10 ms·

Uncomfortable Questions About Android Developer Verification

400 points by ingve 1y ago

jerome-jh 1y ago
You americans are strange. Your government makes arbitrary arrests, illegally searches phones, massively de-funds science and health projects, and only a handful of people demonstrate. Now a company wants the identity of the companies it works with because it distributes their software, and it looks like a massive "scandal". Well at least I am realistic that the "scandal" is only within certain circles.
- lII1lIlI11ll 1y ago
  Google always knew the identity of companies whose software it distributed (via Google Play), now it also want to know the identity of software developers it has nothing to do with. Get your facts straight next time before writing a snarky comment!
sschueller 1y ago
The requirement of verification to side-load any app is fascist control. It is clear as night and day. Shame on Google and Apple, it was always clear this was the end goal and next up is also your PC. Right after will come the removal off apps they don't like and there is nothing you can do about it. Stallman was right
- mettamage 1y ago
  I asked an LLM, so I think I get it but could you try to mention what is meant with "Stallman was right"? The reason I'm asking you and not posting the LLM answer is because it still feels a bit icky to post an LLM answer for everything I don't understand [1]. [1] Feel free to discuss this too, if you want. I'm developing my opinion on it.
  - progval 1y ago
    Probably https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html , mentioned elsewhere in the thread.
    - IsTom 1y ago
      I wish it was as absurd today as it was the first time I read it.
  - LambdaComplex 1y ago
    Richard Stallman has spent basically his entire career trying to convince people that all software should be free as in freedom, so that people truly control the devices that they own--preventing things like Google being able to lock users out of the ability to install applications on a device that they purchased. Read up on the principles of the Free Software Foundation if you want all the details.
  - bigstrat2003 1y ago
    Stallman has a long history of being very abrasive and ideological. He is the kind of guy who makes zero concessions for practicality, and he insists on prioritizing user freedom because he has always feared that otherwise users will be locked out of having the ability to truly control their computers. It's always been kind of easy to laugh at his crusade because of how zealous he is, and how absurd the scenarios he warns about seem to be. The thing is... he seems to have been right the whole time. Companies really do want to lock you out of controlling the devices you own, and do so at the first opportunity. So... Stallman was right.
    - simoncion 1y ago
      > He is the kind of guy who makes zero concessions for practicality... Respectfully, this claim is incorrect. See this 2013 essay [0] for one example out of many where concessions are made to practicality. Folks who are unfamiliar with Stallman's writing and the general philosophy of the FSF and/or the GNU Project might find spending an hour or so reading through some of the essays here [1] (perhaps starting with this 1991 essay [2]) to be informative. [0] <https://www.gnu.org/philosophy/is-ever-good-use-nonfree-program.html https://www.gnu.org/philosophy/is-ever-good-use-nonfree-prog...> [1] <https://www.gnu.org/philosophy/essays-and-articles.html https://www.gnu.org/philosophy/essays-and-articles.html> [2] <https://www.gnu.org/philosophy/shouldbefree.html https://www.gnu.org/philosophy/shouldbefree.html>
- timeon 1y ago
  > next up is also your PC Already starting on macos. Gatekeeper had setting where you could allow any app. Now it is removed. While still possible to allow individual app (you need to do it after every OS update), trajectory is now clear.
  - Citizen8396 1y ago
    boot into Recovery, run "csrutil disable" and do whatever you want (not a recommendation)
    - fsflover 1y ago
      How many people would be able to use this workaround?
- enriquto 1y ago
  > The requirement of verification to side-load any app is fascist control. Even the language we are using to describe the situation is problematic. Why do we say "side-load an app"? It should be just "run a program"! An OS that doesn't let you run programs of your choice is laughable.
  - preisschild 1y ago
    > It should be just "run a program"! More accurate would be "run a program not approved by Google"
  - opan 1y ago
    I think I have an old comment about this, but there is an actual `adb sideload` command for installing an apk on your phone from your computer. Since it's from your computer and not the phone itself, it's sideloading and not frontloading, I guess. Weirdly, and wrongly, people have also started to use the term to refer to just installing apps from outside the official appstores, but that's not sideloading. It's just installing an app. It's a normal Android feature. You can just grab a .apk file with your browser and install it like you would a .exe file on Windows. iOS on the other hand historically required a jailbreak for this. I think that's where the confusion started. Android doesn't need a jailbreak, it doesn't need root (privileges), it doesn't need a custom ROM. You can just install stuff, it's normal. I think iOS users don't realize how different Android is and they just start repeating words like sideload and root without knowing what they mean, assuming it's just Android-speak for a jailbreak. They don't realize there's no jail in the first place. I am aware English is a living language, and if enough people are wrong for long enough, they stop being wrong, but it's certainly painful to witness.
    - ptx 1y ago
      I always used "adb install" to install programs on my phone from my PC. I never heard of the "adb sideload" command, but my search results [1][2] indicate that the second command is for installing things from the recovery mode, when you don't have the full Android system running. So "install" is the command for installing programs under normal circumstances using the Android installer. [1] https://android.stackexchange.com/a/84248 https://android.stackexchange.com/a/84248 [2] https://www.androidauthority.com/how-to-use-adb-android-3260397/ https://www.androidauthority.com/how-to-use-adb-android-3260...
- pjmlp 1y ago
  PC only turned out open, because IBM never saw it coming, and when they tried to get control back it was too late.
  - pjerem 1y ago
    Yep. PC openness is totaly a bug and not a feature of the capitalism. We should cherish this situation and fight for it because it really feels like the other long term alternative is techno-fascism.
- thrance 1y ago
  I'm all for calling out fascist behavior when it is spotted, but let's not muddy the waters further. This word is already denatured enough. This is not fascism, this is just a rational move from Google in a market economy. It feels like every time something like this happens, Americans rediscover what capitalism is and implies, then blame it on "human nature", "greed" or "fascism".
  - rchaud 1y ago
    Google's stated reason for doing this says nothing about it being for market reasons, but rather for "security".
    - thrance 1y ago
