Hacker News Reader

Comment by jadbox | Hacker News Reader

You can still install apps outside the play store, but the developer does need to verify their signing information. Effectively this means that any app you install must have a paper trail to the originating developer, even if its not on the app store. On one hand, I can see the need for this to track down virus creators, but on the other, it provides Google transparency and control over side loaded app. It IS a concerning move, but currently this is far from 'killing' non-appstore apps for most of the market.

View on HN

So let's pick a random example app that might be popular on F-Droid today. Oh, I dunno...newpipe.

Given that Google both owns Android/Google Play Store and YouTube: what do you think they would do with the developer information of someone who makes an app that skirts their ad-model for YouTube?

I can't help but feel that this move is aimed specifically at ReVanced.

The "security" wording is the usual corpospeak - you can always trust "security" to mean "the security of our business model, of course, why are you asking?"

Exactly. I don't think Google is doing this so that people don't install some random FOSS alternatives through F-Droid.

Things like Newpipe seems much more of a target, especially if you want to take legal action. More so than stopping users, this gives Google fat more leverage about what Apps can exist. If they ever want to stop Newpipe a serious lawsuit against whoever signed the APK seems like an effective way to shut down the whole project. Certainly more effective then a constant battle between constraining them and them finding ways to circumvent the constraints.

Google is following the same game plan we saw when they decided that the full version of uBlock Origin (the version that is still effective on YouTube) should no longer be allowed within their browser monopoly.

The fact that there was a temporary workaround didn't change the endgame.

It's just there to boil the frog more slowly and keep you from hopping out of the pot.

It's the same game plan Microsoft used to force users to use an online Microsoft account to log onto their local computer.

Temporary workarounds are not the same thing as publicly abandoning the policy.

Curiously, for me Ublock light works just as well after I was essentially forced to switch. I could still get the original to function, but with every random chrome update, the thing would be deactivated, obviously as "insecure".

From a quick glance at /r/GooglePlayDeveloper/ it looks like Google is just as interested in killing playstore apps! It seems that they only want to support the existing larger apps now. I think they are giving a clear message to developers that its not really worth developing for that platform anymore. I think we will all agree that the playstore needed a purge but they seem to be making it impossible for any new solo devs at this point.

I have no idea what this means. How does this change "kill playstore apps"?

Not related to this particular news item, but several high-profile App developers are either killing their apps on Android entirely (like iA Writer) or removing features due to Google tightening submission requirements and increasing costs for apps that integrate with their services.

not the change mentioned in the news link. I was referring to what people are discussing over on the reddit play store sub. Google are terminating dev accounts without giving any reasons or warnings. I'm sure most, if not all terminations have have some element of justification but ultimately it means that Google seem pretty happy to terminate any dev account without letting the developer know why. And to make things worse, that developer is forever banned from ever publishing any content on the playstore for life. They cannot make a new account. Their career in android app development can be destroyed in an instant. Most terminations seem to be handled by bots... and to rub salt in the wound, Google only responds to appeals... using more bots. That is according to what the community has been saying at least. I'm sure they know what they are doing and one thing we all know is that Google actually IS big enough not to fail. But it does seem like the right thing to at least make new developers more aware of the risks. And it is obviously a very stressful time for anyone who is actually making a living off an android app.

I thought most devs didn’t want to develop on android because IOS devs made more income per user (0) and spent more on in app purchases. Android does well with ad supported apps. Paid apps have had issues with piracy also.

“In 2024, the App Store made $103.4 billion to Google Play’s $46.7 billion.”

0 https://www.businessofapps.com/data/app-data-report/

To wit, there is only one business playbook with two strategies: When you are weak, make friends. When you are strong, make war.

Android used to be weak against iPhone and needed to cooperate, so they allowed more apps in to grow the userbase. Now that they're big and strong, they don't need allies, so they start kicking out everyone who isn't making them money.

