4 ms·

The way I see it, a well-funded and very popular entity tried to bypass Google’s stranglehold (and high taxes) on app distribution. Even they ultimately failed

by zaroth 6y ago

The way I see it, a well-funded and very popular entity tried to bypass Google’s stranglehold (and high taxes) on app distribution. Even they ultimately failed to maintain independent distribution. They probably invested quite a few engineering hours to devise a solution, as there’s a lot of code / Google services that need to be replicated. It’s unsurprising to me that there were some bugs in this code, and I think generally companies that respond to bug reports and issue patches should be commended. Where I would disagree is if you are claiming that we should be treating Google Play akin to a low-level cryptographic library in the vein of a “don’t ever roll your own” approach. Allowing independent software distribution is usually considered a positive differentiator for Android. For this to be a viable distribution channel it’s actually extremely important for large and popular entities to be using side loading in order to build recognition and trust in its use. Ideally it results in open-source sideloading frameworks and best practices that the larger community can build upon.

scarface74 6y ago
Are you as forgiving about security issues with Zoom?
- zaroth 6y ago
  It’s OT but I will totally forgive Zoom for their security issues. Their CEO openly admitted they were wrong, promised to fix it, made real changes fairly quickly to better lock down default settings, have upgraded their ciphers, and made a major acquisition to build-out their security chops (Keybase) to address the larger problem of easy to use key management. Personally I’ve relied on Zoom to get meetings running quickly (without wasting precious time fighting with hard to install client software) many times on meetings where I would gladly trade ease of use for security posture. I think Zoom messed up but has shown they can admit fault and course correct. They are—as far as I’m aware—an entirely content neutral communications network that lets me pay for a service, doesn’t try to analyze and data mine my content, isn’t operating as a middleman between me and my customers, and isn’t at risk of becoming my competitor if it detects my product is becoming successful. They aren’t leveraging a monopoly position to maximize rent seeking and crushing the little guy through arbitrarily enforced content moderation policies. They aren’t exploiting cheap labor or phish a business to intercept their customers. So as far as growth-hacks go, playing some API tricks on Mac and Windows to get their client ridiculously easy to install and running in a meeting — which risked you entering a meeting without an extra prompt, or potentially provided a pivot for unsigned code.... Frankly they seem about as un-villainous as they come in terms of publicly listed tech companies or venture-backed unicorns.
  - scarface74 6y ago
    You mean “API tricks” like surreptitiously installing an always running web server on Macs so that it could reinstall itself when the user uninstalled it? They aren’t sorry for doing it. They are sorry for getting caught....
    - zaroth 6y ago
      Yes, exactly. I believe they used the localhost server to be able to quickly install and launch Zoom with zero extra clicks when you joined a meeting. It wasn’t used to track their users, or serve ads, or nag users to come back to Zoom or monitor anything on your machine. It was used so that when you wanted to join a meeting, it would get you into the room completely effortlessly. Again I just feel like compared to the innumerable ways that big and “well respected” companies are regularly screwing their customers, using a technical hack only to make your product easier to use is in some ways commendable even. I’ve wasted 15, even 20 minutes on some hour long conference calls just trying to get everyone dialed in and able to hear and talk. I actually chose Zoom because of how hard they worked to make it “Just Work”. I guess I feel like they had their heart in the right place, and didn’t actually abuse their users’ trust like almost every other company I’m forced to put up with. I think Fortnite is even more ethically clear cut than Zoom though, because Fortnite tried to develop a feature that they have every moral and technical right and justification to do. I see self-distribution along the lines of self-hosting. It’s feature that we want to be able to exist and be well tested and understood how to “do it right” for strong competitive and anti-censorship reasons. Fortnite just happened to screw up a specific aspect of the implementation. In some cases you screw up, you patch it, you write a blog post explaining what you got wrong and how you fixed it, and you’re a hero for helping the community learn from your mistake! I don’t understand why Fortnite got pilloried instead of the community wanting them to succeed so that they could blaze the trail for independent developers in the future?! Why wasn’t the pressure on Google for not having better documentation and support for what they were trying to do, and for imposing arbitrary technical limitations like not allowing developers to keep the sandbox enabled for side-loaded apps? Wasn’t it Google that actually found and disclosed the bug in Fortnite’s installer? That’s some serious gray hat level hacking. If Fortnite had succeeded in mainstreaming the concept of side-loading it might have made it much more popular and pressured Google into not making side-loading technically inferior. That put the fear of God into Google and gave them a massive financial motive to undermine that effort. It’s not like Google hasn’t badly screwed up many times with Android security in the past.