      As they always do, you should know better than to buy it.
  - fsflover 1y ago
    > This is not fascism, this is just a rational move from Google Google is not very separable from the US government, and they use illegal monopoly everywhere without any oversight.
- selfmodruntime 1y ago
  One day people on the internet will learn what the term „fascism“ entails. This is just plain old government overreach.
  - tremon 1y ago
    "Government overreach" by a private corporation? Let's see what wikipedia has to say about that: > A fascist corporation can be defined as a government-directed confederation of employers and employees unions, with the aim of overseeing production in a comprehensive manner. https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatism https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatis... Google goes even further than that: they do not only control and oversee all production via the Play Store, they also control all usage of their products. And while it may currently not be government-directed, they certainly are government-protected as long as they're allowed to run the only app store in town.
- maxlin 1y ago
  I'm absolutely against this and for similar reasons have boycotted Apple for my entire life on hard ideological grounds, but not everything is "fascist" lol. Don't misuse the term. In any case, I hope this blows up in Google's face hard, ROMs like LineageOS become as popular they were back in their heyday, and root hiders get extra attention too so banking apps etc work seamlessly as on non-rooted phones. Requiring some developer ID crap is essentially as bad as Apple has it, reason for which I've always considered developers having Apple phones quite unserious.
  - JeremyNT 1y ago
    They're not going to publish device trees for pixel phones, so what hardware will you use? Commercial apps and services will require passkeys and device attestation, so you'll only be able to use open source software even if you have a device to run it. The walls are closing in, and it's not just mobile. It's only a matter of time before passkeys are used to block Linux users from the commercial Internet as well.
    - maxlin 1y ago
      I did manage to run banking apps, and after some work, even Fortnite just for principle (they had a crazy anti hacking system) on my rooted Oneplus 7 Pro. I do want to believe if there's a will there's a way. Google has really overstepped here.
- deleted 1y ago
  [deleted]
pastage 1y ago
So no F-Droid?
- sdex 1y ago
  Fdroid signs builds with own key, so it shouldn't be a problem if they pass this verification.
  - BrenBarn 1y ago
    It won't be a problem. . . until Google revokes their accreditation for some reason they won't explain.
  - mzajc 1y ago
    As far as I understand, verification is tied to the package name (or at least the prefix). Since F-Droid packages thousands of applications from different developers, I don't see how they could reasonably get verified.
charcircuit 1y ago
[flagged]
- extropic-engine 1y ago
  It is if the laws are fascist. Which is currently the case, and is the example given in the article.
- userbinator 1y ago
  "If you outlaw freedom, only outlaws will have freedom."
  - latentsea 1y ago
    Until they get caught.
- XorNot 1y ago
  I mean this is also an enormous problem for nations which would like to provide intelligence capability to their agents. A special carve out for anonymous apps only for people with government connections doesn't help because it fingerprints the operative. Tor was originally a deniable communications tool.
- yellow_lead 1y ago
  ICEBlock isn't illegal.
- realusername 1y ago
  I don't see why Google would be considered a trusted party to judge that in the first place. Regardless of what they think about this app.
- 47282847 1y ago
  History has shown time and time again that it is dangerous to centralize power into the hands of few. A lot of mechanisms have been invented and subsequently dismantled again in attempts to protect us from this. Fascism is real.
- 1y ago
userbinator 1y ago
This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile. "debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read, 1997
- sliken 1y ago
  Great justification for switching to Graphene OS, more secure, more control, and google has to ask permission to install things and the play store is optional.
  - fsflover 1y ago
    Unless you're against giving your money to Google and depending on their hardware and software.
- raverbashing 1y ago
  Stallman's fallacy is thinking every system is perfect and unbreakable and that people have a perfect understanding of software and systems (for better or for worse) People will be running pirated debugger copies if that comes to shove 99.9% of people DNGAF about OSS. They do care about doing what they need on their phone without malware/bloatware/nagware Also publishing and development are separate activities
  - superkuh 1y ago
    Your fallacy is thinking that authoritarian governments care about enforcement or successful enforcement of such laws. The goal is to create a status quo in which all citizens break many laws daily and so are already guilty if they ever rock the boat and disturb those in power. Stallman's "Right to Read" is an accurate reflection of reality in that sense.
  - 01HNNWZ0MV43FF 1y ago
    Yeah and people had gay sex when it was illegal but it still is a shameful injustice for the government to decide what software I run on my own hardware
whs 1y ago
I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block that. So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done. I suppose this will be how we'll use F-Droid in the next year for enthusiasts.
- cuu508 1y ago
  Perhaps using the bank's website is an option? I don't have a banking app installed on my phone. When I need to make a bank transfer I sit down at the computer.
  - pmontra 1y ago
    Not the parent poster but my bank uses its own mobile app for 2FA. No app, no website.
    - cuu508 1y ago
      Perhaps there's another bank you can switch to? Here we have a few mobile-only banks, but traditional banks with websites and physical MFA devices as an option too.
      - ninjin 1y ago
        Sadly, traditional banks are very eager to get rid of dedicated multi-factor devices in favour of their own mobile applications. I have seen strong encouragement via nagging and some going so far as to start charging for physical multi-factor authentication devices. Likely this gives them another way to milk information out of you, push their marketing onto to you, and saves them from having to manage physical devices. The obvious downside is of course a degradation in security and further cementing the duopoly and more or less forced participation in it that we as citizens have to endure.
swe_dima 1y ago
There goes one of the main arguments why I've been using Android over iPhone
- Disposal8433 1y ago
  I also remember the early war between Androids and the iPhone. The main argument was that you don't need Google's permission to run applications.
  - silverliver 1y ago
    Can Google be sued for misleading and defrauding phone owners?
- bambax 1y ago
  Yes, and that may be something Google does care about in the end. If Android becomes as closed and as controlled as iOS, why Android??
  - pjmlp 1y ago