Every "enshittified" service does it - Imgur, Reddit, whatever. Everyone selling $10 bills for $9 does it. Microsoft did it. They took a step backwards by buying GitHub, when they realized they were totally blowing it on cloud. But now that they have users stuck on GitHub and VS Code, they're defecting again.

> currently this is far from 'killing' non-appstore apps for most of the market.

It means that Android is no longer suitable for my own private dev projects.

You can use GrapheneOS or LineageOS without the Google rootkit and continue installing any apps you want

Considering both Graphene and Lineage have been complaining about google making development harder and harder for how long will that be a possibility?

Play Store has an attestation API, Google could simply make it harder to run banking apps and similar if you run GrapheneOS. Something like requiring banking apps to use a stricter mode. GrapheneOS even mentions it's not easy spoofing this entirely as it change often on the FAQ page.

There's only so much you can do as a maintainer of a custom OS like Graphene before its too hard to maintain. I don't think there's enough coming in by way of donations to play catch-up.

Need legislation quick. But I suspect the EU doesn't want side loading either in the grand scheme of surveillance.

> Google could simply make it harder to run banking apps and similar if you run GrapheneOS

Thats the Banks fault then. I complained to mine and they removed the safetynet check / let you skip it.

My devices are not supported by either of those, sadly.

sure. now. why do you think google won't choose a way to destroy them in the near future?

Well with that thinking you can't use an OS by any corparation???

Its open source and thus can be forked.

If it's for your own projects, for yourself only, ADB still works without this verification.

True, although using adb requires the use of the usb port, which for some of my projects is highly impractical.

Also, with this move, Google has made it very clear that they don't want people to have any real control over their machines -- so I'm not inclined to think that using adb to work around the problem will always be possible.

It's fine, though. My hobby projects will continue into the future, just probably without using Android.

I didn't think a usb port was required since the introduction of wifi adb?

https://www.androidpolice.com/use-wireless-adb-android-phone...

I know that this is how shizuku (0) does it and it is required anyway if you want to install multi apk applications so stiff won't change for most people then?

(0): https://shizuku.rikka.app/

Ah, I didn't know this was a thing. Thank you!

It also makes it easy for google to blacklist a developer, if for example the trump administration don’t like them (the same way apple removing apps documenting ICE).

And basically every corporation with any business in the US has proven _more_ than willing to instantly capitulate to any demand made by the administration.

Pretty sure virus creators could just pick a real ID leaked by the "adult only logins" shenanigans, whereas legit app developers probably wouldn't want to commit identity fraud.

If it gets that bad; Google can do what they already do with business listings - send a letter to the physical address matching the ID, containing a code, which then must be entered into the online portal.

Do that + identity check = bans for virus makers are not easily evaded, regardless of where they live.

Can you imagine what you're suggesting for a Linux machine? It's absurd. My box my rules, I'll run any damn code I please.

Will they send letters to sanctioned countries? What about a PO box, or a remailer service?

That physical address will be useless, and probably easily worked around, in many if not most countries. Expecting Google to be able to use that address together with the law is a pretty US-centric expectation. I don't think most virus creators would be impacted, especially not the ones that are part of professional (criminal or government) organizations.

Even in the US, it won't always work. If you moved in the past few years, the address on your ID will be wrong.

Yeah... no. This is normal with desktop computers. Let's stop handholding people. If I trust the source, I trust the domain... I want to be able to install app from its source.

Googles/Apples argument would have been much stronger if their stores managed to not allow scams/malware/bad apps to their store but this is not the case. They want to have the full control without having the full responsibility. It's just powergrab.

And you are completely ignoring viruses, ransomware, keyloggers, the 50 toolbars etc that has been the staple of Windows and before that DOS for over 40 years.

Scam apps are rife in the iOS App Store. But what they can’t do easily install viruses that affect anything out of its sandbox, keyloggers, etc

Sandboxing isn't feature dependent on Apple being a big curator is it? These are orthogonal but not the same issues. I've never said that PCs don't have viruses or that it isn't a problem, only that I should be able to install software from developer I trust if I want to.

