7 ms·

"sideloading" connotates something that is negative. On systems before apple's locked-down iphone, it was just called "installing". The PC revolution started

• pjmlp 1y ago
  Which is why alongside freedom came the business of anti-virus.
  • wiseowise 1y ago
    Never in 20 years of using Linux/Macs I’ve ever needed anti-virus.
    • charcircuit 1y ago
      You have been lucky. It's trivial for someone to write a stealer and trick someone to run it. For example there's been stealers targeting Linux built into trojans of Minecraft mods.
      • aquariusDue 1y ago
        As another lucky soul do you happen to know of a case documented somewhere?
        • charcircuit 1y ago
          For example. https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool https://support.curseforge.com/en/support/solutions/articles...
          • aquariusDue 1y ago
            That is wild, the numbers are much bigger than I expected. Thanks for sharing!
    • pjmlp 1y ago
      Many people also never need insurances, until they do. How is that curl https://... | sudo sh going?
      • saagarjha 1y ago
        Given its prevalence, I think it's actually going surprisingly well
        • mike_hearn 1y ago
          Only if you ignore the "npm install" or "pip install" moral equivalent. Free open source packages that come with a side helping of malware have become common in recent years.
          • saagarjha 1y ago
            Oh I included that I just think that statically things are mostly going fine (unless we are all secretly backdoored in a way that has yet to be made public).
    • mike_hearn 1y ago
      Macs come with an Apple provided antivirus built in, it's called XProtect. Apple also has enforced a similar policy to what Google is doing, but much stricter, and has done for ~13 years or so (devs must be identified, the OS rejects unsigned code in all territories by default, Apple pre-approves all binaries even outside the app store). Linux distros have policies far more extreme than anything Google, Apple or Microsoft have ever done. They explicitly don't support installing any software not provided by their "app stores". Getting into those requires giving up your source code to them, and they reserve the right to modify it as they see fit without informing anyone, reject it for any reason or no reason at all (including reasons like "we don't have time"), and they tie getting new releases of your app to the user upgrading to new releases of the OS. If you do try and install stuff from outside of your distribution, not only are there security warnings to click through but an expected outcome is that the OS breaks and the vendor washes their hands of you. Despite those policies, or perhaps because of them, botnets of Linux servers are common. Of all consumer-facing platforms only Windows and Android allow installation of unsigned third party code out of the box via some obvious graphical path. And on Windows that right is somewhat theoretical. You can do it but the built in browser will try very hard to stop you, and the OS itself will happily break unsigned code by blocking file open syscalls heuristically. So in practice most apps don't go the unsigned route. On Android OTOH, unsigned (non ID verified) code is sandboxed and works just like regular apps after installation, the OS won't heuristically interfere with the app.
      • BLKNSLVR 1y ago
        That's an interesting take on Linux. I see it as a lot closer to what Windows programs were like back in the day, where you can install whatever you want. Linux distributions each have their built in package managers, but there's no 'policy', as I understand it, that prevents installation of, literally, whatever you want. It's generally more difficult than just downloading and double clicking on the installer / exe, but just follow the instructions and it's done. And, yes, also there are weird version and dependency issues that crop up more than would be ideal, but that's not the topic.
        • mike_hearn 1y ago
    • zeta0134 1y ago
      Never in those 20 years did I need one on Windows either. It turns out if you vet the software you install in the first place, malware is pretty rare. That isn't the bar for most regular users of software though. Working in retail tech support, we got folks bringing in their new macbooks, freshly ruined by new ransomware, utterly baffled that it was possible at all. But when you're trying to use Photoshop without paying... well, shady stuff's still out there.
      • lukan 1y ago
        But you also browse the web. Running lots of unvetted software. All safe, as long as the sandbox holds.
    • scarface_74 1y ago
      And the other 80%+ of the population that uses Windows?
    • thebruce87m 1y ago
      I’ve never needed the seatbelt in my car or the airbags but I will not be uninstalling them.
