10 ms·

This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. I hope it doesn't become a slippe

by caseyy 2y ago

This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. I hope it doesn't become a slippery slope where for "security" Google would start blocking undesirable or ethically/politically inconvenient apps, too. For example, there are some medical apps that improve people's health outcomes (like custom blood glucose CGM apps and insulin pump closed loop apps for type 1 diabetics). Google does not seem to want them on the Play Store. They are undesirable apps from a business perspective – a liability with no upside. The tech we speak about today provides the infrastructure to block these undesirable apps, as I understand. This lays the foundation of not allowing software to be installed on many consumer Android phones without Google's approval. I do hope it never comes to Google overstepping like that, but it could be optimism or naivety. As a tool for app developers... where app developers make the decision... in this limited situation, it might be still somewhat okay. It's okay in the sense that the apps are their intellectual property and they might be entitled by law and common understanding to choose how it is distributed. But if Google ever decides to ban apps this way against the developers' wishes, it would be a massive overstep.

shiroiushi 2y ago
>This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. No, it isn't. AFAICT, this "feature" only prevents you from sideloading apps that don't want to be side-loaded. It's not going to prevent you from installing your favorite open-source apps from Fdroid or APKs. >For example, there are some medical apps that improve people's health outcomes... Google does not seem to want them on the Play Store. Then it would be very, very stupid for these apps to add this anti-side-loading feature, wouldn't it? Google isn't the one preventing side-loading, it's the individual apps (and their makers) themselves.
- caseyy 2y ago
  Sorry, I was still editing my comment and clarifying my opinion as you responded. I agree with you but I think it could still be historic if this infrastructure is later abused. I'd delete the original comment as my late edit skewed the discussion but HN doesn't let me do that. Apologies.
  - shiroiushi 2y ago
    No problem! Yeah, I think HN's restrictive comment-deletion policy isn't great. Anyway, I'm not sure how much potential for abuse there is here. I don't see anything too horribly wrong with app makers being able to restrict their app to Play Store installation (though I think it's annoying, and sucks for e.g. GrapheneOS users). I'm not really sure why app makers would want to do this anyway, but I guess they have their (dumb IMO) reasons. But to be abused, that probably means Google, or the handset maker, using the feature to prevent any apps from being sideloaded or installed from app stores they don't like (like Fdroid). That would be terrible for sure, but I don't really see how this particular technology would allow that. I mean, if Google wanted to prevent sideloading, it seems like it would be relatively trivial for them; why would they need something like this? Installing from APK is built into the system (you can do it with "adb"), and could just as easily be removed or restricted. Same for the handset makers: they don't have to distribute Android as-is, and usually don't. It seems they could easily disable apk-loading and adb in general.
lolinder 2y ago
> One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. This is a bit hyperbolic—the core differentiator provided by sideloading is that you don't have to distribute through Google. That's still very much intact. What's changed is that apps can opt themselves out of being sideloaded. F-Droid and the FOSS ecosystem in general are entirely unaffected.
- greentea23 2y ago
  Unless you are running a custom ROM which doesn't have Google services. This feature has the potential to force you onto a 1984-style ROM just for a single but essential app. It also forces you to not only make a Google account but log into it on the device you carry in your pocket at all times.
  - lolinder 2y ago
    Custom ROM without Google was always hard, and custom ROM with Google services was already possible to block with attestation.
II2II 2y ago
> This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. How so? You are still able to sideload apps. The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. The decision to use that is on the developer and the user has the choice to move to other apps or succumb to using the Play Store in those cases. If anything, the article suggests that the actual erosion came about a year ago with other integrity check features, such as helping the developer figure out whether the app is being used on a rooted phone. Or with the increased difficulty in using customized versions of Android over the years.
- caseyy 2y ago
  I agree with you that in this limited sense it is okay. I was editing my comment to clarify my thoughts as you responded. Apologies.
- matheusmoreira 2y ago
  > The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. I don't want the app developer to have that power. The developer does not get to subvert my control. If I want to make the app believe it's running on a stock phone, that's what it should believe, and that's what it will believe. It's my machine. What the developer wants or doesn't want is completely irrelevant to me. Only what I want matters. They should count themselves lucky if I trust them enough to allow their software to run without poking at its innards to see what it's really doing. > The decision to use that is on the developer Every developer making apps for a proprietary app store will make the decision to use remote attestation. It's a power struggle. They want to own our computers.
  - gr4vityWall 2y ago
    > their software despite the rhetoric of this world filled with DRM, I believe your copy of a program belongs to you. :)
    - deleted 2y ago
JeremyNT 2y ago
I use GrapheneOS on my Pixel 8 right now but it's been obvious for a while that this is the way Android is moving. Eventually all proprietary Android apps will require both attestation and play store installation, making something like Graphene far less useful than it otherwise could be. There's still a decent amount of good open source software on F-Droid of course, but so much of the Android ecosystem is proprietary software that being unable to run any of it really hamstrings you. I was considering buying a Jelly Star as a second device to run the garbage proprietary apps I will still need. It's a shame we've ended up here.

