12 ms·

Ugh, app stores! No one needs them for discovering new software. You go to the app store to get a specific piece of software you already know about and whose

Ugh, app stores! No one needs them for discovering new software. You go to the app store to get a specific piece of software you already know about and whose reputation you’ve already verified. No one needs them for code signing. If you want the real firefox.apk you can download it from https://firefox.com/ https://firefox.com/ and notice a lack of SSL alarms going off. What’s the code signing for — to let me know that HTTPS works?! All I really want is an OS facility that only executes code that has been installed explicitly by me, and always in a sandbox. That’ll stop that dodgy email from executing r00t.sh via an exploit in my mail client. App stores and code signing popups are proxies for that kind of OS facility, but I’d rather it was just part of the OS explicitly. App stores leave me with all sorts of unwanted properties, namely Google / Apple throwing their unwanted opinion around. Search for Instagram in the iOS App Store: the top UI element is “InstaMap”, thanks Apple!

LennyWhiteJr 7y ago
Code Signing and HTTPS are two completely unrelated concepts...
- etskinner 7y ago
  Yes, but their point is: Why would you need code signing if https is working correctly when downloading software?
  - nwatson 7y ago
    The product is built in a very controlled and secure environment at the core of a company's competency ... code-signing here stamps the product as authoritative and representing the company's efforts. The website from which you, the customer, download the software often is built and managed under less controlled and more vulnerable circumstances, often with third party involvement. Any bad actor in a long chain of internal caretakers and potentially external hackers can replace the to-be-downloaded artifact HTTPS with malicious junk. Code-signing mitigates this.
  - Xylakant 7y ago
    For example, code signing can protect against an attacker that can swap the application, but not the signing certificate. It can allow retroactive disabling of a certain application by revoking the cert that signed it. In short: HTTPS ensures the integrity of the download at the time the app is downloaded, code signing at the time it runs.
  - toxik 7y ago
    Because somebody might’ve changed the files on the distribution servers. We’ve been signing executables for decades?
    - segfaultbuserr 7y ago
      As a matter of fact, APKs are signed anyway using the pubkey of their developers, the signature is embedded in the package, regardless of whether it's in the app store of not. You cannot use a package with a different signature to replace the existing one, the system will warn you about a conflict. If someone has changed the files on the distribution servers. A Hacker News reader will have no problem recognizing it and stop installing, another one will compare the signature and keep it as evidence. Of course, the overwhelmingly majority cannot recognize it though.
  - segfaultbuserr 7y ago
    Semi off-topic, but anyway, I have an supportive argument for you: APKs are signed anyway, the signature is embedded in the package, regardless of whether it's in the app store of not, it the signature has changed, you cannot use a new version to replace the previous version without manual reinstallation, it's an effectively safeguard against phishing. But only the readers of Hacker News can recognize it. I think it's one of the most powerful argument for a walled garden. Not that I support it, but I acknowledge it's still a powerful argument.
pjmlp 7y ago
Street Joe and Jane lack the technical skills to understand https://firefox.com/ https://firefox.com/ from https://firefox,.com/ https://firefox,.com/, or what installing an app means. "Isn't just clicking _next_ until the app starts?"
dewey 7y ago
> No one needs them for discovering new software. There's also people that don't know that they need "Firefox", they just want a browser. Or a tool to print envelopes or crop an image. So they search in the app store and they know it'll probably be okay. If you search for this online you'd get a bunch of SEO spam sites, shady tools among other things. At least due to the developer fee and reviews there's at least some barrier of entry (Also if it's not perfect). > App stores leave me with all sorts of unwanted properties, namely Google / Apple throwing their unwanted opinion around. Search for Instagram in the iOS App Store: the top UI element is “InstaMap”, thanks Apple! Apple's search is notoriously bad and the perfect case to apply Hanlon's razor.
- im3w1l 7y ago
  In what sense will it be ok? Isn't a lot of the stuff in appstores spyware nowadays?
  - dewey 7y ago
    While there is generally always some small percentage of apps that don't do what they promise and slip through the review I think I can be reasonably sure that if I download something from the macOS / iOS app store it'll do what they say. I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere. For the average user it's probably the better option than downloading the top Google result and just executing it.
    - cesarb 7y ago
      > I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere. The current migration towards more sandboxing also helps. For instance, Android has restrictions on how much an application can do in the background without showing up as a persistent notification, and xdg-app's sandboxing can restrict how much of the content of your computer an application can access without using a file open dialog.
    - 7y ago
deleted 7y ago
[deleted]
londons_explore 7y ago
> All I really want is an OS facility that only executes code that has been installed explicitly by me, and always in a sandbox. Androids app sandbox is pretty leaky. It has a massive surface area, and the chances of finding exploits to get out of it to find root are high. Also, even from within the sandbox, there are lots of evil things you can do (for example, start on boot, and go fullscreen and use all the ram so the back and home button SystemUI process gets killed and your app is unkillable.). The 'badness' of the android app model is a big chunk of the reason Google wants to be gatekeeper - otherwise android apps could just load and unload like webpages do. That and profit.
- UncleMeat 7y ago
  You say this, but rooting attempts for flagship Android phones have failed at many recent pwn2owns. The grey market price for a root exploit on flagship Android is comparable to iPhone. The most popular third party rooting services don't seem to support past Android 8. Clearly it isn't easy to root these things.
  - Operyl 7y ago
    I wonder if part of that is that a lot of flagships seem to have unlockable boot loafers now, with a force wipe to do so. Does that have a measurable impact on the number of people trying?
    - UncleMeat 7y ago
      It doesn't seem that way. There are still people attempting pwn2owns. The grey market value of a root exploit is still in six figures and likely higher on the black market.
swiley 7y ago
SSL during download really isn’t a substitute for code signing. But we have fdroid and the GNU/Linux ecosystem is going to eat android’s lunch anyway.
AnIdiotOnTheNet 7y ago
Hear Hear. I'll take that in a non-phone version too please.
ur-whale 7y ago
>Ugh, app stores! >No one needs them for discovering new software I so badly wish I could agree with you :) Sadly, observing the non-tech folks around me, some of which don't even know what an app is, and some of which think the only apps they'll ever use on their phone is the ones it came loaded with ... it's not true. What is needed is an android app. store that is decentralized / distributed, where the "trust" of an app is a consensus-based score and that has the popularity of whatsapp.
- GordonS 7y ago
  I agree with this. What I'd ideally like is to keep the Play and Apple stores, but also make it possible and easy to use 3rd party stores - kind of how you can add alternative package repos in the Linux world. Unlikely to happen without legislation, mind.

