5 ms·

Epic games tried to side step google: > When Fortnite launched on mobile in 2018, Epic Games very notably sidestepped the Google Play Store and pushed users to

Epic games tried to side step google: > When Fortnite launched on mobile in 2018, Epic Games very notably sidestepped the Google Play Store and pushed users to download the title directly from their website, an effort made to avoid the substantial revenue cuts that Google takes from in-app purchases of Play Store downloads. After 18 months of harsh rhetoric regarding platform gatekeeping, Epic Games says that Fortnite is now available for download on the Google Play Store, though it will still be downloadable from fortnite.com moving forward. > Google puts software downloadable outside of Google Play at a disadvantage, through technical and business measures such as scary, repetitive security pop-ups for downloaded and updated software, restrictive manufacturer and carrier agreements and dealings, Google public relations characterizing third party software sources as malware, and new efforts such as Google Play Protect to outright block software obtained outside the Google Play store,: an Epic Games spokesperson said in a statement. "Because of this, we've launched Fortnite for Android on the Google Play Store."

scarface74 6y ago
And Epic conveniently forgot to mention the part about the security warning being well deserved when it came to Fortnite... https://www.cnet.com/news/fortnites-battle-royale-with-android-security-problems-is-just-getting-started/ https://www.cnet.com/news/fortnites-battle-royale-with-andro...
- zaroth 6y ago
  That article reads like propaganda for Google Store. > That's because Fortnite isn't available through Google's Play Store. Epic instead chose an unorthodox -- and more dangerous -- route for the game's fans. Rather than download it through the official Google app store, players need to download the game and "sideload" the app on their Android devices instead. That Epic is allowed to do this underscores why Google's Android often gets knocked for its security chops. No wonder they ultimately folded and came back into the “protection” [racket] offered by Google Play with PR like this coming to bear.
  - scarface74 6y ago
    Those security issues would have been rendered moot by the sandbox if they went through the Play Store. But really? That's the card you're going to play? That "every app has security issues" so this is okay?
    - Aeolun 6y ago
      Why would they not allow you to sandbox non-play store apps?
      - scarface74 6y ago
        Everyone wants their phone to be just as open as their computer and without restrictions - you have that with Android. The minute apps are forced to be in a sandbox, you forgo “openness” and “choice”.
        leppr 6y ago
        I don't think there's any relationship except an inverse one between user choice and app sandboxing. QubesOS, Snaps, Firejail, Sandboxie, browser tabs to some extent, restrict user-freedom in only the most technical way, with no bundled choice traps. On the contrary, a good sandbox allows users to forego human curation/proprietary malware detection services and execute any code they want.
        scarface74 6y ago
        But once you have a sandbox, you limit what the app can do. Would the outspoken users on Android be happy if the sandbox for side loaded apps restricted functionality they wanted?
        leppr 6y ago
        Yes, the issues highlighted in the thread stem not from the technical limitations of Android sandboxing but political censorship by Google. Covid-19 isn't transmitted through apps. This is a stereotypical false dilemma fallacy, where users are artificially forced to chose between security and censorship.
- ppseafield 6y ago
  Hmm... Well deserved, or a poor security choice for Android? The vulnerability appears to be that any app can overwrite an APK downloaded to external storage with a FileObserver. How is that not pathologically bad security on Android's part? > Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified. This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK.
  - berdario 6y ago
    Definitely Well deserved. That's not Android fault: you're asking Android to give you access to an unrestricted storage area (e.g. because you want to edit photos shot with your Camera app), and the fact that other apps can read/write to it, is the whole point of that storage. Hence you need to treat it as untrusted, and validate that you're going to install the APK that you thought you were going to install.
    - Groxx 6y ago
      The flaw appears to be that there is no way to validate in external storage, since the contents can be changed after validation. Which, yes, is a reason to not use external storage. But for large downloads it's undeniably the norm, since internal storage is frequently limited. Since Android doesn't appear to provide a way to use the SD card and also prevent this, that part of it is an Android flaw IMO. As evidence, note the external storage options say "can another app access it? yes, if it's in external storage": https://developer.android.com/training/data-storage https://developer.android.com/training/data-storage
      - berdario 6y ago
        They shouldn't have used external storage while using API for silent installs, full stop. https://developer.android.com/guide/topics/data/data-storage#filesInternal https://developer.android.com/guide/topics/data/data-storage... The fact that the norm is different is a good point, but the norm is also not to implement your own app stores. In fact, if internal storage is so limited that you don't have space for the APK, you'll get errors due to lack of space even while installing apps from the Play store
- nocturnial 6y ago
  So while the app was on an alternate store a security lapse was detected and fixed. Isn't that actually proof that something doesn't need to be on google play to be checked and improved?
  - scarface74 6y ago
    That really doesn’t help if there is a 0 day exploit.
ancarda 6y ago
>new efforts such as Google Play Protect to outright block software obtained outside the Google Play store Wait a sec, does this affect F-Droid as well?

