4 ms·

> Why are the developers at Google acting in such boneheaded ways? (I'm a developer at Google, but I'm not on the Android team and am definitely not providing

by mjg59 6y ago

> Why are the developers at Google acting in such boneheaded ways? (I'm a developer at Google, but I'm not on the Android team and am definitely not providing any sort of official response here - this is personal opinion and may be inaccurate) If apps can download arbitrary code and then execute it, they can bypass the validation that's done as part of the Play Protect program. My understanding is that there's plenty of evidence of malware in the wild that presents as a harmless app and then downloads the actual payload after being installed on the user's device.

mixedCase 6y ago
Okay, can I just get a big popup on the Play Store saying "this app requires the following functionality that could harm your device: - Run and use other applications without your consent Unless you know precisely that this behavior is necessary for this application's main functionality, we recommend you do not proceed". And use some design pattern to make "Cancel" the "go-to" action for the user. Or even more palatable for whoever's behind Play Protect: Forbid these apps from the Play Store, and force it be done through a 3rd party store or manually, and this can be combined with the big popup. We know it's important to protect grandma from malware, but it's also important to give the advanced user the option to ignore this, specially for a platform like Android that has gained the favor of many technical users through providing some reasonable degree of control over their phones.
- lonelappde 6y ago
  It's also important to protect non Grandma from malware. Rugged Individualists can run TempleOS
esotericn 6y ago
I think you've missed my point here, this goes _way_ further than this specific individual issue. The entire ecosystem is built on a model that turns it into a disposable toy and there's no sign that this is going away any time soon. Why do we need hobbyist movements to produce devices that we can actually run real software on and that won't be completely useless as soon as Google decide to update the API?
- djsumdog 6y ago
  Yea, phones should not be designed to be replaced after 2 years. Phones from 6 years ago would still be plenty powerful if they weren't crippled by Google Services eating more and more resources. Google could use mainline kernels and force manufactures in the OHA to open source all their drivers, maybe even back PostmarketOS to prevent e-waste. You can take an old Pentium 4 laptop and still put modern Linux on it and still use it for some tasks. Good luck trying to do that with any ARM system.
  - esotericn 6y ago
    It makes me genuinely really angry that this isn't the case, it has me questioning why I even bother to interact with the development ecosystem when it seems like 90% of the stuff out there is this sort of closed-off 'got mine' fuck-the-environment style thinking. Maybe it's just too much time on HN? Like, how many times does one have to push against the bullshit bootlicker arguments before one just gives up?
  - lonelappde 6y ago
    Why does Google owe you this? Write any OS you want. You can use a open source base. That Pentium will cost more in electricity than just buying a new cheap phone.
  - zozbot234 6y ago
    The problem is the ARM bespoke-devices ecosystem, not Google. The pre-Android "Linux on mobile" world was far worse wrt. the use of downstream patched kernels. We just didn't care as much, because a kludgy, patched BSP was better than a wholly-closed solution with no source available. Our standards as to what qualifies as "open" have simply become stricter.
  - pjmlp 6y ago
    Across Europe pre-paid cards and using phones until they die, are lost or get stolen is the common usage.
ddevault 6y ago
This excuse might hold even a little bit of water if the "validation" actually did anything. Google Play is a malware distributor, plain and simple. Go search the Play store for "flashlight" and read up on the permissions of any of the first 10 results. https://play.google.com/store/search?q=flashlight https://play.google.com/store/search?q=flashlight GPS location, full network access, prevent device from sleeping, run at startup, microtransactions, read contacts and accounts, read your filesystem... for a flashlight app. These are malware. The Play store is 95% malware, or worse. Moves like the one that locks out Termux aren't protecting the user at all; Google has never been interested in that. They centralize power. That's what it's all about.
- thekyle 6y ago
  The other day I was trying to find a QR code scanning app in Google Play for my mother. I honestly cannot blame people for ending up with a phone full or spyware since basically all the top results were garbage. I ended up searching for "qr reader foss" which got me some decent apps.
  - ddevault 6y ago
    Try F-Droid next time.
    - thekyle 6y ago
      I do use that on my phone.
  - zozbot234 6y ago
    Doesn't Android support QR scanning in the stock Camera app anyway? You shouldn't even need to take a photo, it should detect the QR pattern and give you the option of reading/copying/browsing to it.
    - thekyle 6y ago
      I thought so too since it does that on my Galaxy A50, but apparently it doesn't work on the default camera for the Galaxy S8.
AshamedCaptain 6y ago
Until all execution of foreign code is blocked (like Apple), then all that Android does is to add a bit of nuisance to malware, as they can no longer download the actual payload to disk but have to download the payload to memory and execute it from there. Not really a big deal for a malware author, but likely a dealbreaker for a Termux-like program. And if Android implements a policy like Apple's to block all execution of foreign code (which is the apparently inevitable conclusion of this type of security arguments), then browsers and everything else will be gone, exactly like Apple (for the record, where every browser is just a wrapper over Webkit). I used to think that Android was more open than iOS based on principle, but now I realize that no, it was more open than iOS just because they lacked the technical means to enforce the draconian restrictions.