    Because most of us live in countries where an iPhone is two months salary at least, or a contract bound to several years before it can be cancelled, while Android is usually half of that, with the freedom of pre-pay.
- bigstrat2003 1y ago
  If anything, this is even worse than what Apple does. iPhone users frequently argue that the inability to install arbitrary software is a feature in their eyes, one of the things that attracts them to the platform. I disagree with their argument, but in fairness I must admit Apple has never pretended that an iPhone is a device you control. They have always been very up front that it is a curated experience, their way or the highway. It's distasteful to me but they're honest about it. What Google is doing is a bait and switch to so many users who chose their platform specifically because it was open.
self_awareness 1y ago
I'm a nobody, but let me answer these questions in 60 seconds. 1: None, no anonymous accounts allowed. 2: None. Civil what?. 3: It's the Google's company policy, don't use our products if you don't agree to it. 4: If devs write apps for this nearly impossible to develop Mac AppStore ecosystem, I don't see even a slightest problem here. 5: Just change package IDs. Thank you for listening, see you again next time.
- melagonster 1y ago
  Do you work for Google?
  - self_awareness 1y ago
    No, but I was a developer of an app for iPhone, so I know the thought process.
pixelii 1y ago
It must be left up to the device owner to decide if they want to have side loading app of unverified developer disabled or not. Period. There is nothing more to it. If there can be setting on phone to unlock bootloader, then there can also be a setting for this.
qalmakka 1y ago
This is intolerable. You own the device. You must be able to run whatever you want on it. Locking or limiting your access to the stuff you bought is not only unacceptable, it's basically like saying you don't really own anything. You're basically leasing a device until the OEM decides you can't run anything on it anymore. Would people accept if a car manufacturer prohibited you from driving their cars in certain places?
- p0w3n3d 1y ago
  Meanwhile: VW is already limiting horsepower when the yearly subscription is ceased to be paid It's already happening. The greediness of vendors, the ignorance of users...
  - generic92034 1y ago
    Do not forget the inaction and/or corruption of lawmakers.
    - lioeters 1y ago
      Now is a time in history where any corporation worth its ill-gotten billions should take advantage of the government's whole-hearted encouragement to push through anti-competitve and anti-consumer decisions to dominate the market and the public.
  - AnonymousPlanet 1y ago
    Back in the 90s Sun sold you computers with X amount of space. There was an option to upgrade. If you took it, they sent a technician around to do the upgrade. All they did was making the already existing space available. Sun always sold hardware with all the space installed but gave you only what you paid for.
    - p0w3n3d 1y ago
      I wonder if such actions can become a reason for persecution. Let me make an allegory: if I sold someone thing that is designed to break on purpose, and then requested pay for fixing it, it would be a felony. Why the remote downgrading is not considered a felony?
llamavore 1y ago
Maybe we can finally spark an omarchy style user driven linux mobile OS ala DHH? Or are users just going to face network bans and additional tracking like with grapheneos?
- microtonal 1y ago
  Omarchy is just a set of defaults for an existing software stack. The problems here are at a much more fundamental level: getting devices that can be unlocked, getting device drivers/firmware that are also updated on a regular basis, supporting hardware attestation and getting app makers to support it without Google's support (assuming an Android compatibility layer), getting a healthy app ecosystem (if there is no Android compatibility layer). Currently probably the best route is basing the OS on Android (so that you can benefit from all the existing apps), making a non-hostile reference device, and getting regulators' attention (the EU is probably the most likely to succeed) to break Google's monopoly on attestation. This is largely what GrapheneOS is currently trying. I think what we can do as users is install GrapheneOS with sandboxed Google Play and for any apps that do not work, contact their developers. If GrapheneOS manages to get millions of users and get on the radar of app developers, that's the best shot I think. But it feels like the window is closing quickly. So if you care at all about any of this, today is the day to get a GrapheneOS device and make yourself heard.
deleted 1y ago
[deleted]
itake 1y ago
While I am against the policy, Google only publishes developer's full legal name and email address if the app is monetized [0]. If the app is monetized, then the full mailing address is shared. If money is involved, it’s fair for users to know who they’re dealing with. Developers who want to hide their personal identity can still do so legally with a shell company. Taking it a step further, if I am going to run your code on my device, I want to know who I'm giving access to my data/cpu/hardware. Just like with offline transactions, customers should know who they are giving money to. ---- > Google will display your legal name, your country (as per your legal address) and developer email address on Google Play. If you decide to monetise on Google Play, then Google will display your full address. [0] - https://support.google.com/googleplay/android-developer/answer/13628312?hl=en-GB https://support.google.com/googleplay/android-developer/answ...
- quikoa 1y ago
  Small developers need to be easy to contact. Meanwhile Google is notorious for being difficult to get human support. Seems fair.
- dns_snek 1y ago
  All of those are fine things to expect from Google Play but the point is moot because this verification would also apply to apps installed from external sources where they shouldn't have any jurisdiction. Google, just like Apple, should be free to enforce any kind of verification they deems necessary on Google Play, as long as they allow third party stores to be on equal footing, which they don't.
  - itake 1y ago
    I agree. we should be able to install apps we want to install. But if you're installing them from the Google Play store (which is what is discussed) then you should be allowed to know who you're doing business with.
    - dns_snek 1y ago
      > But if you're installing them from the Google Play store (which is what is discussed) Maybe there's been a miscommunication somewhere but Android Developer Verification (what this thread is about) applies to all apps, even those installed outside of Google Play store.
BrenBarn 1y ago
Those questions may make some users uncomfortable, but it's wishful thinking to believe they would make Google uncomfortable. Google doesn't care in the slightest about these issues.
- n4r9 1y ago
  Agreed. PR departments are paid specifically to weasel around questions like this. If anything, it's in Google's interests because it gives them something to claim they're cooperating with.
beardyw 1y ago
