4 ms·

> The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. I don't want the app developer t

> The difference is that an app can detect if it has been sideloaded, and the app developer can decide how to respond to that. I don't want the app developer to have that power. The developer does not get to subvert my control. If I want to make the app believe it's running on a stock phone, that's what it should believe, and that's what it will believe. It's my machine. What the developer wants or doesn't want is completely irrelevant to me. Only what I want matters. They should count themselves lucky if I trust them enough to allow their software to run without poking at its innards to see what it's really doing. > The decision to use that is on the developer Every developer making apps for a proprietary app store will make the decision to use remote attestation. It's a power struggle. They want to own our computers.

gr4vityWall 2y ago
> their software despite the rhetoric of this world filled with DRM, I believe your copy of a program belongs to you. :)
- deleted 2y ago
  [deleted]
danbruc 2y ago
It is your machine and it is their software. Why do you think what you want is more important than what they want? You can decide not to run their software if you do not like what it does, if you decide to run it, it will do what they want it to do.
- matheusmoreira 2y ago
  Because I own the machine that runs the code. It's that simple. Their code will do what I allow it to do. It's not really a "take it or leave it" deal. I have numerous options available to me. If those options aren't there, it means I don't own the machine. If they don't want others to "tamper" with their code, they should run it on their computers. Keep them safe and secure on their servers. Code that runs on our machines is and should be completely under our control. Anything that enables them to usurp this control from us is an attack on computing freedom and should be illegal.
- franga2000 2y ago
  This "you decide to run their software" narrative is the same bullshit as the "just vote with you wallet" crap that even economists don't push anymore. I can choose between one of half a dozen banks, all of which have "integrity" anti-features. Some government and school apps also have them and you basically have to use them. What apps are doing these days is like if all the major grocery store chains decided you can only drive there using a BMW and said "just buy a BMW or shop somewhere else" to everyone that complained, ignoring the fact that 1) there's nowhere else to shop, 2) BMWs are expensive and 3) many people have needs that a BMW isn't suitable for.
  - matheusmoreira 2y ago
    It's just an "our way or the highway, take it or leave it" attitude from people with zero leverage over us. In fact we have a third choice: run their software anyway, and stop it from doing things we don't want it to do, whether they want it or not. We have numerous options available to us at all times. Because we own the computer. Adversarial interoperation. It should be our right, as the owners of the computers, to do this. https://www.eff.org/deeplinks/2019/10/adversarial-interoperability https://www.eff.org/deeplinks/2019/10/adversarial-interopera... https://www.eff.org/deeplinks/2019/06/adversarial-interoperability-reviving-elegant-weapon-more-civilized-age-slay https://www.eff.org/deeplinks/2019/06/adversarial-interopera...
    - danbruc 2y ago
      I am all for that, if they do hostile things and you can break them, go for it. I just think that you can not just demand that a company builds their software the way you want it. For this we have markets, find or build a better alternative. The exception is of course in case of market failures, there it is legitimate to intervene. If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it.
      - matheusmoreira 2y ago
        > you can not just demand that a company builds their software the way you want it I absolutely can. I think building certain types of software should be straight up illegal. And not the copyright infringement kind either. These days our computers come pwned straight off the factory. The only difference between this and malware is that the company consented to it. In other words, from our perspectives as users and owners of computers, there is no difference whatsoever between their software and illegal malware. The entire purpose of those softwares is to usurp control of your computer and make it do somebody else's bidding. Creating malware is already illegal. I think it should also be illegal to sell a computer to a person with such malicious DRM "integrity checking" software included. It should also be illegal for corporations to require it. And so on. This isn't about markets anymore, it's about politics. If a politician shows up and proposes to enforce what I am saying above by force of law, they will have earned my vote. >The exception is of course in case of market failures, there it is legitimate to intervene Can't think of a bigger market failure than big techs building digital fiefdoms where they own the users and their data, where users don't have private property, where the corporations sell their users to other corporations and to software developers, dictate the developer's working conditions and control their futures, collect taxes on their earnings, enforce border controls on "their" devices so that software that didn't pass their customs clearance can't get installed. > If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it. The only reason why they are even able to "check integrity" to begin with is Google gave them the ability to do so via their attestation nonsense. They deployed hardware cryptography against us to deny us control over what was supposed to be our devices. The ones who have the keys own the machines, and it sure as hell ain't us. The truth is these apps should not even have the ability to do any integrity checks at all. They should run on whatever device we put them on. And they should be happy that they get to run at all.
- mardifoufs 2y ago
  Google already enforces a lot of restrictions on how people write their software. Otherwise you could apply the same logic to say, requesting unneeded permissions. If the user doesn't want that they he could just not use the software, right?
t0bia_s 2y ago
You don't have to use apps that you don't like, do you? Use apps that respect your privacy and are open source. For example FairMail developer recommend to install app from github instead of PlayStore.
- fragmede 2y ago
  I do, if I want to get the services that app gives me access to. Eg my bank's app gives me access to my bank. There are no open source bank apps that I am aware of, so switching banks doesn't help.
  - t0bia_s 2y ago
    Why do you need access to your bank from app? Isn't browser enough?
    - SAI_Peregrinus 2y ago
      Remote check deposit usually isn't available without an app. Probably other services as well.
      - t0bia_s 2y ago
        It is avalible via web login. At least in mine bank.
- matheusmoreira 2y ago
  I use free and open source software when I can. I use and contribute to open street maps. I use proton mail's open source software and have purchased a plan with SMTP included. I still gotta use WhatsApp though. In my country, to not have WhatsApp is to be ostracized. And there is no such thing as an open source WhatsApp client. They ban your number if you try. It's in the terms of service. I can't build a free software app to interface with my bank's systems either. I actually tried asking my banks about this once... How naive I was.
em-bee 2y ago
that is why i use Free Software and Open Source applications. quibbling about this detail (not your comment but the discussion as a whole) is not going to change the fact that only FOSS lets us own our computers ourselves.
- matheusmoreira 2y ago
  Free software is a mirage. It's an illusion. I am committed to developing all of my projects as AGPLv3 free software. However, the fact that I even get to do this at all is something of a miracle. Governments don't generally allow non-engineers to erect big buildings. So why is it that we get to make software at home? Individuals developing software is a deeply subversive action. It heavily contributed to the democratization of cryptography. The publication of PGP source code as a book defeated the US government's attempt to keep the cryptography to itself. Someone writes a little software called bittorrent and it threatens to wipe out entire industries, wipe out entire classes of business model. Somebody invents a bitcoin thing and now US presidential candidates speak of strategic bitcoin reserves. Somebody invents stable diffusion... We're all living to see the aftermath of that. It's hard to describe just how powerful and subversive computers are. Computers can literally reshape society. It's all enabled by free computers. General purpose processors which run the code you input into them, no questions asked. And what we are witnessing here is the destruction of those free computers. For the sake of corporate interests. The computer is not free anymore. It only runs the code the corporation allows it to run. Because if it could run the set of all programs, it means it could run code that negatively impacts the corporation's profits. Their solution is to allow execution of the programs the corporations like and nothing else. Could be worse I guess. It might have been the government making that decision. Perhaps one day it will be. Software freedom is not the same thing as computing freedom. There cannot be free and open source software without free computers. Focusing on free software as a solution to this is missing the forest for the trees. There is no point whatsoever to free software which we can't run, free software which can't interface with the services we need, free software which gets us ostracized. Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services. We need home computer fabrication technology so that we can make the computers themselves in our homes. Our own free hardware designs, one hundred percent free from their control, fabricated by ourselves. But more than anything, we need to enshrine computing freedom into actual law. It should be illegal for them to lock our computers down. It should be illegal for them to refuse to interoperate with non-locked down computers. Anything short of this means free software has no future.

