Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android Developer Verification: Threat masquerading as protection

f-droid.org

Post reply on HN
Print view View original

731–740 of 793 posts

Re: Android Developer Verification: Threat masquerading as protection

#731

Post by someonebaggy »

Izkata wrote: post #588
realusername wrote: post #141

Earlier quoted context omitted.

No there isn't, Google's requirement is to put that information publicly for everybody to see. That's not nearly the same thing as being available on court request. With that policy, Google encourages stalkers and put developers in danger.

A California law around a decade ago started it (a consumer protection law I think, something like requiring customers to have an address they can contact any seller at), and Google lazily applied it to everyone. I would have been fine just preventing Californians from downloading my app, but that wasn't an option so I just let my app die.

It would make sense if it was only if your app costs or handles money.

Re: Android Developer Verification: Threat masquerading as protection

#732

Post by sambuccid »

musictubes wrote: post #721
sambuccid wrote: post #593

Earlier quoted context omitted.

I agree that the usability is behind, as we would expect. For me mainly is about missing apps and some hardware support. But in terms of UX for example I liked using SailfishOS, although I'll admit the UI needs some getting used to. But I prefer this to the feeling that I'm being limited on what I can do on Android/Apple, and the worry of being in a duopoly that allows the companies to worsen their products without e…

Aren't you much more limited by not having access to the vast majority of apps built for Android and iOS? The limitations imposed by Apple and Google have led to thriving software systems. Being free to hack as you want on the system won't help most people if they don't have access to the software people want.

Yes that's true, that's the main limitation for me at the moment, and I hope with more people using it and with time we'll get enough apps, like what happened for Linux on desktop. Meanwhile to compensate on Linux mobile we have access to many programs from desktop Linux - not adapted for mobile screen, and many people use Android emulation - which should work very well on official SailfishOS but has limitations on other distros. If I recall correctly I think it might also be possible to have a dual boot Android/Linux for some devices.

Personally I have them separate, an Android phone and a Linux phone. Sadly the Android one is still my main driver, mainly because I chose a not-fully-ready distribution like PureOS on a Librem5, and the battery duration is still too limited for me.

Regarding the thriving software systems of Apple and Google, I think is more due to the popularity of mobile phones than to specific limitations they made on their OSes. I think even on a very open OS, as far as there is a good "famous" framework for development, you can gain the same amount of software.

Re: Android Developer Verification: Threat masquerading as protection

#733

Post by wartywhoa23 »

bigstrat2003 wrote: post #537
wartywhoa23 wrote: post #513

Earlier quoted context omitted.

How about saying no to these "mandates"?

We aren't given the choice, in many cases. For example I remember a poster here who was forced to have an Android or Apple phone because his kids' school required an app to pick up the kids after school. So his options were to get a big tech phone, or get in trouble for not picking up his kids. "Get the school to come to their senses" was, unfortunately, not an option available to him.

The question is should the sane minority jump from the roof in one of the allowed ways - headfirst or assfirst - only because the majority decided (or was duped into believing) it was convenient to do so, or better not partake in madness?

Re: Android Developer Verification: Threat masquerading as protection

#734

Post by mu53 »

grapheneos wrote: post #663
qsxfthnkp2322 wrote: post #658

Earlier quoted context omitted.

The amount of work that goes into tracking you is insane

It's not accurate, see https://news.ycombinator.com/item?id=48767176 .

Love the work you do. Happy to see the debit from my donation every month

Re: Android Developer Verification: Threat masquerading as protection

#735

Post by murderfs »

grapheneos wrote: post #477
murderfs wrote: post #358

Earlier quoted context omitted.

> They are "permitted" to access to Google Play Services because their work hardening Android currently benefits Google. Very little in GrapheneOS has gone back upstream post-Copperhead. > Once Google feels like there is sufficient stability and compatibility with hardened memory allocator and tagged memory (and when they can get Qualcomm to support it across their range), they will make harder, until impossible, for…

> Very little in GrapheneOS has gone back upstream post-Copperhead. Most of what we've landed upstream has been post-Copperhead. AOSP made it increasingly difficult to contribute without being an Android partner and it's nearly impossible now. We've contributed elsewhere including to the Linux kernel and PowerDNS. We don't try to submit security improvements to the Linux kernel anymore based on direct experience of i…

> AOSP made it increasingly difficult to contribute without being an Android partner and it's nearly impossible now.

Yes, by "upstream", I mean "upstream Android".

> Google didn't invent MTE or memory tagging.

Sure, they didn't invent memory tagging (SPARC ADI was an implementation from a decade ago, and I'd bet IBM had an implementation of something similar in like the 70s, judging by the rest of ISA innovations in the last decade), but they definitely invented the instantiation of it in ARM. Pretty much everything aside from instruction encoding for MTE was specified in a doc sent by Google to ARM in response to ARM telling Google something along the lines of "the entirety of our efforts in the security space are going to be spent on something that you're not going to see any benefit from within the next decade: CHERI aka Morello aka Arran".

