Live data from Hacker News

Answering questions about Android developer verification

android-developers.googleblog.com

31–40 of 128 posts

Re: Answering questions about Android developer verification

#31
post #28

This isn't so bad. Unlike other mobile OSes (namely iOS and HarmonyOS), you will still be able to install whatever you like on Android over a USB debugging connection (adb) without any developer verification. It doesn't take much effort to enable Developer Options, plug into a laptop and run "adb install whatever.apk". It's kind of like the floppy disk era again, having to physically insert things into one's computer…

Taking away adb install should be the next step. It's a slippery slope

Re: Answering questions about Android developer verification

#32

Yep, it's as bad as everyone expected it to be. "We aren't taking away sideloading, we're just going to fully control it now! No Google-unapproved code on user devices! For security reasons!" Chrome isn't enough. We need Android to get clawed away from Google too.

Not really though, as you can still install apps over adb without developer verification, same as always.

Re: Answering questions about Android developer verification

#33

I'm not an android developer, so I'm missing some context and key information. But I have a question: When Google is asking developers to "register" their apps as part of this new program, are they just trying to keep a mapping from some code signing key to a government ID? Or are they trying to do a code review process that is similar to submitting to an app store? I know both are objectionable in their own way, but…

The first one for sure, second one — to an extent. If you publish “objectionable” apps (we are told this will be used to combat malware) — your certificate will be revoked.

Re: Answering questions about Android developer verification

#35
post #31
post #28

This isn't so bad. Unlike other mobile OSes (namely iOS and HarmonyOS), you will still be able to install whatever you like on Android over a USB debugging connection (adb) without any developer verification. It doesn't take much effort to enable Developer Options, plug into a laptop and run "adb install whatever.apk". It's kind of like the floppy disk era again, having to physically insert things into one's computer…

Taking away adb install should be the next step. It's a slippery slope

Is there any evidence that Google plan to do this?

Re: Answering questions about Android developer verification

#37
post #32

Yep, it's as bad as everyone expected it to be. "We aren't taking away sideloading, we're just going to fully control it now! No Google-unapproved code on user devices! For security reasons!" Chrome isn't enough. We need Android to get clawed away from Google too.

Not really though, as you can still install apps over adb without developer verification, same as always.

You can sideload apps in ios too, but you may not run it.

Re: Answering questions about Android developer verification

#38
post #28

This isn't so bad. Unlike other mobile OSes (namely iOS and HarmonyOS), you will still be able to install whatever you like on Android over a USB debugging connection (adb) without any developer verification. It doesn't take much effort to enable Developer Options, plug into a laptop and run "adb install whatever.apk". It's kind of like the floppy disk era again, having to physically insert things into one's computer…

At least as far as I understand, this would be a huge issue for F-Droid, to the extent that it isn't clear if it can continue at all. Half of my apps come from there, and gets automatically updated. Starting to download APKs manually and install them with ADB isn't impossible, but a huge downside.

Re: Answering questions about Android developer verification

#39
post #23

So this is saying you have to have an Android developer account and sign the app with your identity… so a one-time $25 cost and that’s it? You can still distribute and sideload apps as long as you sign them. Microsoft does this for Windows apps if you don’t want scary warnings popping up everywhere. Apple doesn’t even let you sideload at all for iOS and for macOS they do the forced trash malware thing unless you run…

The fact that other platforms do something similar is not an excuse, and this is more restrictive than both windows and macOS, even if technically less restrictive than iOS.

(The fact that all those platforms still have malware, as well as the officially sanctioned google store, should also inform you about how effective this measure is for its stated goal)

Re: Answering questions about Android developer verification

#40
post #23

So this is saying you have to have an Android developer account and sign the app with your identity… so a one-time $25 cost and that’s it? You can still distribute and sideload apps as long as you sign them. Microsoft does this for Windows apps if you don’t want scary warnings popping up everywhere. Apple doesn’t even let you sideload at all for iOS and for macOS they do the forced trash malware thing unless you run…

I'm guessing Windows gets a pass because you can still fairly easily bypass the signature check - it's effectively a warning rather than a hard block. It sounds like for (mainstream) Android, the only workaround will be to plug it into a PC and use adb there to install an unsigned app, which is considerably harder. Installing a custom ROM will presumably get around it too, but that's tough, and various government and banking apps etc tend to refuse to run because of attestation.

Apple is of course locked down, but that's not news. The anger is because Android was the better option on this dimension.

Post reply on HN