by zaroth 6y ago

scarface74 6y ago

Are you as forgiving about security issues with Zoom?

zaroth 6y ago
It’s OT but I will totally forgive Zoom for their security issues. Their CEO openly admitted they were wrong, promised to fix it, made real changes fairly quickly to better lock down default settings, have upgraded their ciphers, and made a major acquisition to build-out their security chops (Keybase) to address the larger problem of easy to use key management. Personally I’ve relied on Zoom to get meetings running quickly (without wasting precious time fighting with hard to install client software) many times on meetings where I would gladly trade ease of use for security posture. I think Zoom messed up but has shown they can admit fault and course correct. They are—as far as I’m aware—an entirely content neutral communications network that lets me pay for a service, doesn’t try to analyze and data mine my content, isn’t operating as a middleman between me and my customers, and isn’t at risk of becoming my competitor if it detects my product is becoming successful. They aren’t leveraging a monopoly position to maximize rent seeking and crushing the little guy through arbitrarily enforced content moderation policies. They aren’t exploiting cheap labor or phish a business to intercept their customers. So as far as growth-hacks go, playing some API tricks on Mac and Windows to get their client ridiculously easy to install and running in a meeting — which risked you entering a meeting without an extra prompt, or potentially provided a pivot for unsigned code.... Frankly they seem about as un-villainous as they come in terms of publicly listed tech companies or venture-backed unicorns.
- scarface74 6y ago
  You mean “API tricks” like surreptitiously installing an always running web server on Macs so that it could reinstall itself when the user uninstalled it? They aren’t sorry for doing it. They are sorry for getting caught....
  - zaroth 6y ago
    Yes, exactly. I believe they used the localhost server to be able to quickly install and launch Zoom with zero extra clicks when you joined a meeting. It wasn’t used to track their users, or serve ads, or nag users to come back to Zoom or monitor anything on your machine. It was used so that when you wanted to join a meeting, it would get you into the room completely effortlessly. Again I just feel like compared to the innumerable ways that big and “well respected” companies are regularly screwing their customers, using a technical hack only to make your product easier to use is in some ways commendable even. I’ve wasted 15, even 20 minutes on some hour long conference calls just trying to get everyone dialed in and able to hear and talk. I actually chose Zoom because of how hard they worked to make it “Just Work”. I guess I feel like they had their heart in the right place, and didn’t actually abuse their users’ trust like almost every other company I’m forced to put up with. I think Fortnite is even more ethically clear cut than Zoom though, because Fortnite tried to develop a feature that they have every moral and technical right and justification to do. I see self-distribution along the lines of self-hosting. It’s feature that we want to be able to exist and be well tested and understood how to “do it right” for strong competitive and anti-censorship reasons. Fortnite just happened to screw up a specific aspect of the implementation. In some cases you screw up, you patch it, you write a blog post explaining what you got wrong and how you fixed it, and you’re a hero for helping the community learn from your mistake! I don’t understand why Fortnite got pilloried instead of the community wanting them to succeed so that they could blaze the trail for independent developers in the future?! Why wasn’t the pressure on Google for not having better documentation and support for what they were trying to do, and for imposing arbitrary technical limitations like not allowing developers to keep the sandbox enabled for side-loaded apps? Wasn’t it Google that actually found and disclosed the bug in Fortnite’s installer? That’s some serious gray hat level hacking. If Fortnite had succeeded in mainstreaming the concept of side-loading it might have made it much more popular and pressured Google into not making side-loading technically inferior. That put the fear of God into Google and gave them a massive financial motive to undermine that effort. It’s not like Google hasn’t badly screwed up many times with Android security in the past.