7 ms·

There aren't that many hurdles. 1. You download the apk 2. When you try to install it, it tells you it's from an unknown source and the installation was block

There aren't that many hurdles. 1. You download the apk 2. When you try to install it, it tells you it's from an unknown source and the installation was blocked to protect you 3. You tap "settings" and flip a switch to allow installing apps from your browser 4. You go back and tap "install". That's it. It's done. And you won't need to go to the settings the next time, it'll just work.

spians 6y ago
These are still four more steps then what it takes to directly install from the Play Store. Most people would view any of these four steps as hurdle. > And you won't need to go to the settings the next time, it'll just work. You will still have to find the apk when there is an update, download it and confirm install. There are still three steps to update the apk compared to Play Store's one tap (or even zero clicks if automatic updates are on). Only "Allow installing from this source" step is removed when updating the app.
- grishka 6y ago
  It's possible to build self-update functionality into an app, just like many apps do on desktop. An app can open that installation prompt to update itself.
  - anderspitman 6y ago
    Not on the latest versions of Android, unless you're only updating interpreted code like Python. You can no longer execute files that weren't packaged with the original APK.
    - grishka 6y ago
      You can download an apk and launch the package installer activity to install it. In latest versions of Android, you'll need to serve the apk through a ContentProvider. I tested this myself, it works, even if the app is updating itself. But I think you can actually still load arbitrary dex files using a ClassLoader? I thought that the update was only affecting JNI libraries. I remember reading how they wanted for any and all executable code to come from a signed package. Even then, if you're determined enough, you can load arbitrary native code by allocating some rwx memory pages and copying it in there ;)
      - anderspitman 6y ago
        Yeah I misinterpreted your original comment. I was thinking in terms of the app being in control of itself ie JNI type stuff. Sounds like there are ways to do it within the Android ecosystem, but in cases where Google is suspending things wouldn't they just turn off all the self-update stuff?
        grishka 6y ago
        Google doesn't have the technical ability to "turn off all the self-update stuff", if you mean preventing non-store apps from updating themselves by downloading and installing apks. The worst thing they can try doing is bullying the users into uninstalling the app through Google Play Protect.
        anderspitman 6y ago
        I'm not deep enough in the Android ecosystem to understand all the details. I've only had the misfortune of trying to get a (very portably-written) golang application to run in the environment, and hitting roadblock after roadblock. I guess my overall point is that Google is motivated to have complete control over Android app distribution, and they'll plug as many of the types of holes you're talking about as they can get away with.
tgsovlerkhgsel 6y ago
The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. That's bearable though unpleasant when you have one or two pieces of software that rarely get updated, that's absolutely impossible when you have 10+ pieces of software - you'll sit there for 5 minutes just approving install prompts every week, which isn't something a normal human is going to do. It doesn't help that FDroid is pretty broken, and constantly pops up notifications about updates that don't work/aren't actionable (i.e. tapping the notification doesn't result in an install prompt followed by a successful installation, instead I get various errors etc.). Also, apparently the FDroid review process is even slower than the Play store review process.
- pmlnr 6y ago
  That's a feature, not a bug. Believe it or not, people don't like app/sw updates. Devs and money people do.
- grishka 6y ago
  > there doesn't seem to be a way for alternative app stores to silently update software Yes — because that's something reserved for privileged system apps. You have to root your device to take advantage of that, or make a custom ROM with the alternative store in it. Having that ability as a permission you could grant to any app is an immense security risk. But then there are "device administrator" apps that can literally factory reset the device... I don't know. Maybe package installation should be part of that. Especially now that the legacy permission model was taken care of — if you install an app that doesn't support runtime permissions, you'll get a list of its permissions with toggles next to them when you run it for the first time. > you'll sit there for 5 minutes just approving install prompts every week Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years?
  - GordonS 6y ago
    If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? > Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years? Sure, I'm even old enough to remember this but on cassettes and floppy disks! But - software now is much more complex than it used to be - most software has dependencies on other libraries/frameworks, and has to deal with communication and encryption (where it is all to easy to make subtle mistakes). IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates.
oji0hub 6y ago
No major apps have gained traction that way. So unfortunately, those are enough hurdles that this isn't realistic.
KnobbleMcKnees 6y ago
Sadly, you lost the 90% of users who are not tech experts by point 2.
- grishka 6y ago
  So be it. It's okay for technology to require education. Stop infantilizing users.
  - dominotw 6y ago
    https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 Dropbox wouldn't be a thing if we can "educate" users.
    - grishka 6y ago
      Dropbox's selling point is its simplicity. Apple's as well, for that matter. It's perfectly fine to have simplicity as your selling point. Many people, myself included, love products that "just work" out of the box. That's what everything should be like, ideally. My gripe with modern technology is that it actively inhibits your ability to go in and tinker. DRM, forced app stores, code signing with enforced signing identity, all that kind of stuff. See, imagine someone releases an amazing messaging app that's lightyears ahead of everything else on the market. But — it's only available through F-Droid or as an apk download on the developer's website. People will flock there and install it. And they will be unstoppable. A concrete example of this phenomenon: Pokemon Go wasn't officially released in Russia, so you couldn't download it from the app stores. Yet, everyone played it. And I mean everyone, in 2016, especially during summer, you couldn't take a walk in the downtown St Petersburg without hearing the Pokemon Go sounds from people's phones. Android users sideloaded apks, iOS users created separate Apple IDs to bypass the geoblock. Suddenly everyone educated themselves to get the thing they wanted.
bogwog 6y ago
99% of consumers will stop at step 2. 80% won't have the technical skills to make it past step 1. But even if 99% of people could figure it out, it'd still be an unnecessary hurdle whose only purpose is to provide Google with an unfair competitive advantage. Until all of that bs goes away, side-loading and secondary app stores will be nothing more than a hobby for enthusiasts.
- thu2111 6y ago
  Google shouldn't be doing what they're doing, no question. BUT, this reaction to the idea of people downloading apps is over the top. The world is full of people who made lots of money on the back of people downloading and installing their apps, even with far worse UXs than what Android provides. Minecraft. Steam. Heck, every video game ever. Skype. Microsoft Office. Made billions when people had to physically go to a store and get it. Google Earth. Chrome itself. IntelliJ, any developer tool. Zoom. WebEx. Most video conf tools, actually. Any pro tool whatsoever. You get the picture. No, ticking a box and tapping is not the end of the world and never has been. The UX for app installation on macOS and Windows is totally atrocious in both cases and people figure it out. If you live in the Valley bubble world where every single app that exists is VC funded and desperately racing to get to a 100M daily actives first, then it might seem like one extra click is literally the end of the world. But FFS the vast majority of all businesses and products require more effort to get than that, and they work just fine.
gameswithgo 6y ago
thats a huge hurdle for normal people, it means you can't make a business out of selling things that way unless you have an established product like fortnite
- grishka 6y ago
  > make a business Well here's your problem