I know I risk being down voted remorselessly but I have to put this in context. Where in the real world is anonymity considered ok? If I only put a flyer through someone's letterbox here in the UK, I have to identify myself. If I sell a physical product I not only have to identify myself but take on serious legal liability. An author can take on a pseudonym but only via an identified publisher. In fact that latter example might provide a solution. Set up a company willing to publish apps whilst hiding the actual developer's identity.
- johnnyfaehell 1y ago
  The thing is that so many people are used to doing whatever they want from behind the safety of their screen and are now able to do a lot of things they don’t want anyone to know about. Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world. And I think a lot of people are scared of not being able to do what they used to or being found out for doing it. Plus, and doing what you suggest but in a country where board directors don’t need to be public really solves it.
  - Perz1val 1y ago
    Yea, cus when I write a fanfic I should show my id to the company that owns the printer I purchased and own, before I print out a copy to give for my friend, ffs. Does that analogy make sense to you?
    - johnnyfaehell 1y ago
      No because you purposefully crafted one that is not BB anywhere near similar to what was being discussed. Being obtuse generally means you’re wrong and know it but don’t like the truth.
  - Hizonner 1y ago
    > Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world. Your concept of "common sense" is repulsive, as is your submissive attitude.
morpheuskafka 1y ago
Presumably this won't apply to Chinese OEMs, since even though their devices do ship a disabled by default Google Mobile Services (without the user facing Play Store APK), it obviously would not be suitable to require Google involvement for developing internal apps. The OEMs could set up such a debug licensing service themselves, but each of them would have to do it themselves, and then it would be impossible to debug Google-based apps on the devices.
- xyzal 1y ago
  Many Chinese OEMs are not Google certified, so it won't for sure apply to them. Some (Huawei) even had to implement their own app store and replacement for Google services. They are basically de-googled devices, though, sadly, often loaded with spyware from the other camp.
  - morpheuskafka 1y ago
    But some, like Oppo and Vivo are--they ship with a Google-OKed copy of GMS, and redistribute the Play Store on their own app store as a way to install it (ostensibly for use when traveling outside the mainland, though it can also be used with a VPN). So clearly they are on some level Google certified. However, they also contain switches to disable background GMS, which makes them almost de-googled. All of them, not just Huawei, have their own app store/updater, and have some sort of push notification to replace Firebase Cloud Messaging (as I understand, Tencent provides a one touch service so devs don't need to hardcode each OEMs notifications). Otherwise, it would be impossible to get apps or notifications without a VPN/proxy.
m00dy 1y ago
This is the most terrible thing that I read in this year.
casenmgreen 1y ago
Individual privacy and anonymity matter substantially less when Governments are basically decent and play by the rules, and so it seems there is a tendency to value convenience and utility over privacy and anonymity. When Government goes bad, suddenly we are faced with the utmost need for privacy and anonymity, but we may by then be in a situation where privacy and anonymity are difficult to obtain, with all the consequences that then flow from that.
- Hizonner 1y ago
  Yeah, that's what a lot of us have been saying for decades. But notice that Google is doing this as the government in its home country is going bad (or at least getting dramatically, qualitatively worse than it has already been). Some people see features where others see bugs.
supermatt 1y ago
They know the days of the app-store monopolies are ending so they are now implementing apple-style notarisation - which they could have done years ago, but never seemed to need to until now... IMHO, thats is them still having an unfair control over the android market so the EU will come for them eventually - and no doubt they will implement some other devious bullshit. Ideally the world will wake up and realise multi-sector megacorps simply should not exist and split them all up accordingly - but I'm not holding my breath.
tommica 1y ago
Very good questions, and hope that they can get answers to them.
nolist_policy 1y ago
Did you actually reach out to Google?
- TheChaplain 1y ago
  Trying to get hold of the correct person to get proper answers is a bit harder than you think.
  - self_awareness 1y ago
    The hard part is who does it, not that the process is complicated. If you have an influenctial social account with lots of followers, Google reaches out to you. They only react if something has a potential to hit their PR. So in order to get in contact with Google, you reach out to influencers, not Google itself.
kstenerud 1y ago
I wonder if this would give Epic cause against Google? https://en.wikipedia.org/wiki/Epic_Games_v._Apple https://en.wikipedia.org/wiki/Epic_Games_v._Apple If Google controls verification, then Google - not Epic - controls who can distribute Android apps on the Epic store.
- Andrex 1y ago
  That case is why I don't think Google will actually roll this out in the US (and the EU for different reasons). But I was wrong about them even ever attempting something like this so who knows.
eviks 1y ago
> To Google, these questions might be uncomfortable. Not really, there is no discomfort from something they can easily ignore.
akomtu 1y ago
I'd guess that the main reason Googel has done this is to prevent side-loading of messenger apps, such as Signal, with true end-to-end encryption. Such messengers would be very difficult to surveil at scale. You might ask why not to simply install these apps from Play Store? The reason is Google demands signing keys for all apps, so it can impersonate the developer, inject any spyware, rebuild the app, sign it and make it look untampered. Side-loading bypasses this entirely.
- blueg3 1y ago
  Google doesn't demand your signing keys, and transforming your app in that way is easily detectable by the developer.
notpushkin 1y ago
There’s a feedback form, in case anybody wants to tell Google what they think about all this: https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITkdzMxv81rJDEGGjO-UIDDY28Rz_GEVA/viewform https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk... Discussion: https://news.ycombinator.com/item?id=45030967 https://news.ycombinator.com/item?id=45030967
Varelion 1y ago
Android is no longer open-source, with a move like this. In the past few years, it has become obscene how emboldened the corpos have gotten with how far they are willing to push to mine every last crumb of data, eager to sell it to dangerous government bodies.
curt15 1y ago
>The developer of ICEBlock disclosed his identity. In addition to receiving threats of federal prosecution over the app, the developer has faced other backlash, including his wife being fired from a federal government job. This is the sort of thug behavior you see in CCP China. If the govt can't directly detain overseas dissidents or other "undesirables", it goes after their families back in the mainland.

