Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we talk about when we talk about sideloading

f-droid.org

Post reply on HN
Print view View original

301–310 of 646 posts

Re: What we talk about when we talk about sideloading

#301

Post by marcprux »

1vuio0pswjnm7 wrote: post #253
marcprux wrote: post #27

Author here. I admit I am rather startled by the tone of many comments here and the accusations of disingenuity. Splitting hairs about the origin of the term "sideload" does not change the fact that those who promote the term tend to do so in order to make it feel deviant and hacker-ish. You don't "sideload" software on your Linux, Windows, or macOS computer: you install it. You have the right to install whatever you…

Could you make the claim that F-Droid is actually safer than "Google Play Store" The plea Google makes against so-called "sideloading" always refers to "malware" But how much malware has been distributed via F-Droid versus "Google Play Store" It could be that smaller, independent "app store" might be better managed than Google's

> Could you make the claim that F-Droid is actually safer that "Google Play Store"

That is essentially the assertion that we made in the prequel to this post (at https://f-droid.org/en/2025/09/29/google-developer-registrat...).

> But how much malware has been distributed via F-Droid versus "Google Play Store"

There's been only a single case of malware that we know of that has slipped into distribution on F-Droid (through a supply-chain attack on a transitive dependency), and it was caught within a day. So if we were feeling glib, we might have made the claim that "there is over 224 times as much malware on the Play Store than on F-Droid".

Re: What we talk about when we talk about sideloading

#302

Post by necovek »

terminalshort wrote: post #274
kragen wrote: post #87

Earlier quoted context omitted.

> 2. Having an approved channel for verified app loading is a valuable security tool and greatly reduces the number of malicious apps installed on users devices I would instead say that having a trustworthy channel for verified app loading is a valuable security tool. F-Droid is such a channel; the Google Play Store is not. So Google is trying to take this valuable security tool away from users.

"Trustworthy" requires a qualifier of "for what" and I do trust Google to not intentionally install malware on my device and to take reasonable steps to prevent other people from doing it. I will admit that I don't know the details of how the app stores work, but they are at least checking the hashes of the binaries right? The probability of trying to install Instagram from Meta, but actually installing Instapwned fr…

Yes, but app stores like F-Droid, if you trust them, provide an even stronger security statement: they guarantee that you can check out the full source code of the app you are running.

This is what has made Linux distributions the go to for secure OS to run on your server: even if malware or bug leaks in, you have a full security trail about when and how that happened right in the open.

Re: What we talk about when we talk about sideloading

#303

Post by hansvm »

zouhair wrote: post #186
kuratkull wrote: post #151

Earlier quoted context omitted.

That's also a large part of the issue IMO. I currently _have_ root on my rooted and Lineaged Poco F3. But as hardware attestation is becoming the norm I am deeply worried about the future. I have been a pretty eager Android fan due to its achievable-if-savvy openness. If I lose root and sideloading, then Android is dead to me. There would be nothing valuable in it, just another corporate walled garden.

I have no idea what to do when they lock everything up. I just hope my bank app works with a non google phone.

My HSA just implemented some bullshit where even the web interface requires a near-new phone to even log in. For now I'm just switching HSA providers rather than buying a new phone. I'm also worried about the future.

Re: What we talk about when we talk about sideloading

#304

Post by marcprux »

eminence32 wrote: post #234
marcprux wrote: post #203

Earlier quoted context omitted.

adb is a developer tool. You need a tethered and trusted computer to be able to transfer an app using adb, and you need to enable "developer mode" on the device, which is an arcane dance that involves navigation through an obscure tree of settings and then quickly tapping a mystery spot 5+ times. Google can't block adb, because that is how Android apps are developed and tested, just how Apple cannot block their devel…

> just how Apple cannot block their developer tools from being able to transfer apps onto an iPhone. If I recall correctly (I might be wrong, because this was 10+ years ago), but Apple did exactly this when the iPhone was first released. When the iPhone first came out, Apple released its XCode devtools for free, including an iOS emulator that you could use to test your iPhone app. But you had to pay a $99 USD per yea…

You recall correctly, but that did end in 2015, when Apple ended the requirement that developers sign up for their paid developer program to be able to develop and test iPhone apps. I've written about that elsewhere: https://appfair.org/blog/gpl-and-the-app-stores#fn:3

The adb workaround for Android is essentially on par with being able to use Xcode's tooling to install apps on an iPhone: technically possible without paying a fee, but enough friction that no one would seriously consider as an alternative solution for publishing their apps to a general audience.

Re: What we talk about when we talk about sideloading

#305

Post by nhumrich »

As a power user, and software creator, I absolutely hate this decision. Side loading and power features are a main reason I use android.

That being said, as a grandchild, I also completely understand where google is coming from. A surprisingly high percentage of users do need protecting from themselves. They are so technology illiterate that someone random tells them to install something, "it will say it's not safe, but it's actually okay, just click approve" and they will. This is why HSTS exists, to prevent uneducated users from getting pwned, by preventing them from disabling safeguards.

So, having some system of "no really, I am a power user" makes sense, even if I hate it.

