Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

171–180 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#171

Post by iamnothere »

bitwize wrote: post #155
iamnothere wrote: post #142

Earlier quoted context omitted.

My condolences, that sucks that you’re stuck in such an authoritarian country. If you look at the PostmarketOS site, you may be able to find a legal phone (weird to type that phrase) that can be reflashed. Or you could buy one while on vacation, my guess is they don’t check models at the border if it looks like a personal device.

Illegal in Brazil per the Digital Child and Adolescent Statute. Operating systems are legally required to provide age verification functionality in a manner approved by the government.

Do they do inspections?

Edit: apparently if it isn’t a “marketable product” then the law may not apply. So far they haven’t enforced it against Linux distros, likely because of this exception. However, IANAL (and definitely not a Brazilian lawyer).

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#172

Post by sdsd »

criddell wrote: post #63
dvh wrote: post #14

Wrong approach. Vote with your wallet instead. My next mobile phone will not have OS from Google (not from Apple).

Something like 7 iOS phones are sold every second of the day and there are even more Android phones sold. The number of people who care about this issue is far too few for any kind of boycott to be noticed by the handset makers. The only option is to appeal to Google's sense of what's right. In the time it took you to read this comment, 200 phones were sold.

Highly technically knowledgeable people are more influential in this sphere than the average consumer. If developers hate your device and love your competitor, that's a real problem.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#173

Post by pas »

hbn wrote: post #154
kovek wrote: post #104

Earlier quoted context omitted.

What if we asked users if they want extra protection? I think that would be nice..

You can add 5 layers of "are you sure you want to do this unsafe thing" and it just adds 5 easy steps to the scam where they say "agree to the annoying popup"

then make the unlock cost money

relatively easy for devs, but hard to scale for scammers

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#174

Post by NewsaHackO »

bigstrat2003 wrote: post #123
zeroxfe wrote: post #97

Earlier quoted context omitted.

> At some point you need to treat people as adults, which includes letting them make very bad decisions if they insist on doing so. The world does not consist of all rational actors, and this opens the door to all kinds of exploitation. The attacks today are very sophisticated, and I don't trust my 80-yr old dad to be able to detect them, nor many of my non-tech-savvy friends. > any more than it would be acceptable f…

It's not a false equivalence at all. Both situations are taking away someone's control of something that they own, borne from a paternalistic desire to protect that person from themselves. If one is acceptable, the other should be. Conversely if one is unacceptable, the other should be unacceptable as well. Either paternalistic refusal to let people do as they wish is ok, or it isn't.

Maybe not, but I think that overextending any idea like that in the opposite direction of whatever point you are trying to make at least devolves into a "slippery slope" argument. For instance, is your point that all security on phones that impede freedom of the user (for instance, HTTPS, forced password on initial startup, not allowing apps to access certain parts of the phone without user permissions, verifying boot image signatures) should be removed as well?

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#175

Post by renewiltord »

999900000999 wrote: post #75
dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

How about. "I am responsible for my own actions" mode. You click that, the phone switches into a separate user space. Securenet is disabled, which is what most financial apps rely on. Then you can install all the fun stuff you want. This is really a matter of Google not sandboxing stuff right. Why the hell does App A need access to data or notifications from App B.

This mode already exists. It's called "Install LineageOS".

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#176

Post by bitwize »

RandomGerm4n wrote: post #153
bitwize wrote: post #84

Earlier quoted context omitted.

Of course it extends to PCs. It'd suck for us, but end users, software vendors, content providers, and service providers all benefit from a more restricted platform that can provide certain guarantees against malware, fraud, piracy, and so forth. It's pathologically programmer-brained to assume that the good old days of being able to run arbitrary code on a networked computing device would last forever. That freedom…

Users get way more out of it when the device is free. Even if they don't use this option, it makes it easier to set up competing services. This includes ones that would never be allowed in an official store because they're DRM-free alternatives to big streaming services but still offer all the same content. The existence of such alternatives, if they are easy to use, can force the big services to become more user-fri…

> This includes ones that would never be allowed in an official store because they're DRM-free alternatives to big streaming services but still offer all the same content.

