.g. Google Japan) gave most employees a corporate credit card. Citibank made it impossible to download their app through the Play Store from the country in question, even though it was required to use it. Only option was to sideload it.
This kind of thing has happened on other occasions as well.
It's becoming unbearable, and I'm just not an Apple guy.
I've had the opposite experience with my Retroid Pocket 3+ (think Nintendo Switch Lite, but running Android). A lot of apps/games that the Play Store marks as incompatible actually work fine when installed via the Aurora store. I try to always leave a review stating that the app actually works.
Doesn't change the possibility as such.
It is an exhausting and practically unending task to defend consumers against malfeasant operators but it is one that governments can and must do.
I am suggesting a scenario where a regulator decides that they no longer have that right because the regulator feels that the needs of the consumer outweigh the needs of the manufacturer.
This would be similar to how regulations around interoperability and accessibility where the regulator decides that imposing such obligations on developers leads to a better society.
Software is out of step with hardware at the moment but we do have principles that means "warranty void if removed" stickers are toothless decorations, and Keurig has no right to actually enforce their wishes about what coffee you brew in your machine. We don't currently have software analogs for those, but the principles hold the same.
They claim its raison d'etre is allowing "better download metrics" and control on the kinds of devices allowed to run the app; those reasons hardly justify forcing going through the Play Store (and having, and associating, a Google account).
Perhaps "digital rights management" isn't exactly the thing to use here, but it's still the same general concept of "author of a specific piece of media/content/app adds an arbitrary technological restriction that doesn't directly benefit users in any way (while ideally not affecting intended proper users) but still potentially helps the author".
It's harder to see for free apps, but for paid ones it's utterly trivial - of course you're gonna have to buy it through the Play Store with a Google account if the author has decided to only sell it on the Play Store; and afterwards wanting to use it without Google Play interference is equivalent to wanting to access media without DRM after having bought it (i.e. reasonable desire, perhaps not even illegal to attempt to achieve through arbitrary means, but owners of the respective thing can still try their damnedest to prevent you from it).
It is largely up to the discretion of the EC.
At this rate, I might just end up buying my first ever Apple device for my next phone.
Apps "checking" whether they're running on "approved" hardware and software are the future. And it's only going to get worse from here. They should not even be able to know we're running custom software, much less be able to refuse to run because of it. And yet these corporations are doing just that.
- 1 cheapest possible phone to begrudgingly bend-the-knee to banking and other crybaby apps.
- 1 decent phone for everything else.
Not really, at least not at the app ID level, because revanced can change app ids indefinitely. Google generally only solves a problem when it can be automated, and manually adding revanced app ids to a blacklist cannot easily be automated. In fact, since revanced is patched on device, they could assign each user a unique app id which would make using app ids as a solution unworkable for Google.
[0] https://support.google.com/youtube/answer/2797370?sjid=13102...
They have already used the play store in the past to delete apps from people's devices: https://android.stackexchange.com/questions/252066/does-goog...
Patching out the check might work for now, since they will be supporting older versions of the app for a while.
If they eventually decide that the server needs to verify the check, it might need to be spoofed rather than removed which can be more difficult (again, depending on implementation details).
They are using their monopolistic position to force everyone to do business with them. If that's not illegal, it should be.
Now that you point it out - it's very similar to what Microsoft has been doing with Windows for the past few years - pushing users harder and harder to create accounts in order to use Windows (by leveraging their monopoly). Hardware vs software, sure, but similar principle.
Regulation is a sharp knife that is hard to wield properly, but we're well past the point of needing it here.
And in two hours no one on HackerNews pointed it out??
It's a feature that's existed for years!!!
They just changed the UI a little..!!
I think that it is again a discrete anti competitive move by Google. Recent european regulations protected the right for publisher to distribute through any marketplace their apps for Apple and Android devices.
But it looks like that they have found the loophole of this with the fact that the regulation does not entitle the user to install apps through any mean that they would like.
My guess is that android was not really afraid of third party app store until then, but now that apple devices will have to be open to other store, there is the possibility that another store editor become major but being unique to Apple and Android devices. Let's imagine the "Microsoft app store for mobile devices" for example.
Almost anything is possible when you’re root…
The only way is to make this sort of DRM straight up illegal. Then every computer is a free computer, and they cannot afford to refuse to work on those computers. They have to suck it up.