gr4vityWall 2y ago

> their software despite the rhetoric of this world filled with DRM, I believe your copy of a program belongs to you. :)

deleted 2y ago
[deleted]

danbruc 2y ago

It is your machine and it is their software. Why do you think what you want is more important than what they want? You can decide not to run their software if you do not like what it does, if you decide to run it, it will do what they want it to do.

matheusmoreira 2y ago
Because I own the machine that runs the code. It's that simple. Their code will do what I allow it to do. It's not really a "take it or leave it" deal. I have numerous options available to me. If those options aren't there, it means I don't own the machine. If they don't want others to "tamper" with their code, they should run it on their computers. Keep them safe and secure on their servers. Code that runs on our machines is and should be completely under our control. Anything that enables them to usurp this control from us is an attack on computing freedom and should be illegal.
franga2000 2y ago
This "you decide to run their software" narrative is the same bullshit as the "just vote with you wallet" crap that even economists don't push anymore. I can choose between one of half a dozen banks, all of which have "integrity" anti-features. Some government and school apps also have them and you basically have to use them. What apps are doing these days is like if all the major grocery store chains decided you can only drive there using a BMW and said "just buy a BMW or shop somewhere else" to everyone that complained, ignoring the fact that 1) there's nowhere else to shop, 2) BMWs are expensive and 3) many people have needs that a BMW isn't suitable for.
- matheusmoreira 2y ago
  It's just an "our way or the highway, take it or leave it" attitude from people with zero leverage over us. In fact we have a third choice: run their software anyway, and stop it from doing things we don't want it to do, whether they want it or not. We have numerous options available to us at all times. Because we own the computer. Adversarial interoperation. It should be our right, as the owners of the computers, to do this. https://www.eff.org/deeplinks/2019/10/adversarial-interoperability https://www.eff.org/deeplinks/2019/10/adversarial-interopera... https://www.eff.org/deeplinks/2019/06/adversarial-interoperability-reviving-elegant-weapon-more-civilized-age-slay https://www.eff.org/deeplinks/2019/06/adversarial-interopera...
  - danbruc 2y ago
    I am all for that, if they do hostile things and you can break them, go for it. I just think that you can not just demand that a company builds their software the way you want it. For this we have markets, find or build a better alternative. The exception is of course in case of market failures, there it is legitimate to intervene. If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it.
    - matheusmoreira 2y ago
      > you can not just demand that a company builds their software the way you want it I absolutely can. I think building certain types of software should be straight up illegal. And not the copyright infringement kind either. These days our computers come pwned straight off the factory. The only difference between this and malware is that the company consented to it. In other words, from our perspectives as users and owners of computers, there is no difference whatsoever between their software and illegal malware. The entire purpose of those softwares is to usurp control of your computer and make it do somebody else's bidding. Creating malware is already illegal. I think it should also be illegal to sell a computer to a person with such malicious DRM "integrity checking" software included. It should also be illegal for corporations to require it. And so on. This isn't about markets anymore, it's about politics. If a politician shows up and proposes to enforce what I am saying above by force of law, they will have earned my vote. >The exception is of course in case of market failures, there it is legitimate to intervene Can't think of a bigger market failure than big techs building digital fiefdoms where they own the users and their data, where users don't have private property, where the corporations sell their users to other corporations and to software developers, dictate the developer's working conditions and control their futures, collect taxes on their earnings, enforce border controls on "their" devices so that software that didn't pass their customs clearance can't get installed. > If Google forced apps to do this integrity check, that would be very different from some random apps deciding to make use of it. The only reason why they are even able to "check integrity" to begin with is Google gave them the ability to do so via their attestation nonsense. They deployed hardware cryptography against us to deny us control over what was supposed to be our devices. The ones who have the keys own the machines, and it sure as hell ain't us. The truth is these apps should not even have the ability to do any integrity checks at all. They should run on whatever device we put them on. And they should be happy that they get to run at all.
mardifoufs 2y ago
Google already enforces a lot of restrictions on how people write their software. Otherwise you could apply the same logic to say, requesting unneeded permissions. If the user doesn't want that they he could just not use the software, right?

