4 ms·

> compile it yourself requiring enabling "Allow installation from unknown sources" This is one of my biggest pet peeves about Android. I wish i could add my

> compile it yourself requiring enabling "Allow installation from unknown sources" This is one of my biggest pet peeves about Android. I wish i could add my own signing key for apps I compile myself, rather than just being given the choice of Google play or anything at all.

Operyl 7y ago
In a round about way you sort of can now. The “allow installation from unknown sources” is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you’re looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it’s a bit more possible than before I guess. As an added bonus you could do some signature validations too!
- est31 7y ago
  Yeah Android 8 introduced it. It's a good change IMO.
- boring_twenties 7y ago
  If you use F-Droid, you could also just set up your own local repository for your custom apps.
  - Operyl 7y ago
    Yup! I was just running under the assumption the parent comment wanted no other apps period, with a smaller surface to attack.
- Wowfunhappy 7y ago
  I'm an iOS user, but I suspect I'll end up switching back to Android for my next phone in 4/5 years. Is there a way around this where you can say "no, just let me install from anywhere" or is it forced unless you root the device?
  - Operyl 7y ago
    The reality is it only takes 2-3 seconds to allow it, it’s a direct link to the relevant setting. Once you allow it for that app (say, Chrome or Google Drive) you don’t have to do it again unless, of course, you disable it.
enitihas 7y ago
You are given a similar choice though. Write an app which can do whatever verification you want, gpg or anything, and only give that app permission to install from unknown sources.
ocdtrekkie 7y ago
There's nothing bad about "allowing installation from unknown sources" if you know your sources. It's just a scare tactic Google uses to quash competition. An app you compile yourself (assuming you at least tried to read the source code, the open source Google Auth is pretty brief/readable, I've reviewed it before) is vastly more secure than installing whatever the Play Store serves you.
- angry_octet 7y ago
  This is frankly a ridiculous statement. If you are an experienced software developer, and correctly apply supply chain security policies, you can likely build and install an apk correctly. Literally billions of regular users cannot do that, and regularly install malware laden apks.
  - ocdtrekkie 7y ago
    Consider that if I know how to get to my bank's website, and it gives me an APK to install, I know it came from my bank, unless my bank's server is compromised in some way. I have no way to easily determine that an app on the Play Store actually came from my bank. At best, I can look at the install count, hope the app store does a half way decent job looking for fraud, and hope for the best. Maybe if I'm lucky they have some sort of verification program? The idea we actually trust app stores from Google or Apple over a direct install from the institutions we want to interact with is hilarious, especially considering all of the rampant malware and fraud issues on the Play Store.
    - angry_octet 7y ago
      You go to the bank's website and it has a link to the app on the store? If they dist an apk, how is the bank to provide updates for their app? Build their own updater architecture? If there was a mitmed update from a store they could cancel it centrally. Telling people to prefer apks is setting them up to be hacked.
      - beyondzero 7y ago

Operyl 7y ago

In a round about way you sort of can now. The “allow installation from unknown sources” is per app-source now. You need to enable it for Google Chrome if you downloaded the package from Chrome, or for F-Droid if you downloaded it from F-Droid. So, the solution you’re looking for could be just a small shim app to download from your own repository of sorts. Janky .. but it’s a bit more possible than before I guess. As an added bonus you could do some signature validations too!

est31 7y ago
Yeah Android 8 introduced it. It's a good change IMO.
boring_twenties 7y ago
If you use F-Droid, you could also just set up your own local repository for your custom apps.
- Operyl 7y ago
  Yup! I was just running under the assumption the parent comment wanted no other apps period, with a smaller surface to attack.
Wowfunhappy 7y ago
I'm an iOS user, but I suspect I'll end up switching back to Android for my next phone in 4/5 years. Is there a way around this where you can say "no, just let me install from anywhere" or is it forced unless you root the device?
- Operyl 7y ago
  The reality is it only takes 2-3 seconds to allow it, it’s a direct link to the relevant setting. Once you allow it for that app (say, Chrome or Google Drive) you don’t have to do it again unless, of course, you disable it.

enitihas 7y ago

You are given a similar choice though. Write an app which can do whatever verification you want, gpg or anything, and only give that app permission to install from unknown sources.

ocdtrekkie 7y ago

There's nothing bad about "allowing installation from unknown sources" if you know your sources. It's just a scare tactic Google uses to quash competition. An app you compile yourself (assuming you at least tried to read the source code, the open source Google Auth is pretty brief/readable, I've reviewed it before) is vastly more secure than installing whatever the Play Store serves you.

angry_octet 7y ago
This is frankly a ridiculous statement. If you are an experienced software developer, and correctly apply supply chain security policies, you can likely build and install an apk correctly. Literally billions of regular users cannot do that, and regularly install malware laden apks.
- ocdtrekkie 7y ago
  Consider that if I know how to get to my bank's website, and it gives me an APK to install, I know it came from my bank, unless my bank's server is compromised in some way. I have no way to easily determine that an app on the Play Store actually came from my bank. At best, I can look at the install count, hope the app store does a half way decent job looking for fraud, and hope for the best. Maybe if I'm lucky they have some sort of verification program? The idea we actually trust app stores from Google or Apple over a direct install from the institutions we want to interact with is hilarious, especially considering all of the rampant malware and fraud issues on the Play Store.
  - angry_octet 7y ago
    You go to the bank's website and it has a link to the app on the store? If they dist an apk, how is the bank to provide updates for their app? Build their own updater architecture? If there was a mitmed update from a store they could cancel it centrally. Telling people to prefer apks is setting them up to be hacked.
    - beyondzero 7y ago