400 points by ingve 1y ago

You americans are strange. Your government makes arbitrary arrests, illegally searches phones, massively de-funds science and health projects, and only a handful of people demonstrate. Now a company wants the identity of the companies it works with because it distributes their software, and it looks like a massive "scandal". Well at least I am realistic that the "scandal" is only within certain circles.

lII1lIlI11ll 1y ago
Google always knew the identity of companies whose software it distributed (via Google Play), now it also want to know the identity of software developers it has nothing to do with. Get your facts straight next time before writing a snarky comment!

sschueller 1y ago

The requirement of verification to side-load any app is fascist control. It is clear as night and day. Shame on Google and Apple, it was always clear this was the end goal and next up is also your PC. Right after will come the removal off apps they don't like and there is nothing you can do about it. Stallman was right

mettamage 1y ago
I asked an LLM, so I think I get it but could you try to mention what is meant with "Stallman was right"? The reason I'm asking you and not posting the LLM answer is because it still feels a bit icky to post an LLM answer for everything I don't understand [1]. [1] Feel free to discuss this too, if you want. I'm developing my opinion on it.
- progval 1y ago
  Probably https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html , mentioned elsewhere in the thread.
  - IsTom 1y ago
    I wish it was as absurd today as it was the first time I read it.
- LambdaComplex 1y ago
  Richard Stallman has spent basically his entire career trying to convince people that all software should be free as in freedom, so that people truly control the devices that they own--preventing things like Google being able to lock users out of the ability to install applications on a device that they purchased. Read up on the principles of the Free Software Foundation if you want all the details.
- bigstrat2003 1y ago
  Stallman has a long history of being very abrasive and ideological. He is the kind of guy who makes zero concessions for practicality, and he insists on prioritizing user freedom because he has always feared that otherwise users will be locked out of having the ability to truly control their computers. It's always been kind of easy to laugh at his crusade because of how zealous he is, and how absurd the scenarios he warns about seem to be. The thing is... he seems to have been right the whole time. Companies really do want to lock you out of controlling the devices you own, and do so at the first opportunity. So... Stallman was right.
  - simoncion 1y ago
    > He is the kind of guy who makes zero concessions for practicality... Respectfully, this claim is incorrect. See this 2013 essay [0] for one example out of many where concessions are made to practicality. Folks who are unfamiliar with Stallman's writing and the general philosophy of the FSF and/or the GNU Project might find spending an hour or so reading through some of the essays here [1] (perhaps starting with this 1991 essay [2]) to be informative. [0] <https://www.gnu.org/philosophy/is-ever-good-use-nonfree-program.html https://www.gnu.org/philosophy/is-ever-good-use-nonfree-prog...> [1] <https://www.gnu.org/philosophy/essays-and-articles.html https://www.gnu.org/philosophy/essays-and-articles.html> [2] <https://www.gnu.org/philosophy/shouldbefree.html https://www.gnu.org/philosophy/shouldbefree.html>
timeon 1y ago
> next up is also your PC Already starting on macos. Gatekeeper had setting where you could allow any app. Now it is removed. While still possible to allow individual app (you need to do it after every OS update), trajectory is now clear.
- Citizen8396 1y ago
  boot into Recovery, run "csrutil disable" and do whatever you want (not a recommendation)
  - fsflover 1y ago
    How many people would be able to use this workaround?
enriquto 1y ago
> The requirement of verification to side-load any app is fascist control. Even the language we are using to describe the situation is problematic. Why do we say "side-load an app"? It should be just "run a program"! An OS that doesn't let you run programs of your choice is laughable.
- preisschild 1y ago
  > It should be just "run a program"! More accurate would be "run a program not approved by Google"
- opan 1y ago
  I think I have an old comment about this, but there is an actual `adb sideload` command for installing an apk on your phone from your computer. Since it's from your computer and not the phone itself, it's sideloading and not frontloading, I guess. Weirdly, and wrongly, people have also started to use the term to refer to just installing apps from outside the official appstores, but that's not sideloading. It's just installing an app. It's a normal Android feature. You can just grab a .apk file with your browser and install it like you would a .exe file on Windows. iOS on the other hand historically required a jailbreak for this. I think that's where the confusion started. Android doesn't need a jailbreak, it doesn't need root (privileges), it doesn't need a custom ROM. You can just install stuff, it's normal. I think iOS users don't realize how different Android is and they just start repeating words like sideload and root without knowing what they mean, assuming it's just Android-speak for a jailbreak. They don't realize there's no jail in the first place. I am aware English is a living language, and if enough people are wrong for long enough, they stop being wrong, but it's certainly painful to witness.
  - ptx 1y ago
    I always used "adb install" to install programs on my phone from my PC. I never heard of the "adb sideload" command, but my search results [1][2] indicate that the second command is for installing things from the recovery mode, when you don't have the full Android system running. So "install" is the command for installing programs under normal circumstances using the Android installer. [1] https://android.stackexchange.com/a/84248 https://android.stackexchange.com/a/84248 [2] https://www.androidauthority.com/how-to-use-adb-android-3260397/ https://www.androidauthority.com/how-to-use-adb-android-3260...
pjmlp 1y ago
PC only turned out open, because IBM never saw it coming, and when they tried to get control back it was too late.
- pjerem 1y ago
  Yep. PC openness is totaly a bug and not a feature of the capitalism. We should cherish this situation and fight for it because it really feels like the other long term alternative is techno-fascism.
thrance 1y ago
I'm all for calling out fascist behavior when it is spotted, but let's not muddy the waters further. This word is already denatured enough. This is not fascism, this is just a rational move from Google in a market economy. It feels like every time something like this happens, Americans rediscover what capitalism is and implies, then blame it on "human nature", "greed" or "fascism".
- rchaud 1y ago
  Google's stated reason for doing this says nothing about it being for market reasons, but rather for "security".
  - thrance 1y ago
    As they always do, you should know better than to buy it.
- fsflover 1y ago
  > This is not fascism, this is just a rational move from Google Google is not very separable from the US government, and they use illegal monopoly everywhere without any oversight.
selfmodruntime 1y ago
One day people on the internet will learn what the term „fascism“ entails. This is just plain old government overreach.
- tremon 1y ago
  "Government overreach" by a private corporation? Let's see what wikipedia has to say about that: > A fascist corporation can be defined as a government-directed confederation of employers and employees unions, with the aim of overseeing production in a comprehensive manner. https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatism https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatis... Google goes even further than that: they do not only control and oversee all production via the Play Store, they also control all usage of their products. And while it may currently not be government-directed, they certainly are government-protected as long as they're allowed to run the only app store in town.
maxlin 1y ago
I'm absolutely against this and for similar reasons have boycotted Apple for my entire life on hard ideological grounds, but not everything is "fascist" lol. Don't misuse the term. In any case, I hope this blows up in Google's face hard, ROMs like LineageOS become as popular they were back in their heyday, and root hiders get extra attention too so banking apps etc work seamlessly as on non-rooted phones. Requiring some developer ID crap is essentially as bad as Apple has it, reason for which I've always considered developers having Apple phones quite unserious.
- JeremyNT 1y ago
  They're not going to publish device trees for pixel phones, so what hardware will you use? Commercial apps and services will require passkeys and device attestation, so you'll only be able to use open source software even if you have a device to run it. The walls are closing in, and it's not just mobile. It's only a matter of time before passkeys are used to block Linux users from the commercial Internet as well.
  - maxlin 1y ago
    I did manage to run banking apps, and after some work, even Fortnite just for principle (they had a crazy anti hacking system) on my rooted Oneplus 7 Pro. I do want to believe if there's a will there's a way. Google has really overstepped here.
deleted 1y ago
[deleted]

