Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google have declared Droidscript is malware

groups.google.com

Post reply on HN
Print view View original

161–170 of 665 posts

Re: Google have declared Droidscript is malware

#161

Post by ncann »

pdkl95 wrote: post #73
nromiun wrote: post #26

> We don't allow apps with any code that could put a user, a user’s data, or a device at risk. If Google thinks the ability to execute arbitrary code puts users' data at risk why don't they go the full iOS route and ban everything, from scripting apps to other JS engines beside Chromium? I am so sick of their behaviour, the only reason I am still on Android because things like F-Droid still exists and iOS is even mor…

>> "Can't you just make us a general-purpose computer that runs all the programs, except the ones that scare and anger us? Can't you just make us an Internet that transmits any message over any protocol between any two points, unless it upsets us?"[1] The War On General Purpose Computing continues. Far too many business models depend on selling general purpose computers as "appliances". They presume it is possible to…

Even as a casual Android dev I've noticed it becoming more and more restrictive over the years, from restricting apps from reading storage, to restring apps from accessing clipboard, to restring apps from running in background, and a ton of other things all in the name of protecting customer. Every time I update to a new phone with a new Android version my hobby apps (which only I use, not published anywhere) are broken in some ways because of this. The end goal of Android seems to be a closed system like iOS and that makes me sad. You can make things harder or hard by default but at least give the power user some choices damn it.

Re: Google have declared Droidscript is malware

#162

Post by dheera »

negativegate wrote: post #139
nromiun wrote: post #65

Earlier quoted context omitted.

Yep, Termux is the most used app on my phone and I don't know what I will do when they have to migrate to SDK 29. I will probably buy another phone and install LineageOS.

This is the first I've heard of Termux and now I'm curious what you use it for. Like are you SSHing into other environments?

SSH, and also when you're on the road and want to write a simple Python script to process something, or do something with your sensor data logging. Termux has a Python API to access sensor data, it has numpy, it has requests, so you can do a lot.

Re: Google have declared Droidscript is malware

#163

Post by pdkl95 »

FredFS456 wrote: post #105
pdkl95 wrote: post #73

Earlier quoted context omitted.

>> "Can't you just make us a general-purpose computer that runs all the programs, except the ones that scare and anger us? Can't you just make us an Internet that transmits any message over any protocol between any two points, unless it upsets us?"[1] The War On General Purpose Computing continues. Far too many business models depend on selling general purpose computers as "appliances". They presume it is possible to…

There's nothing wrong with the appliance business model - embedded devices that use microcontrollers are Turing complete and yet no one complains about those. It's only when devices are marketed as general-purpose (i.e. smartphones, PCs) but are locked down to prevent running arbitrary user-loaded code that it becomes a problem.

https://en.wikipedia.org/wiki/Tivoization

So many people complained about not being able to run their on firmware on the TiVo that it caused the GPL to be updated to version 3.

While Turing machines are universal, there are practical limitations of the hardware. A tiny embedded microcontroller with kilobytes (or less) of memory is not an attractive target for customization or repurposing. Today it is probably easier/cheaper to simply buy a Rasberry PI or similar.

Also, some companies understand that they are in the business of selling hardware and don't particularly care what you do with it.

Re: Google have declared Droidscript is malware

#164

Post by ShroudedNight »

oneplane wrote: post #135
ballenf wrote: post #87

Earlier quoted context omitted.

The battle really parallels the larger right to repair debate. (Especially if we realize the latter is probably is better called the right to exercise control over purchased goods.)

Does it? Everyone is quick to judge but coming up with an alternative is hard enough that nobody has done it so far. With scale comes scaling issues; general purpose computing and repairability need a different commercial model that doesn't match with the currently used models. This leaves two avenues: - Make it worse for everyone but keep it going - Make it worse for everyone in a different way and keep it going I d…

Your primary alternative already sounds materially better than the 'Current Scenario' you describe:

1 - I'm not sure I've encountered anybody that universally falls within the 90% 'ideal' coverage. The more hostile things are to outliers, the more difficult everyone's life becomes.

2 - As far as I can tell, the slack that allows the bottom and top vigesimile (? 1/20th) to survive is also what allows the flexibility to foster the discovery of novel technical and societal configurations that are materially better than the status quo. That's how a kid from a family of coal miners has a path to making significant contributions to NASA.

Re: Google have declared Droidscript is malware

#165

Post by dTal »

kube-system wrote: post #137
horsawlarway wrote: post #122

Earlier quoted context omitted.

I disagree. I also mind when things like my tractor or my car are locked down to prevent my ability to use a 3rd party repair shop, repair it myself, or make changes so the item better suits me: The person who fucking owns that computer. I think there's a very real risk that the concept of "ownership" is going to die if we continue in this fashion. Do you own a thing if you're prohibited, intentionally - by the manuf…

I still like my car to have an immobilizer, and locks on the ignition and doors. There is certainly some level of access controls that most people definitely want.

And who owns the keys to those things? You, or the manufacturer?

Re: Google have declared Droidscript is malware

#166

Post by munificent »

szopa wrote: post #100
dtx1 wrote: post #39

Earlier quoted context omitted.

