4 ms·

Having an alternative to the App Store doesn't mean you have to stop using the App Store, or suffer any reduction in quality in the apps available on the App St

Having an alternative to the App Store doesn't mean you have to stop using the App Store, or suffer any reduction in quality in the apps available on the App Store. Nothing changes for you in exchange for more freedom for others.

lotsofpulp 6y ago
I assume a device's security is improved by being hampering the ability to install software. Can I rely on an Android device to not be tampered with or have malware just as much as I can an iOS device? I don't mean secure as in the NSA can't break into it. I mean secure as in normal people can't mess it up clicking bullshit links in WhatsApp messages.
- dec0dedab0de 6y ago
  I'm guessing you don't use Android at all, but it is very difficult to accidentally install something outside of the play store. I would even say it is tricky to purposely install something outside of the play store.
  - lotsofpulp 6y ago
    I did from 2010 to 2015 and while I didn't have a problem, my dad was able to get malware on his. He actually was iOS from 2010 to 2014 then android 2015 to 2018, and then he kept messing his device up so I told him I'm not helping him unless he goes to iOS. All I know is I needed a 100% guarantee the device won't be tampered with by random people for my business and that other than turning it off and on, there was no tech support needed. To me, this meant going with Apple.
    - Apocryphon 6y ago
      Do you know the specific method he got malware on his device? Because people assume that Android malware are from secondary illicit app stores, and not just malware that was not caught on Google's inferior official Play Store, or from exploits at the OS level.
      - lotsofpulp 6y ago
        No, I didn't bother researching that. My dad very well might have gone in the options settings and disabled some stuff if the WhatsApp message instructions told him to to get something he wanted. He has, for some unknown reason, the desire to trust all the things he shouldn't, and for him I need a device that simply can't be touched. Especially since nowadays your financial accounts and everything is secured via SMS 2FA.
        Apocryphon 6y ago
        Fair enough, but again the whole anti-alternate app stores narrative hinges on the supposition that these app stores will be a significant source of malware. I'm wondering if there are any Android security studies that proves or disproves that point.
        nodamage 6y ago
        Yes, Google publishes a security report that indicates that devices that side-load apps have an 8x higher malware incidence compared to devices that only use the Play Store. (https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf https://source.android.com/security/reports/Google_Android_S...) As an example, HummingBad infected 85 million devices primarily via direct-download on malicious adult websites. (https://www.zdnet.com/article/this-android-malware-has-infected-85-million-devices-and-makes-its-creators-300000-a-month/ https://www.zdnet.com/article/this-android-malware-has-infec...)
        Apocryphon 6y ago
        So it looks like allowing users to easily sideload apps, let alone direct download and install binaries from mobile web, is problematic. Their stats on third-party app stores seems more scanty. > In 2018, hostile downloaders made up 22.0% of all sideloaded PHAs, making this the third most prevalent category, as in 2017. While this category accounted for 0.39% of all sideloaded apps in 2017, it is down to 0.20% in 2018, a sharp decline. Last year, Trojans were particularly targeting devices in India, Indonesia, Russia, Brazil, and Mexico. > The prevalence of hostile downloaders is due to a combination of legitimate third-party stores with poor security setups that distribute PHAs, fake stores that are built specifically for spreading PHAs, pre-installed apps that slipped through the security scans of OEMs, and plain apps that pretend to (or actually do) offer user-wanted features while downloading PHAs in the background.
- everfree 6y ago
  Android has an "allow software from unknown sources" option buried in the settings menu. As long as you don't specifically go looking for that option and THEN approve the source of the .apk file and THEN click install on the system dialog, you can't accidentally install non-play-store software.
spideymans 6y ago
Yeah until Facebook moves all their apps to their own App Store so they don’t have to deal with all of Apple’s pesky privacy rules.
- manigandham 6y ago
  What privacy rules would those be? Why would iOS privacy settings be affected by the install method? What would be different from the Facebook SDK that's already installed in millions of apps on the App Store today?
  - spideymans 6y ago
    Abusing private APIs would be a major issues. Binaries uploaded to the App Store are inspected to ensure that they aren't abusing any private APIs. Facebook controlling their own store would allow them to circumvent this check. In the past, private APIs have been used to track users, amongst other malicious behaviour.
    - manigandham 6y ago
      What kind of inspection? The App Store review is not that in-depth and has frequently let through many apps that were leaking private details. And again, how does this affect iOS system level privacy settings and protections? App permissions and warnings don't change.
- Apocryphon 6y ago
  They'd suffer massive public blowback for that, atop all of their PR woes that's been mounting each year since the 2016 U.S. elections.