pastage 1y ago

So no F-Droid?

sdex 1y ago
Fdroid signs builds with own key, so it shouldn't be a problem if they pass this verification.
- BrenBarn 1y ago
  It won't be a problem. . . until Google revokes their accreditation for some reason they won't explain.
- mzajc 1y ago
  As far as I understand, verification is tied to the package name (or at least the prefix). Since F-Droid packages thousands of applications from different developers, I don't see how they could reasonably get verified.

charcircuit 1y ago

[flagged]

extropic-engine 1y ago
It is if the laws are fascist. Which is currently the case, and is the example given in the article.
userbinator 1y ago
"If you outlaw freedom, only outlaws will have freedom."
- latentsea 1y ago
  Until they get caught.
XorNot 1y ago
I mean this is also an enormous problem for nations which would like to provide intelligence capability to their agents. A special carve out for anonymous apps only for people with government connections doesn't help because it fingerprints the operative. Tor was originally a deniable communications tool.
yellow_lead 1y ago
ICEBlock isn't illegal.
realusername 1y ago
I don't see why Google would be considered a trusted party to judge that in the first place. Regardless of what they think about this app.
47282847 1y ago
History has shown time and time again that it is dangerous to centralize power into the hands of few. A lot of mechanisms have been invented and subsequently dismantled again in attempts to protect us from this. Fascism is real.
1y ago

userbinator 1y ago

This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile. "debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read, 1997

sliken 1y ago
Great justification for switching to Graphene OS, more secure, more control, and google has to ask permission to install things and the play store is optional.
- fsflover 1y ago
  Unless you're against giving your money to Google and depending on their hardware and software.
raverbashing 1y ago
Stallman's fallacy is thinking every system is perfect and unbreakable and that people have a perfect understanding of software and systems (for better or for worse) People will be running pirated debugger copies if that comes to shove 99.9% of people DNGAF about OSS. They do care about doing what they need on their phone without malware/bloatware/nagware Also publishing and development are separate activities
- superkuh 1y ago
  Your fallacy is thinking that authoritarian governments care about enforcement or successful enforcement of such laws. The goal is to create a status quo in which all citizens break many laws daily and so are already guilty if they ever rock the boat and disturb those in power. Stallman's "Right to Read" is an accurate reflection of reality in that sense.
- 01HNNWZ0MV43FF 1y ago
  Yeah and people had gay sex when it was illegal but it still is a shameful injustice for the government to decide what software I run on my own hardware

whs 1y ago

I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block that. So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done. I suppose this will be how we'll use F-Droid in the next year for enthusiasts.

cuu508 1y ago
Perhaps using the bank's website is an option? I don't have a banking app installed on my phone. When I need to make a bank transfer I sit down at the computer.
- pmontra 1y ago
  Not the parent poster but my bank uses its own mobile app for 2FA. No app, no website.
  - cuu508 1y ago
    Perhaps there's another bank you can switch to? Here we have a few mobile-only banks, but traditional banks with websites and physical MFA devices as an option too.
    - ninjin 1y ago
      Sadly, traditional banks are very eager to get rid of dedicated multi-factor devices in favour of their own mobile applications. I have seen strong encouragement via nagging and some going so far as to start charging for physical multi-factor authentication devices. Likely this gives them another way to milk information out of you, push their marketing onto to you, and saves them from having to manage physical devices. The obvious downside is of course a degradation in security and further cementing the duopoly and more or less forced participation in it that we as citizens have to endure.

