Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

671–680 of 694 posts

Re: Android developer verification: Early access starts

#671

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #500
rom1v wrote: post #342

I want to be able to install apps from alternative app stores like F-Droid and receive automatic updates, without requiring Google's authorization for app publication. Manually installing an app via adb must, of course, be permitted. But that is not sufficient. > Keeping users safe on Android is our top priority. Google's mandatory verification is not about security, but about control (they want to forbid apps like R…

If "automatic updates" were optional and off-by-default then users would not be vulnerable to something like SimpleMobileTools Why not let the user decide Letting someone else decide has potential consequences Using F-Droid app ("automatic updates") is optional, as it should be "Automatic updates" is another way of saying "allow somone else to remotely install software on this computer" Some computer owners might not…

"Automatic updates" is "remote code execution (RCE)" by permission

Given the frequent complaints about the former, the notion of "permission" is dubious

Re: Android developer verification: Early access starts

#672

Post by Groxx »

reorder9695 wrote: post #656
Groxx wrote: post #144

Earlier quoted context omitted.

yes, they're admitting that their APIs are powerful enough to build accessibility tools (which often must read notifications) and many other useful things (e.g. Pushbullet) that are not possible on iOS. powerful stuff has room for abuse. I didn't really think there's much of a way to make that not the case. it's especially true for anything that you grant accessibility-level access to, and "you cannot build accessibi…

I mean the solution really is a comprehensive permissions system, for an accessibility system that needs to read notifications you should be able to deny it network permissions and whitelist which app's notifications it's allowed to read

entirely agreed, but in the context of this thread that means you just have to convince someone to enable it for the one app, rather than the phone as a whole. which doesn't seem to help at all with the coercion scenario (if anything that might make it safer-sounding and therefore easier), just under normal use / to limit possibly-malicious apps.

Re: Android developer verification: Early access starts

#673

Post by NoGravitas »

noname120 wrote: post #392
izacus wrote: post #266

Earlier quoted context omitted.

All Android devices require signed binaries and have done so since 1.0.

Red herring. Self-signed certificates have always been accepted, and generating a certificate is a one-liner: keytool -genkeypair -keystore mykey.jks -alias myalias -keyalg RSA The public testkey certificate is also accepted so you don’t even need to generate one.

Yes, but then when you update the app, it has to be signed with the same certificate. Android effectively uses TOFU for apk signatures.

Re: Android developer verification: Early access starts

#674

Post by NoGravitas »

AdmiralAsshat wrote: post #591

In light of Google's recent push to eliminate this, I went and installed F-Droid to see what we'd be losing. I had thought about it for years, but always held off on doing it on my daily driver phone because I simply didn't want to open the floodgates on allowing apps to start randomly installing on my phone. But having done it, I'm actually pretty impressed with the existing security. At least on my S24, you have to…

You can also de-whitelist your file manager app from installing apps after you install F-Droid.

Re: Android developer verification: Early access starts

#675

Post by Hizonner »

johnnyanmac wrote: post #646
Hizonner wrote: post #598

Earlier quoted context omitted.

You know what? That's bullshit. Anybody slightly competent can put horrendous back doors into any code, in such a way that they will pass F-Droid's "checks", Apple's "checks", and Google's "checks". Source code is barely a speed bump. Behavioral tests are a joke.

Anyone determined enough can break into any house. If not through ingenuitiy, then by a brick to your window. Doesn't mean we shouldn't lock our doors, turn off our lights, and close our curtains anyway. The fortunate thing is that 99% of people won't bother trying to break your app if it's not dead simple. Advanved security mechanisms to check for backdoors is probably something only billionaire tech companies need…

You totally misunderstand the threat model. It's not about anybody breaking your app. It's about people making their own apps do things they're not supposed to do.

... and there's always a tradeoff in terms of how much of a deterrent anything is. The app store checks are barely measurable.

Re: Android developer verification: Early access starts

#676

Post by AnthonyMouse »

astafrig wrote: post #664
AnthonyMouse wrote: post #652

Earlier quoted context omitted.

It's like a company buying all the land within a 100 mile radius and then nominally "selling" plots to people but with terms of service attached that restrict what you can do with the land you bought and that allow the company to change the terms at any time. And then, after people have moved in, most of them having not even read the terms or realized it wasn't an ordinary sale, they start enforcing the terms against…

> nominally "selling" plots to people but with terms of service attached that restrict what you can do with the land you bought and that allow the company to change the terms at any time. So, a lease.

That's, to begin with, not even how a lease generally works. A lease isn't where you pay once up front to take permanent possession of something.

Moreover, did people buying iPhones on "day 1" think they were buying them or leasing them? Did Apple call it a sale or a rental agreement?

Re: Android developer verification: Early access starts

#677

Post by Spivak »

AnthonyMouse wrote: post #655
Spivak wrote: post #619

Earlier quoted context omitted.

But the ruling is correct. You can't have it both ways, if you invite competition you're not allowed to be anti-competitive. You can be Nintendo, offer a single store, only allow first party hardware, and exercise total control over your product. Then your anticompetitive behavior can only be evaluated externally. But if you open yourself up to internal competition with other phone vendors, other stores, and then you…

> You can be Nintendo, offer a single store, only allow first party hardware, and exercise total control over your product. How is this not even more anti-competitive? It's fine to be mad at Google for being duplicitous, but treachery is in the nature of false advertising or breach of contract. Antitrust is something else. "You can monopolize the market as long as you commit to it from the start" seems like the text…

You can't monopolize a market where there is no market. Nintendo can be anticompetitive in the wider games industry, but there is no market for software that runs on a Switch.

