10 ms·

Google Play Dumps APKs for the More Google-Controlled “Android App Bundle”

180 points by muxator 5y ago

touristtam 5y ago
related discussion: https://news.ycombinator.com/item?id=27695486 https://news.ycombinator.com/item?id=27695486
corty 5y ago
There goes Moxies justification for using only the Playstore for Signal... And I'm waiting for the first supply-chain attack resulting from Google signing a rootkit, Microsoft-style...
- izacus 5y ago
  > There goes Moxies justification for using only the Playstore for Signal... Moxie is fine with this state of affairs on iOS - I'm not sure why this would change anything on that front?
  - corty 5y ago
    Moxie complained about F-Droid recompiling and resigning his stuff. And cited this as his reason to use only the Playstore. But I guess things were more about analytics and control after all.
    - m-p-3 5y ago
      Moxie can use F-Droid with his own signature if he supplies a reproducible build. https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
      - Aissen 5y ago
        Which in theory Signal supports; anyone tried it lately ? https://github.com/signalapp/Signal-Android/tree/master/reproducible-builds https://github.com/signalapp/Signal-Android/tree/master/repr...
    - tssva 5y ago
      You are trying to place events which happened in the past under a completely different set of circumstances into the circumstances of today and then are drawing a conclusion from that.
      - corty 5y ago
        Yes. It is a nice natural experiment as to Moxies motivations and principles, because only a very select set of circumstances has changed: Software authors can no longer control their signatures on Android. That time has passed is not relevant, or at best relevant to explain some change of heart over time.
- tapoxi 5y ago
  AAB supports a code transparency feature: https://developer.android.com/guide/app-bundle/code-transparency https://developer.android.com/guide/app-bundle/code-transpar...
  - toast0 5y ago
    > The code transparency file does not verify resources, assets, the Android Manifest, or any other files that are not DEX files or native libraries contained in the lib/ folder. > Important: The Android OS does not verify code transparency files at install time, and continues to rely on the APK signing schemes for verification of any installed APKs. This is like having checksums in a Readme. If nobody checks them (and that's the likely case, since the OS doesn't), it doesn't matter if they differ from the distributed files. It's still the case that Google is taking over the code signing roles, so that the user's OS will no longer tell the difference between a developer signed update and a Google signed update. This is a negative for security and transparency, regardless of the size benefits and regardless of the fact that the Apple App Store has operated in this fashion since the beginning.
bitwize 5y ago
Wellp, guess who's not distributing their game through the Play Store. It's open source but I thought I might put it on Play for a nominal price and invite those who want it free to compile it themselves. But now? It'll be F-Droid only for me.
- jkaplowitz 5y ago
  For inclusion into their official repo F-Droid requires you to either make sure each build is verifiably reproducible, in which case they will let you sign that build yourself, or else they need to sign it just like Google will now be doing. They used to always require that they sign it, without offering the exception for reproducible builds. They also support publishing parallel versions with both their signing key and yours, to help with smoother upgrades for users with the app already installed. They do allow you to make your own separate F-Droid binary repo which doesn't restrict your ability to use your own signing key, but then you have to get users to add your repo.
- techrat 5y ago
  > It'll be F-Droid only for me. Uh... bruh. They do exactly what you're dumping the play store for.
  - Avamander 5y ago
    Yeah, the choices now are shit and shittier.
grishka 5y ago
The argument about size savings is pretty weak too. Any developer who has an app with large native libraries has already been splitting it by CPU architecture since forever. The screen resolution isn't much relevant at all because who even uses bitmap graphics any more when there's VectorDrawable? The strings do take up space, and I was told that the resources.arsc file where they reside isn't compressed in an apk because that would result in Android having trouble reading it, but its size is still usually negligible compared to the rest of the apk.
- readams 5y ago
  The size savings though are real in actual apps and they are generally around 15%. People are really desperate here to find ways to make everything a bad thing. Apple does stuff like this regularly.
  - Clewza313 5y ago
    iOS has been a fully controlled walled garden since day one though, while Android was supposed to be the "free" open source alternative.
    - izacus 5y ago
      And the market seems to signal Google that Apple is doing the right thing though? IIRC iOS has passed 60% in USA these days and is repeatedly pushed as a "secure and malware free" OS on HN.
      - pas 5y ago
        It's pushed because Apple is seen as less privacy intrusive.
        infinityplus1 5y ago
        No, its because Apple is seen as a status symbol, has good brand reputation and locks users in the walled garden. General users don't know what happens behind the scenes. For example, https://www.theverge.com/2021/4/27/22406303/imessage-android-eddy-cue-emails-apple-epic-deposition https://www.theverge.com/2021/4/27/22406303/imessage-android... > In the absence of a strategy to become the primary messaging service for [the] bulk of cell phone users, I am concerned [that] iMessage on Android would simply serve to remove an obstacle to iPhone families giving their kids Android phones.
roody15 5y ago
“ A government could compel the app store owner to change your app, too.”
