3 ms·

For those who didn't read the article: "Google confirmed to Esper that this restriction was designed to not affect apps installed from app stores, both preload

by ars 5y ago

For those who didn't read the article: "Google confirmed to Esper that this restriction was designed to not affect apps installed from app stores, both preloaded (like Google Play) or sideloaded (like F-Droid). This is because the company does not want to restrict accessibility API access for all apps that are sideloaded — they just want to restrict access for apps that came from less legitimate sources."

IG_Semmelweiss 5y ago
Honest question What keeps google from defining f-droid as a "less legitimate source" ?
- ravi-delia 5y ago
  I mean, nothing? Which means the fact that they specifically carved out an exception for all app repos implies that at least someone at Google is making a good faith effort here. It's still a pointless overreach there should at least be an easy setting for of course, but it seems as though they're trying to strike a balance between protecting the masses and giving power users power.
  - MishaalRahman 5y ago
    Right, in fact, when I was researching for this article, I thought that the fact that the restriction didn't apply when installing apps via the session-based installation API was a loophole/because it wasn't fully implemented in DP2. I surmised that this loophole was intentional so as to not hamper third-party app stores from providing users with apps that use the AccessibilityService API, but I was only able to confirm my suspicion after contacting Google PR.
  - kllrnohj 5y ago
    > It's still a pointless overreach there should at least be an easy setting for of course That seems like a stretch. Why should it be easy to give any app full permission of your device? This is an extremely dangerous permission to give, well, anything. It should be possible (and it seems like it is), but why should it be easy? And calling it a "pointless overreach" is some real sticking your head in the sand stuff. This isn't a fake threat. This abuse isn't theoretical, it's deployed in the wild. The article even provides multiple examples.

by ars 5y ago

IG_Semmelweiss 5y ago

Honest question What keeps google from defining f-droid as a "less legitimate source" ?

ravi-delia 5y ago
I mean, nothing? Which means the fact that they specifically carved out an exception for all app repos implies that at least someone at Google is making a good faith effort here. It's still a pointless overreach there should at least be an easy setting for of course, but it seems as though they're trying to strike a balance between protecting the masses and giving power users power.
- MishaalRahman 5y ago
  Right, in fact, when I was researching for this article, I thought that the fact that the restriction didn't apply when installing apps via the session-based installation API was a loophole/because it wasn't fully implemented in DP2. I surmised that this loophole was intentional so as to not hamper third-party app stores from providing users with apps that use the AccessibilityService API, but I was only able to confirm my suspicion after contacting Google PR.
- kllrnohj 5y ago
  > It's still a pointless overreach there should at least be an easy setting for of course That seems like a stretch. Why should it be easy to give any app full permission of your device? This is an extremely dangerous permission to give, well, anything. It should be possible (and it seems like it is), but why should it be easy? And calling it a "pointless overreach" is some real sticking your head in the sand stuff. This isn't a fake threat. This abuse isn't theoretical, it's deployed in the wild. The article even provides multiple examples.