spians 6y ago

These are still four more steps then what it takes to directly install from the Play Store. Most people would view any of these four steps as hurdle. > And you won't need to go to the settings the next time, it'll just work. You will still have to find the apk when there is an update, download it and confirm install. There are still three steps to update the apk compared to Play Store's one tap (or even zero clicks if automatic updates are on). Only "Allow installing from this source" step is removed when updating the app.

grishka 6y ago
It's possible to build self-update functionality into an app, just like many apps do on desktop. An app can open that installation prompt to update itself.
- anderspitman 6y ago
  Not on the latest versions of Android, unless you're only updating interpreted code like Python. You can no longer execute files that weren't packaged with the original APK.
  - grishka 6y ago
    You can download an apk and launch the package installer activity to install it. In latest versions of Android, you'll need to serve the apk through a ContentProvider. I tested this myself, it works, even if the app is updating itself. But I think you can actually still load arbitrary dex files using a ClassLoader? I thought that the update was only affecting JNI libraries. I remember reading how they wanted for any and all executable code to come from a signed package. Even then, if you're determined enough, you can load arbitrary native code by allocating some rwx memory pages and copying it in there ;)
    - anderspitman 6y ago
      Yeah I misinterpreted your original comment. I was thinking in terms of the app being in control of itself ie JNI type stuff. Sounds like there are ways to do it within the Android ecosystem, but in cases where Google is suspending things wouldn't they just turn off all the self-update stuff?
      - grishka 6y ago
        Google doesn't have the technical ability to "turn off all the self-update stuff", if you mean preventing non-store apps from updating themselves by downloading and installing apks. The worst thing they can try doing is bullying the users into uninstalling the app through Google Play Protect.
        anderspitman 6y ago
        I'm not deep enough in the Android ecosystem to understand all the details. I've only had the misfortune of trying to get a (very portably-written) golang application to run in the environment, and hitting roadblock after roadblock. I guess my overall point is that Google is motivated to have complete control over Android app distribution, and they'll plug as many of the types of holes you're talking about as they can get away with.

