Hacker News Reader

Comment by tadfisher | Hacker News Reader

Just to put out what Google actually said in their blog post [0]:

> We appreciate the community's engagement and have heard the early feedback – specifically from students and hobbyists who need an accessible path to learn, and from power users who are more comfortable with security risks. We are making changes to address the needs of both groups.

> We heard from developers who were concerned about the barrier to entry when building apps intended only for a small group, like family or friends. We are using your input to shape a dedicated account type for students and hobbyists. This will allow you to distribute your creations to a limited number of devices without going through the full verification requirements.

> Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands. We are gathering early feedback on the design of this feature now and will share more details in the coming months.

It is also true that they have not updated their developer documentation site and still assert that developer verification will be "required" in September 2026 [1]. Which might be true by some nonsensical definition of "required" if installing unverified apps requires an "advanced flow", but let's not give too much benefit of the doubt here.

0: https://android-developers.googleblog.com/2025/11/android-de...

1: https://developer.android.com/developer-verification

View on HN

In classic Google fashion, they hear the complaint, pretend that it's about something else, and give a half baked solution to that different problem that was not the actual issue. Any solution that disadvantages F-Droid compared to the less trustworthy Google Play is a problem.

Even restricting the mitigation to "students and hobbyists" is bad.

I should have the right to have parents, friends or anyone use a "free" store that is not under control of Google if the user and app developer wish so. But also, somehow there should be something done to avoid the monopoly forcing to use the Google services. Like major institutions like bank, gov and co being forced to provide alternatives like a webapp when they provide app tied to the Google play store.

> I should have the right to […] use a "free" store that is not under control of Google

Yes, but we also need to stop thinking like we’re trying to please the ghost of Steve Jobs. There is no ”store”. There are installers. You distribute them how you see fit, probably through the web.

These ”alternative stores” angle is a controlled dissent corporate plan B, much like how recycling was propped up by the fossil fuel industry.

We deserve web installs without deep settings menu configurations, scare walls, or onerous processes.

The EU and every other nation with digital sovereignty concerns need to make this happen to both Apple and Google.

These are our devices. The giants are camping.

But unfortunately, it turns out that some people you interact with aren't actually your friend. That guy that seems totally legit and just wants your sister to install his fun little game/app that he wrote is actually trying to get her to install an app that's going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course.

By default their app cannot though because Android uses proper sandboxing and gated API access. So you actually have to give the app location access, access to your messages and access to your photos.

Well, unless you use one of the many crappy Android devices that never get security updates, are running old kernels, old vendor security patch levels, miss all Android security patches, except applying the backported security bulletins every three months (1-2 months late). Yet, Google is happy to certify them as Android devices.

It was never about security, it is about control. If it was about security, they would have revoked the GMS licenses of pretty much every vendor outside Google themselves and maaaaybe Samsung, until vendors actually started caring about security. If it was about security, there would not be as many scam apps in the Play Store itself.

Back to your sister, the proper solution is to educate her (and everyone else) not to give apps unfettered access when they ask you to, plus let Google implement more security measures that systems like GrapheneOS already have (contact scopes, sensor permissions, network access permissions, etc.).

  > Well, unless you use one of the many crappy Android devices that never get security updates

You mean those crappy devices that let me record my phone calls and let the voice recorder continue recording the lecture even when the screen is locked?

The tricky bit with that is it would get a monopoly lawsuit from manufacturers with a lot more money to throw around quickly. The biggest problem in improving android security posture is getting manufacturers to have robust security and release updates without getting monopoly lawsuits.

It also doesn't help that mobile carriers can delay updates for months. Thanks T-Mobile.

It also doesn't help that "robust security" often is the problem in the first place.

People forget to ask the most important question: security for whom, and from what.

>going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course.

The guy's name? Google. ;-)

Actually, what Google does is totally legit because they pester you constantly about "sharing your location/photos/installing Gemini" until you accidentally press yes, and they can say they have your consent. So they are actually the good guys.

I concur, and find it abhorrent. And wish more people would kick up a stink about this. We need a publication or channel that talks about rights like this. I don't know of any that do a decent job. I donate to my local best option.

