Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification: Threat masquerading as protection

f-droid.org

Post reply on HN
Print view View original

721–730 of 793 posts

Re: Android Developer Verification: Threat masquerading as protection

#721

Post by musictubes »

sambuccid wrote: post #593
maxloh wrote: post #566

Earlier quoted context omitted.

Usability-wise, they are no match for Android and iOS—or even versions of them from five years ago. UI/UX is costly, and most FOSS projects cannot get it right without massive investments from enterprises (e.g., Red Hat's UX designers heavily contributed to GNOME) or startups (e.g., Zed, Element, Bluesky). Projects without that backing are mostly unusable, at least from a Gen Z perspective.

I agree that the usability is behind, as we would expect. For me mainly is about missing apps and some hardware support. But in terms of UX for example I liked using SailfishOS, although I'll admit the UI needs some getting used to. But I prefer this to the feeling that I'm being limited on what I can do on Android/Apple, and the worry of being in a duopoly that allows the companies to worsen their products without e…

Aren't you much more limited by not having access to the vast majority of apps built for Android and iOS? The limitations imposed by Apple and Google have led to thriving software systems. Being free to hack as you want on the system won't help most people if they don't have access to the software people want.

Re: Android Developer Verification: Threat masquerading as protection

#722

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #565
hollow-moe wrote: post #188

Earlier quoted context omitted.

And all are useless because you can't use your mandatory bank or gov id app.

This bogus "justification" for not considering any alternative, non-corporate mobile OS on any phone makes no sense HN commenters will not let it go Most HN readers have multiple computers, including multiple phones There is no requirement that one has to run a closed-source banking or government ID app on the same phone as open-source apps, e.g., apps from F-Droid And it ignores countless people who do not and will…

"Smartphones" are not general purpose computers

If a bank or government requires use of a "smartphone app" then this does not mean this smartphone must be used for any other purpose(s)

Nothing forces someone to install the app on every smartphone they own

These required apps do not prevent anyone with multiple smartphones from using alternative OS, i.e., not Android or iOS, on some of them

Re: Android Developer Verification: Threat masquerading as protection

#723

Post by [deleted] »

noosphr wrote: post #400
Forgeties79 wrote: post #391

Earlier quoted context omitted.

This is a textbook “bad faith” argument. Just because someone is part of a particular demographic doesn’t mean they are suddenly incapable of harming them.

You were so close to realizing class is the only thing that matters. But thankfully a good western education make that thought impossible.

[deleted]

Re: Android Developer Verification: Threat masquerading as protection

#725

Post by kalx »

grapheneos wrote: post #617
tredre3 wrote: post #510

Earlier quoted context omitted.

> An end-of-life Xiaomi device with no privacy or security patches for the firmware, Linux kernel, drivers and HALs for years doesn't provide the bare minimum for protecting user privacy and security. Your very rigid view of the world is so distorted to the point of being absurd. You know damn well that the vast, vast majority of spying on Android is done in userspace. A good OS that allows you to remove permissions…

> Your very rigid view of the world is so distorted to the point of being absurd. You know damn well that the vast, vast majority of spying on Android is done in userspace. Most local privilege escalation (LPE) attacks used to escape the app sandbox, browser renderer sandbox or other sandboxes are done with kernel exploits. There are plenty of LPE vulnerabilities in AOSP userspace code but plenty in the userspace dri…

Thanks for this. I wish it was an easy way to market this info to the wider non technical audience. It is a huge selling point for GOS that is difficult to package and make attractive (because it is difficult to understand / care about).

Re: Android Developer Verification: Threat masquerading as protection

#726

Post by mdp2021 »

charcircuit wrote: post #238
Aachen wrote: post #150

Earlier quoted context omitted.

Oh? Maybe you could comment on what part of the f-droid article is wrong

>If you are running Android 8 or higher, a virus has been installed on your device and is silently awaiting remote activation. I have such a phone and the "virus" has not been installed to it. There is no evidence behind this claim. >with as many as 4 billion Android handsets and tablets estimated to have already been contaminated This is misleading wording. It's just as true to say that as many as 1 trillion devices…

We are in a dire situation as the world has been going towards the normalization of the pratices of spreading stubs missing crucial information.

-- The medicine? "It's good against illness. You'll be fine". ("You want to know the side effects - Due Diligence or OCD?")

-- The engine? "It's ecological. Ain't you glad?" ("Three clylinders with consumables inside the engine - really do you want to know?")

-- The stats? "Here is some aggregate data as the layout demands" ("People are confused by numbers, you cannot print them on newspapers" - I really was made to hear that years ago.)

-- The contract? "Everbody signs it, sign here!" ("Really you want to read it? But we had not allotted the time...")

-- New entrance checks? "It's for the children!" ("What do you mean if it involves uploading a document you will never?")

etc.

