5 ms·

This is completely false. The Play Store has "won" by Google chopping the legs off all the alternatives. They have to be sideloaded and you have to enable a sca

This is completely false. The Play Store has "won" by Google chopping the legs off all the alternatives. They have to be sideloaded and you have to enable a scary checkbox to do so, that suggests it's less secure to use any app store but the Play Store.

oxymoran 6y ago
Of course they have to put a scary checkbox, otherwise they would be held liable for any sketchy app that is actually malware people accidentally downloaded. And I guarantee if the checkbox wasn’t there, you would be complaining that there aren’t enough safeguards to keep people safe. I can’t even stand Google, but come on.
- saurik 6y ago
  > And I guarantee if the checkbox wasn’t there, you would be complaining that there aren’t enough safeguards to keep people safe. I hope what you mean is that someone else would be making the argument that the checkbox is necessary: claiming a crowd of people are a single inconsistent argument is disingenuous.
  - pb7 6y ago
    But the opposing crowd exists and maybe you personally don't have to deal with it but these companies do. Apple and Google deal with billions of ordinary people, not just tech nerds.
- _qulr 6y ago
  > Of course they have to put a scary checkbox, otherwise they would be held liable for any sketchy app that is actually malware people accidentally downloaded. What do you mean by "held liable"? It can't be in the legal sense, because Microsoft has never been held legally liable for Windows malware, and Apple has never been held legally liable for Mac malware.
  - pb7 6y ago
    Held liable just like this: "In 2014 the US Federal Trade Commission ordered Apple to pay out $32.3m (£24.6m) to reimburse American parents for unauthorised app purchases made by their children."[0] https://www.theguardian.com/money/2020/mar/11/my-kids-spent-600-on-their-ipads-without-my-knowledge https://www.theguardian.com/money/2020/mar/11/my-kids-spent-...
    - _qulr 6y ago
      This is the complete opposite of holding Apple liable for sideloaded apps. Apple was a direct party to these transactions. If Apple isn't the payment processor, they're off the hook.
      - pb7 6y ago
        Please, in what way is Apple liable for this other than the fact they need to hold someone accountable for the damages? You really can’t imagine this taking place for malware that compromises payment information? They may not be ordered to pay but the headlines would read the same and the negative PR is worth way more than a few million.
        _qulr 6y ago
        But again, Mac malware exists, Windows malware exists. Yet "sideloading" is still much easier on those platforms than on Android. So obviously this kind of "liability", i.e., bad PR, doesn't and hasn't required the same implementation, and certainly doesn't force them to make the platforms App Store only.
    - deleted 6y ago
      [deleted]
- plasticxme 6y ago
  No, there is no reason for them to do that. Microsoft has proven otherwise over their entire existence.
  - TeMPOraL 6y ago
    Microsoft also has a "scary checkbox", in the form of "are you sure you want to run this exe that came from the Internet?" popup.
karlicoss 6y ago
And also third party app stores (e.g. F-droid) can't autoupdate the apps for "security" reasons. One can only circumvent this by flashing a patch via phone recovery... which is fairly tedious and scary even for a tecnhical person, let alone regular users.
- Wowfunhappy 6y ago
  Wait, this is news to me! What aspect of Android is making autoupdates impossible? Apps can replace their contents, and apps can run in the background... shouldn't that be all you need?
  - heavyset_go 6y ago
    Android requires users to go through the explicit install and upgrade screen to upgrade apps outside of the Play Store. That means that F-Droid can't upgrade applications in the background, nor can they be upgraded automatically. Batch installs are also disabled for third party app stores.
    - Wowfunhappy 6y ago
      But isn't an app fundamentally just a collection of files? What is stopping F-Droid from replacing those files? Are executable bits special or something?
      - heavyset_go 6y ago
        Look into the Android security model, it's more complicated than vanilla Linux where you can just log in as root and fiddle with files if you want to get something done.
      - karlicoss 6y ago
        Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data storage (which is represented as /data/data/$APPNAME on the filesystem). But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data. This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it. But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.
megablast 6y ago
Yeah? you think users love hunting down a particular app store becauase that is the one that has the app you are after???
- gjs278 6y ago
  if the app wants more downloads, they will try to get into the main store. if the main store won't accept them for whatever reason, then it's either no store or a side store. I'll take the side store.
- monkeydreams 6y ago
  > Yeah? you think users love hunting down a particular app store becauase that is the one that has the app you are after??? I switch between streaming services based on the content they have. I have Steam, Epic Store and Origin on my PC because of the games and deals each have. Why would I not load a new app store (if I used my phone for anything other than a phone, camera and note-taking device)?
- untog 6y ago
  If only there was an example of a platform where you downloaded apps from the web and installed them at your own will! Oh, wait. It’s what we all did and do with computers. This isn’t some mystical unknown.
  - scarface74 6y ago
    And we see how that worked out. Viruses, malware, ransomware, key loggers, 10 toolbars on your browser.
    - untog 6y ago