As opposed to the Play Store where you search for "ChatGPT" and end up on a scam app which read all your messages and copy all your photos?

And that example isn't random, I just tried and the first result for me is a counterfeit app with the logo of chatgpt copied .

> That guy that seems totally legit and just wants your sister to install his fun little game/app that he wrote is actually trying to get her to install an app that's going to track your location and read all your messages and copy all your photos.

Is "that guy" in the room with us right now?

No. Thankfully the FBI caught them and they're in prison now.

So, what you're saying is that Google should work on better privacy controls. Right? Right???

Let's ban passwords because you could give me your password

Hilarious example to use, because that literally is an effort that’s underway.

Thousands of people get scammed and have their lives ruined every year, so deprecating passwords is absolutely the right move

Yeah, no. The actual solution is

1. Stop requiring computers/phones for everything. Your 91 year old grandma isn't going to make her way through your super cool very intuitive 2FA magic link email confirmation system, and I don't WANT to make my way through your super cool very intuitive 2FA magic link email confirmation system.

2. teach the people who need to use computers, how to use them.

I never said anything about 2FA magic links? We can do much, much better via things like FaceID integrated passkeys, and probably further steps from there.

> Stop requiring computers/phones for everything.

Ah yes, that sounds straight forward. Let us know when you’ve deployed that to prod.

That's why passkeys were introduced. Can not fish them

Which is a problem because someone you need to.

The industry still doesn't understand the concept of delegation of authority and the fundamental role it plays in everyday life.

It also doesn't understand the idea of people making mistakes and the need to have robust recovery paths either.

yes it is like the a problem because someone you need to. The industry still doesn't understand the concept of delegation of authority and the fundamental role it plays in everyday life.

It also doesn't understand the idea of people making mistakes and the need to have robust recovery paths either.

Forced "Log in with a magic link!" wants to say hello

I'm far from a Google apologist, but at the end of the day don't they have the right to write software however they want it? You have the right to build things the way you want to, fork Android, etc etc. If you're trying to say you have the right to tell Google what the code their employees write can do, well, I don't really agree with that. Sounds coercive, honestly. I wouldn't want them to do that to you and I don't want you to do that to them.

Does a business have right to produce whatever it wishes even if it affects the environment ?

Does a business have right to pay literal pennies per hour if it manages to find people willing to work at that pay ?

Does a business have right to lace food products with addictive substances for repeat customers and profit ?

All these cases are already happening today at some level depending on who you ask. But they don’t tilt to extremes because we have laws in place to maintain balance between business needs and collective good.

This move by Google will tilt that balance forever towards absolute duopoly in mobile computing space. It is time for legislation to avoid that.

Yes they do, unless it limits my right tondo whatever I want we software I bought.

And also monopoly.

This is exactly the thing for which Apple gets bashing. Closed garden.

No they don't. They couldn't legally write software to hack into the Pentagon and launch nukes at North Korea. They couldn't legally write software that live streams your camera to them without your actual consent.

No, Google does not have the right. If you're building roads, you don't have a right to build them unsafely. Doesn't matter if they're privatized or not; they're important infrastructure for which we don't have meaningful alternatives.

> I'm far from a Google apologist, but at the end of the day don't they have the right to write software however they want it?

Not after creating de facto duopoly.

It is little surprising a lot of smart people somehow miss this simple logic.

Android is massive and extremely popular and I know several people who have been scammed already. It is important that Google makes this harder for scammers.

Google is not doing this to harm developers but to protect their users.

You already get a pretty scary warning when you try to install an app that was downloaded outside the Play Store. If people still install malware, that's the responsibility that comes with freedom. Your line of reasoning can be applied everywhere in life - people should not be able to do their own bank transfers or use a credit card, I know several people that who have been scammed already.

Moreover, there are better ways to protect against malware: 1. educate people; 2. rather than using whitelisting, use blacklisting (similar to XProtect on macOS).

Finally, the argument is not very strong on Google's side, since the Play Store itself has had its history of scams. Which, again is easier to protect against by educating people. No, don't put your banking information in a random app you downloaded from the Play Store (use the app that your bank tells you to). Do not install random keyboards from the Play Store. Etc.