lotsofpulp 6y ago

I assume a device's security is improved by being hampering the ability to install software. Can I rely on an Android device to not be tampered with or have malware just as much as I can an iOS device? I don't mean secure as in the NSA can't break into it. I mean secure as in normal people can't mess it up clicking bullshit links in WhatsApp messages.

dec0dedab0de 6y ago
I'm guessing you don't use Android at all, but it is very difficult to accidentally install something outside of the play store. I would even say it is tricky to purposely install something outside of the play store.
- lotsofpulp 6y ago
  I did from 2010 to 2015 and while I didn't have a problem, my dad was able to get malware on his. He actually was iOS from 2010 to 2014 then android 2015 to 2018, and then he kept messing his device up so I told him I'm not helping him unless he goes to iOS. All I know is I needed a 100% guarantee the device won't be tampered with by random people for my business and that other than turning it off and on, there was no tech support needed. To me, this meant going with Apple.
  - Apocryphon 6y ago
    Do you know the specific method he got malware on his device? Because people assume that Android malware are from secondary illicit app stores, and not just malware that was not caught on Google's inferior official Play Store, or from exploits at the OS level.
    - lotsofpulp 6y ago
      No, I didn't bother researching that. My dad very well might have gone in the options settings and disabled some stuff if the WhatsApp message instructions told him to to get something he wanted. He has, for some unknown reason, the desire to trust all the things he shouldn't, and for him I need a device that simply can't be touched. Especially since nowadays your financial accounts and everything is secured via SMS 2FA.
      - Apocryphon 6y ago
        Fair enough, but again the whole anti-alternate app stores narrative hinges on the supposition that these app stores will be a significant source of malware. I'm wondering if there are any Android security studies that proves or disproves that point.
        nodamage 6y ago
        Yes, Google publishes a security report that indicates that devices that side-load apps have an 8x higher malware incidence compared to devices that only use the Play Store. (https://source.android.com/security/reports/Google_Android_Security_2018_Report_Final.pdf https://source.android.com/security/reports/Google_Android_S...) As an example, HummingBad infected 85 million devices primarily via direct-download on malicious adult websites. (https://www.zdnet.com/article/this-android-malware-has-infected-85-million-devices-and-makes-its-creators-300000-a-month/ https://www.zdnet.com/article/this-android-malware-has-infec...)
        Apocryphon 6y ago
        So it looks like allowing users to easily sideload apps, let alone direct download and install binaries from mobile web, is problematic. Their stats on third-party app stores seems more scanty. > In 2018, hostile downloaders made up 22.0% of all sideloaded PHAs, making this the third most prevalent category, as in 2017. While this category accounted for 0.39% of all sideloaded apps in 2017, it is down to 0.20% in 2018, a sharp decline. Last year, Trojans were particularly targeting devices in India, Indonesia, Russia, Brazil, and Mexico. > The prevalence of hostile downloaders is due to a combination of legitimate third-party stores with poor security setups that distribute PHAs, fake stores that are built specifically for spreading PHAs, pre-installed apps that slipped through the security scans of OEMs, and plain apps that pretend to (or actually do) offer user-wanted features while downloading PHAs in the background.
everfree 6y ago
Android has an "allow software from unknown sources" option buried in the settings menu. As long as you don't specifically go looking for that option and THEN approve the source of the .apk file and THEN click install on the system dialog, you can't accidentally install non-play-store software.

spideymans 6y ago

Yeah until Facebook moves all their apps to their own App Store so they don’t have to deal with all of Apple’s pesky privacy rules.

manigandham 6y ago
What privacy rules would those be? Why would iOS privacy settings be affected by the install method? What would be different from the Facebook SDK that's already installed in millions of apps on the App Store today?
- spideymans 6y ago
  Abusing private APIs would be a major issues. Binaries uploaded to the App Store are inspected to ensure that they aren't abusing any private APIs. Facebook controlling their own store would allow them to circumvent this check. In the past, private APIs have been used to track users, amongst other malicious behaviour.
  - manigandham 6y ago
    What kind of inspection? The App Store review is not that in-depth and has frequently let through many apps that were leaking private details. And again, how does this affect iOS system level privacy settings and protections? App permissions and warnings don't change.
Apocryphon 6y ago
They'd suffer massive public blowback for that, atop all of their PR woes that's been mounting each year since the 2016 U.S. elections.