Live data from Hacker News

A theoretical way to circumvent Android developer verification

enaix.github.io

51–60 of 185 posts

Re: A theoretical way to circumvent Android developer verification

#51
post #33

I'm already banned from publishing Android apps through Google, but apart from that, what would stop me making a server you can upload any app to and sign it with my certificate?

That could actually be done solely on the device. You can develop an app to sign arbitrary APKs with users' own hobbyist certificate. Lucky Patcher have done that for a decade.

Re: A theoretical way to circumvent Android developer verification

#52
post #3

While it is technically feasible, it is not a good idea to try and find a technical solution to a people/organisation problem. Do not accept the premise of assholes. I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs. --- edit --- Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task…

The same EU that's doing Chat Control?

Re: A theoretical way to circumvent Android developer verification

#53

Earlier quoted context omitted.

You can use any country's SIM card in any other country, regardless of its registration status.

… if you have roaming coverage. And even in that case, doing this for a long period of time violates most roaming policies

Even with fair usage policy violations (like long term roaming) the prices are still quite reasonable: 1.30 EUR/GiB (+VAT); from next year 1.10 EUR/GiB (+VAT).

https://en.wikipedia.org/wiki/European_Union_roaming_regulat...

Re: A theoretical way to circumvent Android developer verification

#54

I think this means we need to rely on web technologies more. PWAs are looking pretty good on mobile devices these days and you can publish any web app you want with no reviewing authority. The web has a bunch of crazy APIs now that let you build crazy things and for everything else you're a hosted server away somewhere that can run more complex jobs. I believe devices I own should let me do whatever I want with them…

I thought Brent Simmons did a great job laying out why PWAs don't work: https://inessential.com/2025/10/04/why-netnewswire-is-not-we... The tl;dr is that a PWA implies an app which is based in the cloud. So suddenly you need a server, and you need to store user data, which means costs and dealing with privacy and security.

That explanation doesn't really make sense to me.

If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever.

You still have to host the static files for the webapp itself, but that can be made very cheap.

Of course, API feature parity between native and web apps is a separate issue. But the argument about server costs doesn't seem like a good one.

Re: A theoretical way to circumvent Android developer verification

#55

Earlier quoted context omitted.

I thought Brent Simmons did a great job laying out why PWAs don't work: https://inessential.com/2025/10/04/why-netnewswire-is-not-we... The tl;dr is that a PWA implies an app which is based in the cloud. So suddenly you need a server, and you need to store user data, which means costs and dealing with privacy and security.

That explanation doesn't really make sense to me. If something could be built as a native app without depending on a central server, it could also be built as a PWA without a central server. You don't need to store user data centrally at all, just because it's a webapp. You can just have the clients use localStorage or IndexedDB or whatever. You still have to host the static files for the webapp itself, but that can…

Isn't localStorage limited to 5 MB of data?

Re: A theoretical way to circumvent Android developer verification

#56
post #3

While it is technically feasible, it is not a good idea to try and find a technical solution to a people/organisation problem. Do not accept the premise of assholes. I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs. --- edit --- Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task…

What's wrong with lineage?

You have to get some of the big names to unlock the bootloader first. The trend towards locking it off permanently is alarming.

Edit: Google could ultimately use that as a lever in licensing deals with manufacturers. It'd marginalize everything.

Re: A theoretical way to circumvent Android developer verification

#58
post #3

While it is technically feasible, it is not a good idea to try and find a technical solution to a people/organisation problem. Do not accept the premise of assholes. I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs. --- edit --- Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task…

The same EU that's doing Chat Control?

The same EU of which parts are trying to make chat control work and are once again abandoning it. Politician get this particular fancy idea every other year in all kinds of countries, not just EU. Overreach out of desperation for a problem that cannot simply be solved is wrong but understandable.

Re: A theoretical way to circumvent Android developer verification

#59

I think this means we need to rely on web technologies more. PWAs are looking pretty good on mobile devices these days and you can publish any web app you want with no reviewing authority. The web has a bunch of crazy APIs now that let you build crazy things and for everything else you're a hosted server away somewhere that can run more complex jobs. I believe devices I own should let me do whatever I want with them…

You need native apps to access specific hardware, and to run some native code. WASM may help but it's limited, too.

Re: A theoretical way to circumvent Android developer verification

#60
While neat, it glosses over the actual problem, while maybe not even solving it (depending on what you deem the problem to be in the first place). It solved the immediate problem today, but not in a way that's going to remain solved.

I'd imagine Google would plug any major holes in their soon to be closed garden, assuming that is their intention. So this and any other fix to the problem of 'install app through not-Google Play' that goes via technical means that Google can just cover up after a month or two doesn't actually move the needle any meaningful amount.

In the same vein, using adb isn't a real solution to that same problem for most people, since having to use adb is a massive jump in required effort that's going to leave all the normies behind, with only the super-dedicated willing to go through the hassle, and an equivalent amount of developer effort is going to be left behind as well, since their audience just got decimated, and they themselves might not even bother to develop something that even their dad or sister is going to bother/be able to install. Anything that's much more complicated than 'go to website, download thing, run thing, click your way through' doesn't solve for this.

The actual problem is to have Google not be knobheads about it, and the only way that's realistically going to happen is through the law, but that's not looking all that likely in my view.

Post reply on HN