Live data from Hacker News

A theoretical way to circumvent Android developer verification

enaix.github.io

61–70 of 185 posts

Re: A theoretical way to circumvent Android developer verification

#61
post #36

Earlier quoted context omitted.

… if you have roaming coverage. And even in that case, doing this for a long period of time violates most roaming policies

There's eu(maybe even EEA?) wide free roaming legally mandated since I think 2017 or so? But it's not a permanent solution, your second paragraph still holds true.

[deleted]

Re: A theoretical way to circumvent Android developer verification

#62
post #36

Earlier quoted context omitted.

… if you have roaming coverage. And even in that case, doing this for a long period of time violates most roaming policies

There's eu(maybe even EEA?) wide free roaming legally mandated since I think 2017 or so? But it's not a permanent solution, your second paragraph still holds true.

I know of some UK SIMs that do not roam.

Re: A theoretical way to circumvent Android developer verification

#63

Earlier quoted context omitted.

… if you have roaming coverage. And even in that case, doing this for a long period of time violates most roaming policies

The only thing that happens is your data becomes a lot more expensive, the card still continues to work as normal. I've not lived in Poland for over 15 years now, and I still have a polish SIM card that I use almost daily - the only thing that I've lost due to roaming long term is cheap data packs, I can still call and text as normal from my monthly allowance.

Maybe in the countries that you are familiar with that is the case.

In some places your plan will be cancelled for roaming beyond a certain number of days or quantity of usage. Telecom laws and polices vary widely.

Re: A theoretical way to circumvent Android developer verification

#64

I think this means we need to rely on web technologies more. PWAs are looking pretty good on mobile devices these days and you can publish any web app you want with no reviewing authority. The web has a bunch of crazy APIs now that let you build crazy things and for everything else you're a hosted server away somewhere that can run more complex jobs. I believe devices I own should let me do whatever I want with them…

Bad news for you, Google happens to have a tight grip on the entire web ecosystem -- browser, search, ads etc.

Re: A theoretical way to circumvent Android developer verification

#65
post #25

This "attack" is not even theoretical. Android apps can just download arbitrary binary code, mprotect(PROT_MAYEXEC) some area in RAM, link the code there, and run it. Google will simply revoke the keys for the "loader" APK. But that's fine for malware, its authors will just use the next stolen credit card to register a new account. That's also why this has nothing to do with security.

what does it really have to do with?

Re: A theoretical way to circumvent Android developer verification

#67

Or you could just tell everyone out there that there are already tons of older Android devices which will never get any of these hostile updates, and if you're a developer, make sure your app runs on those older versions. Spread the word about how hostile the newer devices are, and let the lazy masses do what they're best at doing. Of course there will always be rabid bootlickers who will gladly pay to put Google's n…

If this is an acceptable solution, just run a modern uncertified Android instead.

Re: A theoretical way to circumvent Android developer verification

#68

Earlier quoted context omitted.

That explanation doesn't really make sense to me. If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever. You still have to host the static files for the webapp itself, but that can…

Isn't localStorage limited to 5 MB of data?

Sure, but localStorage isn't really ideal for storing large objects anyway, because it forces everything to be stored in one big string-to-string map. It's great for small amounts of data such as user preferences.

There are other APIs that allow you to store binary data directly (which you'll probably want if you're storing large files) and also to use/request larger quotas.

Re: A theoretical way to circumvent Android developer verification

#69

Earlier quoted context omitted.

That explanation doesn't really make sense to me. If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever. You still have to host the static files for the webapp itself, but that can…

Isn't localStorage limited to 5 MB of data?

Yeah, better is the filesystem API

Re: A theoretical way to circumvent Android developer verification

#70

Earlier quoted context omitted.

That explanation doesn't really make sense to me. If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever. You still have to host the static files for the webapp itself, but that can…

Isn't localStorage limited to 5 MB of data?

IndexedDB API is a bit more liberal in that regard
Post reply on HN