5 ms·

This post for info purposes only having worked with the Amazon app store team and does not reflect my opinions at all, I haven't spent time thinking about if it

This post for info purposes only having worked with the Amazon app store team and does not reflect my opinions at all, I haven't spent time thinking about if it's good or bad: The resigning stuff is because they alter the apps to fix dependence on Google play apis and gsuite apis. Developers were not interested in rebuilding their apps for fire and other devices without those apis baked in and this was a good solution to ease uptake for fire/Amazon app store. Also note that ms will control this android os, so they already control the signature verification method. They could do this without you knowing very easily by just with something like carrying a second sig and hash of what they modified and the original partial sums from the original app. Google and amazon or any os supplier can. Signature verification is only as strong as the verifier code. Glad to burn karma to put data out there.

teraflop 5y ago
Sure, there are any number of ways Microsoft could break their own security model. For example, they could stop verifying signatures entirely. The fact that they're not doing worse things doesn't make what they are doing less bad. If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? Sure, some devs might be too lazy to do it, but how does that justify forcing everyone to give up control over their signatures?
- cptskippy 5y ago
  > If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? I would imagine the tool rebinds the Google APIs to Amazon's equivalent APIs rather than neutering them. Since Apps are relying on the API responses. I don't imagine Amazon wants Apps distributed outside their Store using their APIs and getting a free ride. Am I missunderstanding things? Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? I understand there's a chain of custody and a developer can upload their App, then download it from the store and be confident it's what they uploaded. But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.
  - teraflop 5y ago
    > But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification. In fact, Google is planning to soon force app developers to use this model, just like Amazon. Yes, it removes the ability for developers to know/control what code is running with their name attached to it, and it's bad regardless of who's doing it.
  - iggldiggl 5y ago
    > Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? The primary (or at least original) purpose is to verify that app updates (or in some cases extensions/companion app that can directly access each other's data) are signed by the same key as the already installed app. Though I supposed that these days PlayProtect will likely indeed check the signature against Google's database on first installation, too.
- slownews45 5y ago
  Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.
  - teraflop 5y ago
    > And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?
    - slownews45 5y ago
      The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.
tyingq 5y ago
Given the choice between an Amazon app store and a Google one, running on my Windows machine...Amazon does seem the lesser of the two "evils".
Sebb767 5y ago
> The resigning stuff is because they alter the apps to fix dependence on Google play apis and gsuite apis. Except the article clearly states: > Amazon wraps your app with code that enables the app to communicate with the Amazon Appstore client to collect analytics, evaluate and enforce program policies, and share aggregated information with you. Your app will always communicate with the Amazon Appstore client when it starts Now, the original reason to do this might have been benign and well-intentioned, but the result is bad already. This is for now, who says they don't simply add ads like Google [0], or even without the developers knowledge like SF [1] once did? Ubuntu tried to only implement a search and it backfired badly [2], I hope this goes down a similar path. As a side-note: Of course I'm very happy that competition to the PlayStore is getting some love. This is direly needed. But Microsoft could have gone with F-Droid easily. Trading a bad thing for something worse does not fill me with joy. [0] https://news.ycombinator.com/item?id=27643208 https://news.ycombinator.com/item?id=27643208 [1] https://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ https://arstechnica.com/information-technology/2015/05/sourc... [2] https://nakedsecurity.sophos.com/2012/11/01/ubuntu-search-amazon-privacy/ https://nakedsecurity.sophos.com/2012/11/01/ubuntu-search-am...
- cptskippy 5y ago
  > But Microsoft could have gone with F-Droid easily. Slipping that in at the end really hurts your argument. Microsoft opting to use F-Driod would be worse than starting from scratch and only benefit F-Droid. Presenting F-Droid as an equivalent to any of the large stores is like trying to say a lending library in someone's front yard is the equivalent to Barnes & Noble or Amazon. It's borderline delusional to compare F-Droid to the big players in much the same way it's silly to compare FOSS apps like GIMP to Photoshop. Sure it performs the same core function but they're in completely different classes. They aren't equivalents unless you willfully ignore a lot of differences and that is just dishonest.
  - hanselot 5y ago
    The most major difference being that I have come to associate apps installed via F-droid with quality, while I associate anything produced by the "Big players" with bloatware and trash. Almost without exception, the more apps from "Big players'" stores I install, the more laggy and trash my experience on mobile becomes, until I am forced to buy a flagship. This is exactly the same way my PC experience had become prior to migrating to Linux. Now, I get to be in control of my computer, and honestly, if people would shift their attention from "it doesn't compare to 'insert hacked together proprietary trash X' " to, "who actually owns my data and computing devices?", we would immediately see a turnaround of this experience. The catch22 has always been, nobody is using the software on Linux enough for enough people to be submitting feedback, while simultaneously, not enough people believe Linux is worth moving to. Those people still left supporting these corporations immediately jump to the same argument as always, while these "big players" find and innovate unique ways of slipping ever more propaganda directly onto your machine, all while you are stuck staring at the newest trash filter added to photoshop. Quite honestly **** you good sir, how dare you **** on the effort of the Open Source community by even pretending for a second that you are not representing the opinion of the very corporations that would see these communities extinguished if it added so much as a cent to their quarterly profits. Seriously, don't even try to represent what qualifies as software in today's world with what used to be "good" software. There does not exist a program in today's world that isn't a bunch of hacked together trash, sticky-taped together by countless shortcuts, all in an effort to ship in time for the next deadline.