Re: Android Developer Verification: Threat masquerading as protection

#736

Post by matheusmoreira »

palata wrote: post #701
matheusmoreira wrote: post #212

Earlier quoted context omitted.

It's not just shameful, it's stupid. Freedom was the whole point of tolerating the shittiness of Android. If they get rid of that, then there is no point, and I'll just buy an iPhone instead. If I must be in a walled garden, I'll choose the better kept garden, and it sure as hell isn't Google's.

I like Android a lot better. And I really, really like the fact that Android is open source, so that 1) I can read the sources and 2) projects like GrapheneOS can do it right. Apple does not remotely allow that.

The whole point of remote attestation is to ban projects like GrapheneOS which "do it right". If you install such things, you are "tampering" with the phone, it becomes an "untrusted" device and you are banned from digital society, completely ostracized.

It's not your phone, it's the corporation's phone, they're only generously allowing you to use it, on their terms. If you install GrapheneOS, or any other system that you gives you ownership of the machine, from the bank's perspective you turn into a fraudster, from the video game's perspective you turn into a cheater, etc.

Re: Android Developer Verification: Threat masquerading as protection

#737

Post by cromka »

petu wrote: post #728
cromka wrote: post #693

Earlier quoted context omitted.

Wasn't it just explained they meet the criteria?

Maybe I didn't put it clear enough: __just the first__ GrapheneOS requirement leaves us with three brands. There's 20+ more items on the list after that, Nothing and Fairphone likely fail on them.

Fair.

Re: Android Developer Verification: Threat masquerading as protection

#738

Post by curt15 »

tsoukase wrote: post #705
unknownfuture wrote: post #700

Earlier quoted context omitted.

> 1) side loading or however it's called is used less than 1-2% of global Android users (they can't be more than 50million). Google made us a favor leaving it open after an only 24h delay. It could be much worsa and is nothing in our eternal tinkering with developer options. Thank you from me Google It's wild how far we've come, from IBM trying to lock down the PC to truly open hardware, to you now thanking Google fo…

I don't distinguish a phone from other electronic home devices I also happen to buy. I don't change their firmware for various reasons, like not worth it (eg fridge, washing machine), illegal (eg set top box or car) or impossible. Being able to even enable developer mode in Android and do anything more than designed for a regular user goes already too far in relation to the other devices. Is there any car that you ca…

From day one, Google sought to attract customers to Android by marketing it as an "open" alternative to Apple's locked-down appliance model. Android couldn't quite compete with Apple's UI polish or battery life, but that was okay because Android sought to be a hand-held personal computer that could also make phone calls. The most important quality of personal computers, of course, is that they can run whatever software their users desire, including the users' own code.

Having gained their market share, Google now pulls a bait-and-switch by quietly retreating from Android's "open" messaging and philosophy. That's too bad for Google, because a mere appliance, it's worse than iPhone in every dimension.

Re: Android Developer Verification: Threat masquerading as protection

#739

Post by UnreachableCode »

arximboldi wrote: post #640
mr_mitm wrote: post #297

Earlier quoted context omitted.

There are plenty of banks in Germany which offer over-the-counter services, if you prefer to do banking as if it's 1999. Most of the time, when people say it's impossible to live without a smartphone, it's actually only impossible to enjoy the conveniences of the internet without a smartphone (at least in Germany). Besides these rentable scooters, I can't think of anything that actually requires a smartphone. Sure, y…

I recently bought my first smartphone, just went for a refurbished Pixel 8 with GrapeheneOS. To be honest, life without a smartphone was increasingly becoming a PITA. For example, Ryanair doesn't accept printed tickets anymore. A few clubs in Berlin (Tresor, Ohm, Oxi) have recently replaced their cloakroom by automated lockers that require a smartphone to operate. I've encountered a few gyms (2 in Spain, 1 in USA) th…

https://dumbermini.com/ (LineageOS fork)

https://commodore.net/callback/ (Sailfish OS)

I too am a GrapheneOS Pixel 8 user. However, I am starting to realise even a screen this large is a huge source of distraction and dopamine fracking that I don't have the time or desire for in my life. So I'm looking at these even dumber options. I just want my calendar and email, and maybe Signal. No web browser or socials.

Re: Android Developer Verification: Threat masquerading as protection

#740

Post by UnreachableCode »

JeremyNT wrote: post #581
wartywhoa23 wrote: post #513

Earlier quoted context omitted.

How about saying no to these "mandates"?

Android is going to bifurcate between "phones that run proprietary apps from the play store" and "phones that run software from anywhere else." And while maybe you can get by without banking apps, your life is going to get increasingly harder when you want to do many other things. Ride hail app? Transit fare app? Government ID app? Airline app? Maybe you don't need them yet, but the best way to model this future is t…

No.
Post reply on HN