scarface74 6y ago

And Epic conveniently forgot to mention the part about the security warning being well deserved when it came to Fortnite... https://www.cnet.com/news/fortnites-battle-royale-with-android-security-problems-is-just-getting-started/ https://www.cnet.com/news/fortnites-battle-royale-with-andro...

zaroth 6y ago
That article reads like propaganda for Google Store. > That's because Fortnite isn't available through Google's Play Store. Epic instead chose an unorthodox -- and more dangerous -- route for the game's fans. Rather than download it through the official Google app store, players need to download the game and "sideload" the app on their Android devices instead. That Epic is allowed to do this underscores why Google's Android often gets knocked for its security chops. No wonder they ultimately folded and came back into the “protection” [racket] offered by Google Play with PR like this coming to bear.
- scarface74 6y ago
  Those security issues would have been rendered moot by the sandbox if they went through the Play Store. But really? That's the card you're going to play? That "every app has security issues" so this is okay?
  - Aeolun 6y ago
    Why would they not allow you to sandbox non-play store apps?
    - scarface74 6y ago
      Everyone wants their phone to be just as open as their computer and without restrictions - you have that with Android. The minute apps are forced to be in a sandbox, you forgo “openness” and “choice”.
      - leppr 6y ago
        I don't think there's any relationship except an inverse one between user choice and app sandboxing. QubesOS, Snaps, Firejail, Sandboxie, browser tabs to some extent, restrict user-freedom in only the most technical way, with no bundled choice traps. On the contrary, a good sandbox allows users to forego human curation/proprietary malware detection services and execute any code they want.
        scarface74 6y ago
        But once you have a sandbox, you limit what the app can do. Would the outspoken users on Android be happy if the sandbox for side loaded apps restricted functionality they wanted?
        leppr 6y ago
        Yes, the issues highlighted in the thread stem not from the technical limitations of Android sandboxing but political censorship by Google. Covid-19 isn't transmitted through apps. This is a stereotypical false dilemma fallacy, where users are artificially forced to chose between security and censorship.
ppseafield 6y ago
Hmm... Well deserved, or a poor security choice for Android? The vulnerability appears to be that any app can overwrite an APK downloaded to external storage with a FileObserver. How is that not pathologically bad security on Android's part? > Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified. This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK.
- berdario 6y ago
  Definitely Well deserved. That's not Android fault: you're asking Android to give you access to an unrestricted storage area (e.g. because you want to edit photos shot with your Camera app), and the fact that other apps can read/write to it, is the whole point of that storage. Hence you need to treat it as untrusted, and validate that you're going to install the APK that you thought you were going to install.
  - Groxx 6y ago
    The flaw appears to be that there is no way to validate in external storage, since the contents can be changed after validation. Which, yes, is a reason to not use external storage. But for large downloads it's undeniably the norm, since internal storage is frequently limited. Since Android doesn't appear to provide a way to use the SD card and also prevent this, that part of it is an Android flaw IMO. As evidence, note the external storage options say "can another app access it? yes, if it's in external storage": https://developer.android.com/training/data-storage https://developer.android.com/training/data-storage
    - berdario 6y ago
      They shouldn't have used external storage while using API for silent installs, full stop. https://developer.android.com/guide/topics/data/data-storage#filesInternal https://developer.android.com/guide/topics/data/data-storage... The fact that the norm is different is a good point, but the norm is also not to implement your own app stores. In fact, if internal storage is so limited that you don't have space for the APK, you'll get errors due to lack of space even while installing apps from the Play store
nocturnial 6y ago
So while the app was on an alternate store a security lapse was detected and fixed. Isn't that actually proof that something doesn't need to be on google play to be checked and improved?
- scarface74 6y ago
  That really doesn’t help if there is a 0 day exploit.

ancarda 6y ago

>new efforts such as Google Play Protect to outright block software obtained outside the Google Play store Wait a sec, does this affect F-Droid as well?