Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

891–900 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#891

Post by 1970-01-01 »

ninjagoo wrote: post #845

It is way past time to build a 'people's phone', funding it through a platform like LiberaPay [1][2] or Open Collective [3][4], with a requirement for the device to be completely open-source. [1] https://liberapay.com/ [2] https://en.wikipedia.org/wiki/Liberapay [3] https://opencollective.com/ [4] https://en.wikipedia.org/wiki/Open_Collective If we start today, we could have a new phone in 2-3 years. Future generatio…

So we don't even have a 'people's battery' to power up this phone. All these phone pouch batteries are proprietary in design. Go ask Framework for their BMS design details and provide links to it if you think I'm joking

Re: Google details new 24-hour process to sideload unverified Android apps

#892

Post by fortyseven »

astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

One of the first things I do when I buy a new Android phone, like day one, is to enable developer mode. I usually use that simply for the ability to speed up animations so the phone feels a bit more snappy. In all the years I've engaged in this behavior, I've never had an application refuse to work. A rooted phone? Yes. Definitely. But just having developer mode enabled, no.

That said, it may be that I've simply been lucky and have an encountered that yet. So I'll be keeping an eye out for it.

Re: Google details new 24-hour process to sideload unverified Android apps

#893

Post by g947o »

al_borland wrote: post #581
vachina wrote: post #550

Earlier quoted context omitted.

Why are you even using the Gmail as your mail app?

The switching cost on a 20+ year old email address is high. It’s basically impossible to totally migrate away from. On top of that, since Google does their own thing, it doesn’t fit well into standard IMAP that most clients use. Sparrow made Gmail a great experience, but Google bought it and shut it down. I’m still rather bitter about that. It’s the only email client that actually made me enjoy email.

It's possible and I migrated almost all my emails from Outlook and Gmail. That's two services.

I still have those accounts and occasionally check for emails from old contacts or service emails, but on a daily basis I don't interact with Gmail at all.

Re: Google details new 24-hour process to sideload unverified Android apps

#894

Post by jackpeterfletch »

BatteryMountain wrote: post #782
SchemaLoad wrote: post #352

Earlier quoted context omitted.

There is immense pressure to stop online scams which are draining old people of their life savings. The whole flow from the article seems entirely based around letting power users install what they want while being able to break the flow of a scammer guiding a clueless person in to installing malware. It is promising that Google has avoided just turning off sideloading but still put measures in place to protect peopl…

Why can't a bank put a lock on large transfers or have an extra verification step? Or a cooldown period, so that if they see a large transfer from people above 60, let them go to a branch to verify/ack the transaction. Why is this the internet or operating systems problem to solve?

Well in many countries this is the case.

But it's an interesting thing to raise, because so often when they do enforce those controls - the outcry is 'bank won't let me do what I want with my money!'.

Not such a stones throw from - 'tech company won't let me do what I want with my device!'

Im not making any specific point. But perhaps thats indicative that the solution needs to be holistic, or just that security is hard XD.

Re: Google details new 24-hour process to sideload unverified Android apps

#895

Post by glenstein »

I feel like there's a big thing being missed in all of this, which is that F-Droid lives. I scrolled through hundreds of comments so far and not seen anyone make this observation.

Do I love it? Absolutely not. But F-Droid was facing an existential threat from the early early versions of the proposal and now will continue to live. Again, I don't love it but this is a huge change to the fate of F-Droid.

Re: Google details new 24-hour process to sideload unverified Android apps

#896

Post by eykanal »

sokoloff wrote: post #863

This is getting a ton of hate here, but I think it feels like a pretty reasonably balanced response to competing concerns: protecting literally billions of non-tech-savvy users from potentially malicious social-engineering attacks while allowing devs and tech-savvy a path to bypass that protection if they’re sure they want to. What concrete change to the policy would be a strict Pareto improvement keeping just those…

I'm pretty surprised at the amount of hate here. All the "just build it ourselves!" and "Google wants your data", and almost no top-level comments even discussing the difficulty of dealing with malware and social engineering.

