Google I/O 2021 and Uncomfortable Questions
commonsware.com
Google I/O 2021 and Uncomfortable Questions
1–10 of 152 posts
Re: Google I/O 2021 and Uncomfortable Questions
#2Google Playstore is a walled garden, like Apple's. The walls are only growing higher and higher. Once Apple adds a layer of bricks, Google follows and vice versa.
Re: Google I/O 2021 and Uncomfortable Questions
#3tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser.
Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality of your apps.
Finally, it appears to be the intention that this will justify setting a new norm and become mandatory for all apps.
Re: Google I/O 2021 and Uncomfortable Questions
#4tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…
They probably just want to be able to patch in OS api compatibility shims so they can make faster changes.
For app bundles they want to be able to remove unneeded assets and make device specific builds. Think high dpi only. I think ios has a similar feature called app thinning.
Re: Google I/O 2021 and Uncomfortable Questions
#5tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…
Wouldn't a simple solution to this be a double signing of one and the same app by both Google and the app's author?
That way, if Google changes the app and signs it, while the author only signed the unchanged app, then the author's signature would no longer validate on the new, changed app.
Or am I missing something?
Re: Google I/O 2021 and Uncomfortable Questions
#6App bundles allow smaller apk sizes [0]:
> Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads.
But as all this logic sits on Google servers and might involve lots of signing of apks for a single app and version, Google has decided it needs your signing keys for that feature. Which is weird already because you could also think of a model where you provide Google not with the keys but a service where Google presents you an apk, and you sign it. Then you can inspect it retroactively and run scanners on it, if you want to. The keys stay yours and you would know what Google is up to with your application.
If you have problems with giving Google your signing keys, you can just avoid this feature. But apparently there is the fear that Google wants to make the feature required. Which would give them ability to alter basically any app on the play store as they deem fit. Or they might in fact be forced by governments. Already now many providers like facebook take down public posts because a local government disliked a post. What if a govt told Google "please install this altered Signal app on this person's device"? And yes, Google apps already run as system app so they could already do something like that, but an implementation of that is way harder to make consistent among different vendors.
Re: Google I/O 2021 and Uncomfortable Questions
#7Apple and Google, the Rockefeller and Standard Oil of our era.
Re: Google I/O 2021 and Uncomfortable Questions
#8Google Playstore is a walled garden, like Apple's. The walls are only growing higher and higher. Once Apple adds a layer of bricks, Google follows and vice versa.
Google has done the same with YouTube to create lock-in for content creators, just like the Play Store. My pet conspiracy theory, they're also doing the same with Chrome browser, by creating as many useless features as possible.
Re: Google I/O 2021 and Uncomfortable Questions
#9tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…
Wouldn't a simple solution to this be a double signing of one and the same app by both Google and the app's author? That way, if Google changes the app and signs it, while the author only signed the unchanged app, then the author's signature would no longer validate on the new, changed app. Or am I missing something?
You're not, this is absolutely the correct solution. There's no reason it needs to be either/or.
Re: Google I/O 2021 and Uncomfortable Questions
#10App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…
I seriously doubt 99% of Google Play developers worry enough that they would take the time and money to run a signing server, and that would introduce a lot of complexity for Google.