Re: What we talk about when we talk about sideloading

#306

Post by akerl_ »

necovek wrote: post #287
akerl_ wrote: post #249

Earlier quoted context omitted.

"why not" isn't a compelling case for something to be a fundamental right. I'm not saying I dislike the concept of being able to run my own code on my devices. I love it. I do it on several devices, some of which involve circumventing manufacturer restrictions or controls. I just don't think that because manufacturers started using the same chips in phones as computers, they magically had new requirements applied to…

You've asked for an intrinsic difference between a class of devices: no, you are unlikely to want to run general purpose apps on your washing machine. Yes, you are likely to do so on your smart phone. Probable on your modern "smart TV". Low probability on your eReader. Legislation like EU Cybersecurity Act hopefully pushes things into more of a fundamental rights thing by demanding that devices don't go into the tras…

I'm not asking for an intrinsic difference: I'm suggesting that if "I can install custom applications/code on this device I own" is a fundamental right, there would need to be an intrinsic difference. My personal opinion is that there is not an intrinsic difference. That "I want to do it to these devices and not those" can't be the justification for it being a right that I'm able to.

Re: What we talk about when we talk about sideloading

#307

Post by qiqitori »

marcprux wrote: post #203
dataflow wrote: post #166

Earlier quoted context omitted.

Hey, question. While I'm also miffed about Google's decision and see your point about the term sideloading, there is another elephant in the room you seem to not be addressing here. You write: > “Sideloading is Not Going Away” is clear, concise, and false_ But isn't Google saying that you will still be able to sideload via ADB ? Which would mean their statement is true, and that your claim that Google's statement is…

adb is a developer tool. You need a tethered and trusted computer to be able to transfer an app using adb, and you need to enable "developer mode" on the device, which is an arcane dance that involves navigation through an obscure tree of settings and then quickly tapping a mystery spot 5+ times. Google can't block adb, because that is how Android apps are developed and tested, just how Apple cannot block their devel…

I think your position is valid.

Note: Apple restricts apps uploaded with Xcode, (depending on how it is signed I believe) to 7 days or 1 year. adb currently doesn't have this limit.

But what if they find that somebody made 'sideloading' 'too easy' again. E.g. somebody could come up with the idea of running adb or an adb emulator on another phone, or even a small hardware dongle, integrating it with a pretty UI that looks like a regular app shop. Then their currently proposed new rule would become ineffective and due to whatever thought process they arrived at their current conclusion, could place similar limits on adb.

Re: What we talk about when we talk about sideloading

#308

Post by asveikau »

marcprux wrote: post #27

Author here. I admit I am rather startled by the tone of many comments here and the accusations of disingenuity. Splitting hairs about the origin of the term "sideload" does not change the fact that those who promote the term tend to do so in order to make it feel deviant and hacker-ish. You don't "sideload" software on your Linux, Windows, or macOS computer: you install it. You have the right to install whatever you…

This community has pockets of people who like authoritarian control, and genuinely believe in Apple or Google Play as some kind of superego that they need to defend, that they believe is protecting us.

This surfaces in many types of discussions, including discussions where they may be prompted to defend the locked down nature of mobile devices.

I say it's just pockets. A vocal pocket. It's not everyone here. But it elicits comments justifying that stuff, which can feel surprising for those who don't share those views.

Re: What we talk about when we talk about sideloading

#309

Post by seany »

1vuio0pswjnm7 wrote: post #253
marcprux wrote: post #27

Author here. I admit I am rather startled by the tone of many comments here and the accusations of disingenuity. Splitting hairs about the origin of the term "sideload" does not change the fact that those who promote the term tend to do so in order to make it feel deviant and hacker-ish. You don't "sideload" software on your Linux, Windows, or macOS computer: you install it. You have the right to install whatever you…

Could you make the claim that F-Droid is actually safer than "Google Play Store" The plea Google makes against so-called "sideloading" always refers to "malware" But how much malware has been distributed via F-Droid versus "Google Play Store" It could be that smaller, independent "app store" might be better managed than Google's

I don't even understand how this is an interesting or relevant point. "Can I install what I want on my service how and when I want" is the end of the conversation.

Re: What we talk about when we talk about sideloading

#310

Post by znort_ »

marcprux wrote: post #27

Author here. I admit I am rather startled by the tone of many comments here and the accusations of disingenuity. Splitting hairs about the origin of the term "sideload" does not change the fact that those who promote the term tend to do so in order to make it feel deviant and hacker-ish. You don't "sideload" software on your Linux, Windows, or macOS computer: you install it. You have the right to install whatever you…

>You have the right to install whatever you want on your computer, regardless of whether that computer is on your desk or in your pocket. That's a hill I'll die on. I'm dismayed to see that this sentiment is not more widespread in this of all communities.

agreed, but i'm not going to die on any hill. i don't see much point in this discussion, these corps will do whatever they like. for me it is simple: iphone never was an option precisely because of this reason, and i've been quite content with android, but i don't think my current smartphone will run android for much longer, and the next one will definitely not.

Post reply on HN