- josefx 5y ago
  I am not sure it is any way better right now. Is there even a way a user can check who signed the apk unless he has his unlocked android device hooked up to a PC with android dev. tools installed and a black belt in android development?
  - roody15 5y ago
    APK model has worked well… does it need changed?
    - techrat 5y ago
      It's not being changed. The end format is still APK.
      - roody15 5y ago
        Except google gets the source code first and then creates custom specific APK’s. Not sure this step is really “needed”.
        tdeck 5y ago
        nit: Google doesn't get the source code. It gets essentially the contents of the APK (compiled DEX code, compiled native code, assets, and resources) along with some additional protobuf files that contain metadata. Google can then decide how to split that up into APKs, generate those, and sign them. In theory Google could add or alter things before signing them. The alternative to this was called Multi-APK and hardly anyone used it. It required generating and uploading a large number of different APKs and then uploading gigabytes of mostly-redundant APKs to the Play Store. That allowed you to manage the signing and minimize install size, but it was such a pain to orchestrate that it wasn't practical in most cases.
gjsman-1000 5y ago
According to rumors, a big "extra benefit" Google receives is that Windows 11 will be able to directly run APKs. So, retire the universal APK so people on Windows get odd and incorrect experiences with incorrect feature mixes.
- readams 5y ago
  APKs don't magically stop existing. This doesn't have any effect on other app stores.
  - patmorgan23 5y ago
    Yes but if android changes it's format then people will stop publishing APKs for new versions.
    - pas 5y ago
      No. Devices will still get APKs, but they'll be optimized and signed by Google. ( https://news.ycombinator.com/item?id=27711002 https://news.ycombinator.com/item?id=27711002 )
      - Avamander 5y ago
        Good luck finding the correct version that matches your DPI and arch. Bunch of really "fun" malware campaigns are probably going to happen.
- deleted 5y ago
  [deleted]
- ehsankia 5y ago
  I don't understand how this change has anything to do with Windows 11 APK support? Hell, Microsoft didn't even work with Google, considering they're using the Amazon App Store, and this change is specific to Play Store. AFAIK Windows 11 runs APKs directly, app bundles play no role there.
deregulateMed 5y ago
Is there a community that's keeping the FOSS nature of Android? I'm not talking about fdroid, they are great. I'm asking about a community/fourm that is discussing how Android can be separate from Google in the distopian future. Anyone know of a website where this is discussed?
- ppf 5y ago
  www.googlehaswon.com/buyadumbphone
- DaiPlusPlus 5y ago
  Remember when we thought an alliance of Samsung, HTC, and LG would keep Android alive no-matter what Google would do? Oh those were the years...
- fragileone 5y ago
  The most popular FOSS ROM communities probably have the biggest interest in this e.g. GrapheneOS, CalyxOS, LineageOS.
- solarkraft 5y ago
  The LineageOS folks are the main developers of a non-Google version of Android. For actually running it without Google services you'll need microG, which seems to be worked on by one lone German developer.
- fsflover 5y ago
  Consider GNU/Linux phones, Librem 5 and Pinephone, instead.
izacus 5y ago
The title is misleading on a technicality though - Android will continue to deploy applications via APKs. Developers will have to upload apps as AppBundles, which the Play Store service will repackage, resign and deliver to the devices as a set of APKs. Which means: the devices will continue to be able to install APKs. The major massive difference is that the apps will now be signed by Google on servers and not by developers on their local machines. I'm wondering why Google doesn't allow developers to build the optimizes APKs still - the Android build system does have that capability. Noone really used it, but it's there - there should be a way to opt out of signing key sharing.
- techrat 5y ago
  Yep. The end format is still APK. What is being dumped is the unnecessary libraries/APIs that are not relevant to the device that is receiving the APK. This doesn't affect sideloading in the slightest.
- diegoperini 5y ago
  One important distinction is that now Google is able to inject code to apps without notice since they are the ones who sign the final APKs.
  - Someone1234 5y ago
    Google has always been able to do that. Just alter and re-sign the APK with their own key(s), since Google's keys are trusted by Google Play Services (third party app stores also trust Google's signing keys for compatibility reasons). The way the Play Store is currently designed, end users don't even have the ability to view the key-path before installing a package. So detecting if it is Google Vs. app developer's signing key is extremely unlikely without copying that APK off-device and inspecting it. All users know is: Is this using a signing key trusted by Google? Yay/Nay.
    - psykus 5y ago
      That's true for new installs at least. But Android won't let you install an update to an existing app with a different signing key, it'll error out with something generic.
for1nner 5y ago
Democracy dying with a silent whimper before our very eyes.
deleted 5y ago
[deleted]
kumarm 5y ago
App Bundle has significant advantages: 1. Reduction in APK Size. Not just native libraries, this gives ability for Google to optimize downloads based on screen size, locale etc. In countries where data still costs $$$, its a significant boost to both end user and developers (Reduce size = increased no of downloads). 2. The amount of developers who lose their private keys is mind boggling. This fixes the issue. 3. Enables dynamic features. End users can download parts of app only when they need it.