I agree let's have sandboxed app instalations on platforms. Flatpak is already going this way. But it looks like big players Microsoft,Apple and Google are gatekeeping app sandboxing behind their stores instead of allowing people/devs to use sandboxing directly.

And then there will still be complaints about Google limiting what apps can do and take away “your freedom”. What happens when a third party app wants to be able to read in other apps internal storage to create a back up solution like iCloud? Should that be allowed? What about if they want to create an app that autocompletes what you type when working in another app requiring key logger like capabilities?

What part of "I should be able to install software from developer I trust if I want to" was hard to understand?

Then you don’t want sandboxing if you want all of those permissions.

You can have sandboxing and run whatever you want. I do it every day on PCs where I, the user, can define the terms of sandboxing any appliclation I want, and not a trillion dollar corporation using sandboxes to enforce their chosen revenue streams upon users.

Yes and for you to think that is a valid argument for a consumer product is why most open source products suck for consumers and end up being about as bad as the “homermobile”.

You do realize macOS has used sandboxing by default for over a decade, right?

ChromeOS/ChromiumOS uses heavy sandboxing. Android currently uses sandboxing transparently, despite plans to iOS-ify the platform. Hell, Windows uses app isolation sandboxing these days.

All four consumer platforms let you run the software you want to and they provide sandboxing at the same time. They also let you configure sandboxes, too.

As for open source, consumer products like the Steam Deck use sandboxes, popular game launchers like Lutris use sandboxes, Firefox transparently uses sandboxing by default, as does Chromium/Chrome, anything installed automatically with Flatpak or Snap are sandboxed by default and AppArmor/SELinux works in the background automatically on most distros and are activated by default.

Saying open source projects like the Steam Deck, Firefox, Chromium, ChromiumOS and Android suck for consumers is a weird opinion, but you're free to have it.

Mac apps outside of the Mac App Store really doesn’t have any sandboxing.

And Android’s sandboxing is so bad, you always hear about the malware of the week especially outside of the Play Store.

ChromeOS also isn’t open source. And expecting end users to “configure sandboxes” you might as well not have one.

Firefox is s browser, and didn’t they tighten what third party extensions can run?

Android - or at least the version that most people use - is not “open source” by any stretch of the imagination.

> Mac apps outside of the Mac App Store really doesn’t have any sandboxing.

Apps can and do ship with sandboxing rules that will be applied at runtime.

> ChromeOS also isn’t open source. And expecting end users to “configure sandboxes” you might as well not have one.

I listed ChromeOS as one of four consumer operating systems used by billions of people that uses sandboxing, not as an open source OS.

Notice how I did use ChromiumOS when referring to open source software, along with Chromium.

> And expecting end users to “configure sandboxes” you might as well not have one.

Who said anything about expecting users to do that? I just mentioned that you could configure them if you wanted to, like I said in my GP.

Again, my point is that these are consumer products that billions of people use everyday that use sandboxing by default, yet somehow not even having to think about sandboxing is too onerous for end users?

> Firefox is s browser, and didn’t they tighten what third party extensions can run?

Yes, it is open source consumer software that does sandboxing by default without the user having to think about it.

> Android - or at least the version that most people use - is not “open source” by any stretch of the imagination.

AOSP is very much open source

> Apps can and do ship with sandboxing rules that will be applied at runtime.

Hardly any apps outside of the Mac App Store voluntarily opt in for sandboxing

> I listed ChromeOS as one of four consumer operating systems used by billions of people that uses sandboxing, not as an open source OS.

And also locked down…

> AOSP is very much open source

Calling AOSP open source when it’s almost useless to most consumers without the proprietary bits from Google is just as disingenuous as calling iOS open source because Darwin is open source.

Sure I do. I sandbox what I want when I want.

So now you are expecting users to navigate hundreds of permissions and know the consequences of each one? How did that work out for Vista?