by mjg59 6y ago

mixedCase 6y ago

Okay, can I just get a big popup on the Play Store saying "this app requires the following functionality that could harm your device: - Run and use other applications without your consent Unless you know precisely that this behavior is necessary for this application's main functionality, we recommend you do not proceed". And use some design pattern to make "Cancel" the "go-to" action for the user. Or even more palatable for whoever's behind Play Protect: Forbid these apps from the Play Store, and force it be done through a 3rd party store or manually, and this can be combined with the big popup. We know it's important to protect grandma from malware, but it's also important to give the advanced user the option to ignore this, specially for a platform like Android that has gained the favor of many technical users through providing some reasonable degree of control over their phones.

lonelappde 6y ago
It's also important to protect non Grandma from malware. Rugged Individualists can run TempleOS

esotericn 6y ago

I think you've missed my point here, this goes _way_ further than this specific individual issue. The entire ecosystem is built on a model that turns it into a disposable toy and there's no sign that this is going away any time soon. Why do we need hobbyist movements to produce devices that we can actually run real software on and that won't be completely useless as soon as Google decide to update the API?

djsumdog 6y ago
Yea, phones should not be designed to be replaced after 2 years. Phones from 6 years ago would still be plenty powerful if they weren't crippled by Google Services eating more and more resources. Google could use mainline kernels and force manufactures in the OHA to open source all their drivers, maybe even back PostmarketOS to prevent e-waste. You can take an old Pentium 4 laptop and still put modern Linux on it and still use it for some tasks. Good luck trying to do that with any ARM system.
- esotericn 6y ago
  It makes me genuinely really angry that this isn't the case, it has me questioning why I even bother to interact with the development ecosystem when it seems like 90% of the stuff out there is this sort of closed-off 'got mine' fuck-the-environment style thinking. Maybe it's just too much time on HN? Like, how many times does one have to push against the bullshit bootlicker arguments before one just gives up?
- lonelappde 6y ago
  Why does Google owe you this? Write any OS you want. You can use a open source base. That Pentium will cost more in electricity than just buying a new cheap phone.
- zozbot234 6y ago
  The problem is the ARM bespoke-devices ecosystem, not Google. The pre-Android "Linux on mobile" world was far worse wrt. the use of downstream patched kernels. We just didn't care as much, because a kludgy, patched BSP was better than a wholly-closed solution with no source available. Our standards as to what qualifies as "open" have simply become stricter.
- pjmlp 6y ago
  Across Europe pre-paid cards and using phones until they die, are lost or get stolen is the common usage.

ddevault 6y ago

This excuse might hold even a little bit of water if the "validation" actually did anything. Google Play is a malware distributor, plain and simple. Go search the Play store for "flashlight" and read up on the permissions of any of the first 10 results. https://play.google.com/store/search?q=flashlight https://play.google.com/store/search?q=flashlight GPS location, full network access, prevent device from sleeping, run at startup, microtransactions, read contacts and accounts, read your filesystem... for a flashlight app. These are malware. The Play store is 95% malware, or worse. Moves like the one that locks out Termux aren't protecting the user at all; Google has never been interested in that. They centralize power. That's what it's all about.

thekyle 6y ago
The other day I was trying to find a QR code scanning app in Google Play for my mother. I honestly cannot blame people for ending up with a phone full or spyware since basically all the top results were garbage. I ended up searching for "qr reader foss" which got me some decent apps.
- ddevault 6y ago
  Try F-Droid next time.
  - thekyle 6y ago
    I do use that on my phone.
- zozbot234 6y ago
  Doesn't Android support QR scanning in the stock Camera app anyway? You shouldn't even need to take a photo, it should detect the QR pattern and give you the option of reading/copying/browsing to it.
  - thekyle 6y ago
    I thought so too since it does that on my Galaxy A50, but apparently it doesn't work on the default camera for the Galaxy S8.

AshamedCaptain 6y ago

Until all execution of foreign code is blocked (like Apple), then all that Android does is to add a bit of nuisance to malware, as they can no longer download the actual payload to disk but have to download the payload to memory and execute it from there. Not really a big deal for a malware author, but likely a dealbreaker for a Termux-like program. And if Android implements a policy like Apple's to block all execution of foreign code (which is the apparently inevitable conclusion of this type of security arguments), then browsers and everything else will be gone, exactly like Apple (for the record, where every browser is just a wrapper over Webkit). I used to think that Android was more open than iOS based on principle, but now I realize that no, it was more open than iOS just because they lacked the technical means to enforce the draconian restrictions.