180 points by muxator 5y ago

related discussion: https://news.ycombinator.com/item?id=27695486 https://news.ycombinator.com/item?id=27695486

There goes Moxies justification for using only the Playstore for Signal... And I'm waiting for the first supply-chain attack resulting from Google signing a rootkit, Microsoft-style...

izacus 5y ago
> There goes Moxies justification for using only the Playstore for Signal... Moxie is fine with this state of affairs on iOS - I'm not sure why this would change anything on that front?
- corty 5y ago
  Moxie complained about F-Droid recompiling and resigning his stuff. And cited this as his reason to use only the Playstore. But I guess things were more about analytics and control after all.
  - m-p-3 5y ago
    Moxie can use F-Droid with his own signature if he supplies a reproducible build. https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
    - Aissen 5y ago
      Which in theory Signal supports; anyone tried it lately ? https://github.com/signalapp/Signal-Android/tree/master/reproducible-builds https://github.com/signalapp/Signal-Android/tree/master/repr...
  - tssva 5y ago
    You are trying to place events which happened in the past under a completely different set of circumstances into the circumstances of today and then are drawing a conclusion from that.
    - corty 5y ago
      Yes. It is a nice natural experiment as to Moxies motivations and principles, because only a very select set of circumstances has changed: Software authors can no longer control their signatures on Android. That time has passed is not relevant, or at best relevant to explain some change of heart over time.
tapoxi 5y ago
AAB supports a code transparency feature: https://developer.android.com/guide/app-bundle/code-transparency https://developer.android.com/guide/app-bundle/code-transpar...
- toast0 5y ago
  > The code transparency file does not verify resources, assets, the Android Manifest, or any other files that are not DEX files or native libraries contained in the lib/ folder. > Important: The Android OS does not verify code transparency files at install time, and continues to rely on the APK signing schemes for verification of any installed APKs. This is like having checksums in a Readme. If nobody checks them (and that's the likely case, since the OS doesn't), it doesn't matter if they differ from the distributed files. It's still the case that Google is taking over the code signing roles, so that the user's OS will no longer tell the difference between a developer signed update and a Google signed update. This is a negative for security and transparency, regardless of the size benefits and regardless of the fact that the Apple App Store has operated in this fashion since the beginning.