Yes, if you bother with the rigmarole of escaping walled garden then you should be expected to navigate 20-30 permissions, which is in practice all that's necessary.

If users without that level of technical skill are pressured into making those decisions, that's because they're being mistreated.

“Besides that, how was the play Mrs. Lincoln?”

Nah it's really not that bad.

The toolbars don’t just magically appear there. They are the product of a technically illiterate user.

Yes because technically literate users shouldn’t have trusted mainstream companies to not install bundle ware back in the Day? They shouldn’t have trusted Zoom not to install a web server on Macs surreptitiously that caused a vulnerability? They shouldn’t have searched Google for printer drivers not knowing that it was a fake printer driver? They shouldn’t have trusted Facebook when they installed VPN software that tracked all of their traffic from any app?

Is that really your answer? To make the phone ecosystem as fraught as Windows PCs for the average user? How is they worked out for PC users since the 80s?

How is they worked out for PC users since the 80s?

Just to be clear, are you claiming that we would be better off if PC hardware and OS vendors had the level of control that smartphone vendors do today?

For almost every user - yes. If apps had to run in a strict sandbox it would be better for most users. Where it would make you jump through an incredible number of hoops or even install “developer editions” of operating systems.

You really can’t trust developers to do the right thing - even major developers like Zoom (the secret web server) , Facebook (the VPN that trashed usage actoss apps on iOS) and Google (convincing consumers to install corporate certificates to track usages on iOS).

Even more to the point, you read about some app installed outside of the Google Play store that’s malware - including the official side loaded version of FortNite…

https://blog.checkpoint.com/research/fortnite-vulnerability-...

I appreciate your response even though I strongly disagree.

You really can’t trust developers to do the right thing

Indeed not, and that includes OS developers. Imagine if Microsoft had been able to block web browsers other than IE in the name of "security".

Well, you have to trust the operating system vendor.

In this case, I’ll much rather trust F-Droid maintainers than Google.

Technically illiterate users should leave the default security settings enabled.

In the modern day, I actually think this mostly works? Are you aware of instances where normies installed Windows malware because they purposefully disabled Windows Defender?

Everyone always talks about the "Dancing Bunnies Problem" but I'm not convinced it's actually a thing.

You mean like all of the ransomware that is being reported on a monthly basis? My mom looked for a printer driver by searching on Google and installed some type of crap that wasn’t the official driver. She is 80. But she has actively been using computers since we had an Apple //e in the house in 1986.

On the Mac, people installed Zoom and it installed a backdoor web server.

I'm explicitly only talking about ransomware that requires disabling Windows Defender.

Please install an ad blocker on your mom's computer, if you haven't already. Not every fake driver etc gets blocked by an ad blocker, but the majority do.

The fake printer driver came up in the organic results…

The default security settings only got to be the way they are after more than a decade of exploited windows xp machines breaking the whole internet.

You are missing the part where the OS provider is the virus and keylogger. Unless of course you feel it reasonable that google and apple datamine everything you type via their software keyboard[0] or reading the contents of your notifications via play services[1].

0 - https://discuss.grapheneos.org/d/16046-google-keyboard-w-net... 1 - https://discuss.privacyguides.net/t/sandboxed-google-play-pr...

You mean if you run an OS made by a company whose whole profit model is based on tracking users so they can advertise to you is invading your privacy?

It's normal for Windows and *nix, not for modern macOS which has big limitations on unsigned apps requiring command line and control panel shenanigans.

> need for this to track down virus creators

I think they’re just going to track down a random person in a random country who put their name down in exchange for a modest sum of money. That’s if there’s even a real person at the other end. Do you really think that malware creators will stumble on this?

This has to be about controlling apps that are inconvenient to Google. Those that are used to bypass Google’s control and hits their ad revenue or data collection efforts.

It's killing F-Droid, which is the only place I want to sideload from.

It makes sense for average users to have identifiable traceability.

Developers, and power users often pre-date these kinds of smartphones.

Reply on news.ycombinator.com