Android's sideloading limits are its most anti-consumer move

Do you think the 100 most popular F-Droid apps do more spying than the 100 most popular Play store apps?

I used to work for Google, on Android security, and it's an ongoing philosophical debate: How much risk do you expose typical users to in the name of preserving the rights and capabilities of the tiny base of power users? Both are important but at some point the typical users have to win because there are far, far more of them.

The article implies that this move is security theater. It's not. I wasn't involved in this decision at all, but the security benefit is clear: Rate limiting.

As the article points out, Google already scans all the devices for harmful apps. The problem is knowing what apps to look for. Static analysis can catch them, dynamic analysis with apps running in virtual environments can catch them, researchers can catch them, users can report them... all of these channels are taken advantage of to identify bad apps and Google Play Protect (or whatever it's called these days) can then identify them on user devices and warn the users, but if bad actors can iterate fast enough they can get apps deployed to devices before Google catches on.

So, the intention here is to slow down that iteration. If attackers use the same developer account to produce multiple bad apps, the dev account will get shut down, requiring the attackers to create a new account, registered with a different user identity and confirmed with different government identification documents.

Note that in the short term this will just create an additional arms race. In order to iterate their malware rapidly, attackers will also need to fake government IDs rapidly. This means Google will have to get better at verifying the IDs, including, I expect, getting set up to be able to verify the IDs using government databases. Attackers will probably respond by finding countries where Google can't do that for whatever reason. Google will have to find some mitigation for that, and so on.

So it won't be a perfect solution, but in the real world, especially at Google scale, there are no perfect solutions. It's all about raising the bar, introducing additional barriers to abuse and making the attackers have to work harder and move slower, which will make the existing mechanisms more effective.

I mean, flagship vs flagship idk if one has ever been significantly cheaper, but I've never been in the market for those either. It's very easy to get a higher priced, more interesting, highly specced Android phone. Both iPhones and flagship android phones are way too expensive for what they are capable of compared to any of their own prior generations of themselves, if you ignore tech specs and consider the tangible end-user functionality, but even still.

I've always bought the phone that suits me in the moment, have never budgeted higher than $600CAD, and have simply never been interested in iPhones beyond what used to be nice industrial design. For that, last time I got a brand new Pixel 7 on sale, Pixel 4a, Nexus 5 etc.. and they've all done what I needed and usually came close to matching the fancier versions in some ways in the same year's lineup.

Usually though I have breadth of options to pick from across a range of brands that I can choose between based on whatever the hell I prefer. iPhones are just iPhones, bigger or smaller, more expensive or cheaper, big camera plateau or small, and that's all fine too.

The sideloading aspect for me and a better sense of control is absolutely a component in that preference, and I'll have to consider that going forward, but I'd sooner just dial back my dependence on phones in general than switch to an iPhone.