      Which is where the (existing, robust) system of app permissions comes in. Something the desktop world never had. (besides, last time I checked my macOS machine is neither virus ridden nor covered in toolbars)
      - 6y ago
pb7 6y ago
It very well may be less secure. This is no different than warning boxes popping up on Windows/MacOS cautioning running executables downloaded from untrusted sources.
DevBih 6y ago
Good! Apple may ask for a bit too much with the 30 percent but still doesn’t give Epic the right to try and do things on their own. Judging on their little trailer they released shortly after getting removed, they new this was going to happen. A company that makes so much money should be able to compromise.
- misnome 6y ago
  It completely gives them the right to do it on their own. They are free to take their business elsewhere, or start their own mobile platform.
  - CarbyAu 6y ago
    As things currently stand this is unarguably true. The next question is though, given the incentives in place are entirely due to Apple, is that anti-competitive? I think it is. It is also ruthless smart business to make money. Given societies rules about "make money" for corporations I can't blame them. But I am allowed to wish it were otherwise.
- ryanbrunner 6y ago
  The problem is that Apple has consistently demonstrated that "compromise" means "accept Apple's terms without any wiggle room for negotiation".
- sushid 6y ago
  > A company that makes so much money should be able to compromise. It's hilarious to see people rooting for Apple as if they're the little guys. The company that makes so much money here is Apple, not Epic. They should be willing to compromise. They gouge app developers and in turn its end users by charging a 30% ransom.
  - enos_feedler 6y ago
    How many app developers feel they are getting gouged? I’m an iOS developer and don’t feel that way? Is it when you get big and greedy?
simonh 6y ago
Plenty of handset makers to this day preinstall their own app stores, including the biggest and most successful, Samsung.
- esnard 6y ago
  Related: I often find item bundles cheaper if I buy them via the Samsung Galaxy Store (10% cheaper). Is it because Samsung doesn't have keep 30% of the money, but a lower amount?
olliej 6y ago
The scary check box exists for a reason. The reason malware isn't everywhere on android and iOS is because randomly installing apps isn't unsafe. I mean sans play store's automatic tools occasionally letting nonsense through. A large part of the security model on both systems is the ability to constrain what apps can do, and by ensuring those have happened. The various privileged (in the security sense) sandbox entitlements on iOS can't be used by a malicious app because the malicious app can't get through the App Store. That significantly increases the bar for any malware. I assume the Google Play store similarly limits access to privileged system features, and I would fully expect the 3rd party stores do not. Also personally: The Epic store is a terrible app, and signing up for it requires providing vastly more information to them than I ever wanted to, especially for only a single company's games, from a company that has no stated intent of reducing data collection and improving privacy. A company that also engages in scummy tactics like loot boxes, virtual currency, etc
- _qulr 6y ago
  > The reason malware isn't everywhere on android and iOS is because randomly installing apps isn't unsafe. What about macOS?
  - olliej 6y ago
    It is perennially being targeted by malware :)
scarface74 6y ago
Right because why would Google think it needs to warn people about the dangers imposed by installing an app outside of the Google Play store by a well known developer like Epic? https://arstechnica.com/gadgets/2018/08/fortnites-android-vulnerability-leads-to-googleepic-games-spat/ https://arstechnica.com/gadgets/2018/08/fortnites-android-vu...
Wowfunhappy 6y ago
> that suggests it's less secure to use any app store but the Play Store. The suggestion is usually correct, though. Google does a terrible job of vetting Play Store apps, but they do still have some automated safety checks, and they kick out known malware once it's found. If you allow sideloading, you give up all of that. It's still perfectly safe if you trust what you install, but you have to make that assessment. Google can't save you. This is exactly how I wish iOS worked. It's also basically how the Mac works nowadays, except replace "App Store" with "Apple notary service." How would you suggest Google correctly communicate the risk?
- ocdtrekkie 6y ago
  Installing an app from F-Droid is drastically safer than installing an app from the Play Store though.
  - ithkuil 6y ago
    Could it be because a niche is not such an interesting attack vector?
    - ocdtrekkie 6y ago
      Maybe a little, but more importantly, all apps on F-Droid are open source, and verifibly built from said source. It's very hard to hide malicious activity on it, whereas duping the Play Store content moderators is like taking candy from a baby.
      - distances 6y ago
        For a small apps there's nothing checking against intentional malicious activity. Sure it'd be there in plain sight, but it's pretty unlikely really that anyone would read the source code of some random single person project.
  - Wowfunhappy 6y ago
    Google doesn't know whether you're installing F-Droid or Totally-Free-Money.apk.
ggggtez 6y ago
>They have to be sideloaded and you have to enable a scary checkbox to do so And windows has a scary sounding checkbox when you download an .exe from the internet. So what? In the old days, it never warned you, and people were CONSTANTLY getting malware by downloading random stuff from sketchy sites.
izacus 6y ago
Majority of Android phones shipped in last years were built by Samsung and Huawei which both ship their own app store by default. Your claim doesn't match the reality.

