7 ms·

Disabling by default but allow sideloading with some disclaimers and warnings seems like a fair compromise, similarly to how Windows will put up barriers and wa

Disabling by default but allow sideloading with some disclaimers and warnings seems like a fair compromise, similarly to how Windows will put up barriers and warnings if you try to install software from unknown sources. The downside is that you don't protect those who enable sideloading and see the warnings when installing Facebook sideload and tap through anyway.

gabeio 4y ago
I would agree if you can't do it all on the device itself, the unlocking/sideloading initial warning bypass. The idea would be to prevent those who can barely work their phone from "accidentally" enabling sideloading and then downloading some random app off the internet or other app store by accident or being talked through it with a scammer.
- kipchak 4y ago
  Maybe requiring approval from the iOS account that manages the device, signed in to some other device? I'm imagining something somewhat similar to the "ask to buy" feature for child accounts. That could also help with child or elder accounts if they're managed by someone else holding the keys. Downside is not everyone would have someone to manage their account for them. Having to call into Apple to confirm maybe?
- eli 4y ago
  Doesn't the Android process still involving tapping 7 times in a row on the build number in the About Device screen? There's definitely ways to create a feature that can't be found accidentally.
  - lxgr 4y ago
    You're probably thinking of activating developer mode. Sideloading doesn't (yet) require that, at least not on my Pixel (Android 12).
    - freedomben 4y ago
      Yes that's what they're thinking of (activating developer mode). Sideloading does require several clicks though. First you download the APK, then you "open" the file in the installer. Then you have to allow "installation from unkown sources," then allow for the app that you downloaded it with (for me that's usually firefox, but for most it's probably Chrome), then you can install it.
- lxgr 4y ago
  Sure, vetting apps can be quite efficient at preventing malware. But if a sideloaded app can do significantly more harm than just visiting a malicious website (which a scammer can already direct a victim to do), maybe the OS is providing too dangerous (or coarsely-controllable) permissions via its APIs?
droopyEyelids 4y ago
Warnings won't suffice when Facebook, Google, and increasingly ByteDance make apps that are necessary infrastructure for modern life. People will be forced to choose between clicking through an explanation & accepting risks they don't understand, and participating in society.
- kipchak 4y ago
  For apps that are genuine but behave as malware in terms of data collection I'm not sure it will be possible to build walls high enough to keep them out short of regulation, or that currently users aren't already unknowingly accepting those risks. As is for iOS apps while the user can opt out of their IDFA being shared other tracking methods other fingerprinting methods can still be used, Fingerprint.com/demo has a good demonstration. If sideloading stays prohibited I'm not sure what would stop Facebook from migrating to a browser only version. Over the long term I'm not sure there's a good solution other than legislation arriving at some "acceptable" level of tracking, given how crucial expanding tracking is to social media companies.
- josephcsible 4y ago
  None of those companies make you sideload their apps to use them on Android.
lxgr 4y ago
"Install our game via sideloading now: Just ignore all the warnings (we promise it's just as secure) and we'll give you $100 of our in-game currency as a thank-you!" And who would be able to resist? There's even a little shield icon!
- gambiting 4y ago
  The problem with all of these arguments is that literally no one is doing this at any scale on Android where sideloading has existed since the very beginning. There's literally zero reason to believe that if sideloading was allowed on iOS this would suddenly become a problem.
  - jsheard 4y ago
    It's not common, but Fortnite is a notable example of a game which eschews the Play Store in favor of sideloading.
    - waboremo 4y ago
      Fortnite is the biggest example, and still they struggle to encourage installs. People just went to PUBG Mobile instead. Fortnite has the support of the second biggest android stores (Galaxy Store), and still their android revenue isn't great.
    - josephcsible 4y ago
      Fortnite is basically the only such app with any significant user base, right? So it doesn't make allowing sideloading a bad thing any more than the ZFS-on-Linux situation makes copyleft a bad thing.
  - lxgr 4y ago
    Google has however also been very careful about parity in functionality between the Play Store and sideloaded apps form the beginning. Only very recently have they started cracking down on third-party in-app payments and subscriptions, and otherwise I think they have basically approved everything that's not either outright malware or illegal, significantly including third-party browsers, VMs and emulators and other things that Apple bans by policy.
basch 4y ago
I wouldnt necessarily encourage it, but if its not illegally anticompetitive, and Apple wants to retain control of devices, they could make it where "enable sideloading" disables the Apple App Store, and prevents any app from the Apple App Store from running, including cancelling all subscriptions. If they really wanted to get nasty, they could force a full device reset before going back to Disable Sideloading. The latter part is almost exactly the route Microsoft went with Windows Mode S. They could let you have your phone in either mode, but refuse to allow "hybrid" App Store + Sideloading configurations.
- josephcsible 4y ago
  Imagine if an automaker said "if you ever install a non-OEM part in your vehicle, none of our dealers will ever sell you any OEM parts or perform any service on it." Or if Keurig said "if you ever use a third-party K-cup, you'll never be able to use any of ours in that machine ever again."
  - basch 4y ago
    We are talking software though, where a factory reset can restore originalness.
    - josephcsible 4y ago
      Okay, how about "if you ever install any non-OEM parts in your vehicle, none of our dealers will sell you any other OEM parts or perform any unrelated service on it until you pay to have them all re-replaced with OEM ones again?"
      - basch 3y ago
        How is that at all the same as "we wont let you use our apps if you have unsourced apps on your phone." There's no cost to wiping the phone. It doesnt require you to drive to an apple store and have them do it. This also isnt a phone part. It's not "you cant have a new battery until you wipe your phone."