LennyWhiteJr 7y ago

Code Signing and HTTPS are two completely unrelated concepts...

etskinner 7y ago
Yes, but their point is: Why would you need code signing if https is working correctly when downloading software?
- nwatson 7y ago
  The product is built in a very controlled and secure environment at the core of a company's competency ... code-signing here stamps the product as authoritative and representing the company's efforts. The website from which you, the customer, download the software often is built and managed under less controlled and more vulnerable circumstances, often with third party involvement. Any bad actor in a long chain of internal caretakers and potentially external hackers can replace the to-be-downloaded artifact HTTPS with malicious junk. Code-signing mitigates this.
- Xylakant 7y ago
  For example, code signing can protect against an attacker that can swap the application, but not the signing certificate. It can allow retroactive disabling of a certain application by revoking the cert that signed it. In short: HTTPS ensures the integrity of the download at the time the app is downloaded, code signing at the time it runs.
- toxik 7y ago
  Because somebody might’ve changed the files on the distribution servers. We’ve been signing executables for decades?
  - segfaultbuserr 7y ago
    As a matter of fact, APKs are signed anyway using the pubkey of their developers, the signature is embedded in the package, regardless of whether it's in the app store of not. You cannot use a package with a different signature to replace the existing one, the system will warn you about a conflict. If someone has changed the files on the distribution servers. A Hacker News reader will have no problem recognizing it and stop installing, another one will compare the signature and keep it as evidence. Of course, the overwhelmingly majority cannot recognize it though.
- segfaultbuserr 7y ago
  Semi off-topic, but anyway, I have an supportive argument for you: APKs are signed anyway, the signature is embedded in the package, regardless of whether it's in the app store of not, it the signature has changed, you cannot use a new version to replace the previous version without manual reinstallation, it's an effectively safeguard against phishing. But only the readers of Hacker News can recognize it. I think it's one of the most powerful argument for a walled garden. Not that I support it, but I acknowledge it's still a powerful argument.

