Hacker News Reader

Comment by blindriver | Hacker News Reader

99% of malware with real world consequences of people losing much or all of their money is from unverified developers.

This is a step in the right direction to keep people safe in my opinion. Most people around the world don’t understand the risks.

View on HN

Having a trustworthy channel for verified app loading is a vital security tool. F-Droid is such a channel; the Google Play Store is not. F-Droid inspects the source code of the applications they build, removes malware and other antifeatures from them, and compiles them from source to ensure that the binaries they deliver correspond to the source code they've inspected. The Google Play Store doesn't do any of those things. Consequently it's full of malware.

The topic here is Google nuking F-Droid from orbit, probably because it has NewPipe.

I'm not sure about the NewPipe angle, as Grey Jay exists (Backed by FUTO/Louis Rossman) on the Play store, which has ad-block and sponsor block incorporated into it. Google is just being malicious towards opensource and privacy, under the guise of security

Not neccesarily a guise of security, but perhaps a different means of security. E.g. securing stock investments, profits, monies, etc. Nothing is 100% secure, you can't be in the void and still call it a void, etc

"NewPipe" I use "PipePipe", which does less stracktraces.

99% of all malware with real world consequences is caused by unverified developers, ergo, all unverified developers should be removed from app stores.

99% of all car accidents with real world consequences are caused by licensed human drivers, ergo, all licensed human drivers should be removed from roads.

Same argument. It's true, and simultaneously, it skips right past all of the ramifications of the proposal, even when the ramifications conceivably result in more harm than the original problem did.

https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_...

AFAIK most of the victims actually fall for social engineering in combination with legit apps. If you force developer registration criminals will simply find other attack vectors.

You are restricting a fundamental digital right in exchange for a minuscule reduction in risk.

That's rich knowing that both Apple and Google get most of their store money from dubious casino like games which I'm uncomfortable giving to my family.

Before they are allowed to make any comment on scams, they should clean up their own store first.

The malware boogeyman is really paying off tangibly for Google. They've got actual fans of their profit-motivated paternalism.

Anyone who has lived through the windows PC era knows it's a legitimate problem. Google has tons of data to show malware exists for Android as well. Being able to prevent that malware from affecting the lives of Android users is a moral imperative for Google. I understand why folks are skeptical, but it's worth trying to dig into the fact rather than just react blindly.

To the extent that this is true, the lesson is very much not that Microsoft should have had total control over what users were allowed to run.

The ability to 'sideload' is already off by default, and warns you before turning it on. Maybe just a bigger or sterner warning? I mean there's only so much you can do there...

This won't be true for much longer iiuc. Look at the outcomes of the Epic lawsuit. That's probably why Google is changing how they tackle this problem.

When was the last time you read articles about malware in F-droid? When was the last time you read articles about malware in the play store?

What those "people-who-don't-understand-the-risks" will do then, with more money left? I think they will give their money to all sorts of political populists, who will cause danger not only to themselves, but everyone.

Akshually 99% of malware with real world consequences comes preinstalled on your phone.

YOU should be kept safe.

A ton of malware is pushed through Google's adsense network, which already requires some level of verification afaik. It doesn't stop jack shit. You are naive if you think more verification is somehow going to stop this.

Reply on news.ycombinator.com