gabeio 4y ago

I would agree if you can't do it all on the device itself, the unlocking/sideloading initial warning bypass. The idea would be to prevent those who can barely work their phone from "accidentally" enabling sideloading and then downloading some random app off the internet or other app store by accident or being talked through it with a scammer.

kipchak 4y ago
Maybe requiring approval from the iOS account that manages the device, signed in to some other device? I'm imagining something somewhat similar to the "ask to buy" feature for child accounts. That could also help with child or elder accounts if they're managed by someone else holding the keys. Downside is not everyone would have someone to manage their account for them. Having to call into Apple to confirm maybe?
eli 4y ago
Doesn't the Android process still involving tapping 7 times in a row on the build number in the About Device screen? There's definitely ways to create a feature that can't be found accidentally.
- lxgr 4y ago
  You're probably thinking of activating developer mode. Sideloading doesn't (yet) require that, at least not on my Pixel (Android 12).
  - freedomben 4y ago
    Yes that's what they're thinking of (activating developer mode). Sideloading does require several clicks though. First you download the APK, then you "open" the file in the installer. Then you have to allow "installation from unkown sources," then allow for the app that you downloaded it with (for me that's usually firefox, but for most it's probably Chrome), then you can install it.
lxgr 4y ago
Sure, vetting apps can be quite efficient at preventing malware. But if a sideloaded app can do significantly more harm than just visiting a malicious website (which a scammer can already direct a victim to do), maybe the OS is providing too dangerous (or coarsely-controllable) permissions via its APIs?

droopyEyelids 4y ago

Warnings won't suffice when Facebook, Google, and increasingly ByteDance make apps that are necessary infrastructure for modern life. People will be forced to choose between clicking through an explanation & accepting risks they don't understand, and participating in society.

kipchak 4y ago
For apps that are genuine but behave as malware in terms of data collection I'm not sure it will be possible to build walls high enough to keep them out short of regulation, or that currently users aren't already unknowingly accepting those risks. As is for iOS apps while the user can opt out of their IDFA being shared other tracking methods other fingerprinting methods can still be used, Fingerprint.com/demo has a good demonstration. If sideloading stays prohibited I'm not sure what would stop Facebook from migrating to a browser only version. Over the long term I'm not sure there's a good solution other than legislation arriving at some "acceptable" level of tracking, given how crucial expanding tracking is to social media companies.
josephcsible 4y ago
None of those companies make you sideload their apps to use them on Android.

lxgr 4y ago

"Install our game via sideloading now: Just ignore all the warnings (we promise it's just as secure) and we'll give you $100 of our in-game currency as a thank-you!" And who would be able to resist? There's even a little shield icon!

gambiting 4y ago
The problem with all of these arguments is that literally no one is doing this at any scale on Android where sideloading has existed since the very beginning. There's literally zero reason to believe that if sideloading was allowed on iOS this would suddenly become a problem.
- jsheard 4y ago
  It's not common, but Fortnite is a notable example of a game which eschews the Play Store in favor of sideloading.
  - waboremo 4y ago
    Fortnite is the biggest example, and still they struggle to encourage installs. People just went to PUBG Mobile instead. Fortnite has the support of the second biggest android stores (Galaxy Store), and still their android revenue isn't great.
  - josephcsible 4y ago
    Fortnite is basically the only such app with any significant user base, right? So it doesn't make allowing sideloading a bad thing any more than the ZFS-on-Linux situation makes copyleft a bad thing.
- lxgr 4y ago
  Google has however also been very careful about parity in functionality between the Play Store and sideloaded apps form the beginning. Only very recently have they started cracking down on third-party in-app payments and subscriptions, and otherwise I think they have basically approved everything that's not either outright malware or illegal, significantly including third-party browsers, VMs and emulators and other things that Apple bans by policy.

basch 4y ago

I wouldnt necessarily encourage it, but if its not illegally anticompetitive, and Apple wants to retain control of devices, they could make it where "enable sideloading" disables the Apple App Store, and prevents any app from the Apple App Store from running, including cancelling all subscriptions. If they really wanted to get nasty, they could force a full device reset before going back to Disable Sideloading. The latter part is almost exactly the route Microsoft went with Windows Mode S. They could let you have your phone in either mode, but refuse to allow "hybrid" App Store + Sideloading configurations.

josephcsible 4y ago
Imagine if an automaker said "if you ever install a non-OEM part in your vehicle, none of our dealers will ever sell you any OEM parts or perform any service on it." Or if Keurig said "if you ever use a third-party K-cup, you'll never be able to use any of ours in that machine ever again."
- basch 4y ago
  We are talking software though, where a factory reset can restore originalness.
  - josephcsible 4y ago
    Okay, how about "if you ever install any non-OEM parts in your vehicle, none of our dealers will sell you any other OEM parts or perform any unrelated service on it until you pay to have them all re-replaced with OEM ones again?"
    - basch 3y ago
      How is that at all the same as "we wont let you use our apps if you have unsourced apps on your phone." There's no cost to wiping the phone. It doesnt require you to drive to an apple store and have them do it. This also isnt a phone part. It's not "you cant have a new battery until you wipe your phone."