bitwize 5y ago

Wellp, guess who's not distributing their game through the Play Store. It's open source but I thought I might put it on Play for a nominal price and invite those who want it free to compile it themselves. But now? It'll be F-Droid only for me.

jkaplowitz 5y ago
For inclusion into their official repo F-Droid requires you to either make sure each build is verifiably reproducible, in which case they will let you sign that build yourself, or else they need to sign it just like Google will now be doing. They used to always require that they sign it, without offering the exception for reproducible builds. They also support publishing parallel versions with both their signing key and yours, to help with smoother upgrades for users with the app already installed. They do allow you to make your own separate F-Droid binary repo which doesn't restrict your ability to use your own signing key, but then you have to get users to add your repo.
techrat 5y ago
> It'll be F-Droid only for me. Uh... bruh. They do exactly what you're dumping the play store for.
- Avamander 5y ago
  Yeah, the choices now are shit and shittier.

grishka 5y ago

The argument about size savings is pretty weak too. Any developer who has an app with large native libraries has already been splitting it by CPU architecture since forever. The screen resolution isn't much relevant at all because who even uses bitmap graphics any more when there's VectorDrawable? The strings do take up space, and I was told that the resources.arsc file where they reside isn't compressed in an apk because that would result in Android having trouble reading it, but its size is still usually negligible compared to the rest of the apk.

readams 5y ago
The size savings though are real in actual apps and they are generally around 15%. People are really desperate here to find ways to make everything a bad thing. Apple does stuff like this regularly.
- Clewza313 5y ago
  iOS has been a fully controlled walled garden since day one though, while Android was supposed to be the "free" open source alternative.
  - izacus 5y ago
    And the market seems to signal Google that Apple is doing the right thing though? IIRC iOS has passed 60% in USA these days and is repeatedly pushed as a "secure and malware free" OS on HN.
    - pas 5y ago
      It's pushed because Apple is seen as less privacy intrusive.
      - infinityplus1 5y ago
        No, its because Apple is seen as a status symbol, has good brand reputation and locks users in the walled garden. General users don't know what happens behind the scenes. For example, https://www.theverge.com/2021/4/27/22406303/imessage-android-eddy-cue-emails-apple-epic-deposition https://www.theverge.com/2021/4/27/22406303/imessage-android... > In the absence of a strategy to become the primary messaging service for [the] bulk of cell phone users, I am concerned [that] iMessage on Android would simply serve to remove an obstacle to iPhone families giving their kids Android phones.

roody15 5y ago

“ A government could compel the app store owner to change your app, too.”

josefx 5y ago
I am not sure it is any way better right now. Is there even a way a user can check who signed the apk unless he has his unlocked android device hooked up to a PC with android dev. tools installed and a black belt in android development?
- roody15 5y ago
  APK model has worked well… does it need changed?
  - techrat 5y ago
    It's not being changed. The end format is still APK.
    - roody15 5y ago
      Except google gets the source code first and then creates custom specific APK’s. Not sure this step is really “needed”.
      - tdeck 5y ago
        nit: Google doesn't get the source code. It gets essentially the contents of the APK (compiled DEX code, compiled native code, assets, and resources) along with some additional protobuf files that contain metadata. Google can then decide how to split that up into APKs, generate those, and sign them. In theory Google could add or alter things before signing them. The alternative to this was called Multi-APK and hardly anyone used it. It required generating and uploading a large number of different APKs and then uploading gigabytes of mostly-redundant APKs to the Play Store. That allowed you to manage the signing and minimize install size, but it was such a pain to orchestrate that it wasn't practical in most cases.

