Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

131–140 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#131

Post by thewebguyd »

999900000999 wrote: post #75
dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

How about. "I am responsible for my own actions" mode. You click that, the phone switches into a separate user space. Securenet is disabled, which is what most financial apps rely on. Then you can install all the fun stuff you want. This is really a matter of Google not sandboxing stuff right. Why the hell does App A need access to data or notifications from App B.

> Why the hell does App A need access to data or notifications from App B.

Advertising networks. Just like how you see crap like a metronome app have a laundry list of permissions that it doesn’t need. Some cases they are just scammy data harvesters, but in other cases it’s the ad networks that are actually demanding those permissions.

Google won’t sandbox properly because it’s against their direct business interest for them to do so. Google’s Android is adware, and that is the fundamental problem.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#132

Post by btreesOfSpring »

Would rather a more robust and distributed app store system that figures out how to police these edge cases of fraud rather than one vendor (Apple or Google) whose monopolies push developers into subscriptionware across the board. Something more akin to how internic moved from one domain name registrar to what we have today, chock full of competition and new top level domains.

It feels like independent development on devices has slowed in recent years. More stores appealing to different developer models/tools and monetization strategies please.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#133

Post by rprend »

TJTorola wrote: post #73
rprend wrote: post #64

[flagged]

Ideological is carrying a lot of weight there. Perhaps you can be more specific about the ideological arguments you are hearing that are not worth it?

Walled gardens have less fraud and malware because it's less open. But developers prefer open source decentralized software. Of course, we are technologically literate enough to avoid the fraud. It's similar to drug decriminalization or the legalization of sports gambling.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#134

Post by pserwylo »

Many people online and in person telling me "Google backed down" or "Google has an advanced flow" are typically referring to these two statements from Google staff:

> Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. [0]

> Advanced users will be able to"Install without verifying," but expect a high-friction flow designed to help users understand the risks. [1]

Firstly - I am yet to see "ongoing conversations with the community" from Google. Either before this blog post or in the substantial time since this blog post. "The community" has no insight into whether any such "advanced flow" is fit for purpose.

Secondly - I as an experienced engineer may be able to work around a "high-friction flow". But I am not fighting this fight for me, I am fighting it for the billions of humans for whom smart phones are an integral part of their daily lives. They deserve the right to be able to install software using free, open, transparent app stores that don't require signing up with Google/Samsung/Amazon for the privilege of: Installing software on a device they own.

One example of a "high friction flow" which I would find unacceptable if implemented for app installation on Android is the way in which browsers treat invalid SSL certificates. If I as a web developer setup a valid cert, and then the client receives an invalid cert, this means that the browser (which is - typically - working on behalf of the customer) is unable to guarantee that it is talking to the right server. This is a specific and real threat model which the browser addresses by showing [2]:

* "Your connection is not private"

* "Attackers might be trying to steal your information (for example, passwords, messages or credit cards)"

* "Advanced" button (not "Back to safety")

* "Proceed (unsafe)" link

* "Not secure" shown in address bar forever

In this threat model, the web dev asked the browser to ensure communication is encrypted, and it is encrypted with their private key. The browser cannot confirm this to be the case, so there is a risk that a MITM attack is taking place.

This is proportionate to the threat, and very "high friction". I don't know of many non-tech people who will click through these warnings.

When the developer uses HSTS, it is even more "high friction". The user is presented all the warnings above, but no advanced button. Instead, on Chromium based browsers they need to type "thisisunsafe" - not into a text box, just randomly type it while viewing the page. On Firefox, there is no recourse. I know of very few software engineers who know how to bypass HSTS certificate issues when presented with them, e.g. in a non-prod environment with corporate certs where they still want to bypass it to test something.

If these "high friction" flows were applied to certified Android devices each time a user wanted to install an app from F-Droid - it would kill F-Droid and similar projects for almost all non-tech users. All users, not just tech users, deserve the right to install software on their smart phone without having to sign up for an "app store" experience that games your attention and tries to get you to install scammy attention seeking games that harvest your personal information and flood you with advertisements

Hence, I don't want to tell people "Just install [insert non-certified AOSP based project here]". I want Android to remain a viable alternative for billions of people.

[0] - https://android-developers.googleblog.com/2025/11/android-de...

[1] - https://x.com/matt_w_forsythe/status/2012293577854930948

[2] - https://wrong.host.badssl.com/

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#135

Post by nickorlow »

dsl wrote: post #83
bigstrat2003 wrote: post #59

Earlier quoted context omitted.

Nice strawman. People want the ability to decide for themselves whether or not to install some APK, they are not saying every APK under the sun is trustworthy.

It is a simplification, not a strawman. If you want to make the decision to install Hay Day, the user should be able to know that it is the Hay Day from Supercell or from Sketchy McMalwareson. 99.9% of apps should have no issue with their name being associated with their work. If you genuinely need to use an anonymously published app, you will still be able to do that as a user.

> If you genuinely need to use an anonymously published app, you will still be able to do that as a user.

I'm pretty sure the goal of Google's changes is to make it so you can't

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#137

Post by iamnothere »

hypeatei wrote: post #69
dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

> but I think the community needs a better response The community does not need to do that. Installing software on my device should not require identification to be uploaded to a third party beforehand. We're getting into dystopian levels of compliance here because grandma and grandpa are incapable of detecting a scam. I sympathize, not everyone is in their peak mental state at all times, but this seems like a proble…

These people would try to ban talking if the scams moved to in-person conversations. At some point individual responsibility has to come into play.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#138

Post by sschueller »

gretch wrote: post #94
bigstrat2003 wrote: post #67

Earlier quoted context omitted.

> I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." Why would the community give a different response? Everything is fine as it is. Life is not safe, nor can it be made safe without taking away freedom. That is a fundamental truth of the world. At some point you need to treat people as adul…

> At some point you need to treat people as adults, which includes letting them make very bad decisions if they insist on doing so. That's right, it's your decision to use Android. If you choose to do so, that's on you.

If there was a choice to a non-walled garden. It has been taken away, how can you bank without one of the two?

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#139

Post by NicuCalcea »

dsl wrote: post #83
bigstrat2003 wrote: post #59

Earlier quoted context omitted.

Nice strawman. People want the ability to decide for themselves whether or not to install some APK, they are not saying every APK under the sun is trustworthy.

It is a simplification, not a strawman. If you want to make the decision to install Hay Day, the user should be able to know that it is the Hay Day from Supercell or from Sketchy McMalwareson. 99.9% of apps should have no issue with their name being associated with their work. If you genuinely need to use an anonymously published app, you will still be able to do that as a user.

Android already tells users when they're installing software from outside the Play Store and shows big scary warnings if Play Protect is turned off. What else do you want? If I want to install something from Sketchy McMalwareson after all that, that's my phone and my business.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#140

Post by rprend »

mhitza wrote: post #92
rprend wrote: post #64

[flagged]

Who says that Google is the one to decide what open source software I can install on my mobile Android computing device?

Wym? Google says it’s the one to decide. They are doing this because side loading causes fraud. There is pressure and lobbying (like this open letter) to stop them from locking it down.
Post reply on HN