t0bia_s 2y ago

You don't have to use apps that you don't like, do you? Use apps that respect your privacy and are open source. For example FairMail developer recommend to install app from github instead of PlayStore.

fragmede 2y ago
I do, if I want to get the services that app gives me access to. Eg my bank's app gives me access to my bank. There are no open source bank apps that I am aware of, so switching banks doesn't help.
- t0bia_s 2y ago
  Why do you need access to your bank from app? Isn't browser enough?
  - SAI_Peregrinus 2y ago
    Remote check deposit usually isn't available without an app. Probably other services as well.
    - t0bia_s 2y ago
      It is avalible via web login. At least in mine bank.
matheusmoreira 2y ago
I use free and open source software when I can. I use and contribute to open street maps. I use proton mail's open source software and have purchased a plan with SMTP included. I still gotta use WhatsApp though. In my country, to not have WhatsApp is to be ostracized. And there is no such thing as an open source WhatsApp client. They ban your number if you try. It's in the terms of service. I can't build a free software app to interface with my bank's systems either. I actually tried asking my banks about this once... How naive I was.

em-bee 2y ago

that is why i use Free Software and Open Source applications. quibbling about this detail (not your comment but the discussion as a whole) is not going to change the fact that only FOSS lets us own our computers ourselves.

matheusmoreira 2y ago
Free software is a mirage. It's an illusion. I am committed to developing all of my projects as AGPLv3 free software. However, the fact that I even get to do this at all is something of a miracle. Governments don't generally allow non-engineers to erect big buildings. So why is it that we get to make software at home? Individuals developing software is a deeply subversive action. It heavily contributed to the democratization of cryptography. The publication of PGP source code as a book defeated the US government's attempt to keep the cryptography to itself. Someone writes a little software called bittorrent and it threatens to wipe out entire industries, wipe out entire classes of business model. Somebody invents a bitcoin thing and now US presidential candidates speak of strategic bitcoin reserves. Somebody invents stable diffusion... We're all living to see the aftermath of that. It's hard to describe just how powerful and subversive computers are. Computers can literally reshape society. It's all enabled by free computers. General purpose processors which run the code you input into them, no questions asked. And what we are witnessing here is the destruction of those free computers. For the sake of corporate interests. The computer is not free anymore. It only runs the code the corporation allows it to run. Because if it could run the set of all programs, it means it could run code that negatively impacts the corporation's profits. Their solution is to allow execution of the programs the corporations like and nothing else. Could be worse I guess. It might have been the government making that decision. Perhaps one day it will be. Software freedom is not the same thing as computing freedom. There cannot be free and open source software without free computers. Focusing on free software as a solution to this is missing the forest for the trees. There is no point whatsoever to free software which we can't run, free software which can't interface with the services we need, free software which gets us ostracized. Our free computers are being increasingly labeled as "untrusted" and excluded from networks and services. We need home computer fabrication technology so that we can make the computers themselves in our homes. Our own free hardware designs, one hundred percent free from their control, fabricated by ourselves. But more than anything, we need to enshrine computing freedom into actual law. It should be illegal for them to lock our computers down. It should be illegal for them to refuse to interoperate with non-locked down computers. Anything short of this means free software has no future.