Banning it first is fine. banning it first, then not giving a reply to the concerns they have is not. Even if they have reasonable believe or proof that droidscript is indeed malware, it looks like at least a chunk of their userbase uses it for legitimate usecases and the devs, who likely invested at least a few hundred hours of work in it, deserve at least some communication.

I used to work at Google, and a friend reached out to me for help – his company's app was in a similar situation, with similar communication from Google. This was a good friend from high school, so I pressed the issue using internal channels. The person handling it on Google's side was very assertive about them violating a policy, and after some back and forth I received a _vague hint_ about what was the supposed vio…

Caveat: I work at Google but know nothing about this area and my opinion here is entirely personal.

> which would create an unsustainable situation at this scale.

Financial sustainability may have something to do with it, but I suspect the larger issue is that providing too much detail essentially trains malware authors to route around the company's defenses.

Imagine the Play Store as a castle which has both good townsfolk coming and going as well as being perpetually under siege by a malicious lord. Sometimes, the castle's defenses inadvertently prevent a townsperson from getting to market to sell their onions. When the townsperson is like, "Hey, I can't get in to sell my onions." it's helpful for the castle defenses to be like, "Well, we have the portcullis raised from 9am-11am on Tuesdays and the gatekeepers listen for your accent to decide if you're a local or an enemy."

But that's, like, exactly not what you want to say if the "townsperson" you're talking to is actually an enemy spy taking notes.

Re: Google have declared Droidscript is malware

#167

Post by kube-system »

kelnos wrote: post #158
kube-system wrote: post #137

Earlier quoted context omitted.

I still like my car to have an immobilizer, and locks on the ignition and doors. There is certainly some level of access controls that most people definitely want.

That's not what people are taking about, though. Certainly people want security features that make it more difficult for someone else to steal their car. But those features should be under the control of the owner of the car, not the manufacturer.

It's really hard to do that and make the thing a consumer-friendly product. We've been trying to solve this problem for most of the history of computers, yet, attacking authentication (often indirectly) is still the #1 way that computers are compromised.

Most people simply are unable to properly handle private keys. All of the systems with the highest levels of consumer satisfaction have third parties that manage (or at least can override) keys on the user's behalf. Systems that do what you're suggesting are notoriously plagued with issues surrounding key management to the point where they never reach mainstream use. i.e. PGP, bitcoin, etc.

Re: Google have declared Droidscript is malware

#168

Post by phh »

eplanit wrote: post #25

It's seriously time to re-embrace the idea of ownership and control of our devices, and reject Android and iOS altogether. Developing for those platforms has become worse and more restrictive over the years, and this kind of crap is now just everyday news. How good are Pinephones[1]? Are there better alternatives? [1] https://www.pine64.org/pinephone/

Maybe don't scratch Android too fast.

Android is opensource, and is technically really great. There is a great opensource community of people that are very capable in this area, and supports already the vast majority of devices in the world.

You only need to get rid of Google. Which many custom Android provide. Personally my smartphone is a Pixel 5 (IMO best smartphone currently available that fit in a hand), running Android, without any Google application. I'm very happy with it, and from what I discussed with Pinephone users, it's lightyears more usable than what exists for Pinephone.

Re: Google have declared Droidscript is malware

#169

Post by salawat »

kube-system wrote: post #137
horsawlarway wrote: post #122

Earlier quoted context omitted.

I disagree. I also mind when things like my tractor or my car are locked down to prevent my ability to use a 3rd party repair shop, repair it myself, or make changes so the item better suits me: The person who fucking owns that computer. I think there's a very real risk that the concept of "ownership" is going to die if we continue in this fashion. Do you own a thing if you're prohibited, intentionally - by the manuf…

I still like my car to have an immobilizer, and locks on the ignition and doors. There is certainly some level of access controls that most people definitely want.

Those are still "yours" in a sense, so don't fall into the feature set the poster you are replying to is talking about. Though the immobilizer somewhat skirts the line. (Or at least from my personal view).

Think John Deere implementing software lockouts in the tractor ECU. That is nothing more than forcing their business model onto the end user through digital logic.

Re: Google have declared Droidscript is malware

#170

Post by troyvit »

Aissen wrote: post #111
szopa wrote: post #100

Earlier quoted context omitted.

I used to work at Google, and a friend reached out to me for help – his company's app was in a similar situation, with similar communication from Google. This was a good friend from high school, so I pressed the issue using internal channels. The person handling it on Google's side was very assertive about them violating a policy, and after some back and forth I received a _vague hint_ about what was the supposed vio…

> Now, it's a shame Google couldn't let them know what was the issue. However, it's a safe assumption that the vast majority of people Google support deals with are spammers. And there's a lot of them. If Google gave a detailed explanation to all of them it would mean a ton of additional work – which would create an unsustainable situation at this scale. I don't think that's reasonable. What if most are spammers ? Be…

Google has the scale to do this, but they also have a large enough monopoly where they don't have to, so they won't. It's not that it's unsustainable, it's that it is entirely sustainable to continue doing things this way.
Post reply on HN