swe_dima 1y ago

There goes one of the main arguments why I've been using Android over iPhone

Disposal8433 1y ago
I also remember the early war between Androids and the iPhone. The main argument was that you don't need Google's permission to run applications.
- silverliver 1y ago
  Can Google be sued for misleading and defrauding phone owners?
bambax 1y ago
Yes, and that may be something Google does care about in the end. If Android becomes as closed and as controlled as iOS, why Android??
- pjmlp 1y ago
  Because most of us live in countries where an iPhone is two months salary at least, or a contract bound to several years before it can be cancelled, while Android is usually half of that, with the freedom of pre-pay.
bigstrat2003 1y ago
If anything, this is even worse than what Apple does. iPhone users frequently argue that the inability to install arbitrary software is a feature in their eyes, one of the things that attracts them to the platform. I disagree with their argument, but in fairness I must admit Apple has never pretended that an iPhone is a device you control. They have always been very up front that it is a curated experience, their way or the highway. It's distasteful to me but they're honest about it. What Google is doing is a bait and switch to so many users who chose their platform specifically because it was open.

self_awareness 1y ago

I'm a nobody, but let me answer these questions in 60 seconds. 1: None, no anonymous accounts allowed. 2: None. Civil what?. 3: It's the Google's company policy, don't use our products if you don't agree to it. 4: If devs write apps for this nearly impossible to develop Mac AppStore ecosystem, I don't see even a slightest problem here. 5: Just change package IDs. Thank you for listening, see you again next time.

melagonster 1y ago
Do you work for Google?
- self_awareness 1y ago
  No, but I was a developer of an app for iPhone, so I know the thought process.

pixelii 1y ago

It must be left up to the device owner to decide if they want to have side loading app of unverified developer disabled or not. Period. There is nothing more to it. If there can be setting on phone to unlock bootloader, then there can also be a setting for this.

qalmakka 1y ago

This is intolerable. You own the device. You must be able to run whatever you want on it. Locking or limiting your access to the stuff you bought is not only unacceptable, it's basically like saying you don't really own anything. You're basically leasing a device until the OEM decides you can't run anything on it anymore. Would people accept if a car manufacturer prohibited you from driving their cars in certain places?

p0w3n3d 1y ago
Meanwhile: VW is already limiting horsepower when the yearly subscription is ceased to be paid It's already happening. The greediness of vendors, the ignorance of users...
- generic92034 1y ago
  Do not forget the inaction and/or corruption of lawmakers.
  - lioeters 1y ago
    Now is a time in history where any corporation worth its ill-gotten billions should take advantage of the government's whole-hearted encouragement to push through anti-competitve and anti-consumer decisions to dominate the market and the public.
- AnonymousPlanet 1y ago
  Back in the 90s Sun sold you computers with X amount of space. There was an option to upgrade. If you took it, they sent a technician around to do the upgrade. All they did was making the already existing space available. Sun always sold hardware with all the space installed but gave you only what you paid for.
  - p0w3n3d 1y ago
    I wonder if such actions can become a reason for persecution. Let me make an allegory: if I sold someone thing that is designed to break on purpose, and then requested pay for fixing it, it would be a felony. Why the remote downgrading is not considered a felony?

llamavore 1y ago

Maybe we can finally spark an omarchy style user driven linux mobile OS ala DHH? Or are users just going to face network bans and additional tracking like with grapheneos?

microtonal 1y ago
Omarchy is just a set of defaults for an existing software stack. The problems here are at a much more fundamental level: getting devices that can be unlocked, getting device drivers/firmware that are also updated on a regular basis, supporting hardware attestation and getting app makers to support it without Google's support (assuming an Android compatibility layer), getting a healthy app ecosystem (if there is no Android compatibility layer). Currently probably the best route is basing the OS on Android (so that you can benefit from all the existing apps), making a non-hostile reference device, and getting regulators' attention (the EU is probably the most likely to succeed) to break Google's monopoly on attestation. This is largely what GrapheneOS is currently trying. I think what we can do as users is install GrapheneOS with sandboxed Google Play and for any apps that do not work, contact their developers. If GrapheneOS manages to get millions of users and get on the radar of app developers, that's the best shot I think. But it feels like the window is closing quickly. So if you care at all about any of this, today is the day to get a GrapheneOS device and make yourself heard.

deleted 1y ago

[deleted]

itake 1y ago

While I am against the policy, Google only publishes developer's full legal name and email address if the app is monetized [0]. If the app is monetized, then the full mailing address is shared. If money is involved, it’s fair for users to know who they’re dealing with. Developers who want to hide their personal identity can still do so legally with a shell company. Taking it a step further, if I am going to run your code on my device, I want to know who I'm giving access to my data/cpu/hardware. Just like with offline transactions, customers should know who they are giving money to. ---- > Google will display your legal name, your country (as per your legal address) and developer email address on Google Play. If you decide to monetise on Google Play, then Google will display your full address. [0] - https://support.google.com/googleplay/android-developer/answer/13628312?hl=en-GB https://support.google.com/googleplay/android-developer/answ...

quikoa 1y ago
Small developers need to be easy to contact. Meanwhile Google is notorious for being difficult to get human support. Seems fair.
dns_snek 1y ago
All of those are fine things to expect from Google Play but the point is moot because this verification would also apply to apps installed from external sources where they shouldn't have any jurisdiction. Google, just like Apple, should be free to enforce any kind of verification they deems necessary on Google Play, as long as they allow third party stores to be on equal footing, which they don't.
- itake 1y ago
  I agree. we should be able to install apps we want to install. But if you're installing them from the Google Play store (which is what is discussed) then you should be allowed to know who you're doing business with.
  - dns_snek 1y ago
    > But if you're installing them from the Google Play store (which is what is discussed) Maybe there's been a miscommunication somewhere but Android Developer Verification (what this thread is about) applies to all apps, even those installed outside of Google Play store.

