5 ms·

Someone needs to take this to the EU courts and force google (and apple) to allow the use of alternate app stores that are not technically hindered. It was don

Someone needs to take this to the EU courts and force google (and apple) to allow the use of alternate app stores that are not technically hindered. It was done with Windows and Explorer so I don't see why this is any different.

scarface74 6y ago
Alternate app stores have been allowed on Android since day one.
- searchableguy 6y ago
  Not really. You need to be root to have the same experience as playstore - namely auto updates.
  - scarface74 6y ago
    So I’m going to both trust an app that is not sandboxed on my phone and trust it to update itself without my consent?
    - WrtCdEvrydy 6y ago
      All apps are sandboxed in Android... even the ones installed externally.
      - scarface74 6y ago
        Obviously not well enough considering what happened with Fortnite....
        WrtCdEvrydy 6y ago
        What happened to Fortnite?
        scarface74 6y ago
        https://www.cnet.com/news/just-as-critics-feared-fortnite-for-android-came-with-an-epic-security-risk/ https://www.cnet.com/news/just-as-critics-feared-fortnite-fo...
        searchableguy 6y ago
        > For the attack to work, it sounds like you would have already needed to have a piece of malware on your phone, ready and waiting to strike. But not a particularly sophisticated one. After you ask the Fortnite Launcher to download Fortnite, Google claims that any app with the WRITE_EXTERNAL_STORAGE permission would have been able to sneakily replace the real Fortnite app with a fake one after security checks were already complete. It's known as a "man-in-the-disk" attack.
- unethical_ban 6y ago
  Getting F-Droid is not "hard" but it isn't easy, and IIRC Google's Android gives off warnings. (Also it isn't as refined as the Play Store). I believe the parent was suggesting, like with Windows/IE decades ago, that Android phones may have to come with a prompt to enable alternative stores to Play.
  - scarface74 6y ago
    That worked really well for Windows....
- derekp7 6y ago
  But only if you set a security flag to "allow anything to be installed". I want a security flag that says "allow apps from sources signed by the following keys", where I can import app store keys from the app store(s) of my choosing. So I'm still protected, as long as I trust those app stores that I import.
  - scarface74 6y ago
    Yeah, that's going to work really well for the average consumer....
    - Spivak 6y ago
      "Allow this app to install other apps" and behind the scenes this means it adds the store's public key to "known sources." Just because the parent is talking about the implementation doesn't mean the user-facing UI will actually expose any of it.
  - roblabla 6y ago
    That has changed somewhat recently (android O I believe?). Now, when an app tries to start an installation, Android will bring you to that app's setting page where you can toggle an option "Allow this app to install other apps" or something along those lines. It's a lot more straightforward than it used to be. That said, auto-updates are still not possible without root access, I believe.
    - cft 6y ago
      If anything, new Android is killing termux, one of the best apps for devs: https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...
  - celebrant 6y ago
    That doesn't matter when companies ship their own app stores installed as systems apps like Samsung and Amazon do.
  - 6y ago
slightwinder 6y ago
How are app stores on Android technically hindered? I thought except the additional step for installing them, there is no difference in ability?
- phh 6y ago
  A 3rd-party application store can't update apps silently to name one, the user has to approve every app update one by one.
  - Grazester 6y ago
    I fully agree with this for non play store apps from a security standpoint.
    - zaroth 6y ago
      I think the problem is that users aren’t given the option. Hence the original question of; what technical disadvantages do non-Play stores face? I think we agree this is a crucial technical disadvantage. Do you think it would be fair for users to be able to make this decision for themselves on devices they own?
  - dylan604 6y ago
    This is how it should be. You cannot trust developers to not break things. Whether that's from ignorance, incompetence, just don't give a shit attitude, it results in the same. I'm not saying don't update, but update when you understand what the update will do. It's funny (ironic) that the people that these auto-updates are meant to "protect" are the non-tech types, yet these are also the people that tend to not do backups and are most negatively affected by bad updates.
  - eulenteufel 6y ago
    At least for fdroid you can update apps silently. You need a rooted device, flash [1] and install the f-droid privilege extension [2]. [1] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged... [2] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...