~~

Is there any place in which the crucial, critical information about this new idea from Google, duly FAQ, is found? E.g. what installs the service, what does the service do if it encounters the software that we develop locally and we install on the device etc. Is there any authoritative source?

~~

> Nothing will happen. But if Play Protect were to flag malware it manually asks you if you want to delete the app

charcircuit, could you share what makes you confident (or informed) that the above is what will happen?

Some people use Android devices for the development of non-public software that will never reach the Play Store. (The "Corporation C internal tools APK" has no place there.) Where do we read the warranties that no disaster will happen involving my_private_app.apk?

Re: Android Developer Verification: Threat masquerading as protection

#727

Post by charcircuit »

mdp2021 wrote: post #726
charcircuit wrote: post #238

Earlier quoted context omitted.

>If you are running Android 8 or higher, a virus has been installed on your device and is silently awaiting remote activation. I have such a phone and the "virus" has not been installed to it. There is no evidence behind this claim. >with as many as 4 billion Android handsets and tablets estimated to have already been contaminated This is misleading wording. It's just as true to say that as many as 1 trillion devices…

We are in a dire situation as the world has been going towards the normalization of the pratices of spreading stubs missing crucial information. -- The medicine? "It's good against illness. You'll be fine". ("You want to know the side effects - Due Diligence or OCD?") -- The engine? "It's ecological. Ain't you glad?" ("Three clylinders with consumables inside the engine - really do you want to know?") -- The stats? "…

>charcircuit, could you share what makes you confident (or informed) that the above is what will happen?

Google has stated that this is about sideloading apps and has only talked about the sideloading flow being changed. Removing already installed apps is unrelated to the sideloading / package installation flow. Google has not stated anything about deleting apps from unverified developers so I am confident it won't happen. As I mentioned there already is a component in the system responsible for removing malware.

>Where do we read the warranties that no disaster will happen involving my_private_app.apk?

There is no warranty similar to how there is no warranty Google will make your phone summon nasal demons.

>Is there any place in which the crucial, critical information about this new idea from Google, duly FAQ, is found?

It will eventually be in an apk on the device and once someone dumps I would be willing to reverse engineer it and explain its functionality free of charge.

Re: Android Developer Verification: Threat masquerading as protection

#728

Post by petu »

cromka wrote: post #693
HybridStatAnim8 wrote: post #551

Earlier quoted context omitted.

These devices fall far behind the industry standard hardware security requirements GrapheneOS has.

Wasn't it just explained they meet the criteria?

Maybe I didn't put it clear enough: __just the first__ GrapheneOS requirement leaves us with three brands. There's 20+ more items on the list after that, Nothing and Fairphone likely fail on them.

Re: Android Developer Verification: Threat masquerading as protection

#729

Post by sambuccid »

HybridStatAnim8 wrote: post #692
baranul wrote: post #691

Earlier quoted context omitted.

The way out is for people to support the various Linux phones. These Linux distros need to support and push Android compatibility, so that people can load F-Droid, Aurora, and Obtainium on them and get most of the Android apps they want. The ability to use both Linux and Android apps should satisfy nearly everyone. A strong message of consumer defiance needs to be sent.

The Android family of operating systems and the forks made from the android open source project are all linux distributions, and linux phones. Using desktop linux phones and trying to force that as a norm would set privacy and security back substantially. The inverse of what you suggest, which is Android with desktop linux app compatibility, would be a huge step forward, and is already much closer than you might thin…

Personally I think that Android AOSP relies too much on the support from google, that has demonstrated to happily use anti-competitive practices and not be afraid to close and centralise AOSP as much as possible.

In a possible future where google decides to continue any new update of Android as closed source, will the community have enough people stepping in to support the development of AOSP? Will google allow the Play Store to run on AOSP? If not, do we have enough apps distributed outside of the Play Store to compensate?

My point is that for an OS that shares more code with desktop Linux (same apps, same DE, same terminal programs, ...) we can rely on the existing Linux community to maintain and advance the OS, and then adapt it for mobile, which I think takes considerably less resources

Re: Android Developer Verification: Threat masquerading as protection

#730

Post by someonebaggy »

WarmWash wrote: post #539
someonebaggy wrote: post #67

Earlier quoted context omitted.

They already lost a lawsuit and were fined a hundred billion dollars in the EU for locking down Android. Maybe they think since they already lost once, they can't lose again.

Google had an open (but maybe not perfectly open) platform and is paying out billions in anti-competitive fines because of it. None of the other platform vendors with totally closed platforms are paying out anything. So with even a room temperature business IQ, it's pretty clear that closed platforms are the best way to do business, and court rulings in both the US and EU have affirmed this multiple times over the la…

They are paying fines for trying to close their open platform. Microsoft isn't because their platform is still open enough, and Apple isn't because it was always closed and everyone who bought it knew it was closed.
Post reply on HN