Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

561–570 of 694 posts

Re: Android developer verification: Early access starts

#561

Post by callc »

ramshanker wrote: post #233

Ancedotal: I used to believe in this "freedom to install". Than my Father got scammed (~$1000) in the name of Electricity recharge. The APK was sent over WhatsApp. Now I am not so sure how to implement this freedom. At the bare minimum there has to be big red warnings. One thing which can immediately improve security is forbidding SMS read access forever. Just like Apple does. No App should be able to read SMS.

Freedom and protecting tech illiterate people are not mutually exclusive.

Our right to choose install software on our own devices should not be encroached because over-trusting elderly follower scammers instructions.

We can protect people like your dad with an opt-in system like parental controls. Have a responsible family member lock the system down however you deem fit.

Re: Android developer verification: Early access starts

#562

Post by devsda »

croemer wrote: post #408

Actual title is "Android developer verification: Early access starts now as we continue to build with your feedback" Two key announcements: > we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. > We are using your input to shape a dedicated account type for students and hobbyists. This will allow you to distribute your creations to a limite…

Doesn't it mean Google will collect the app ids of all installs on all devices whether they are signed into an account or not.

I'm not naive to think its not happening today, whats probably new is them admitting to it.

How long does it take them to use that info to drop ban hammer on the user accountd for using apps like newpipe and hide behind reasons like violation of TnCs.

Re: Android developer verification: Early access starts

#564

Post by u8080 »

Arnt wrote: post #544
u8080 wrote: post #487

Earlier quoted context omitted.

Could have been easily solved by granting it by default, but I doubt that was original intent.

Well, the original intent was to ask the user for permission at installation time, which turned out to be a poor idea after a while. Perhaps you mean that it would have been simple to change the API in some particular way, while retaining compatibility with existing apps? If I remember the timeline correctly, which is far from certain, this happened around the same time as Android passed 100k apps, so a fairly strong…

I mean, just make it "Granted" by default and give user ability to control it. Permissions API was already broken few times(i.e. Location for bluetooth and granular Files permissions)

Re: Android developer verification: Early access starts

#565

Post by jMyles »

> Keeping users safe on Android is our top priority.

I'm really over third parties telling me that my safety is their priority. Unless you're transporting my body (ie, airline, ride share, etc), then I really don't need you to be looking out for my safety. See the problem is: when you do look out for my safety, you do it by giving yourself control over my life that is not healthy for either of us.

Let my safety be my concern, and the functionality of your product can be your top priority.

Re: Android developer verification: Early access starts

#566

Post by CodeMage »

binkHN wrote: post #508
1vuio0pswjnm7 wrote: post #500

Earlier quoted context omitted.

If "automatic updates" were optional and off-by-default then users would not be vulnerable to something like SimpleMobileTools Why not let the user decide Letting someone else decide has potential consequences Using F-Droid app ("automatic updates") is optional, as it should be "Automatic updates" is another way of saying "allow somone else to remotely install software on this computer" Some computer owners might not…

> If "automatic updates" were optional and off-by-default then users would not be vulnerable to something like SimpleMobileTools The problem is the vast majority of users want this on by default; they don't want to be bothered with looking at every update and deciding if they should update or not.

The vast majority of users want their apps to work. They don't care whether that happens through automatic updates or not.

It's the developers who don't want the headache of not having automatic updates.

Re: Android developer verification: Early access starts

#567

Post by nandomrumber »

prmoustache wrote: post #528
nandomrumber wrote: post #412

Earlier quoted context omitted.

It’s been a few months since I used an Android device. What was the process? Enable developer mode and grant ’can install apps’ to a browser or file browser? Am I remembering this correctly? The only other step is to download a file from the internet, or otherwise receive one. That’s not a technical-knowledge step though

no, that is not done via developer mode. When You download or try to open an apk from any app, it asks you if you want to allow it to install apps and send you to the configuration dialog. You still have to validate the app installation manually tbrough another dialog. In that case I usually leave the config dialog open while the app is installed, then disable the app permission right after install because that optio…

Point being: it’s easier than my middle aged blue collar tradesman’s brain remembered it.

The comment I replied to tried to tell us some technical knowledge required.

Doesn’t sound like it?

Re: Android developer verification: Early access starts

#568

Post by pxc »

rom1v wrote: post #342

I want to be able to install apps from alternative app stores like F-Droid and receive automatic updates, without requiring Google's authorization for app publication. Manually installing an app via adb must, of course, be permitted. But that is not sufficient. > Keeping users safe on Android is our top priority. Google's mandatory verification is not about security, but about control (they want to forbid apps like R…

And of course, code signing can't protect you from such a thing. When software publishing rights get bought, so (usually) do the signing keys.

Curation (and even patching) by independent, third-party volunteers with strong value commitments does protect users from this (and many other things). Code signing is still helpful for F/OSS distributions of software, but the truth is that most of the security measures related to app installation serve primarily to solve problems with proprietary app markets like Google's Play Store and Apple's App Store. Same thing with app sandboxing.

It's unfortunate but predictable when powerful corporations taint genuine security features (like anti-tampering measures, built-in encryption devices, code signing, sandboxing, malware scanning, etc.) by using them as instruments of control to subdue their competitors and their own users.

Re: Android developer verification: Early access starts

#569

Post by Dilettante_ »

stavros wrote: post #550
Dilettante_ wrote: post #539

Earlier quoted context omitted.

There is a distinction between installing something via the primary or a secondary mechanism. If someone said I just had to "install" a windows program and it turned out I had to compile it from scratch and set all the registry entries myself, I would be "astonished"(as in: The Principle Of Least Astonishment). I fully understand that language matters and if this was an attempt by Google to de-legitimize this way of…

I don't see why you'd be astonished here. The Play Store downloads the APK and installs the APK. If you've downloaded it already (eg with a browser), you just install the APK. How is that comparable to compiling from scratch and setting the registry entries yourself?

About five clicks more(than a single click) and a scary safety setting to turn off. But I didn't mean that installing an apk was as involved as my windows example. That was meant to illustrate that there are two completely different lines of action, two completely different levels of user competence at play.

Installing from the play store involves exactly zero knowledge of what an apk even is.

I want to flip the question around and ask you: How are you not seeing that there is a distinction?

Re: Android developer verification: Early access starts

#570

Post by notepad0x90 »

curtisnewton wrote: post #344
notepad0x90 wrote: post #268

Earlier quoted context omitted.

Then i guess you can't publish apps? One of those issues where i should be "writing to my congressman" or whatever I guess. the problem is real and people like you are being obtuse, unwilling to find a solution or a compromise. Something as simple as number of installs is an invasion of privacy? how? it's a number, you increment a counter when someone hits download, that's it. Yeah, if google gets to have rules over…

> Then i guess you can't publish apps? I want to distribute apps (someone might also want to simply sell them), not publish them I don't need a publisher, internet is a publishing media already > you don't have the right to publish to the android platform then let me install an alternative OS on the HW i legally bought and own or pay me back. > the harms caused by malware and malicious actors life is full of people d…

> life is full of people doing harms and malicious actors, but we don't let Google or any other company gatekeep our lives

Yeah, you're certainly not speaking for malware victims here. android is not your life, so google gatekeeping android (actually only google approved builds) is not gatekeeping your life.

You certainly should be able to load an alternative OS. isn't that what lineage and other android distributions do already?

Post reply on HN