oxymoran 6y ago

Of course they have to put a scary checkbox, otherwise they would be held liable for any sketchy app that is actually malware people accidentally downloaded. And I guarantee if the checkbox wasn’t there, you would be complaining that there aren’t enough safeguards to keep people safe. I can’t even stand Google, but come on.

saurik 6y ago
> And I guarantee if the checkbox wasn’t there, you would be complaining that there aren’t enough safeguards to keep people safe. I hope what you mean is that someone else would be making the argument that the checkbox is necessary: claiming a crowd of people are a single inconsistent argument is disingenuous.
- pb7 6y ago
  But the opposing crowd exists and maybe you personally don't have to deal with it but these companies do. Apple and Google deal with billions of ordinary people, not just tech nerds.
_qulr 6y ago
> Of course they have to put a scary checkbox, otherwise they would be held liable for any sketchy app that is actually malware people accidentally downloaded. What do you mean by "held liable"? It can't be in the legal sense, because Microsoft has never been held legally liable for Windows malware, and Apple has never been held legally liable for Mac malware.
- pb7 6y ago
  Held liable just like this: "In 2014 the US Federal Trade Commission ordered Apple to pay out $32.3m (£24.6m) to reimburse American parents for unauthorised app purchases made by their children."[0] https://www.theguardian.com/money/2020/mar/11/my-kids-spent-600-on-their-ipads-without-my-knowledge https://www.theguardian.com/money/2020/mar/11/my-kids-spent-...
  - _qulr 6y ago
    This is the complete opposite of holding Apple liable for sideloaded apps. Apple was a direct party to these transactions. If Apple isn't the payment processor, they're off the hook.
    - pb7 6y ago
      Please, in what way is Apple liable for this other than the fact they need to hold someone accountable for the damages? You really can’t imagine this taking place for malware that compromises payment information? They may not be ordered to pay but the headlines would read the same and the negative PR is worth way more than a few million.
      - _qulr 6y ago
        But again, Mac malware exists, Windows malware exists. Yet "sideloading" is still much easier on those platforms than on Android. So obviously this kind of "liability", i.e., bad PR, doesn't and hasn't required the same implementation, and certainly doesn't force them to make the platforms App Store only.
  - deleted 6y ago
    [deleted]
plasticxme 6y ago
No, there is no reason for them to do that. Microsoft has proven otherwise over their entire existence.
- TeMPOraL 6y ago
  Microsoft also has a "scary checkbox", in the form of "are you sure you want to run this exe that came from the Internet?" popup.