Do you know anyone who works in a professional creative field that doesn't involve writing code? If so, ask them how they'd feel about their work bring out there on the internet free to all takers. What the implications would be for their ability to feed their children and pay their mortgage doing the things they love.

This is what I mean by "programmer-brained." Of all creative workers, only programmers seem okay with abolishing IP laws, I guess because they figure they'll be okay living out of an office at MIT, or even worse out of an office at some YC startup that turns the user into the product. But artists, musicians, writers, filmmakers, etc. all put food on the table because of those IP laws programmers hate so much. Taking that protection for the fruit of your labor away would be at least as disruptive as AI has been.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#177

Post by kodebach »

pas wrote: post #165
WarmWash wrote: post #158

The judge told Google that Apple is not anti-competitive because Apple has no competitors on it's platform (this all stemming from the Epic lawsuits). Google listened. Blame the judge for one of the worst legal calls in recent history. Google is a monopoly and Apple is not. Simple fix for Google... Same comment I made a few days ago, I feel it bears repeating as much as possible until it's really driven home how detr…

Sorry, which exact ruling are you referring to? How did the court arrived at this finding (that seems irrelevant, false)?

It is a non-sensical ruling. But IIRC the reason was basically that while Apple and Google did basically the same shit, only Google kept a written record of their monopolistic behaviour, so only Google was found guilty.

However, there is a relevant court case here. The one about Samsung's "Auto Blocker" (https://arstechnica.com/gadgets/2025/07/samsung-and-epic-gam...). Epic Games sued because Samsung made it too hard to install apps from "untrusted" sources. This may be a reason why Google is now trying to make the process more difficult on the developer side instead.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#178

Post by asim »

I think we're about to see an explosion in "mini apps". It's taken 10+ years for us to catch up to WeChat and China but this regulation and other issues are going to block a lot of innovation and we're better off surfacing tiny PWA or SPA like apps that get loaded in native apps or we just do away with that entirely. The time has come.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#179

Post by [deleted] »

tadfisher wrote: post #157
Retr0id wrote: post #122

Earlier quoted context omitted.

I'm not sure if you understand what makes passkeys phishing-resistant? The backdoored version of the app would need to have a different app ID, since the attacker does not have the legitimate publisher's signing keys. So the OS shouldn't let it access the legitimate app's credentials.

Correction: nothing prevents the attacker from using the app's legit package ID other than requiring the uninstall of the existing app. The spoofed app can't request passkeys for the legit app because the legit app's domain is associated with the legit app's signing key fingerprint via .well-known/assetlinks.json, and the CredentialManager service checks that association.

[deleted]

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#180

Post by joshuamorton »

jeroenhd wrote: post #66
gjsman-1000 wrote: post #49

Earlier quoted context omitted.

> Stolen ID can be found for a lot less money than what a day in a scam farm's operation will bring in. Well, in that case, Google has an easy escalation path that they already use for Google Business Listings: They send you a physical card, in the mail, with a code, to the address listed. If this turns out to be a real problem at scale, the patch is barely an inconvenience.

So they'll have a lead time building up a set of verified developers. These scams are pulled by organized crime syndicates, using human trafficking and beatings to keep their call centers manned with complicit workers. Now they'll need to pay off a local mailman to give them all of Google's letters with an address in an area they control so they can register a town's worth of addresses, big whoop. It'll cost them a b…

> Now they'll need to pay off a local mailman to give them all of Google's letters with an address in an area they control so they can register a town's worth of addresses, big whoop. It'll cost them a bit more than the registration fee, but I doubt it'll be enough to solve the problem.

Yeah, this is a huge amount more work than, like, nothing.

Post reply on HN