4 ms·
Can someone articulate for me why everyone seems to be opposed to this? You can sideload apps on non-google-certified android builds/installs just fine right?
by notepad0x90 1y ago
Can someone articulate for me why everyone seems to be opposed to this?
You can sideload apps on non-google-certified android builds/installs just fine right? If you're going to publish an app that literally be installed on billions of devices, is this not a sensible measure? Long overdue even? Why isn't Windows and Linux distros enforcing this as well is my question!
Do you guys understand that people's lives are being ruined by malware? and the most popular way of deploying malware on the most popular platform (android) is sideloading apps!
This is a similar situation as "Freedom of speech isn't freedom of reach". You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).
I get a petition to allow alternative attestation and verification authorities. and honestly, I don't think Alphabet has much choice on that given EU and US anti-trust policies. I can't image the EU being ok with a US company collecting the IDs of all its developers.
For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example. And that has dramatically reduced rootkit abuse on the platform. Don't get me wrong, I also don't want to submit my ID to anyone. But this is a very sensible measure, one that will improve security in measurable and significant ways to millions of regular people.
- moi2388 1y agoCompany details, sure. But personal details?!
- janice1999 1y ago> You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones). This is about users freedom to install apps on the devices they own. > non-google-certified android builds/installs Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder). > Do you guys understand that people's lives are being ruined by malware? Do you have figures to back that up? There are already multiple warnings when sideload apps. > For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example. Drivers and applications are not the same things.
- notepad0x90 1y agoI don't have figures to back that up, but I did read some figures on posts regarding this. my comment was based on real-life compromises observed. Drivers and applications are not the same thing, certainly and no application is the same as other applications. browsers aren't the same as file managers. To users what matters is impact not category. A persons entire life can be destroyed because of one side-loaded app, much less so with a windows rootkit (because you don't have phone number/2fa app,etc.. on your windows box). Users are free to buy devices that let them install any app. Google is responsible for the majority of users who don't care about installing apps from anonymous randos, but care much much more about their livelihoods and well being suffering at the hands of criminals! > Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder). Ok, then let's talk about that, I'm all for sticking it to Google for all that b.s., but not for the topic at hand.
- drewbitt 1y agoI have a lot of third party apps and none of them are by 'anonymous' developers. Presenting the situation as if everyone is exposed to 'anonymous' apps and Google is here to save you is misleading and fear‑mongering.
- notepad0x90 1y agoThen what's the problem here? If they're not anonymous, what do they lose that's so valuable that it is worth endangering the unsuspecting public over?
- ulrikrasmussen 1y agoIt really, really sucks to be tricked into installing malware, and I have sympathy for the victims. But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified. We just have to educate people better about how to protect themselves online, not resort to paternalistic control regimes which just happens to give one of the largest tech giants the power to also crush anything that it sees as a threat to their business model.
- notepad0x90 1y ago> But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified. Maybe that's the disconnect here, because i don't think you/others lack empathy for regular people being victimized. You're incorrect about that figure, the people being actually impacted (not merely compromised but harmed, as in financial loss, job loss, harassment, or worse) is many times more than people who want to sideload apps. Educating people doesn't work. We've been doing it with phishing for decades now , and it has no impact. in the moment, you're sure it's legitimate, so you won't look for obvious signs of phishiness.They use a lure to establish trust in the context, so you guards are down. Absolutely anyone can fall for deceptive lures. No amount of education changes that. You know what made a difference with phishing? Trust senders, DKIM/SPF validation, url-rewriting with sandbox detonation and global-scale reputation analysis/response (it means as soon as you hit one person, your domain/infra gets burned globally) ,etc.. It really frustrates me to no end, because it is the exact audience on HN that innovate and create software/apps but the level of ignorance on this subject is atrocious. I know you guys care as much as I do when people get hurt! It's just a case of knowing a lot about one domain and assuming you also know a lot about a related domain I think.
- ulrikrasmussen 1y agoEven if I'm in the minority it still doesn't justify it. I'm sorry, it sucks, but I don't hold this position because I lack knowledge, I hold it because I think giving up freedom to control our own devices is too much, even if it means people will get hurt. I also perfectly understand how cameras in every home will prevent so much domestic abuse and crime, but I am still against it. Not because I don't understand how many people are victim to these things, but because I think the intrusion on ME is too much.
