3 ms·
> How can this be done without loss of security for typical users? It cannot. Typical users are not capable of 'vetting' app stores for their security capabili
by floatingatoll 6y ago
> How can this be done without loss of security for typical users?
It cannot. Typical users are not capable of 'vetting' app stores for their security capabilities.
- ben_w 6y agoIt doesn’t have to be directly end-users — could it be like the HTTPS chain of trust, only with Apple and Google as the roots of certification?
- floatingatoll 6y agoWhat incentive does Google or Apple have to associate their name with someone else’s security judgment calls?
- 29083011397778 6y agoMost people don't understand the difference between "Google Play served a malicious app" and "Their Android device had a malicious app installed". This is one reason Google Play Protect scans all apps installed, not just those installed through the Play Store. "That way, no matter where you download an app from, you know it's been checked by Google Play Protect"[1] [1] https://www.android.com/play-protect/ https://www.android.com/play-protect/
- ben_w 6y agoOh, none whatsoever. This would have to be forced upon them against their will. I just hope it’s done by governments who actually care about end users, not by those acting as though feudal aristocracy is the current economic standard and want a cut of Big Tech’s trillions.
- floatingatoll 6y agoI take it we've moved past the era of "governments shouldn't control the Internet", then.
- ben_w 6y agoGovernments have always controlled it (SSL encryption ‘export’ limitations, for example); what we’ve moved past is the idea that those governments which control it are uniquely those which sit in Washington DC.
- floatingatoll 6y agoI wasn’t talking about ITAR controls, but that’s an easier path to explain to others. Good call, I’ll use it, thanks.
- mercer 6y agoSandboxing, which is implemented, takes care of most of these issues.