3 ms·

Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, y

Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.

teraflop 5y ago
> And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?
- slownews45 5y ago
  The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.

teraflop 5y ago

> And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?

slownews45 5y ago
The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.