    • BLKNSLVR 1y ago
      Same with me for Linux, but I would also say that, with the discipline and knowledge I have had for the last 10-15 years I probably wouldn't need anti-virus for Windows either.
      • thebruce87m 1y ago
        Discipline and knowledge cannot protect against 0-click attacks.
        • rcxdude 1y ago
          antivirus won't generally do much for those either.
          • thebruce87m 1y ago
            If your system is infected you may know after the fact, which is better than never knowing.
  • sunaookami 1y ago
    And people were successfully tricked into "needing" anti virus scanners that do more harm then good.
    • mike_hearn 1y ago
      Anti-virus apps aren't actually useless. They are slow, inefficient, have bad false positive and negative rates, but they aren't useless. I know it's an unpopular opinion but most HN posters have never been on the other side of this stuff. Many moons ago I attended an internal tech talk by the Google security team. This was shortly after they got hacked by China around 2010 or so. The talk was a general one on what they were doing to boost the security posture in general. Number one thing they were doing was moving away from AV scanners on Windows to a regime in which IT would centrally whitelist all apps by signature or EXE/DLL hashes. Beyond the issue of false negatives, the reason was that people would routinely install malware infected software despite being told by the AV scanner that it was infected. They'd be told that and they'd just override it. Nearly always the reason was that they were installing pirated software and wanted it badly enough that they either didn't care that it was virus infected, or they talked themselves into believing a conspiracy theory in which AV companies reported false positives to try and discourage piracy. The other problem with AV was that it reported true positives centrally, but then they'd be coming from high level executives and there'd be problems with addressing the issue. Whereas in a whitelisting scheme said executive would have to file a ticket to request permission to install the malware-ridden pirated Photoshop or whatever, and they wouldn't do it. This was very sad and I don't know if they kept it up, that sort of thing is terribly high maintenance and it wouldn't be a surprise if they moved away from it at some point. But when your biggest problem is AV that is accurate but ignored and that's inside one of the world's most sophisticated tech companies, it's fair to say AV is not useless but if anything needs to be even stricter.
      • LoganDark 1y ago
        > or they talked themselves into believing a conspiracy theory in which AV companies reported false positives to try and discourage piracy. To be fair, pirated software often uses obfuscation techniques similar to malware, and then it's more like antivirus vendors refusing to add an exception for pirated software, rather than antivirus vendors specifically seeking out pirated software to mark as malware. Also: Certain types of scripts and software that I use to configure Windows in unsupported ways are detected as malware by major scanners. While I'm sure someone wouldn't appreciate these scripts being used on their computer by surprise, when I use them intentionally, I want their effects.
  • _Algernon_ 1y ago
    As a consequence of the freedom of driving cars we got seat belts. But we did not prevent everyone from driving.
    • pjmlp 1y ago
      We certainly did, those that fail to obey following the rules, besides the monetary expenses, given enough points they either lose their license or are given some months on a tiny room to think about their life decisions.
• gblargg 1y ago
  Sideloading sounds like sidestepping (synonyms: circumventing, avoiding, evading, bypassing, ignoring, dodging, escaping, skirting). I wonder if the term originated on iOS, where you did have to circumvent things to install programs manually.
  • toast0 1y ago
    Probably on the N-Gage, where you did would side-talk and so side-loading was the next thing to do :p But the terminology did seem to spring up with iOS. It makes sense to call it that there. But on a platform that allows it, it's just installing.
    • extra88 1y ago
      I think side-loading is meant to be a third option between downloading and uploading. I think it was installation from a flash drive/card connected to the device.
• bluesign 1y ago
  If you consider developer has the right to determine who runs their software, it is actually. My last 10 apk installs: - 9 apps not available in the local store - 1 app I changed some setting in the manifest For less technical people it will also include some shady apk's for example promising free La Liga match broadcast but then scraping everything from phone.
  • tdeck 1y ago
    I've found myself having to sideload more apps in Android lately, simply because they didn't update and were removed by Google from the Play Store. Great apps that worked for years and did what I needed them to do are now no longer good enough because the developer didn't choose to stay on a ridiculous treadmill.
