Comment by lern_too_spel | Hacker News Reader

Comment by lern_too_spel | Hacker News Reader

Parent Full thread

Article got developer verification completely wrong. The point of developer verification is to be able to install apps outside the app store without warning, which brings Google Android builds in compliance with the antitrust ruling. Third party Android builds can choose other trust roots or disable ADV completely and require warnings for everything because they are not subject to the judgment.

Separately, the process of installing apps that are outside a system app store and aren't verified has also changed, but this is not required by the developer verification feature, and the result seems like a wash to me. The first time you enable installing apps from other sources is harder, but this setting then persists across device upgrades, so the subsequent times go away completely. This now requires developer mode, but apps that check developer mode (I haven't found any in the US) can be mollified with a Tasker task to disable developer mode when launching those apps and enable it again after.

That's only the consumer side of it though. As the post states:

> Should a developer[...] elect to register themself with Google as a “verified” developer, they should expect to sign up for an account and pay a fee, surrender detailed personal information and upload government-issued identification, and then proceed to register the identifiers and signing keys for all the apps they intend to distribute (now or ever).

Those are big impediments to open development. The agreement developers sign states:

> 6.5 If You violate any of the Terms or if You distribute malware or other harmful applications, Google may terminate Your access to the ADC…

But they don't actually define "malware" anywhere in the document. Search HN if you want to hear horror stories about how google handles loose definitions and peoples' accounts.

This is no different from before. If you want consumers to be able to install your app without a warning on Google builds, you have to jump through verification hoops. The only thing that ADV changes for developers is that now they can distribute their apps outside the system app stores without a warning as well, which is a new benefit, not a new restriction.

The correct thing to complain about is requiring developer mode for unverified installs, which doesn't seem necessary, not ADV. If you complain about ADV, of course the legislators are going to ignore you. ADV makes Google builds strictly more open and resolves the complaints of the state.

Can Android OEMs, bundling Google Mobile Services for Android certification, choose different trust roots for verification?

>The correct thing to complain about is requiring developer mode for unverified installs, which doesn't seem necessary

I had assumed the friction was to dissuade developers from not going through ADV. Isn't it partly for making malware distribution more traceable and campaigns easier to halt on GMS/certified Android systems?

> Can Android OEMs, bundling Google Mobile Services for Android certification, choose different trust roots for verification?

They can already install additional system app stores, so it would surprise me if they can't allow additional verifiers.

> Isn't it partly for making malware distribution more traceable

Enabling developer mode does not make malware distribution more traceable.

What happens if Google says "nope" to a developer who applied for ADV? Does the developer retain the ability to distribute their software to end users through whatever non-Google-approved channels they use today?

Yes. That doesn't change. The only thing ADV changes is that it adds another way to distribute apps that can be installed without a warning.

Oh man thank you for the clarification <3

Reply on news.ycombinator.com