3 ms·

IMHO, there are too many drawbacks to being forced to distribute an app through only one "self-authorised" app store and very few advantages. Pros (ironically)

by Daril 3y ago

IMHO, there are too many drawbacks to being forced to distribute an app through only one "self-authorised" app store and very few advantages. Pros (ironically): 1. the app store manager is supposed to check the app for malware and viruses before publishing it, ironically all the apps full of Google ads, Google and Facebook trackers of any kind are welcome ... 2. make it very easy for the user to search, install and update the apps, if he can find what they are looking for through billions of game apps and very similar apps that are only published to send advertisements to the user or to collect his personal data. Disadvantages: 1. you are tied to the whims of the app store manager 2. You have no control over the app publishing process: You cannot decide if you can publish your app or not, only the App Store Manager has the power to decide when and if it is convenient for him. I think only the user should have this right. I'd prefer to install the native commercial native apps (for example, the home banking app) on my phone by downloading them from the developer's website, in a private area that I have to access with my credentials, where the app is GPG signed and I can check the integrity of the package. An auto-update feature is doable. For open source apps, there is the F-Droid store where you can add your own repository (a bit technical and not for everyone, I admit : pre installing F-Droid on the new phones could help a lot, but I don't think Google will ever allow this). Another viable option is PWA. In my opinion, there are very few apps that need the native features, for all the others, almost everything is now doable with PWA technology, and you do not have to bother sending updates to users or asking them to upgrade. The monopolistic and commercial app stores, with the excuse of making life easier for users and in a supposedly "better security", are a "wonderful" way for Apple and Google to make billions on the work of independent developers and, in the case of Google, to collect and sell personal data about users and to sell ads of any kind in any way.

kmeisthax 3y ago
You forgot another pro: it keeps the Boston Strangler[0] out of your house. By tying users' hands behind your back you can ensure that you dictate the terms by which they use your work. No piracy, no adblock, etc. This is why game developers largely fell in line with the "Licensed by Nintendo" model back in the 80s and 90s, and mobile app developers did the same thing with the iOS App Store in the late 2000s. They don't want to work directly with users to circumvent the platform owner, they want the platform owner to tie the users' hands, and they're willing to have their hands tied in the process. In the specific case of, say, your banking app; they want secure remote attestation so they can ban users that are running credential stuffing attacks against their app, prevent malware from opening your banking app and clicking the "pay fraudster" button, prevent users from extracting various tap-and-pay related encryption secrets, and also prevent them from injecting stolen secrets into their phone app. The app cannot, on its own, validate that the user's hands are tied; it needs a trustworthy (to them, not you) third party that lives in the boot chain and/or EL3 to validate that. So they don't want to just give you an app and a signature. They want Google to do it so that Google can tie your hands. It's important to note that all the user-facing benefits of app stores are backreasoning. The goal from the beginning was to tie users down, because to them, users are little thieving mosquitoes. This is the "quiet part" that they don't say out loud. Let's hope to dear god that Google's WEI proposal doesn't happen and PWAs never have access to attestation. Google already has the whole "we don't let you login on unknown browsers" nonsense and we don't need that cancer spreading. F-Droid is great. Google's shenanigans with Android need to be shut down. Hell, the EU was able to do that but the US needs to also do that and have it apply internationally. [0] MPAA code word for noncommercial small-scale copying, i.e. someone with a VCR taping shows off TV. Jack Valenti really was a piece of shit, wasn't he?

by Daril 3y ago

kmeisthax 3y ago

You forgot another pro: it keeps the Boston Strangler[0] out of your house. By tying users' hands behind your back you can ensure that you dictate the terms by which they use your work. No piracy, no adblock, etc. This is why game developers largely fell in line with the "Licensed by Nintendo" model back in the 80s and 90s, and mobile app developers did the same thing with the iOS App Store in the late 2000s. They don't want to work directly with users to circumvent the platform owner, they want the platform owner to tie the users' hands, and they're willing to have their hands tied in the process. In the specific case of, say, your banking app; they want secure remote attestation so they can ban users that are running credential stuffing attacks against their app, prevent malware from opening your banking app and clicking the "pay fraudster" button, prevent users from extracting various tap-and-pay related encryption secrets, and also prevent them from injecting stolen secrets into their phone app. The app cannot, on its own, validate that the user's hands are tied; it needs a trustworthy (to them, not you) third party that lives in the boot chain and/or EL3 to validate that. So they don't want to just give you an app and a signature. They want Google to do it so that Google can tie your hands. It's important to note that all the user-facing benefits of app stores are backreasoning. The goal from the beginning was to tie users down, because to them, users are little thieving mosquitoes. This is the "quiet part" that they don't say out loud. Let's hope to dear god that Google's WEI proposal doesn't happen and PWAs never have access to attestation. Google already has the whole "we don't let you login on unknown browsers" nonsense and we don't need that cancer spreading. F-Droid is great. Google's shenanigans with Android need to be shut down. Hell, the EU was able to do that but the US needs to also do that and have it apply internationally. [0] MPAA code word for noncommercial small-scale copying, i.e. someone with a VCR taping shows off TV. Jack Valenti really was a piece of shit, wasn't he?