> that's the responsibility that comes with freedom

We live in a dark age where the majority of people would gladly give their freedom so the don't have to be responsible.

> It is little surprising a lot of smart people somehow miss this simple logic.

Is it that people "somehow miss this simple logic", or is it that they weigh security and freedom differently than you?

This is "think of the children/grandma" logic. There is a different between maintaining a company store where everything is verified, and forcing everyone to use it.

Google shouldn't be able to hold a vertical monopoly, on what apps can run, what os's are allowed and what hardware can be used on devices that run Android, rest solely on this weak excuse that someone might harm grandma.

Oh, and of course, if grandma gets scammed by a app in the Google store, Google isn't in any way held responsible. Such garbage, two-faced bs.

That argument falls apart when you consider that:

1. The ownership of security can be entrusted with the user. For example, if the user wants to install a 3rd party app store that doesn't use developer registration, they should be able to do so. The consequences of that decision should be on the owner. FDroid is one such app store. But I trust it over play store any day.

2. Careless users can be prevented from making such decisions, and capable users can be prevented from making mistakes, by careful UI designs that provide copious warnings and require deliberate actions. We have plenty of examples for both. An example for a system that prevents mistakes with warnings is the certificate trust override in browsers. They allow you to override rejection of untrustworthy certificates, but not before you read a lengthy warning message and click a couple of buttons. Similarly, an example of a deliberate action is when you want a repo to be deleted on github or gitlab. They force you to type in the repo name as confirmation. Not only does it take multiple key strokes, it forces you to review what you're actually deleting.

> Google is not doing this to harm developers but to protect their users.

No. Google is doing this to satisfy their insatiable appetite for profit growth by squeezing their current revenue streams. This protects no one, but their shareholders and top executives. I'm a bit ashamed to have to explain this on HN.

> I'm a bit ashamed to have to explain this on HN.

Don't be. Like it or not, this is a site run by venture capitalists and populated most heavily by software engineers, both of which have historically been treated well by capitalism.

Although it's improved in recent years, I've noticed there's still a lot of corporate bootlickers on this site.

Yes, it saddens me too.

I think you're getting downvoted because of your slightly strong language. Well! We will know that soon, based on how this post fares! The problem I find is that some people argue on the basis of outright weird logic, while neglecting the obvious. I really can't tell if they're talking on behalf of someone else's commercial interests, or if they really believe what they say.

You're probably right about why I'm getting downvoted. But, you know, in my honest opinion, those people are just further demonstrating my point. They're probably actually paid well, or at least are afraid to badmouth the hand that feeds them.

But people need to realize that most of the population aren't treated well or paid well. Most of us don't have the luxury of being SWEs, or even white-collar workers for that matter. Most of us struggle to even put food on the table and have to scrounge week to week, let alone month to month.

So, I'm not bothered by the bootlickers downvoting me. At best, they're fooling themselves; at worst, they're class traitors.

If you ask me, the time for tactful language is long over.

> But people need to realize that most of the population aren't treated well or paid well. Most of us don't have the luxury of being SWEs, or even white-collar workers for that matter. Most of us struggle to even put food on the table and have to scrounge week to week, let alone month to month.

> If you ask me, the time for tactful language is long over.

Sadly, I reached the same conclusion a while ago. Subtlety seems to have lost all value and too much is at stake to keep on appealing to everyone's sensibility.

I think you've omitted the next section, which seems more relevant. It seems like they will still allow installs, just hide it behind some scare text. Seems reasonable?

> It seems like they will still allow installs, just hide it behind some scare text.

This was already the case for enabling sideloading at system level: it warned you. Nobody really says having this toggle is a bad thing, basically the user shouldn't get an ad network installing apk's just browsing around the web without their informed consent (and android has been found to be vulnerable to popunder style confirmations in the past).

They also already had the PlayProtect scanning thing that scans sideloaded APK's for known malware and removes it. People already found this problematic since what's to stop them pulling off apps they just don't like, and no idea what if any telemetry it sends back about what you have installed. There have been a handful of cases where it proved beneficial pulling off botnet stuff.

Finally, they also have an additional permission per-application that needs to be enabled to install APK's. This stops a sketchy app from installing an APK again without user consent to install APK's.