tgsovlerkhgsel 6y ago

The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. That's bearable though unpleasant when you have one or two pieces of software that rarely get updated, that's absolutely impossible when you have 10+ pieces of software - you'll sit there for 5 minutes just approving install prompts every week, which isn't something a normal human is going to do. It doesn't help that FDroid is pretty broken, and constantly pops up notifications about updates that don't work/aren't actionable (i.e. tapping the notification doesn't result in an install prompt followed by a successful installation, instead I get various errors etc.). Also, apparently the FDroid review process is even slower than the Play store review process.

pmlnr 6y ago
That's a feature, not a bug. Believe it or not, people don't like app/sw updates. Devs and money people do.
grishka 6y ago
> there doesn't seem to be a way for alternative app stores to silently update software Yes — because that's something reserved for privileged system apps. You have to root your device to take advantage of that, or make a custom ROM with the alternative store in it. Having that ability as a permission you could grant to any app is an immense security risk. But then there are "device administrator" apps that can literally factory reset the device... I don't know. Maybe package installation should be part of that. Especially now that the legacy permission model was taken care of — if you install an app that doesn't support runtime permissions, you'll get a list of its permissions with toggles next to them when you run it for the first time. > you'll sit there for 5 minutes just approving install prompts every week Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years?
- GordonS 6y ago
  If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? > Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years? Sure, I'm even old enough to remember this but on cassettes and floppy disks! But - software now is much more complex than it used to be - most software has dependencies on other libraries/frameworks, and has to deal with communication and encryption (where it is all to easy to make subtle mistakes). IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates.

oji0hub 6y ago

No major apps have gained traction that way. So unfortunately, those are enough hurdles that this isn't realistic.

KnobbleMcKnees 6y ago

Sadly, you lost the 90% of users who are not tech experts by point 2.

grishka 6y ago
So be it. It's okay for technology to require education. Stop infantilizing users.
- dominotw 6y ago
  https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 Dropbox wouldn't be a thing if we can "educate" users.
  - grishka 6y ago
    Dropbox's selling point is its simplicity. Apple's as well, for that matter. It's perfectly fine to have simplicity as your selling point. Many people, myself included, love products that "just work" out of the box. That's what everything should be like, ideally. My gripe with modern technology is that it actively inhibits your ability to go in and tinker. DRM, forced app stores, code signing with enforced signing identity, all that kind of stuff. See, imagine someone releases an amazing messaging app that's lightyears ahead of everything else on the market. But — it's only available through F-Droid or as an apk download on the developer's website. People will flock there and install it. And they will be unstoppable. A concrete example of this phenomenon: Pokemon Go wasn't officially released in Russia, so you couldn't download it from the app stores. Yet, everyone played it. And I mean everyone, in 2016, especially during summer, you couldn't take a walk in the downtown St Petersburg without hearing the Pokemon Go sounds from people's phones. Android users sideloaded apks, iOS users created separate Apple IDs to bypass the geoblock. Suddenly everyone educated themselves to get the thing they wanted.

bogwog 6y ago

99% of consumers will stop at step 2. 80% won't have the technical skills to make it past step 1. But even if 99% of people could figure it out, it'd still be an unnecessary hurdle whose only purpose is to provide Google with an unfair competitive advantage. Until all of that bs goes away, side-loading and secondary app stores will be nothing more than a hobby for enthusiasts.

thu2111 6y ago
Google shouldn't be doing what they're doing, no question. BUT, this reaction to the idea of people downloading apps is over the top. The world is full of people who made lots of money on the back of people downloading and installing their apps, even with far worse UXs than what Android provides. Minecraft. Steam. Heck, every video game ever. Skype. Microsoft Office. Made billions when people had to physically go to a store and get it. Google Earth. Chrome itself. IntelliJ, any developer tool. Zoom. WebEx. Most video conf tools, actually. Any pro tool whatsoever. You get the picture. No, ticking a box and tapping is not the end of the world and never has been. The UX for app installation on macOS and Windows is totally atrocious in both cases and people figure it out. If you live in the Valley bubble world where every single app that exists is VC funded and desperately racing to get to a 100M daily actives first, then it might seem like one extra click is literally the end of the world. But FFS the vast majority of all businesses and products require more effort to get than that, and they work just fine.

gameswithgo 6y ago

thats a huge hurdle for normal people, it means you can't make a business out of selling things that way unless you have an established product like fortnite

grishka 6y ago
> make a business Well here's your problem