Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

81–90 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#81

Post by [deleted] »

plorg wrote: post #68
john_strinlai wrote: post #25

Earlier quoted context omitted.

> You can also cut yourself with a kitchen knife but nobody proposes banning kitchen knives. oh nice, i love this game. you cant carry a kitchen knife that is too long, you cant carry your kitchen knife into a school, you cant brandish your kitchen knife at police, you cant let a small child run around with a kitchen knife... literally most of what "the state" does is be a "nanny" (not agreeing or disagreeing with go…

In this example we still don't require you to register with anyone to buy a knife, get the blessing of some institution to sell knives, or, as in this case, get a certification before you can start making knives.

[deleted]

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#82

Post by sdenton4 »

JoshTriplett wrote: post #34
harikb wrote: post #19

Earlier quoted context omitted.

Installing an app that silently intercepts SMS/MMS data is a persistent technical compromise. Once the app is there, the attacker has ongoing access. In contrast, convincing someone to read an OTP over the phone is a one-time manual bypass. To use your logic.. A insalled app - Like a hidden camera in a room. Social engineering over phone - Like convincing someone to leave the door unlocked once.

> Installing an app that silently intercepts SMS/MMS data is a persistent technical compromise. Once the app is there, the attacker has ongoing access. The motivating example as described involves "giving the scammer everything they need to drain the account". Once they've drained the account, they don't need ongoing access.

When the victim's relatives send them money because they need to eat and pay rent after handing everything over to the scammer, the persistent backdoor lets that money be drained as well... You're underestimating the persistence and ruthlessness of the scammers.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#83

Post by dsl »

bigstrat2003 wrote: post #59
dsl wrote: post #50

Dear Undersigned, I have an APK I would like you to install on your personal phones. No, I won't tell you who I am. Please let me know when you are comfortable with this.

Nice strawman. People want the ability to decide for themselves whether or not to install some APK, they are not saying every APK under the sun is trustworthy.

It is a simplification, not a strawman.

If you want to make the decision to install Hay Day, the user should be able to know that it is the Hay Day from Supercell or from Sketchy McMalwareson.

99.9% of apps should have no issue with their name being associated with their work. If you genuinely need to use an anonymously published app, you will still be able to do that as a user.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#84

Post by bitwize »

Cyph0n wrote: post #46
dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

Does your logic extend to PCs? If not, why? Because I hope you realize that clamping down on “sideloading” (read: installing unsigned software) on PCs is the next logical step. TPMs are already present on a large chunk of consumer PCs - they just need to be used.

Of course it extends to PCs. It'd suck for us, but end users, software vendors, content providers, and service providers all benefit from a more restricted platform that can provide certain guarantees against malware, fraud, piracy, and so forth. It's pathologically programmer-brained to assume that the good old days of being able to run arbitrary code on a networked computing device would last forever. That freedom must be balanced against the interests of the rest of society to avoid risk from certain kinds of harm which can easily proliferate in an environment where any program can run with the full authority of the owner and malware spreads willy-nilly.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#85

Post by OutOfHere »

pmdr wrote: post #2

The undersigned are basically a list of entities Google would like to see disappear.

Precisely! Google doesn't care one bit about civil society; it cares about power to itself even if this means punching freedom and liberty in the face. Personally I think it'll be a good thing if this restriction finally wakes up people to seek alternatives to Google.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#87

Post by mhitza »

criddell wrote: post #54
EmbarrassedHelp wrote: post #41

The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. It would not be unsurprising for a government to tell Google they must block any VPN apps from being installed on devices, and Google using the developer requirements to carry out the ban.

> The problem with mandatory developer registration, is that it gives Google and Governments the ability to veto apps. Don't they already have that power?

No, that is one reason why they are pushing for these changes.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#89

Post by hahn-kev »

dfabulich wrote: post #3

The most controversial claim in this letter is in the section that "Existing Measures Are Sufficient." In Google's announcement in Nov 2025, they articulated a pretty clear attack vector. https://android-developers.googleblog.com/2025/11/android-de... > For example, a common attack we track in Southeast Asia illustrates this threat clearly. A scammer calls a victim claiming their bank account is compromised and uses…

I like the idea of requiring extra work to get notification access. But really what all these scams pray on are time sensitivity, take that away and you solve the problem in many ways. For example, your bank shouldn't let you drain your account without either being in person or having a mandatory 24hr waiting period. Same could be done with side loaded apps getting notifications, if it's side loaded and wants to read notifications, then it needs to wait 24 hrs. Mostly it won't ever matter.

Alternatively reading notifications could be opt in per app, so the reading app needs to have permission to read your SMS message app notifications, or your bank notifications, that would not be as full proof as that requires some tech literacy to understand.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#90

Post by Retr0id »

kelp6063 wrote: post #4

why anyone thinks "open letters" and petitions to a trillion-dollar company will get them to change their mind is beyond me

Because the company either has to address it, or stop pretending it's "listening to concerns" or whatever. Even if it doesn't change the outcome, it makes it clearer that the company is engaging in bad faith.
Post reply on HN