The question is: How many other hurdles are going to be put in place? Are you going to have to do a KYC with Google and ping them for every single thing you want to install? Do you see how this gets to be a problem?

The whole point of TFA, if you read it, is that they SAID they would do that, but there has since been ZERO evidence that they actually will. This feature is not present in anything they have released since that statement.

On the other hand, blocking installation of non-notarized apps is not present in anything they released since that statement either, as far as I know.

It's already implemented in 36.1:

https://developer.android.com/sdk/api_diff/36.1/changes/andr...()

The API is implemented in 36.1, but the previously proposed notarization requirement is not enforced in any production build, so this error is never thrown. Even if they implement the scare text, this API will still be needed.

If they implement what they said they would implement after the uproar, users will be better off. Previously, if a company wanted to distribute their app on their website, any user who installed it would have to dismiss scare text. Now, they have a way to distribute apps on their website without the scare text, and people who want to distribute apps without any tracking can still do that with the scare text.

It would be foolish to depend on that & far harder to get ridd of it if they put it in place. There needs to be clear statement and verification method to make sure they really are backtracking.

Anything else won't do.

Why is it reasonable that installing software is behind an "advanced flow" what ever that means? I find it not very reasonable at all that the only way to install software on my phone is by jumping through hoops. I don't think it reasonable that the Play Store is the only portal. I don't even find it reasonable to call installing software "sideloading". Downloading and installing software from a vendor's page has been the norm for decades before smart phones came along but all of a sudden when it is on a small screen the user can not be trusted? That's ridiculous and not at all reasonable.

It's not the screen size, it's the demographic shift. By 2000, only half of U.S. households had a shared living room PC, mostly for work and/or games. Everybody having a phone in their pocket later was a change that we did very much have to account for. Non-technical people can be scammed very easily into life-ruining mistakes with a little social engineering and a little bit of access to powerful tools already on their devices.

I remember when big sites started having to put big banners in your browser console warning you that if you weren't a dev and someone told you to paste something there, you had been scammed, and not to do it. They had to do that because the average Facebook user could be tricked very easily by promises of free FarmVille items or the opportunity to hack someone else's account, and those are fairly low stakes bait. Now people bank with real money on their phones.

> Now people bank with real money on their phones.

Maybe the real solution here is not to. Pay cash when you can (better privacy), else use a credit card. Other types of "banking" such as sending wires is best done on a big screen anyway. The idea that everything can and should be done on a phone is terribly misguided.

And yet the Play Store and App Store are the largest vectors of scams and malware out there, to the tune of billions of dollars a year.

We should be prioritizing securing our systems so that they run only what we want them to run, instead of putting all of that trust in gatekeepers who make money when they let you get scammed.

They are the largest vector of scams and malware because they've centralized it and it's hard to deliver malware and scams otherwise. That malevolence will always happen and centralizing it ensures a single avenue that can be controlled and measured and importantly sued when they fuck up. I can't sue f-droid when they allow malware on my device, that's one of many reasons why I don't use it, that's why nobody uses it in real life. Every day on HN I see people who seem to unironically think "enshittification" is a real term normal people use, a generally understood term by people who don't follow links to Corey Feldman's blog.

HN tends to forget that linux is not a target for general malware because nobody gives a single fuck about linux as a real malware target because they're smart, and therefore not the target of most scams. HN has the cute attitude that technology is king and that as long as you inspect it and open source it and care enough and have full control, then that's enough. Often the same people ignoring that AI has made it way easier to fuck stupid people over with no effort at all.

I don't not want unlimited control over the hardware that I buy from vendors like Google but I don't know yet of any better way to keep stupid people from kneecapping themselves other than introducing harder and harder quizzes. If you think it's an advantage that third party vendors like f-droid are absolved of responsibility then you deserve and own the fault when you get hacked and fucked over. Most people don't want that. They have real life to deal with. In real life you can kill people or sue them and it's harder to kill people over the internet.

> I can't sue f-droid when they allow malware on my device

How many people have successfully sued Google because of malware on the Play Store? Ever?

Why would F-Droid be any or more less "absolved of responsibility" than Play Store?

More relevantly: how much malware has F-Droid ever distributed?