Governments will never do that though. Citizens having access to free computers is incredibly subversive. Computers have the power to wipe out entire industries, entire economies, entire countries. Computers can defeat police, judges, militaries. They do not want citizens to have unrestricted computers. The thought of citizens having access to technology such as cryptography is offensive and subversive to them. So they will never do this. They will do the opposite. They will look at the little digital fiefdoms the big techs have created for themselves and they will be inspired. They want that sort of control for themselves. And thus we keep inching towards the fabled cyberpunk hellscape that no doubt awaits us, if it's not already here.
I agree with your statement on what needs to be done, but I disagree with the above ^
Companies will always skirt around laws because the dev cycle of regulations is thousands of times slower than the dev cycle of private companies. Just take Apple's intentional malicious app store compliance in the EU as an example. They would rather spend millions in legal fees to not comply than to simply comply. This is a pessimistic view, but it literally happens all the time.
No the reason answer is choice. Making something so good and designing it around freedom and making it sexy is the way to go. Regulation is for people that think they can control human behavior with force, which rarely if ever works.
We're already going down that path right now, and we are failing miserably. The only possible result of that path is what's already happening right now. Corporations use their trillions to create nice pretty convenient gratis little digital fiefdoms where they hold all the keys, and people are only too happy to become their digital serfs. People actually see absolutely nothing wrong with sacrificing their freedom and control for security and convenience. In fact they look down on us for eschewing the conveniences of 21st century technology.
Once the monopoly is established, it is simple for them to squeeze out any non-conformers and then tighten the screws on their serfs. This post right here is just one example of the methods they will use to squeeze us out. Every post that contains the word "enshittification" is an example of them tightening the screws on their serfs. We're gonna see an infinite number of these until something is done about it.
The only way I can think of to solve this is to enshrine computing freedom into law. Somebody's gotta decide that this computer freedom stuff is right and just and moral and correct, and literally write those principles into society's code of law. And it's gotta be done without a bunch of industry lobbyists neutering the law to uselessness.
The owner of the machine is whoever bought it for his own use. That human must have absolute control over every last bit of it, lest he instead be controlled by it. A machine controlling a human being without his consent is a violation of his basic human dignity and it should be treated as such. It is his right to be in complete control and any attempt to usurp that control is violence. I've come to believe that anything short of this will fail to stop these corporations.
If a person previously could install Instagram and now they can't on Platform A, but on platform B they can it's a simple choice.
They have absolutely no trouble at all choosing B and look down on us for choosing A.
They can now just point to the developers: it's them, not us!
the point is that the word railroads you into the assumption that having an official app store is the default behaviour and installing software from elsewhere is somewhat underhanded and sneaky, which is convenient for Apple, Google and Microsoft's profit margins
If you tell someone to install Adguard, for example, then on iOS they're installing an app that gives them a Safari extension through the official mechanisms. It can block ads in Safari. But on Android they don't install it from the official store, they sideload an APK by disabling some built in system protections against unsanctioned apps. It's more hoops on Android because of the sideloading, but they get way more power (it acts as a VPN and also a HTTPS MITM cert and filters all your traffic). It can filter ads in all apps, even through HTTPS. The downside is that now all your data goes to this small ad blocking company and circumvents the billions of dollars Google's spent trying to keep your device safe. It's a meaningful difference and users should know both the risks and benefits of being able to sideload apps, just like they should understand the risks and benefits of fully rooting your phone.
the term sideload gives implicit primacy to monopolistic app stores. install does not.
we should be fighting for third party installation to be the default, not to have the scraps of some workaround that developers are less likely to work with.
for 20 years computers managed just fine with third party downloads as the default. developers favoured broad compatibility and users had more power
there are times and places for locked-down devices: children. old people. corporate devices. display models. etc.
however, this should be opt-in. with an optional app store if the OS manufacturer cares to provide one.
using the term "install" favours a world where developers make apps that you can install on your own terms. using the term "sideload" favours a world where developers make apps for an official app store.
I'm not saying stop using the word sideload, I'm just saying stop fighting for sideloading, and fight for (mobile) install rights.
For myself, as a dev, I like Android for this very reason. I don't root it anymore, but I do sideload apps. But for friends and family, I have the exact opposite advice: Not only do I tell them not to sideload anything, they also shouldn't download any no-name apps from the official app store either (especially on Android) because the chance of malware and scams is so incredibly high.