I didn't say I liked the ruling, just that it's correct. The opposite conclusion would be absurd, that you can invent a market where there isn't one and claim a company has a monopoly over it. You would be asking the court to declare that every computing device is a de facto marketplace for software that could run on it and that you can't privilege any specific software vendor. I would love if that were true but you can hopefully agree that such a thing would be a huge stretch legally.

Re: Android developer verification: Early access starts

#678

Post by AnthonyMouse »

Spivak wrote: post #677
AnthonyMouse wrote: post #655

Earlier quoted context omitted.

> You can be Nintendo, offer a single store, only allow first party hardware, and exercise total control over your product. How is this not even more anti-competitive? It's fine to be mad at Google for being duplicitous, but treachery is in the nature of false advertising or breach of contract. Antitrust is something else. "You can monopolize the market as long as you commit to it from the start" seems like the text…

You can't monopolize a market where there is no market. Nintendo can be anticompetitive in the wider games industry, but there is no market for software that runs on a Switch. I didn't say I liked the ruling, just that it's correct. The opposite conclusion would be absurd, that you can invent a market where there isn't one and claim a company has a monopoly over it. You would be asking the court to declare that every…

> You can't monopolize a market where there is no market. The opposite conclusion would be absurd, that you can invent a market where there isn't one and claim a company has a monopoly over it.

There is no such thing as "there is no market". There is always a market. The question is, what's in the market? The typical strategy is to do the opposite -- have Nintendo claim that they're competing with Sony and Microsoft in the same market to try to claim that it isn't a monopoly.

But then the question is, are they the same market? So to take some traditional examples, third party software that could run on MS-DOS could also run on non-Microsoft flavors of DOS. OS/2 could run software for Windows. The various POSIX-compliant versions of Unix and Linux could run the same software as one another. Samsung phones can run the same apps as Pixel phones. Which puts these things in the same market as each other, because they're actually substitutes, even though they're made by different companies.

Conversely, you can't run iOS apps on Android or get iOS apps from Google Play or vice versa. It's not because they're different companies -- both of them could support both if they wanted to -- it's that they choose not to and choices have consequences.

If you intentionally avoid competing in the same market as another company then you're not competing in the same market as that company and the absurdity is trying to have it both ways by doing that and then still wanting to claim them as a competitor.

Re: Android developer verification: Early access starts

#679

Post by johnnyanmac »

Hizonner wrote: post #675
johnnyanmac wrote: post #646

Earlier quoted context omitted.

Anyone determined enough can break into any house. If not through ingenuitiy, then by a brick to your window. Doesn't mean we shouldn't lock our doors, turn off our lights, and close our curtains anyway. The fortunate thing is that 99% of people won't bother trying to break your app if it's not dead simple. Advanved security mechanisms to check for backdoors is probably something only billionaire tech companies need…

You totally misunderstand the threat model. It's not about anybody breaking your app. It's about people making their own apps do things they're not supposed to do. ... and there's always a tradeoff in terms of how much of a deterrent anything is. The app store checks are barely measurable.

The app store checks are barely measureable, yes. Hence why being open source is the best check for any undocumented changes. Even if it's not discovered on FDoid, reports will come out for those who dig. Much easier to view source code than decompiling an APK to analyze.

But at some point there needs to be some level of trust in anything you install. You can't rely on institutions to make sure everything is squeaky clean. They can't even do that on content platforms (or at least, they choose not to afford it).

Re: Android developer verification: Early access starts

#680

Post by Spivak »

AnthonyMouse wrote: post #678
Spivak wrote: post #677

Earlier quoted context omitted.

You can't monopolize a market where there is no market. Nintendo can be anticompetitive in the wider games industry, but there is no market for software that runs on a Switch. I didn't say I liked the ruling, just that it's correct. The opposite conclusion would be absurd, that you can invent a market where there isn't one and claim a company has a monopoly over it. You would be asking the court to declare that every…

> You can't monopolize a market where there is no market. The opposite conclusion would be absurd, that you can invent a market where there isn't one and claim a company has a monopoly over it. There is no such thing as "there is no market". There is always a market. The question is, what's in the market? The typical strategy is to do the opposite -- have Nintendo claim that they're competing with Sony and Microsoft…

You avoided the important part, there is no market for hardware that can play Nintendo Switch games and there is no market for software providers on Nintendo Switch. And they are legally allowed to do that. You can sell appliances that are bound to a single vendor and you are allowed to not license your hardware or software to 3rd parties.

Since that is a legally permissible action it would be an odd thing for a court to declare that doing such a thing is anticompetitive. If they did they would be declaring all locked down hardware effectively illegal. And while that might be nice it's a bit of a pipedream. Where Google fucked up is that they did license their software to 3rd parties—good for them. But then Google had some regrets and didn't like the fact that they didn't have control over those 3rd parties. But they did have some leverage in the form of Google Play and GSM because users expect it to be there on every Android phone. And then they used that leverage. That's the fuckup. They used Google Play and GSM access to make 3rd parties preinstall Chrome and kill 3rd party Android forks. They used anticompetitive practices on their competitors—other Android device manufacturers.

This situation can't occur for Apple or Nintendo because there aren't other iOS/Switch device manufacturers and they don't have to allow them to exist. They can be anticompetitive for other reasons but not this.

Post reply on HN