And yet, these same people will install modchips on consoles, pay for VPNs, use ReVanced, and generally find ways to do what they want rather than what corporations want, and safely too.

People can learn about links to payment websites, self-signed apps/updates and unlocked bootloaders, because anything less is restricting computers for idiotic reasons.

No, because it isn't something that should be up to google's control.

Why not? It's their operating system, and they're trying to balance quite a few competing priorities. Scammers are not a threat to dismiss out of hand (i've had family who were victims).

For it to be truly considered open source, you should be able to fork it and create your own edits to change the defaults however you wish. Whether that is still a possibility or not, is a completely separate issue from how they proceed with their own fork.

> Why not? It's their operating system

It's my phone.

Of course it's your phone, but the whole point of using Android is that it makes a lot of choices for you. It forces a billion things on you, and this is really no different than any of the others. Everything from UI colors, to the way every feature actually works. For instance, should you be able to text message one million people at a time? You might want to, but Android doesn't offer that feature. Do you want to install spyware on your girlfriends phone? Maybe that's your idea of complete freedom, but the fact that Google makes it harder, is a good thing, not a bad thing.

If you don't like their choices, you should be able to install other software you do like. There should be completely free options that people can choose if they desire. But the majority of people just want a working phone, that someone like Google is taking great pains to make work safely and reliably.

> Of course it's your phone, but the whole point of using Android is that it makes a lot of choices for you. It forces a billion things on you, and this is really no different than any of the others. Everything from UI colors, to the way every feature actually works.

There is a difference between making a choice because there has to be something there (setting a default wallpaper, installing a default phone/sms app so your phone works as a phone) and actively choosing to act against the user (restricting what I can install on my own device, including via dark patterns, or telling me that I'm not allowed to grant apps additional permissions).

> For instance, should you be able to text message one million people at a time? You might want to, but Android doesn't offer that feature.

There's a difference between not implementing something, and actively blocking it. While we're at it, making it harder to programmatically send SMS is another regression that I dislike.

> Do you want to install spyware on your girlfriends phone? Maybe that's your idea of complete freedom, but the fact that Google makes it harder, is a good thing, not a bad thing.

Obviously someone else installing things on your phone is bad; you can't object to the owner controlling a device by talking about other people controlling it.

> If you don't like their choices, you should be able to install other software you do like. There should be completely free options that people can choose if they desire. But the majority of people just want a working phone, that someone like Google is taking great pains to make work safely and reliably.

Okay, then we agree, right? I should be able to install other software I like - eg. F-Droid - without Google getting in my way? No artificial hurdles, no dark patterns, no difficulty that they wouldn't impose on Google Play? After all, F-Droid has less malware, so in the name of safety the thing they should be putting warning labels on is the Google Play.

The problem is that step by step ownership of your device is taken away. First most phones stopped supporting unlocking/relocking (thank Google for keeping the Pixel open), now the backtracked version of this, next the full version, etc.

Yes, that is a real problem. But it doesn't justify arguing uncritically or unrealistically in other areas. I think people should be free to do anything they want with their own devices. They should be able to install any software they want. That's very different than demanding someone make their software exactly how you desire. ie. You should be able to install your own operating system, you don't get to tell them how theirs should operate.

There are legitimate concerns being addressed by these feature restrictions.

> demanding someone make their software exactly how you desire

IMO the way this should work is that Google can make their software however they want provided they don't do anything to stop me from changing it to work the way I want.

Unfortunately, they've already done a lot of things to stop me from changing it to work the way I want. SafetyNet, locked bootloaders, closed-source system apps, and now they're (maybe) trying to layer "you can't install apps we don't approve of" on top of that.

> IMO the way this should work is that Google can make their software however they want provided they don't do anything to stop me from changing it to work the way I want.

That's exactly how it is. You're free to get your soldering iron out, or your debugger and reverse engineer anything you want. I don't mean to argue unfairly, but all we're talking about here is the relative ease with which you can do what you want to do. How easy do they have to make it?

As for their software, as delivered, there are literally an infinite number of ways that it stops you from changing it. Maybe you want everything in Pig Latin, or a language you made up yourself. Do they have to design around this desire? Do they have to make this easy to do?