pjmlp 7y ago

Street Joe and Jane lack the technical skills to understand https://firefox.com/ https://firefox.com/ from https://firefox,.com/ https://firefox,.com/, or what installing an app means. "Isn't just clicking _next_ until the app starts?"

dewey 7y ago

> No one needs them for discovering new software. There's also people that don't know that they need "Firefox", they just want a browser. Or a tool to print envelopes or crop an image. So they search in the app store and they know it'll probably be okay. If you search for this online you'd get a bunch of SEO spam sites, shady tools among other things. At least due to the developer fee and reviews there's at least some barrier of entry (Also if it's not perfect). > App stores leave me with all sorts of unwanted properties, namely Google / Apple throwing their unwanted opinion around. Search for Instagram in the iOS App Store: the top UI element is “InstaMap”, thanks Apple! Apple's search is notoriously bad and the perfect case to apply Hanlon's razor.

im3w1l 7y ago
In what sense will it be ok? Isn't a lot of the stuff in appstores spyware nowadays?
- dewey 7y ago
  While there is generally always some small percentage of apps that don't do what they promise and slip through the review I think I can be reasonably sure that if I download something from the macOS / iOS app store it'll do what they say. I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere. For the average user it's probably the better option than downloading the top Google result and just executing it.
  - cesarb 7y ago
    > I trust it enough to believe it won't start crypto mining in the background or connect to random servers and sending the content of my computer somewhere. The current migration towards more sandboxing also helps. For instance, Android has restrictions on how much an application can do in the background without showing up as a persistent notification, and xdg-app's sandboxing can restrict how much of the content of your computer an application can access without using a file open dialog.
  - 7y ago

deleted 7y ago

[deleted]

londons_explore 7y ago

> All I really want is an OS facility that only executes code that has been installed explicitly by me, and always in a sandbox. Androids app sandbox is pretty leaky. It has a massive surface area, and the chances of finding exploits to get out of it to find root are high. Also, even from within the sandbox, there are lots of evil things you can do (for example, start on boot, and go fullscreen and use all the ram so the back and home button SystemUI process gets killed and your app is unkillable.). The 'badness' of the android app model is a big chunk of the reason Google wants to be gatekeeper - otherwise android apps could just load and unload like webpages do. That and profit.

UncleMeat 7y ago
You say this, but rooting attempts for flagship Android phones have failed at many recent pwn2owns. The grey market price for a root exploit on flagship Android is comparable to iPhone. The most popular third party rooting services don't seem to support past Android 8. Clearly it isn't easy to root these things.
- Operyl 7y ago
  I wonder if part of that is that a lot of flagships seem to have unlockable boot loafers now, with a force wipe to do so. Does that have a measurable impact on the number of people trying?
  - UncleMeat 7y ago
    It doesn't seem that way. There are still people attempting pwn2owns. The grey market value of a root exploit is still in six figures and likely higher on the black market.

swiley 7y ago

SSL during download really isn’t a substitute for code signing. But we have fdroid and the GNU/Linux ecosystem is going to eat android’s lunch anyway.

AnIdiotOnTheNet 7y ago

Hear Hear. I'll take that in a non-phone version too please.

ur-whale 7y ago

>Ugh, app stores! >No one needs them for discovering new software I so badly wish I could agree with you :) Sadly, observing the non-tech folks around me, some of which don't even know what an app is, and some of which think the only apps they'll ever use on their phone is the ones it came loaded with ... it's not true. What is needed is an android app. store that is decentralized / distributed, where the "trust" of an app is a consensus-based score and that has the popularity of whatsapp.

GordonS 7y ago
I agree with this. What I'd ideally like is to keep the Play and Apple stores, but also make it possible and easy to use 3rd party stores - kind of how you can add alternative package repos in the Linux world. Unlikely to happen without legislation, mind.