gjsman-1000 5y ago

According to rumors, a big "extra benefit" Google receives is that Windows 11 will be able to directly run APKs. So, retire the universal APK so people on Windows get odd and incorrect experiences with incorrect feature mixes.

readams 5y ago
APKs don't magically stop existing. This doesn't have any effect on other app stores.
- patmorgan23 5y ago
  Yes but if android changes it's format then people will stop publishing APKs for new versions.
  - pas 5y ago
    No. Devices will still get APKs, but they'll be optimized and signed by Google. ( https://news.ycombinator.com/item?id=27711002 https://news.ycombinator.com/item?id=27711002 )
    - Avamander 5y ago
      Good luck finding the correct version that matches your DPI and arch. Bunch of really "fun" malware campaigns are probably going to happen.
deleted 5y ago
[deleted]
ehsankia 5y ago
I don't understand how this change has anything to do with Windows 11 APK support? Hell, Microsoft didn't even work with Google, considering they're using the Amazon App Store, and this change is specific to Play Store. AFAIK Windows 11 runs APKs directly, app bundles play no role there.

deregulateMed 5y ago

Is there a community that's keeping the FOSS nature of Android? I'm not talking about fdroid, they are great. I'm asking about a community/fourm that is discussing how Android can be separate from Google in the distopian future. Anyone know of a website where this is discussed?

ppf 5y ago
www.googlehaswon.com/buyadumbphone
DaiPlusPlus 5y ago
Remember when we thought an alliance of Samsung, HTC, and LG would keep Android alive no-matter what Google would do? Oh those were the years...
fragileone 5y ago
The most popular FOSS ROM communities probably have the biggest interest in this e.g. GrapheneOS, CalyxOS, LineageOS.
solarkraft 5y ago
The LineageOS folks are the main developers of a non-Google version of Android. For actually running it without Google services you'll need microG, which seems to be worked on by one lone German developer.
fsflover 5y ago
Consider GNU/Linux phones, Librem 5 and Pinephone, instead.

izacus 5y ago

The title is misleading on a technicality though - Android will continue to deploy applications via APKs. Developers will have to upload apps as AppBundles, which the Play Store service will repackage, resign and deliver to the devices as a set of APKs. Which means: the devices will continue to be able to install APKs. The major massive difference is that the apps will now be signed by Google on servers and not by developers on their local machines. I'm wondering why Google doesn't allow developers to build the optimizes APKs still - the Android build system does have that capability. Noone really used it, but it's there - there should be a way to opt out of signing key sharing.

techrat 5y ago
Yep. The end format is still APK. What is being dumped is the unnecessary libraries/APIs that are not relevant to the device that is receiving the APK. This doesn't affect sideloading in the slightest.
diegoperini 5y ago
One important distinction is that now Google is able to inject code to apps without notice since they are the ones who sign the final APKs.
- Someone1234 5y ago
  Google has always been able to do that. Just alter and re-sign the APK with their own key(s), since Google's keys are trusted by Google Play Services (third party app stores also trust Google's signing keys for compatibility reasons). The way the Play Store is currently designed, end users don't even have the ability to view the key-path before installing a package. So detecting if it is Google Vs. app developer's signing key is extremely unlikely without copying that APK off-device and inspecting it. All users know is: Is this using a signing key trusted by Google? Yay/Nay.
  - psykus 5y ago
    That's true for new installs at least. But Android won't let you install an update to an existing app with a different signing key, it'll error out with something generic.

for1nner 5y ago

Democracy dying with a silent whimper before our very eyes.

deleted 5y ago

[deleted]

kumarm 5y ago

App Bundle has significant advantages: 1. Reduction in APK Size. Not just native libraries, this gives ability for Google to optimize downloads based on screen size, locale etc. In countries where data still costs $$$, its a significant boost to both end user and developers (Reduce size = increased no of downloads). 2. The amount of developers who lose their private keys is mind boggling. This fixes the issue. 3. Enables dynamic features. End users can download parts of app only when they need it.