This was always a risky thing to do, even back in the Tucows/CNET Downloads days, and why Windows malware was always a problem. Normal users don't really have the technical ability to audit all the random crap that's available on the internet. Hell, most devs don't either (how many npm or apt-get packages have I audited recently...? zero).
I'm the kind of person who turns off UAC for every fresh Windows install, and if they ever lock down macOS like iOS, I'm gone. But people like us also are not typical users. I think it's actually nice that the market offers this sort of choice. Power users and devs can always choose Framework machines and build their own Linuxes. Boring ol' web devs can use standard Macs. Kids and grandmas get iPads (and honestly most adults would be fine with them) in its default locked-down state. People who really want some customizability on their phones can still use Android and either sideload or put some de-Googled distro on there.
Really, the average person doesn't need this much power and customizability either for their PC, phone, TV, car, washing machine... they're just commodity appliances to watch Game of Thrones and browse TikTok on. I think it's actually a good thing they're locked down. They don't have to worry as much about all the malware and broken configurations that were so common in the Windows 95 days.
But it's also nice, of course, that there are still niche options in the market that you can get if you really want that full bare-metal experience. Most people just don't need or care about that, and it actively hurts them by making them less safe.
In the USA, you have things like the first sale doctrine, which applies to things like books and audio recordings, but DOES NOT apply to software, especially not software that makes use of services provided by the author (as most mobile apps do). Do not expect, in general, to have a right to use a piece of software, especially a mobile app, in ways not explicitly authorized by the app's vendor. Yes, this also means video games as things you can play forever are going away. Get used to it.
users should, that's why feedback forms exist
And what these companies are doing is making the (hardware or external) functionality dependent on that copy-written computer program. So now it's impossible to modify your device without modifying software and thus breaking copyright.
Take a look at the US constitution copyright clause:
[the United States Congress shall have power] To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.
How does this use case of copyright promote the progress of science and useful arts? Copyright was clearly intended to make it temporarily difficult to publish information, not to make it impossible to modify machines.
But regardless of whether they should have that say, they empirically do seem to have it.
Which is why the solution is free software, and why the FSF has always understood the threat of hardware and encryption being used against the user rather than for them.
Maybe arbitrary programs on a phone is akin to a random .exe on Windows 95, but instead of Windows 95 it's a computing platform that a majority of human beings have in their pocket and that can provide direct or indirect access to almost all personal and financial information. I mean, you have to grant the privileges, but of course you will.
Maybe having a locked down library of programs is good, I'm just too much of a cynic to see it as anything but a power grab. On the other hand, maybe the support and legal headaches of customers "screwing themselves up" also plays a part, especially when there's a whole dark industry to trick people into screwing themselves up.
Instead, they work on mixing the data so much users can't tell what is being accessed, blocking data-redacting apps, and making sure term changes are invisible.
No, it isn't because there is already sandboxing.
>that can provide direct or indirect access to almost all personal and financial information.
Windows 95 computers also used to have web browsers and bank information. The risk has not progressed
"Side" as in "go in through the side door".
A term precipitated by the operating system locking down installation paths to The One Approved Way(tm).
This makes the apk untrusted, as it won’t be signed by the original developer anymore.
Looks like a weakening of Android ecosystem security to me.
"Select Play Partners" can block unofficial installation of their apps.
I would however agree, if this gets bundled together with other features and you get forced to enable this if you want to make use of the other stuff in the bundle, that seems more problematic. Even then you could argue that it is up to Google to decide what kind of features they want to offer and bundle together, but given the market dominance I would be more open to the point of view that they should not be allowed to do whatever they want.
EDIT: I did a quick search and to me it looks like you have to make an API call and then look at the response and decide what to do. Is there some ready-made component that you can use without getting to see the details? Otherwise it seems that you have to check appLicensingVerdict and decide to refuse to run if this comes back as UNLICENSED and I do not see how you could do this by accident. Then again, that does not sound like selected partners, that sounds like everyone can do this, so maybe I was looking at the wrong thing.
My understanding was that Android apps were quite unsecure and could be pirated and distributed by another "developer" in an app store in a different country without the original developer ever knowing.
Some software should be free. Software that is nonfree has its place as well and should be allowed to have restrictions so the developers can protect their hard work, get paid, feed their families, etc. I really am looking at this from the indie developer's perspective.
Local backups would unfortunately end up as collateral damage.