by caseyy 2y ago

shiroiushi 2y ago

>This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. No, it isn't. AFAICT, this "feature" only prevents you from sideloading apps that don't want to be side-loaded. It's not going to prevent you from installing your favorite open-source apps from Fdroid or APKs. >For example, there are some medical apps that improve people's health outcomes... Google does not seem to want them on the Play Store. Then it would be very, very stupid for these apps to add this anti-side-loading feature, wouldn't it? Google isn't the one preventing side-loading, it's the individual apps (and their makers) themselves.

caseyy 2y ago
Sorry, I was still editing my comment and clarifying my opinion as you responded. I agree with you but I think it could still be historic if this infrastructure is later abused. I'd delete the original comment as my late edit skewed the discussion but HN doesn't let me do that. Apologies.
- shiroiushi 2y ago
  No problem! Yeah, I think HN's restrictive comment-deletion policy isn't great. Anyway, I'm not sure how much potential for abuse there is here. I don't see anything too horribly wrong with app makers being able to restrict their app to Play Store installation (though I think it's annoying, and sucks for e.g. GrapheneOS users). I'm not really sure why app makers would want to do this anyway, but I guess they have their (dumb IMO) reasons. But to be abused, that probably means Google, or the handset maker, using the feature to prevent any apps from being sideloaded or installed from app stores they don't like (like Fdroid). That would be terrible for sure, but I don't really see how this particular technology would allow that. I mean, if Google wanted to prevent sideloading, it seems like it would be relatively trivial for them; why would they need something like this? Installing from APK is built into the system (you can do it with "adb"), and could just as easily be removed or restricted. Same for the handset makers: they don't have to distribute Android as-is, and usually don't. It seems they could easily disable apk-loading and adb in general.

lolinder 2y ago

> One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. This is a bit hyperbolic—the core differentiator provided by sideloading is that you don't have to distribute through Google. That's still very much intact. What's changed is that apps can opt themselves out of being sideloaded. F-Droid and the FOSS ecosystem in general are entirely unaffected.

greentea23 2y ago
Unless you are running a custom ROM which doesn't have Google services. This feature has the potential to force you onto a 1984-style ROM just for a single but essential app. It also forces you to not only make a Google account but log into it on the device you carry in your pocket at all times.
- lolinder 2y ago
  Custom ROM without Google was always hard, and custom ROM with Google services was already possible to block with attestation.

II2II 2y ago

> This seems historic. One of the core differentiators between iOS and Android that worked in Android's favor is now destroyed. How so? You are still able to sideload apps. The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. The decision to use that is on the developer and the user has the choice to move to other apps or succumb to using the Play Store in those cases. If anything, the article suggests that the actual erosion came about a year ago with other integrity check features, such as helping the developer figure out whether the app is being used on a rooted phone. Or with the increased difficulty in using customized versions of Android over the years.

caseyy 2y ago
I agree with you that in this limited sense it is okay. I was editing my comment to clarify my thoughts as you responded. Apologies.
matheusmoreira 2y ago
> The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. I don't want the app developer to have that power. The developer does not get to subvert my control. If I want to make the app believe it's running on a stock phone, that's what it should believe, and that's what it will believe. It's my machine. What the developer wants or doesn't want is completely irrelevant to me. Only what I want matters. They should count themselves lucky if I trust them enough to allow their software to run without poking at its innards to see what it's really doing. > The decision to use that is on the developer Every developer making apps for a proprietary app store will make the decision to use remote attestation. It's a power struggle. They want to own our computers.
- gr4vityWall 2y ago
  > their software despite the rhetoric of this world filled with DRM, I believe your copy of a program belongs to you. :)
  - deleted 2y ago

JeremyNT 2y ago

I use GrapheneOS on my Pixel 8 right now but it's been obvious for a while that this is the way Android is moving. Eventually all proprietary Android apps will require both attestation and play store installation, making something like Graphene far less useful than it otherwise could be. There's still a decent amount of good open source software on F-Droid of course, but so much of the Android ecosystem is proprietary software that being unable to run any of it really hamstrings you. I was considering buying a Jelly Star as a second device to run the garbage proprietary apps I will still need. It's a shame we've ended up here.