Hacker News Reader

> You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).

This is about users freedom to install apps on the devices they own.

> non-google-certified android builds/installs

Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).

> Do you guys understand that people's lives are being ruined by malware?

Do you have figures to back that up? There are already multiple warnings when sideload apps.

> For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example.

Drivers and applications are not the same things.

I don't have figures to back that up, but I did read some figures on posts regarding this. my comment was based on real-life compromises observed.

Drivers and applications are not the same thing, certainly and no application is the same as other applications. browsers aren't the same as file managers. To users what matters is impact not category. A persons entire life can be destroyed because of one side-loaded app, much less so with a windows rootkit (because you don't have phone number/2fa app,etc.. on your windows box).

Users are free to buy devices that let them install any app. Google is responsible for the majority of users who don't care about installing apps from anonymous randos, but care much much more about their livelihoods and well being suffering at the hands of criminals!

> Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).

Ok, then let's talk about that, I'm all for sticking it to Google for all that b.s., but not for the topic at hand.

I have a lot of third party apps and none of them are by 'anonymous' developers. Presenting the situation as if everyone is exposed to 'anonymous' apps and Google is here to save you is misleading and fear‑mongering.

Then what's the problem here? If they're not anonymous, what do they lose that's so valuable that it is worth endangering the unsuspecting public over?

It really, really sucks to be tricked into installing malware, and I have sympathy for the victims. But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.

We just have to educate people better about how to protect themselves online, not resort to paternalistic control regimes which just happens to give one of the largest tech giants the power to also crush anything that it sees as a threat to their business model.

> But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.

Maybe that's the disconnect here, because i don't think you/others lack empathy for regular people being victimized. You're incorrect about that figure, the people being actually impacted (not merely compromised but harmed, as in financial loss, job loss, harassment, or worse) is many times more than people who want to sideload apps.

Educating people doesn't work. We've been doing it with phishing for decades now , and it has no impact. in the moment, you're sure it's legitimate, so you won't look for obvious signs of phishiness.They use a lure to establish trust in the context, so you guards are down. Absolutely anyone can fall for deceptive lures. No amount of education changes that. You know what made a difference with phishing? Trust senders, DKIM/SPF validation, url-rewriting with sandbox detonation and global-scale reputation analysis/response (it means as soon as you hit one person, your domain/infra gets burned globally) ,etc..

It really frustrates me to no end, because it is the exact audience on HN that innovate and create software/apps but the level of ignorance on this subject is atrocious. I know you guys care as much as I do when people get hurt! It's just a case of knowing a lot about one domain and assuming you also know a lot about a related domain I think.

Even if I'm in the minority it still doesn't justify it. I'm sorry, it sucks, but I don't hold this position because I lack knowledge, I hold it because I think giving up freedom to control our own devices is too much, even if it means people will get hurt. I also perfectly understand how cameras in every home will prevent so much domestic abuse and crime, but I am still against it. Not because I don't understand how many people are victim to these things, but because I think the intrusion on ME is too much.

But we're not talking about your devices, so long as you have alternatives. and Apple has this policy already. But unlike apple, you can use non-google-certified builds just fine and do whatever you want.

Also, how about not using android or iphones at all, support a FOSS phone with 100% control over it? This is a private business selling services to the public, taking measures to protect the public. You or anyone else has no entitlement or rights over how they provide that service. The right you have is to not spend your money on that business. Getting a phone that doesn't give you root on it to begin with is submitting to Google's (and vendor's) authority to arbitrarily decide what gets and doesn't get installed on your device.

I AM using GrapheneOS, but its future is also uncertain as Google has gutted AOSP. There aren't really any alternatives, and the problem is that phones are much more than just phones now, they are general purpose computing devices and run many applications that are pretty essential to modern society, such as ticket apps for public transport, government identity apps, payment apps and so on. In my country, Denmark, we are getting mandatory age verification next year, and it looks like it's going to be offered only as an app. These apps are simply not available for non-AOSP Linux phones, and there is little hope that they'll ever be.

Owning a smartphone is becoming less of a choice, and it's becoming harder to own one that respects my freedom. I don't think it is entitlement to demand freedom in an ecosystem that I feel I am forced into.

I say let's fight against smartphone usage being required everywhere. I don't care if the phone is FOSS or not, we still should be allowed to not have a personal tracking device. I am also all for supporting a fork of AOSP. The EU talks big on not depending on US tech companies, it even funds lots of FOSS projects, this should be on top of their list.

The fact that your country is getting age verification, given how democratic and free Denmark is should tell you the prevailing view of the public on the subject matter. Why not focus on what everyone will support - which is being free from tech companies and closed code systems. The 99% of people that do pay for phones, don't think about technology much, they don't even know what sideloading is let along care about it. You/HN is an extreme minority in that aspect, as are android devs. and there are definitely more people being adversely impacted by sideloaded malware. Freedom that is not practical is just wishful thinking. Freedom that ignores the harm caused on others is tyranny by any other name.

I am also doing my part on fighting that, but it is an uphill battle. I will not stop fighting, and I am actively trying to bring my point into the public discourse in my country and organize myself in organizations that fight this.