There are at least three moral arguments that can be made:

- Google, as a capitalist company, is ignoring the privacy and FOSS implications, and is guilty of screwing the customer due to greed

- Regular, non-tech folks are constantly being robbed of their privacy, money, and/or identity through malware and social engineering attacks, and Google is guilty of not doing enough to protect them

- Enabling malware delivery and use props up criminals and known bad actors (e.g., north korean), and by not stopping this Google is guilty of supporting these bad actors

I'm not seeing either of those last two points being made strongly. Maybe it's just not the target audience — people here aren't as likely to be scammed, and few of us are regularly thinking about north korea — but I'd expect to see more consideration for the costs of inaction here.

Re: Google details new 24-hour process to sideload unverified Android apps

#897

Post by rpdillon »

glenstein wrote: post #895

I feel like there's a big thing being missed in all of this, which is that F-Droid lives. I scrolled through hundreds of comments so far and not seen anyone make this observation. Do I love it? Absolutely not. But F-Droid was facing an existential threat from the early early versions of the proposal and now will continue to live. Again, I don't love it but this is a huge change to the fate of F-Droid.

Well, Google is keeping the fees and the ID requirements for devs, while also vastly shrinking the population that will be willing to get permission to sideload from Google, decimating much of F-Droid's reach. They are basically attacking freedom on both sides, clamping down and extracting on the supply side, and creating friction and confusion on the demand side.

I'm extremely worried for the future of open source on mobile operating systems. We traded freedom for convenience.

Re: Google details new 24-hour process to sideload unverified Android apps

#898

Post by Andrex »

glenstein wrote: post #895

I feel like there's a big thing being missed in all of this, which is that F-Droid lives. I scrolled through hundreds of comments so far and not seen anyone make this observation. Do I love it? Absolutely not. But F-Droid was facing an existential threat from the early early versions of the proposal and now will continue to live. Again, I don't love it but this is a huge change to the fate of F-Droid.

TBH it is a little surprising, because one option available to Google was staying the course and hiding behind their Epic court loss.

"Everyone can still access F-Droid, it just has to live in the Play Store. We're bound by law to support alternative app stores now anyways. Everyone wins!"

Re: Google details new 24-hour process to sideload unverified Android apps

#899

Post by minnowguy »

al_borland wrote: post #644
b112 wrote: post #607

Earlier quoted context omitted.

It's OK. This is the dying, last gasp effort that a company makes when it has no way to innovate, no way to add any real value, no capacity to drive change internally, and has become completely non-user focused. In short, it's what companies like IBM and Broadcom are now. Shallow husks of their former self, mere holding companies for patents, with a complete lack of care and concern about any end-user retention. Goog…

The problem is that these companies can remain on life support for decades, phoning it in and making things continuously worse as their desperation grows. If they follow the path of IBM and Broadcom, they will move away from the consumer market and focus more on the enterprise. If Google fully realized that vision it would be extremely disruptive. Them shutting down Google Reader practically killed RSS for quite a wh…

Microsoft is already pivoting away from consumer products.

Re: Google details new 24-hour process to sideload unverified Android apps

#900

Post by ptx »

Could this be worked around by installing a single shell app which then loads other apps internally? I think it's possible to dynamically load Dalvik byte code in ART these days, right?

Obviously permissions would be a problem, as you can't update the app manifest, so there would either have to be one shell app per publisher (which would at least solve the problem of installing updates for their apps) or the shell would need its own internal system for managing permissions (like a browser does). Maybe it could also sandbox different apps from each other in different subprocesses, unless that needs root privileges, but maybe it's possible with Landlock?

Or we can always fall back to the "sweet solution" Steve Jobs offered us with the original iPhone, and just let the web browser be the shell.

Or implement everything as WeChat mini programs.

Post reply on HN