I don't necessarily think they should have to design anything to make it easier, just not actively design things to make it harder.

Though actually... I've recently become more sympathetic to the idea that software developers should be forced to take active steps to make software they distribute easy for users to modify, because software is both essential to modern life, and uniquely able to act against consumer interests in a way that's almost completely unprecedented for other goods in all human history.

A couple decades ago it would have been impractical if not impossible to make a TV, sell it to a bunch of people, and then remotely update it a few years later to start showing unkippable manufacturer-installed video ads every time you power it on. Or create a car that requires you to pay money to the manufacturer every month in order to use the seat heaters. Or build a tractor that detects if you repair it using parts not made by a specific manufacturer and shuts itself off if you do.

But now, in the age of software, all of these abuses are not only feasible to implement, but easy. And it all comes down to the fact that the software that controls these devices cannot be easily modified by the user who purchased them, or by anyone other than the company that originally manufactured them. It's a local monopoly. Were software developers required to distribute the source and build tools along with the compiled code, I suspect a vibrant modding community would spring up around any product of sufficient popularity which would make such abuses much more difficult to get away with. (Why pay a monthly subscription for my seat heaters when I can just buy a $5 software mod that permanently enables them? And why bother developing such an anti-feature in the first place if you know users will easily bypass it?)

> You should be able to install your own operating system

So you draw the line between the bootloader and the OS. Other people draw the line between the OS and applications. Most (nearly all) people can't write either, so for them it is just part of the device.

> you don't get to tell them how theirs should operate.

I paid for it, and I allow it to be legal in the jurisdiction I (partly) control. So it is not only theirs anymore.

Yes, and it should be 100% legal for you to hack it. Get the soldering iron out, and the debugger, and alter it to your hearts content. You bought it, you own it. But the supplier should be under no obligation to make any of that easy for you.

Just like they shouldn't be required to offer it in pink if that's your favorite color. It's up to you to paint it yourself. And if you want to load random apk's, you'll have to do whatever it takes to figure that out too, up to creating your own hardware and software.

I think you misunderstood me, the software is part of the device I paid for and own.

If I tell someone to install a light switch in my living room and then it occasionally switches states when someone presses another switch at my outside wall and occasionally refuses working, I don't feel like they fulfilled their contractual obligation. Same with smartphones and software.

I would agree with you if I would want additional features, like if I want a filesystem, but there is no filesystem manager yet, or if I want to install a package, but there is no package manager, or the package manager uses another format. But here there is a package manager and the package has the right format, so I tell the device to install it and it just doesn't solely because I am called John Brown and not Alphabet Inc. . That is not right.

You bought the device as delivered. They built it in the best way they know how. If you don't like it you're free to try to change it. But they're under no obligation to make it easy for you.

If the light switch you bought, has a little daylight sensor on it, and turns off when the sun is out, and that's what it does.. you may not like that light switch. You might want one that "does what you want, because you paid for it!" but then you should have purchased a different one, or made a light switch you actually liked. Of course you are free to get the soldering iron out, and try to change the light switch. But the manufacturer is under no obligation to make it easy for you to change the way it works.

That is fair, and right.

> If the light switch you bought, has a little daylight sensor on it, and turns off when the sun is out, and that's what it does.. you may not like that light switch. You might want one that "does what you want, because you paid for it!" but then you should have purchased a different one, or made a light switch you actually liked.

Not sure this analogy works as it gives prospective light switch buyers a choice of different light switch types. What google is doing seems more like forcing EVERY light switch to have daylight sensors, thus forcing you to save power (even if you're pro-global warming and just trying to do your part for the cause), then telling people with vision problems relating to suboptimal indoor illumination or suffer from sunlight frequency melting disorder or think they've got some other random "daylight makes life suck" bullshit to create a student/hobbyist account.

That's really a different issue. There may be only one light switch vendor, and then you're stuck with what they offer, too. There is room in the market for more manufacturers. I'd definitely buy from one who offered a truly open source and customizable option. But I wouldn't get it for my grandmother, she's much better served by what Google offers already.

> They should be able to install any software they want. That's very different than demanding someone make their software exactly how you desire. ie. You should be able to install your own operating system, you don't get to tell them how theirs should operate.