Until we have laws that guarantee that I won't be forced to be a Google customer, I will demand freedom over my device if I am practically prevented from running an alternative OS because I risk getting my access to the rest of society limited. If it means that some people will be more vulnerable to scams in the mean time, that is not my fault, but the fault of politicians who have failed to secure our right to digital autonomy and our right to remain analog. I also think there should be other technical measures that could mitigate these scams that would not be as draconic, but I don't know enough about what scams you have in mind that I can offer concrete alternatives.

I do not think that is tyranny, but I think Google is definitely being a tyrant and misuse their market position.

I think two things can be true. I agree with most of what you said. I think Google is doing the right thing with the right intent, but they shouldn't be the sole arbiter of who can write apps. It should be similar to the PKI/CA ecosystem, or better yet, governments can directly issue permits of some sort and they could be the CA's.

Agreed. What Google is doing is practically inserting themselves as the only CA in this domain. They, a private company, effectively take on the role of policing the digital infrastructure of many countries, but without being a democratically controlled agency. That makes me very very uneasy.

But to be fair, they are doing that with browsers as part of the CA/B forum/group. If google doesn't like your CA, you can't be a CA.

Also a problem, but at least the power is decentralized for now. Also, browsers are not operating systems, and it is easier to switch to another browser if you don't agree with its list of trusted CAs.

All valid points, except no CA can survive when Chrome isn't supporting them. Most users won't switch browsers because one site isn't compatible with Chrome, they're more likely to just use another site. So using that CA costs site owners customers and they in turn will move away from the CA.

My point sort of being, there is a deeper problem where industries self-police. People complain about oligarchies, ruling classes and corporations running America but at the same time they don't push for or support governments regulating things like this. Governments should be the arbiters of which CA is legitimate, just as which appstore and which app developer. If you want to treat patients, sell drugs, build bridges, sell cars,etc.. you give your id to the government and validate your credentials. App development as well as all other public safety impacting credential validation should be the same way.

If you're in europe, your local government does the validation and OSes like Android will respect the CA's of the country they're operating under. Software should obey laws. And if governments can't be trusted, that isn't a software problem but a political one.

Requiring ID won't stop scams.

Often bank scams rely on sending money to another account (obviously registered with an ID), and then being drained at ATM. The account is going to be registered on a drop or another victim. Sure, it's burned after that, but as long as it's an insignificant cost, scamming is still profitable.

The same situation with malware, bad actors are incentivized to put effort into bypassing this, so dev accounts will be registered on random homeless people, stolen IDs, or just fake IDs. While normal developers will choose to give away IDs.

And as always, it starts with 'protect the children/elderly/vulnerable', then that authoritarian country requires Google to give away info on every developer to operate legally, then it's UK and other 'democracies', then you can't run your code on your device without the government approval.

Yeah, and then we should also maybe install spyware on everybody's phones, so the government can scan our phones for child porn, because people are using phones to share child porn you know, and that is bad you know.

And if we're at it, we should maybe also put camera's and microphones in everybody's houses so we can see what everyone's doing all the time, because many children are being hurt in houses you know.

But don't worry, if you don't want all of this you can just get this degoogled phone just around the corner and it works perfect you know, because everybody is using them and there's a big market for it and it's very easy to use.

Or maybe not

I can't tell if your argument is a slipper-slope fallacy or a straw-man argument, has to be one or both.

When you sell physical goods, you have to have a business license right? To a small group of people you know, nobody cares. But to mass market goods or services, you need to give the government your id, and they need to be able to hold you accountable, in the event you decide to break the law and/or harm the public.

I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers. Although, they sort of already verify identify, just not using a formal/official way.

You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege.

You can speak with a loud microrphone in public anonymously, but if you want to arrange a protest, you must give your id for the approval. If you want to start a radio or tv station, you must give up your id for the FCC license,etc... software isn't special.

Not all software is sold as part of a business. Free software is one such example. So this comparison is inappropriate.

>I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers.

There should be massive burdens and surveillance on linux and free software maintainers, because ???. I guess it's just too easy for them, so they should be shoeboxed into a business model for developing software whether they like it or not.

>You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege.

This is just some nonsense platitude, not unlike the canadian idea of "freedom of expression". "You have the right to a completely weak and useless form of speech because I say so"

>but if you want to arrange a protest, you must give your id for the approval.

What are you yapping about old man? We have the right to assemble. There is limited radio and TV is regulated only because there is limited bandwidth.

Software is special because it is just information and Information Wants To Be Free.

You are making the argument here that because some old forms of information distribution are regulated due to technical restraints, that all forms of information should be highly regulated.

Software is just information, as I stated earlier. It could be encoded into any information medium, for example a book. So why not regulate software in the same way that books are regulated, which provides strong free speech protections?

Right, we have an online community where we share some cool software that we wrote for each other, and then suddenly we need to show our IDs because of "safety".

You are falling for the trap that all these wannabe dictators are setting up for us: that they are protecting us with all these regulations. Oh sure it protects some people in some ways, but you're not seeing how you're giving away your freedom and put them in control of your life.