karlicoss 6y ago

And also third party app stores (e.g. F-droid) can't autoupdate the apps for "security" reasons. One can only circumvent this by flashing a patch via phone recovery... which is fairly tedious and scary even for a tecnhical person, let alone regular users.

Wowfunhappy 6y ago
Wait, this is news to me! What aspect of Android is making autoupdates impossible? Apps can replace their contents, and apps can run in the background... shouldn't that be all you need?
- heavyset_go 6y ago
  Android requires users to go through the explicit install and upgrade screen to upgrade apps outside of the Play Store. That means that F-Droid can't upgrade applications in the background, nor can they be upgraded automatically. Batch installs are also disabled for third party app stores.
  - Wowfunhappy 6y ago
    But isn't an app fundamentally just a collection of files? What is stopping F-Droid from replacing those files? Are executable bits special or something?
    - heavyset_go 6y ago
      Look into the Android security model, it's more complicated than vanilla Linux where you can just log in as root and fiddle with files if you want to get something done.
    - karlicoss 6y ago
      Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data storage (which is represented as /data/data/$APPNAME on the filesystem). But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data. This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it. But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.

megablast 6y ago

Yeah? you think users love hunting down a particular app store becauase that is the one that has the app you are after???

gjs278 6y ago
if the app wants more downloads, they will try to get into the main store. if the main store won't accept them for whatever reason, then it's either no store or a side store. I'll take the side store.
monkeydreams 6y ago
> Yeah? you think users love hunting down a particular app store becauase that is the one that has the app you are after??? I switch between streaming services based on the content they have. I have Steam, Epic Store and Origin on my PC because of the games and deals each have. Why would I not load a new app store (if I used my phone for anything other than a phone, camera and note-taking device)?
untog 6y ago
If only there was an example of a platform where you downloaded apps from the web and installed them at your own will! Oh, wait. It’s what we all did and do with computers. This isn’t some mystical unknown.
- scarface74 6y ago
  And we see how that worked out. Viruses, malware, ransomware, key loggers, 10 toolbars on your browser.
  - untog 6y ago
    Which is where the (existing, robust) system of app permissions comes in. Something the desktop world never had. (besides, last time I checked my macOS machine is neither virus ridden nor covered in toolbars)
    - 6y ago

pb7 6y ago

It very well may be less secure. This is no different than warning boxes popping up on Windows/MacOS cautioning running executables downloaded from untrusted sources.

DevBih 6y ago

Good! Apple may ask for a bit too much with the 30 percent but still doesn’t give Epic the right to try and do things on their own. Judging on their little trailer they released shortly after getting removed, they new this was going to happen. A company that makes so much money should be able to compromise.