I don't think the distinction exists the way you're trying to describe. If I should be allowed to install any software I want, surely that includes any .apk I want? Conversely, someone could make the exact claim one step down the chain and argue that you don't get to tell them how their firmware should work and if you want to install your own OS you should just go buy a fab, make your own chips, write your own firmware, and make your own phone. And that's absurd, because users should be allowed to run their own software without being forced to ditch the rest of the stack for no reason.

No, I don't think you have the inerhent right to install any apk you desire, if their OS is designed to prohibit it. You should be free to try to alter their OS any way you want, but they should not have to make it easy.

And the argument is the same lower down the stack. You shouldn't be able to tell someone how to design their firmware.

The only problem is where the law prohibits us from trying to undo these restrictions, or make modifications ourselves. It's government that restricts us, and we should focus our efforts there.

> No, I don't think you have the inerhent right to install any apk you desire, if their OS is designed to prohibit it. You should be free to try to alter their OS any way you want, but they should not have to make it easy.

> And the argument is the same lower down the stack. You shouldn't be able to tell someone how to design their firmware.

Earlier, you claimed,

> They should be able to install any software they want.

but it sounds like actually you only mean that users should be allowed to futilely attempt it, not that there should actually be allowed to run software at will. If the firmware only allows running a signed OS, and that OS only allows running approved apps, then the user is not able to install any software they want.

I want maximum freedom, for everyone. That includes developers. We should be free to produce the software as we see fit. If that means we think that our users are best served by having devices that are locked down against scammers etc, then we should be free to produce locked down devices like that.

And as users we should be free to buy only devices that respect maximum capabilities and customization.

There is a tension between these goals, and it's difficult to resolve, so that everyone gets most of what they want. Google seems to be doing the right thing mostly though. Providing both the locked down device, and making provisions for people who want the non-standard option too.

Anyone who thinks they can do better, should enter the market and give us something better. I'd like more options for completely open and hackable phones.

There's a very easy way to achieve maximum freedom: punish people who take away other people's freedom. To achieve maximum freedom, the one freedom people must never be allowed to have is the freedom to take away other people's freedom. Google must be punished for every software module they wrote whose sole purpose is to make you less free.

They didn't make you less free. They protected your phone from scammers. On top of which, nobody twisted your arm and made you buy from them, you're free to change the phone any way you want, get the debugger out and change it. You have everything you need, it's your phone, change it any way you want; and they have the freedom to not help you.

How do I unlock the bootloader so I can exercise my freedom?

The whole point of using Android for most users is that they have no other choice if they need a mobile phone.

Google killed every other competition via dumping and shady business practices. Sure, you can go to iOS, but that is even more closed and restrictive, not to mention the devices are overpriced.

Google makes it mandatory for your girlfriend's phone to have spyware on it. The spyware is made by Google. It doesn't protect you from spyware.

While we're talking about that, have you heard of Bright Data SDK? A lot of apps on the Play Store include it to monetize. What does it do? It uses your phone as a botnet node while the app is open, and pays the app developer. How is Google protecting you from spyware, again?

> If you don't like their choices, you should be able to install other software you do like.

The problem is that this is decreasingly possible. If this was possible then people wouldn't be complaining much about Android being more opinionated than an ordinary operating system has any right to be.

100%. If I buy something, it's mine. I should be able to resell it, modify it, or generally work on it however I see fit. Licensed digital media bound to platforms is different (barring some kind of NFT solution?) but an OS that my phone cannot function without (and that cannot be replaced in many cases) absolutely must be under my jurisdiction.

What makes it “yours”?

You paid for it but Google still has the control. I understand that you prefers things to be different (as do I) but the reality is that we don’t have control over devices we paid for.

> What makes it “yours”?

The law. The contract. The money I paid.

> the reality is that we don’t have control over devices we paid for

So, the reality is that a company is exerting ownership rights on things they don't own. If that is exclusive, then that is called theft.

You might choose to not have control. The reason people protest is because we should have more control over the things we own. Sure this might create a better market for alternatives but it is worse for most people. F-droid is spectacular.

> What makes it “yours”?

