Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

381–390 of 694 posts

Re: Android developer verification: Early access starts

#381

Post by exe34 »

reddalo wrote: post #361
xyzzy_plugh wrote: post #127

> we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choi…

I also think we should stop calling it "sideloading". We need a better word. Sideloading has a negative vibe, as if it's a dangerous thing to install apps from sources other than the Play Store.

I call it installing. If it's from play store I'd say "Install from Play Store".

Re: Android developer verification: Early access starts

#382

Post by NooneAtAll3 »

how to make people forget about your bad practices

1) announce decision that will make everything even worse

2) wait for negative opinion

3) announce walking back on the decision

4) observe general sense of relief

The only way this can be stopped is to make it costly to even announce "decisions making everything worse"

Re: Android developer verification: Early access starts

#383

Post by sebastiennight »

fingerlocks wrote: post #366
jacquesm wrote: post #60

Earlier quoted context omitted.

These two things are not the same. The GDPR afforded rights to common people. Those companies that would pull out are the ones that were abusing data that was never theirs and could no longer do so.

Nah. I know of several startups that had nothing but anonymous telemetry and they blocked all Europe because there was no capacity for compliance. I was at an incubator at the time and the decision was unanimous across a dozen or so companies. It’s not like anyone was going to lose out on VC money from that market

> anonymous telemetry

is not covered by GDPR.

And it's a bit hard to believe that these several startups functioned without ever collecting names, emails, IP, phone number, or address of any lead or customer ever.

Re: Android developer verification: Early access starts

#384

Post by wolvesechoes »

gdulli wrote: post #37
charcircuit wrote: post #20

Earlier quoted context omitted.

You would still be able to adb installs them. They wouldn't die.

Developers of these apps would have little motivation if the maximum audience size was cut down to the very few who would use adb. The ecosystem would die.

And how do you estimate the audience that even cares about those issues?

I think number of people caring about alternative app stores, F-droid or whatever is very similar to the number of people willing to use adb if necessary, so rather small.

Re: Android developer verification: Early access starts

#385

Post by maxlin »

>This is why we announced this change early: to gather input and ensure our solutions are balanced.

Sounds like just trying to save face, they didn't have a language of "we're only _MAYBE_ stopping everyone from installing non-verified apps" back then. They were quite adamant.

But happy that they're dropping the craziest part of this in any case. Won't stop me from investigating Graphene OS and other options when getting my next handset though, the previous move surely caused a jolt in my interest.

Re: Android developer verification: Early access starts

#386

Post by thw_9a83c »

xzjis wrote: post #330
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

Why can't they just put up a big, red warning: "Never enable software installation if someone asks you to (over the phone or via message). If you're unsure, check out this article on scams."?

> "Never enable software installation if someone asks you..."

Imagine a situation in which a frightened, stressed user sees such a message on their screen. Meanwhile, a very convincing fake police officer or bank representative is telling them over the phone that they must ignore this message due to specific dangerous emergency situation to save the money in their bank account. Would the user realize at that moment that the message is right and the person on the phone is a thief? I'm not so sure.

Re: Android developer verification: Early access starts

#388

Post by [deleted] »

etatoby wrote: post #332
ashleyn wrote: post #121

Earlier quoted context omitted.

yt-dlp's days are fairly numbered as Google has a trump card they can eventually deploy: all content is gated behind DRM. IIRC the only reason YouTube content is not yet served exclusively through DRM is to maintain compatibility with older hardware like smart TVs.

Something I've never understood about DRM is, if the content is ultimately played on my device, what stops me from reverse engineering their code to make an alternative client or downloader? Is it just making it harder to do so? Or is there a theoretical limit to reverse engineering that I'm not getting? Do they have hardware decryption keys in every monitor, inside the LCD controller chip?

[deleted]

Re: Android developer verification: Early access starts

#390

Post by nandomrumber »

4u00u wrote: post #378
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

To be fair, on Google Play you have the option to transfer the app to someone else's account. People don't need to trade accounts...

That doesn’t help mitigate the class of attack you responded to.
Post reply on HN