I think it's just that certified Google devices are no longer usable for your much smaller use case, because Google prioritized their much larger customers who suffer from harm. Freedom vs security is not the argument here, because there is no expectation of Freedom when it comes to a private business. If you ask me, software licensing and copyrights should entirely be torn down. If google is a monopoly and they are forcing this measure, it might qualify for an anti-trust suit by governments. But if they aren't a monopoly (cooperhead,lineage,etc..) then you should use other options and ditch certified google devices.

I say all of you should give up and use iphones like me! :)

So I assume then you would also be completely obedient when the government or companies wants instant access to all your data all the time, because of safety you know. Just because there are a few of these stupid rebels, the whole world shouldn't be an unsafer place right? And of course they are not gonna misuse this power, why so suspicious? It's all silly conspiracy theories. Big tech and the government are here to protect us!

People change their tune extremely quickly when you ask them to show you their phone, ask them for the password and let you look through it to make sure you don't have anything bad on it. Every single message, every single app and every single social media. This is the world we are heading towards if we don't take a stand now, except instead of me checking your phone it will be the government and Google.

I agree, people here have no empathy to less technical users. Peoples' lives being ruined is not a hyperbole. You have people losing their life savings due to pig-butchering scams and such. And people here think their convenience and desire to publish apps anonymously outweighs this?

It's less about saving the concept of anonymous development, more about the tightening grip that the big three companies, Apple, Google and Microsoft (they're making their own moves in the same direction) have on home and personal computing. We would be giving up a lot; this would effectively kill any open source computing products from ever becoming viable. Platforms become fiefdoms, they become shit to use because there's no other choice and can never be. Any app that runs counter to the desires of the parent of the platform can be killed and it becomes impossible to build a competitive ecosystem because the chicken & egg software problem, something which open ecosystems can solve through compatibility laters, but that becomes unviable thanks to DRM and hardware integrity lockouts.

It's a nightmare scenario, our lives locked in to total corporate control. What do we get in return for that? Scammers won't be stopped by this, the key to grifting isn't technology but people. What you're suggesting is trading open platforms and open source and fortifying current marketplace monopolies for a marginal decrease in scams. For a while. Maybe. I suggest that is unbelievably stupid.

How does it kill open source products? The only thing required is for open source contributor who is responsible for publishing .apk to present their ID.

You are requiring users to submit their ID to the government whenever they want to modify a program

This gives Google (and inherently, the US government) the power to unilaterally remove any application from every Android phone on the planet. I don't trust them with that capability and neither should anyone else with an ounce of sense.

Maybe the EU and other parties should fund an open source fork of Android? People who don't want these big companies to control their devices can use that instead.

Yes, I do think the benefits of free speech outweigh risks from criminals who will publish bad software

There's many ways to combat crime. Banning free distribution of software is one of the options but not the one I'd pick from the menu first

You're still freely publishing any apps you want. You want anonymous speech which isn't the same as free speech. And the benefits of that certainly doesn't outweigh harm caused against even one innocent person.

"There's many ways to combat crime" - name one effective way to combat sideloading of apps, that is anywhere as effective as id verification of devs?

Here's one: prosecuting the devs that currently spread malware, block (or warn users for) foreign sources that don't cooperate with law enforcement

You don't need an ID to find the person behind an IP address + timestamp. The line physically goes to a subscriber (yes, also with CGNAT: ISPs are required to keep logs for a reason). The police can do that in any country. Google isn't an elected government that I want to sit on that seat of power

Besides, criminals by definition don't care about laws. Photoediting an ID is not particularly hard, but quite illegal. Tackling the source (the person) ought to help more than impacting everyone who uses a specific distribution mechanism

The devs that write malware are typically in a different jurisdiction, and how can you prosecute them if they're anonymous? That's what this measure does!

The moment they use IPs to find devs and prosecute them , every malware dev will just use a vpn or Tor. or just use a compromised device to route their connection. This is a long running cat and mouse game.

Criminals care about laws if breaking the law is difficult, because laws have consequences. ID verification isn't as simple as "hey, it's an ID, all is good", and now you're on the hook for the much more serious crime of faking IDs and defrauding. It doesn't need to prevent all criminals, it just needs to be a good enough measure that it reduces the amount of abuse significantly.

There is no need to regulate anonymous speech if you uphold the principle of free speech. The only reason why you want to de-anonymize speech is to apply consequences for some forms of speech.

You are free publish source code for your app. You are free to publish unsigned .apk and people who want it will find a way to install it. Once app is installed it's more than a speech: it's a potentially hazardous product. The analogy is how chemists are free to publish formula for any pharmaceutical but are not free to put pharmaceuticals on the market without approval.

That is a totally inappropriate comparison. Knowing the chemical formula for cocaine does not give me access to cocaine. Whereas access to the source code of a program nessisarially gives you access to the program.

In one case, it is efficacious to restrict the product without restricting the information. In the other case it is not.

some people will move heaven and earth to stop the inevitable process of natural selection

Company details, sure. But personal details?!