misnome 6y ago
It completely gives them the right to do it on their own. They are free to take their business elsewhere, or start their own mobile platform.
- CarbyAu 6y ago
  As things currently stand this is unarguably true. The next question is though, given the incentives in place are entirely due to Apple, is that anti-competitive? I think it is. It is also ruthless smart business to make money. Given societies rules about "make money" for corporations I can't blame them. But I am allowed to wish it were otherwise.
ryanbrunner 6y ago
The problem is that Apple has consistently demonstrated that "compromise" means "accept Apple's terms without any wiggle room for negotiation".
sushid 6y ago
> A company that makes so much money should be able to compromise. It's hilarious to see people rooting for Apple as if they're the little guys. The company that makes so much money here is Apple, not Epic. They should be willing to compromise. They gouge app developers and in turn its end users by charging a 30% ransom.
- enos_feedler 6y ago
  How many app developers feel they are getting gouged? I’m an iOS developer and don’t feel that way? Is it when you get big and greedy?

simonh 6y ago

Plenty of handset makers to this day preinstall their own app stores, including the biggest and most successful, Samsung.

esnard 6y ago
Related: I often find item bundles cheaper if I buy them via the Samsung Galaxy Store (10% cheaper). Is it because Samsung doesn't have keep 30% of the money, but a lower amount?

olliej 6y ago

The scary check box exists for a reason. The reason malware isn't everywhere on android and iOS is because randomly installing apps isn't unsafe. I mean sans play store's automatic tools occasionally letting nonsense through. A large part of the security model on both systems is the ability to constrain what apps can do, and by ensuring those have happened. The various privileged (in the security sense) sandbox entitlements on iOS can't be used by a malicious app because the malicious app can't get through the App Store. That significantly increases the bar for any malware. I assume the Google Play store similarly limits access to privileged system features, and I would fully expect the 3rd party stores do not. Also personally: The Epic store is a terrible app, and signing up for it requires providing vastly more information to them than I ever wanted to, especially for only a single company's games, from a company that has no stated intent of reducing data collection and improving privacy. A company that also engages in scummy tactics like loot boxes, virtual currency, etc

_qulr 6y ago
> The reason malware isn't everywhere on android and iOS is because randomly installing apps isn't unsafe. What about macOS?
- olliej 6y ago
  It is perennially being targeted by malware :)

scarface74 6y ago

Right because why would Google think it needs to warn people about the dangers imposed by installing an app outside of the Google Play store by a well known developer like Epic? https://arstechnica.com/gadgets/2018/08/fortnites-android-vulnerability-leads-to-googleepic-games-spat/ https://arstechnica.com/gadgets/2018/08/fortnites-android-vu...

Wowfunhappy 6y ago

> that suggests it's less secure to use any app store but the Play Store. The suggestion is usually correct, though. Google does a terrible job of vetting Play Store apps, but they do still have some automated safety checks, and they kick out known malware once it's found. If you allow sideloading, you give up all of that. It's still perfectly safe if you trust what you install, but you have to make that assessment. Google can't save you. This is exactly how I wish iOS worked. It's also basically how the Mac works nowadays, except replace "App Store" with "Apple notary service." How would you suggest Google correctly communicate the risk?

ocdtrekkie 6y ago
Installing an app from F-Droid is drastically safer than installing an app from the Play Store though.
- ithkuil 6y ago
  Could it be because a niche is not such an interesting attack vector?
  - ocdtrekkie 6y ago
    Maybe a little, but more importantly, all apps on F-Droid are open source, and verifibly built from said source. It's very hard to hide malicious activity on it, whereas duping the Play Store content moderators is like taking candy from a baby.
    - distances 6y ago
      For a small apps there's nothing checking against intentional malicious activity. Sure it'd be there in plain sight, but it's pretty unlikely really that anyone would read the source code of some random single person project.
- Wowfunhappy 6y ago
  Google doesn't know whether you're installing F-Droid or Totally-Free-Money.apk.

ggggtez 6y ago

>They have to be sideloaded and you have to enable a scary checkbox to do so And windows has a scary sounding checkbox when you download an .exe from the internet. So what? In the old days, it never warned you, and people were CONSTANTLY getting malware by downloading random stuff from sketchy sites.

izacus 6y ago

Majority of Android phones shipped in last years were built by Samsung and Huawei which both ship their own app store by default. Your claim doesn't match the reality.