Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

151–160 of 694 posts

Re: Android developer verification: Early access starts

#151

Post by wkat4242 »

svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

Then let them do that for those countries. Not for everyone. I'm not in any of those autocratic countries. Or offer an opt out in the countries where this isn't a thing. Using adb is not really great for doing updates.

And also, I'm the owner of my device. Not my country.

Re: Android developer verification: Early access starts

#152

Post by hekkle »

gpm wrote: post #137
hekkle wrote: post #136

Earlier quoted context omitted.

> and highly appreciated. Not by the maintainers it wasn't Mr. Google.

Yes, but it was a public service not a service for the maintainers, and as a member of the public who like anyone who had run `ffmpeg -i ` was previously exposed to the vulnerability I highly appreciate their service. I'd highly appreciate even if the maintainers never did anything with the report, because in that case I would know to stop using ffmpeg on untrusted files.

So you were using untrusted video files that required the LucasArts Smush codec?

Again, if YOU highly appreciate their service, that's great, but FFMPEG isn't fixing a codec for a decades old game studio, so all Google has done is tell cyber criminals how to infect your Rebel Assault 2. I'm glad you find that useful.

Re: Android developer verification: Early access starts

#153

Post by gpm »

hekkle wrote: post #152
gpm wrote: post #137

Earlier quoted context omitted.

Yes, but it was a public service not a service for the maintainers, and as a member of the public who like anyone who had run `ffmpeg -i ` was previously exposed to the vulnerability I highly appreciate their service. I'd highly appreciate even if the maintainers never did anything with the report, because in that case I would know to stop using ffmpeg on untrusted files.

So you were using untrusted video files that required the LucasArts Smush codec? Again, if YOU highly appreciate their service, that's great, but FFMPEG isn't fixing a codec for a decades old game studio, so all Google has done is tell cyber criminals how to infect your Rebel Assault 2. I'm glad you find that useful.

No, I was running on normal untrusted video files. The standard ffmpeg command line would happily attempt to parse those with the LucasArts Smush codec even though I'd never heard of it before.

See the POC in the report by google, the command they run is just `./ffmpeg -i crash.anim -f null /dev/null -loglevel repeat+trace -threads 1` and the only relevant part of that for being vulnerable is that crash.anim is untrusted.

Edit: And to be clear, it doesn't care about the extension. You can name it kittens.mp4 instead of crash.anim and the vulnerability works the same way.

Re: Android developer verification: Early access starts

#154

Post by makeitdouble »

edoceo wrote: post #33
bilsbie wrote: post #18

I don’t like to see the word “allow” in the same sentence with a device I own.

It's a device you own, sure. But you've licensed the software.

Let's not shoot the messenger (edoceo)

Too many people are in denial about what they actually own, and seem to refuse to accept this battle isn't starting or coming up, we're already in the process of losing it.

Clinging to material ownership feels great on the moment, but that's absolutely not what we need to deal with right now. It's kinda like being so proud to be the registered owner of your car, while it's getting impounded and you'll be spending the next 10 years trying to get it back.

Re: Android developer verification: Early access starts

#155

Post by makeitdouble »

EMIRELADERO wrote: post #68
edoceo wrote: post #33

Earlier quoted context omitted.

It's a device you own, sure. But you've licensed the software.

This is misleading though. There is simply no other choice if you want to use mainstream apps. It could be argued (successfully in my view) that any agreement is null and void due to its acceptance under duress. Users have an inherent legal right to unconditionally access the full advertised functionality of devices they purchase. Any agreement after that is inherently suspect and I wouldn't be surprised to find out…

> This is misleading though.

This isn't misleading in any way. It's unfortunate and we should be pissed about it, but this is exactly the legal arrangement that Google and Apple came up with.

> I wouldn't be surprised to find out it was ruled unconscionable by some court

Last US court battle, Apple told the court it needed the money from the kids casino to keep its profits, and the court just nodded.

Apple had to be held in comptempt of a court order after 4 years and a deluge of evidence, for us to see any significant move.

Re: Android developer verification: Early access starts

#156

Post by gowthamgts12 »

erohead wrote: post #2

Sounds like they're rolling back the mandatory verification flow: Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure…

> Sounds like they're rolling back the mandatory verification flow

absolutely no. this is for the user side. but if you're a developer who is planning to publish the app in alternative play store/from your website, you have to do verification flow. please read the full text.

Re: Android developer verification: Early access starts

#157

Post by [deleted] »

svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

[deleted]

Re: Android developer verification: Early access starts

#158

Post by gowthamgts12 »

nunez wrote: post #112

Glad to see Google come to their senses on this. Disabling it entirely would have basically guaranteed an exodus of power users over to iOS. If your only choices are walled gardens, you might as well pick the easiest, prettiest one.

it's not

> "Google come to their senses on this"

it's

> "Google was forced to their senses on this"

Re: Android developer verification: Early access starts

#159

Post by kragen »

tadfisher wrote: post #43
BrenBarn wrote: post #23

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw up tons of barriers for every individual app install.

There's a second path, whereby F-Droid registers as an "alternative app store", which is a new category of app created in the fallout of Epic Games v. Google [0]. This is interesting because it applies to all regions and will necessarily need more elevated permissions than the typical REQUEST_INSTALL_PACKAGES permission used today. No idea what requirements Google will impose on such apps. [0]: https://en.wikipedia.o…

What would they have to offer Google in return for being granted this status? Would they have to ban NewPipe, for example?

Re: Android developer verification: Early access starts

#160

Post by calvinmorrison »

tomrod wrote: post #36
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop. That right ends are your nose, as the saying goes.

I suppose you have the right to do whatever you want with it, including zapping it in the microwave or using it as a rectal probe. I am not sure that right extends are far as forcing companies to deliver a product to your specifications (open software, hardware, or otherwise)
Post reply on HN