- loandbehold 1y agoI agree, people here have no empathy to less technical users. Peoples' lives being ruined is not a hyperbole. You have people losing their life savings due to pig-butchering scams and such. And people here think their convenience and desire to publish apps anonymously outweighs this?
- scheeseman486 1y agoIt's less about saving the concept of anonymous development, more about the tightening grip that the big three companies, Apple, Google and Microsoft (they're making their own moves in the same direction) have on home and personal computing. We would be giving up a lot; this would effectively kill any open source computing products from ever becoming viable. Platforms become fiefdoms, they become shit to use because there's no other choice and can never be. Any app that runs counter to the desires of the parent of the platform can be killed and it becomes impossible to build a competitive ecosystem because the chicken & egg software problem, something which open ecosystems can solve through compatibility laters, but that becomes unviable thanks to DRM and hardware integrity lockouts. It's a nightmare scenario, our lives locked in to total corporate control. What do we get in return for that? Scammers won't be stopped by this, the key to grifting isn't technology but people. What you're suggesting is trading open platforms and open source and fortifying current marketplace monopolies for a marginal decrease in scams. For a while. Maybe. I suggest that is unbelievably stupid.
- loandbehold 1y agoHow does it kill open source products? The only thing required is for open source contributor who is responsible for publishing .apk to present their ID.
- beeflet 1y agoYou are requiring users to submit their ID to the government whenever they want to modify a program
- scheeseman486 1y ago
- gitaarik 1y agoYeah, and then we should also maybe install spyware on everybody's phones, so the government can scan our phones for child porn, because people are using phones to share child porn you know, and that is bad you know. And if we're at it, we should maybe also put camera's and microphones in everybody's houses so we can see what everyone's doing all the time, because many children are being hurt in houses you know. But don't worry, if you don't want all of this you can just get this degoogled phone just around the corner and it works perfect you know, because everybody is using them and there's a big market for it and it's very easy to use. Or maybe not
- notepad0x90 1y agoI can't tell if your argument is a slipper-slope fallacy or a straw-man argument, has to be one or both. When you sell physical goods, you have to have a business license right? To a small group of people you know, nobody cares. But to mass market goods or services, you need to give the government your id, and they need to be able to hold you accountable, in the event you decide to break the law and/or harm the public. I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers. Although, they sort of already verify identify, just not using a formal/official way. You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege. You can speak with a loud microrphone in public anonymously, but if you want to arrange a protest, you must give your id for the approval. If you want to start a radio or tv station, you must give up your id for the FCC license,etc... software isn't special.
- beeflet 1y agoNot all software is sold as part of a business. Free software is one such example. So this comparison is inappropriate. >I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers. There should be massive burdens and surveillance on linux and free software maintainers, because ???. I guess it's just too easy for them, so they should be shoeboxed into a business model for developing software whether they like it or not. >You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege. This is just some nonsense platitude, not unlike the canadian idea of "freedom of expression". "You have the right to a completely weak and useless form of speech because I say so" >but if you want to arrange a protest, you must give your id for the approval. What are you yapping about old man? We have the right to assemble. There is limited radio and TV is regulated only because there is limited bandwidth. Software is special because it is just information and Information Wants To Be Free. You are making the argument here that because some old forms of information distribution are regulated due to technical restraints, that all forms of information should be highly regulated. Software is just information, as I stated earlier. It could be encoded into any information medium, for example a book. So why not regulate software in the same way that books are regulated, which provides strong free speech protections?
- throw_me_uwu 1y agoRequiring ID won't stop scams. Often bank scams rely on sending money to another account (obviously registered with an ID), and then being drained at ATM. The account is going to be registered on a drop or another victim. Sure, it's burned after that, but as long as it's an insignificant cost, scamming is still profitable. The same situation with malware, bad actors are incentivized to put effort into bypassing this, so dev accounts will be registered on random homeless people, stolen IDs, or just fake IDs. While normal developers will choose to give away IDs. And as always, it starts with 'protect the children/elderly/vulnerable', then that authoritarian country requires Google to give away info on every developer to operate legally, then it's UK and other 'democracies', then you can't run your code on your device without the government approval.