teraflop 5y ago

Sure, there are any number of ways Microsoft could break their own security model. For example, they could stop verifying signatures entirely. The fact that they're not doing worse things doesn't make what they are doing less bad. If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? Sure, some devs might be too lazy to do it, but how does that justify forcing everyone to give up control over their signatures?

cptskippy 5y ago
> If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? I would imagine the tool rebinds the Google APIs to Amazon's equivalent APIs rather than neutering them. Since Apps are relying on the API responses. I don't imagine Amazon wants Apps distributed outside their Store using their APIs and getting a free ride. Am I missunderstanding things? Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? I understand there's a chain of custody and a developer can upload their App, then download it from the store and be confident it's what they uploaded. But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.
- teraflop 5y ago
  > But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification. In fact, Google is planning to soon force app developers to use this model, just like Amazon. Yes, it removes the ability for developers to know/control what code is running with their name attached to it, and it's bad regardless of who's doing it.
- iggldiggl 5y ago
  > Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? The primary (or at least original) purpose is to verify that app updates (or in some cases extensions/companion app that can directly access each other's data) are signed by the same key as the already installed app. Though I supposed that these days PlayProtect will likely indeed check the signature against Google's database on first installation, too.
slownews45 5y ago
Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.
- teraflop 5y ago
  > And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?
  - slownews45 5y ago
    The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.

tyingq 5y ago

Given the choice between an Amazon app store and a Google one, running on my Windows machine...Amazon does seem the lesser of the two "evils".

Sebb767 5y ago

> The resigning stuff is because they alter the apps to fix dependence on Google play apis and gsuite apis. Except the article clearly states: > Amazon wraps your app with code that enables the app to communicate with the Amazon Appstore client to collect analytics, evaluate and enforce program policies, and share aggregated information with you. Your app will always communicate with the Amazon Appstore client when it starts Now, the original reason to do this might have been benign and well-intentioned, but the result is bad already. This is for now, who says they don't simply add ads like Google [0], or even without the developers knowledge like SF [1] once did? Ubuntu tried to only implement a search and it backfired badly [2], I hope this goes down a similar path. As a side-note: Of course I'm very happy that competition to the PlayStore is getting some love. This is direly needed. But Microsoft could have gone with F-Droid easily. Trading a bad thing for something worse does not fill me with joy. [0] https://news.ycombinator.com/item?id=27643208 https://news.ycombinator.com/item?id=27643208 [1] https://arstechnica.com/information-technology/2015/05/sourceforge-grabs-gimp-for-windows-account-wraps-installer-in-bundle-pushing-adware/ https://arstechnica.com/information-technology/2015/05/sourc... [2] https://nakedsecurity.sophos.com/2012/11/01/ubuntu-search-amazon-privacy/ https://nakedsecurity.sophos.com/2012/11/01/ubuntu-search-am...

cptskippy 5y ago
> But Microsoft could have gone with F-Droid easily. Slipping that in at the end really hurts your argument. Microsoft opting to use F-Driod would be worse than starting from scratch and only benefit F-Droid. Presenting F-Droid as an equivalent to any of the large stores is like trying to say a lending library in someone's front yard is the equivalent to Barnes & Noble or Amazon. It's borderline delusional to compare F-Droid to the big players in much the same way it's silly to compare FOSS apps like GIMP to Photoshop. Sure it performs the same core function but they're in completely different classes. They aren't equivalents unless you willfully ignore a lot of differences and that is just dishonest.
- hanselot 5y ago
  The most major difference being that I have come to associate apps installed via F-droid with quality, while I associate anything produced by the "Big players" with bloatware and trash. Almost without exception, the more apps from "Big players'" stores I install, the more laggy and trash my experience on mobile becomes, until I am forced to buy a flagship. This is exactly the same way my PC experience had become prior to migrating to Linux. Now, I get to be in control of my computer, and honestly, if people would shift their attention from "it doesn't compare to 'insert hacked together proprietary trash X' " to, "who actually owns my data and computing devices?", we would immediately see a turnaround of this experience. The catch22 has always been, nobody is using the software on Linux enough for enough people to be submitting feedback, while simultaneously, not enough people believe Linux is worth moving to. Those people still left supporting these corporations immediately jump to the same argument as always, while these "big players" find and innovate unique ways of slipping ever more propaganda directly onto your machine, all while you are stuck staring at the newest trash filter added to photoshop. Quite honestly **** you good sir, how dare you **** on the effort of the Open Source community by even pretending for a second that you are not representing the opinion of the very corporations that would see these communities extinguished if it added so much as a cent to their quarterly profits. Seriously, don't even try to represent what qualifies as software in today's world with what used to be "good" software. There does not exist a program in today's world that isn't a bunch of hacked together trash, sticky-taped together by countless shortcuts, all in an effort to ship in time for the next deadline.