BrenBarn 1y ago

Those questions may make some users uncomfortable, but it's wishful thinking to believe they would make Google uncomfortable. Google doesn't care in the slightest about these issues.

n4r9 1y ago
Agreed. PR departments are paid specifically to weasel around questions like this. If anything, it's in Google's interests because it gives them something to claim they're cooperating with.

beardyw 1y ago

I know I risk being down voted remorselessly but I have to put this in context. Where in the real world is anonymity considered ok? If I only put a flyer through someone's letterbox here in the UK, I have to identify myself. If I sell a physical product I not only have to identify myself but take on serious legal liability. An author can take on a pseudonym but only via an identified publisher. In fact that latter example might provide a solution. Set up a company willing to publish apps whilst hiding the actual developer's identity.

johnnyfaehell 1y ago
The thing is that so many people are used to doing whatever they want from behind the safety of their screen and are now able to do a lot of things they don’t want anyone to know about. Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world. And I think a lot of people are scared of not being able to do what they used to or being found out for doing it. Plus, and doing what you suggest but in a country where board directors don’t need to be public really solves it.
- Perz1val 1y ago
  Yea, cus when I write a fanfic I should show my id to the company that owns the printer I purchased and own, before I print out a copy to give for my friend, ffs. Does that analogy make sense to you?
  - johnnyfaehell 1y ago
    No because you purposefully crafted one that is not BB anywhere near similar to what was being discussed. Being obtuse generally means you’re wrong and know it but don’t like the truth.
- Hizonner 1y ago
  > Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world. Your concept of "common sense" is repulsive, as is your submissive attitude.

morpheuskafka 1y ago

Presumably this won't apply to Chinese OEMs, since even though their devices do ship a disabled by default Google Mobile Services (without the user facing Play Store APK), it obviously would not be suitable to require Google involvement for developing internal apps. The OEMs could set up such a debug licensing service themselves, but each of them would have to do it themselves, and then it would be impossible to debug Google-based apps on the devices.

xyzal 1y ago
Many Chinese OEMs are not Google certified, so it won't for sure apply to them. Some (Huawei) even had to implement their own app store and replacement for Google services. They are basically de-googled devices, though, sadly, often loaded with spyware from the other camp.
- morpheuskafka 1y ago
  But some, like Oppo and Vivo are--they ship with a Google-OKed copy of GMS, and redistribute the Play Store on their own app store as a way to install it (ostensibly for use when traveling outside the mainland, though it can also be used with a VPN). So clearly they are on some level Google certified. However, they also contain switches to disable background GMS, which makes them almost de-googled. All of them, not just Huawei, have their own app store/updater, and have some sort of push notification to replace Firebase Cloud Messaging (as I understand, Tencent provides a one touch service so devs don't need to hardcode each OEMs notifications). Otherwise, it would be impossible to get apps or notifications without a VPN/proxy.

m00dy 1y ago

This is the most terrible thing that I read in this year.

casenmgreen 1y ago

Individual privacy and anonymity matter substantially less when Governments are basically decent and play by the rules, and so it seems there is a tendency to value convenience and utility over privacy and anonymity. When Government goes bad, suddenly we are faced with the utmost need for privacy and anonymity, but we may by then be in a situation where privacy and anonymity are difficult to obtain, with all the consequences that then flow from that.

Hizonner 1y ago
Yeah, that's what a lot of us have been saying for decades. But notice that Google is doing this as the government in its home country is going bad (or at least getting dramatically, qualitatively worse than it has already been). Some people see features where others see bugs.

supermatt 1y ago

They know the days of the app-store monopolies are ending so they are now implementing apple-style notarisation - which they could have done years ago, but never seemed to need to until now... IMHO, thats is them still having an unfair control over the android market so the EU will come for them eventually - and no doubt they will implement some other devious bullshit. Ideally the world will wake up and realise multi-sector megacorps simply should not exist and split them all up accordingly - but I'm not holding my breath.

tommica 1y ago

Very good questions, and hope that they can get answers to them.

nolist_policy 1y ago

Did you actually reach out to Google?

TheChaplain 1y ago
Trying to get hold of the correct person to get proper answers is a bit harder than you think.
- self_awareness 1y ago
  The hard part is who does it, not that the process is complicated. If you have an influenctial social account with lots of followers, Google reaches out to you. They only react if something has a potential to hit their PR. So in order to get in contact with Google, you reach out to influencers, not Google itself.

kstenerud 1y ago

I wonder if this would give Epic cause against Google? https://en.wikipedia.org/wiki/Epic_Games_v._Apple https://en.wikipedia.org/wiki/Epic_Games_v._Apple If Google controls verification, then Google - not Epic - controls who can distribute Android apps on the Epic store.

Andrex 1y ago
That case is why I don't think Google will actually roll this out in the US (and the EU for different reasons). But I was wrong about them even ever attempting something like this so who knows.

eviks 1y ago

> To Google, these questions might be uncomfortable. Not really, there is no discomfort from something they can easily ignore.

akomtu 1y ago

I'd guess that the main reason Googel has done this is to prevent side-loading of messenger apps, such as Signal, with true end-to-end encryption. Such messengers would be very difficult to surveil at scale. You might ask why not to simply install these apps from Play Store? The reason is Google demands signing keys for all apps, so it can impersonate the developer, inject any spyware, rebuild the app, sign it and make it look untampered. Side-loading bypasses this entirely.

blueg3 1y ago
Google doesn't demand your signing keys, and transforming your app in that way is easily detectable by the developer.

notpushkin 1y ago

There’s a feedback form, in case anybody wants to tell Google what they think about all this: https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITkdzMxv81rJDEGGjO-UIDDY28Rz_GEVA/viewform https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk... Discussion: https://news.ycombinator.com/item?id=45030967 https://news.ycombinator.com/item?id=45030967

Varelion 1y ago

Android is no longer open-source, with a move like this. In the past few years, it has become obscene how emboldened the corpos have gotten with how far they are willing to push to mine every last crumb of data, eager to sell it to dangerous government bodies.

curt15 1y ago

>The developer of ICEBlock disclosed his identity. In addition to receiving threats of federal prosecution over the app, the developer has faced other backlash, including his wife being fired from a federal government job. This is the sort of thug behavior you see in CCP China. If the govt can't directly detain overseas dissidents or other "undesirables", it goes after their families back in the mainland.