You answered the question here:

> You paid for it

If you paid for hardware, legally that makes it yours.

> Google still has the control

Therein lies the problem. Google should not exercise such control over devices which are yours, not theirs.

I think it's reasonable for Google to control what happens in their version of Android (which can be installed by default) but it's not reasonable for Google to lock the bootloader (preventing installation of a non-Google OS).

Perhaps this is why Google hardware doesn't have locked bootloaders; Samsung et al can get away with locked bootloaders since it's not Google forcing the consumer in that case.

Whether the bootloader is or isn't locked should be very conspicuous before purchase, for consumer protection.

Microsoft got penalized for way less.

Is anything stopping you from coding your own OS?

Reverse engineering the drivers, to permit you creating your own OS, for your own hardware, is already an area where people are accused of crimes. DMCA Section 1201 isn't something to so easily be worked around, to allow you to place your software in a working state onto undocumented hardware.

So, yes, there is a lot of things stopping you from coding your own OS.

It's their only if they use it.

> We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands.

I've lived through them locking down a11y settings "to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer", and it's a nightmare. It's not just some scare text, it's a convoluted process that explicitly prevents you from just opening the settings and allowing access. I'm not giving them the benefit of the doubt; after they actually show what their supposed solution is we can discuss it, but precedent is against them.

> Seems reasonable?

No. As I said before, any solution that disadvantages F-Droid compared to the less trustworthy Google Play is a problem.

> It seems like they will still allow installs, just hide it behind some scare text.

That describes the current (and long-established) behavior. App installation is only from Google's store by default and the user has to manually enable each additional source on a screen with scare text.

It's deliberately written to be vague and not say anything, and given the original intention, it's hard to believe that means it should be interpreted generously.

> shape a dedicated account type for students and hobbyists.

Even that is a step too far in the wrong direction. Doesn't matter if it's free, or whatever, simply requiring an account at all to create and run software on your own device (or make it available to others) is wrong.

There exists no freedom when you are required to verify your identity, or even just provide any personal information whatsoever, to a company to run software on your device that you own.

The problem with this mentality is that you're not proposing a solution that solves the problem Google and Apple are trying to solve (or are at least stating they are). Rather than just vent about ideals, showing up to the table and listening to the requirements of all stakeholders (even if they differ from yours) will lead to a more productive result. I would not listen to your concerns if you didn't listen to mine.

They aren't actually trying to solve any real problem.

Feel free to cite some sources. I have plenty of anecdotes to suggest the problem exists, although I've not looked for data to prove it either way. However if you would like suggest it's not real you should prove it.

There is no problem to solve, though.

“Sideloading” is disabled by default on all new android devices. You have to go through deliberate steps to enable installation from outside sources.

End users are ultimately responsible or their own devices and choosing what software to run and not run. That some people can get scammed by someone on the phone walking them through how to enable sideloading, and telling them to ignore all the warnings that currently pop up, is not a problem that Google, Apple, etc. need to solve. It is already solved, via the disabled by default setting and all of the warnings.

We don’t need further restrictions on creation and distribution of software. We need end users to step up and educate themselves on how to use and operate technology safely.

Addressed in the OP

> We see a battle of PR campaigns and whomever has the last post out remains in the media memory as the truth, and having journalists just copy/paste Google posts serves no one.

> But Google said… Said what? That there’s a magical “advanced flow”? Did you see it? Did anyone experience it? When is it scheduled to be released? Was it part of Android 16 QPR2 in December? Of 16 QPR3 Beta 2.1 last week? Of Android 17 Beta 1? No? That’s the issue… As time marches on people were left with the impression that everything was done, fixed, Google “wasn’t evil” after all, this time, yay!

Perhaps this, when shipped, will pave the way for sane regulation of Apple’s practices along these lines, too.

For reference, [0] was discussed here: https://news.ycombinator.com/item?id=45908938

> This will allow you to distribute your creations to a limited number of devices without going through the full verification requirements.

How can they count the number of devices you install the app on without being the ones to give a permission to install it?

They took nothing back, they are still putting in place the requirement that Google gives permission to install apps on your phone. They are misleading us about it too which is also terrible.

So basically the Apple model but worse.

Reply on news.ycombinator.com