scarface74 6y ago

Alternate app stores have been allowed on Android since day one.

searchableguy 6y ago
Not really. You need to be root to have the same experience as playstore - namely auto updates.
- scarface74 6y ago
  So I’m going to both trust an app that is not sandboxed on my phone and trust it to update itself without my consent?
  - WrtCdEvrydy 6y ago
    All apps are sandboxed in Android... even the ones installed externally.
    - scarface74 6y ago
      Obviously not well enough considering what happened with Fortnite....
      - WrtCdEvrydy 6y ago
        What happened to Fortnite?
        scarface74 6y ago
        https://www.cnet.com/news/just-as-critics-feared-fortnite-for-android-came-with-an-epic-security-risk/ https://www.cnet.com/news/just-as-critics-feared-fortnite-fo...
        searchableguy 6y ago
        > For the attack to work, it sounds like you would have already needed to have a piece of malware on your phone, ready and waiting to strike. But not a particularly sophisticated one. After you ask the Fortnite Launcher to download Fortnite, Google claims that any app with the WRITE_EXTERNAL_STORAGE permission would have been able to sneakily replace the real Fortnite app with a fake one after security checks were already complete. It's known as a "man-in-the-disk" attack.
unethical_ban 6y ago
Getting F-Droid is not "hard" but it isn't easy, and IIRC Google's Android gives off warnings. (Also it isn't as refined as the Play Store). I believe the parent was suggesting, like with Windows/IE decades ago, that Android phones may have to come with a prompt to enable alternative stores to Play.
- scarface74 6y ago
  That worked really well for Windows....
derekp7 6y ago
But only if you set a security flag to "allow anything to be installed". I want a security flag that says "allow apps from sources signed by the following keys", where I can import app store keys from the app store(s) of my choosing. So I'm still protected, as long as I trust those app stores that I import.
- scarface74 6y ago
  Yeah, that's going to work really well for the average consumer....
  - Spivak 6y ago
    "Allow this app to install other apps" and behind the scenes this means it adds the store's public key to "known sources." Just because the parent is talking about the implementation doesn't mean the user-facing UI will actually expose any of it.
- roblabla 6y ago
  That has changed somewhat recently (android O I believe?). Now, when an app tries to start an installation, Android will bring you to that app's setting page where you can toggle an option "Allow this app to install other apps" or something along those lines. It's a lot more straightforward than it used to be. That said, auto-updates are still not possible without root access, I believe.
  - cft 6y ago
    If anything, new Android is killing termux, one of the best apps for devs: https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...
- celebrant 6y ago
  That doesn't matter when companies ship their own app stores installed as systems apps like Samsung and Amazon do.
- 6y ago

slightwinder 6y ago

How are app stores on Android technically hindered? I thought except the additional step for installing them, there is no difference in ability?

phh 6y ago
A 3rd-party application store can't update apps silently to name one, the user has to approve every app update one by one.
- Grazester 6y ago
  I fully agree with this for non play store apps from a security standpoint.
  - zaroth 6y ago
    I think the problem is that users aren’t given the option. Hence the original question of; what technical disadvantages do non-Play stores face? I think we agree this is a crucial technical disadvantage. Do you think it would be fair for users to be able to make this decision for themselves on devices they own?
- dylan604 6y ago
  This is how it should be. You cannot trust developers to not break things. Whether that's from ignorance, incompetence, just don't give a shit attitude, it results in the same. I'm not saying don't update, but update when you understand what the update will do. It's funny (ironic) that the people that these auto-updates are meant to "protect" are the non-tech types, yet these are also the people that tend to not do backups and are most negatively affected by bad updates.
- eulenteufel 6y ago
  At least for fdroid you can update apps silently. You need a rooted device, flash [1] and install the f-droid privilege extension [2]. [1] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged.ota/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged... [2] https://f-droid.org/en/packages/org.fdroid.fdroid.privileged/ https://f-droid.org/en/packages/org.fdroid.fdroid.privileged...