  • fruitworks 1y ago
    The developer does not have the right to determine who runs their software
• scarface_74 1y ago
  Yes and called viruses, dozens of toolbars on your computer, key loggers, malware, ransomware, etc. If you want an open phone, buy one. But I instruct all of the older members of my family to buy iPhones and iPads. I’ve been programming computers since 1986 and even I have never said it would be cool to side load on my phone.
  • andrepd 1y ago
    > If you want an open phone, buy one. Is this a joke? The reason for TFA is precisely that this is quickly becoming impossible as Google closes down Android. It's already viciously impractical to install a privacy respecting OS like Lineage or Graphene, and now they're coming for the very possibility of installing software.
    • scarface_74 1y ago
      Is viciously impractical yet people on HN brag about doing it all the time?
      • SXX 1y ago
        5 years ago you could install custom rom and still use 99% of apps with it. Now with Google "safety" and "certification" features you won't be able to use most of financial apps and a lot of non financial apps too. Obviously there no way on earth Google will allow you to decide whatever device you own is "safe". There is still ways to bypass it using kernel hacks, but it's both cat and mouse game and often not very trustworthy since a lot of software used to bypass safetynet is proprietary. So yep, using custom OS on your phone is impractical because Google made it so.
        • scarface_74 1y ago
          And people keep saying this - what financial services companies are inaccessible via a web browser? And if they do exist, why do you choose such a bank? I’ve heard people say Monzo in the UK. But there are plenty of banks in the UK you can choose from in the UK that have websites
• mystraline 1y ago
  1. I buy computer hardware, like an iPhone 2. I try to install my own software. 3. I'm prevented in installing my software on my device without "permission" from manufacturer. 4. Therefore, I do not own said hardware; manufacturer still does. 5. Therefore this is a indefinite rental instead of a sale. 6. I was defrauded with a fake sale, and Apple is defrauding IRS by not being properly taxed over millions of rental units (phones, tablets)
  • john-h-k 1y ago
    If this is true, why doesn’t someone sue and make an absolute huge amount of money?
    • tomkarho 1y ago
      There was a class action suit against Sony over preventing PS3 users from installing Linux on their consoles. I think it ended in Sony losing and having to pay reparations. Whether it was a "huge amount" is subject to debate.
      • b112 1y ago
        Yes, but fheg advertised this feature pre-sale, and took it away later. So Apple has never allowed sideloading. Google however? Well if an update breaks that, it would be the same thing sort of.
        • tomkarho 1y ago
          Isn't Google kind of doing something to that ilk rn?
          • b112 1y ago
            And that's where class action stuff happens, just like with Sony.
  • an0malous 1y ago
• salawat 1y ago
  No it doesn't, it just connotes not using the "integrated with the OS" install path. There has been a big push to differentiate "developers" from "users" in general, and that is co-opted in a corporate environment to try to restrict the "user" layer while only parceling out the ability to really leverage the system to those deemed "blessed".
• Animats 1y ago
  > On systems before apple's locked-down iphone, it was just called "installing". If the phone people could make a solid permissions system, this wouldn't be a problem. Applications should by default be able to read their own install files, and have dedicated directories for their local storage, caches, and such. They can make network connections to their home site, if the user allows it. That's all they get. This covers most games. What else does it cover?
  • MrDrMcCoy 1y ago
    That would cover almost every app that doesn't need camera, microphone, or GPS access to work. GPS access infuriates me, because so many lazy developers either don't allow the app to run without it, or never test it, so searching by zip code never works.
    • deleted 1y ago
      [deleted]
• stuaxo 1y ago
  Indeed, and some of those bits of hardware were phones.
• hulitu 1y ago
  > You cannot install a firewall and block arbitrary software on your phone. Why would you block iMessage from running every picture it receives as a zero click exploit ? /s It is for your security. Ahm, and to protect the children.