4 ms·

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw up tons of barriers for every individual app install.

NewJazz 1y ago
If F-Droid is no longer part of the android community, then neither will I. I'm not too worried. My employer should be, though.
andrepd 1y ago
Correct me if I'm wrong but doesn't the EU digital markets act mandate this?
- gumby271 1y ago
  Isn't Apple technically complying with this even while forcing notarization? Seems like Google could get away with the same scheme.
  - gpm 1y ago
    Apple says they are. The EU says they aren't. They're fighting over it.
- advisedwang 1y ago
  EU digital markets mandates that you can install apps through f-droid... but doesn't mandate that those apps don't to comply with Google's signing policy.
tadfisher 1y ago
There's a second path, whereby F-Droid registers as an "alternative app store", which is a new category of app created in the fallout of Epic Games v. Google [0]. This is interesting because it applies to all regions and will necessarily need more elevated permissions than the typical REQUEST_INSTALL_PACKAGES permission used today. No idea what requirements Google will impose on such apps. [0]: https://en.wikipedia.org/wiki/Epic_Games_v._Google https://en.wikipedia.org/wiki/Epic_Games_v._Google
- kragen 1y ago
  What would they have to offer Google in return for being granted this status? Would they have to ban NewPipe, for example?
  - gpm 1y ago
    Up to what a committee of 3 people (or in the alternate district court judge James Donato) believes this means, assuming the judge approves the proposed modification to the injunction in the first place > Google may create reasonable requirements for certification as a Registered App Store, including but not limited to review of the app store by Google’s Android team and the payment of reasonable fees to cover the operational costs associated with the review and certification process. Such fees may not be revenue proportionate. One appointed by Google, one by Epic, one appointed by the other two. All three will be barred from private communications about any of this with any parties. Considering this is an anti-trust suit I suspect the judge would be extremely unamused if the committee members found that "must ban NewPipe" was a reasonable requirement.
    - kragen 1y ago
      That sounds reasonable, but I doubt F-Droid can cough up the required US$1 million to pay 12 Google L7 SWEs to spend a month reviewing F-Droid once they get enough free time. I wonder if they'd require F-Droid to comply with PCI-DSS? That seems to be the trendy thing in review and certification processes, and naturally it's important for an "App Store" to have secure payments, isn't it? (Never mind that F-Droid doesn't accept payment except donations via liberapay.)
- BrenBarn 1y ago
  Yes, that possibility has occurred to me as well, and is potentially a reasonable compromise (depending on those requirements).
AndrewDavis 1y ago
It all depends on how the flow is implemented. If it's a one time unlock, eg like developer mode then hopefully it'll just work. If it's a big long flow per install... Yikes, that's not much better than adb install
sowbug 1y ago
If I were designing the advanced flow, I'd require the decision to be made at phone setup time. Changing your mind later requires a factory reset. Real sideloaders (F-Droid users, etc.) know at setup time that that's how they'll be using their phone, so it works for them. But ordinary users who are targets for sideloading malware will become a lot less attractive if attackers must convince them to wipe their phone to complete the coercive instructions. Aliexpress has a similar approach to protect their accounts from takeovers. If you change or forget your password, all your saved payment methods are erased. This makes the account less valuable to an attacker, at the cost of a little pain to authentic account holders.
- 201984 1y ago
  No, that's ridiculous. If I want to send an app to someone, now they have to wipe their phone to install it? That would kill installing non-Play apps far more than Google's original proposal.
- arcfour 1y ago
  I hadn't installed a non-Play Store app for something like 5 years until this year. I don't see why I should have been forced to factory reset my phone then.
- g-b-r 1y ago
  Great, at phone setup when many people don't know anything about the implications of the choice. And factory reset when it's impossible to backup and restore everything, or anything at all without a Google account
- eviks 1y ago
  But wiping your phone isn't "a little pain"
- archon810 1y ago
  Forgive my bluntness, but I hope you are never allowed on the Android team or near any significant UX decisions on any devices or apps I use or will use.
- 1y ago

NewJazz 1y ago

If F-Droid is no longer part of the android community, then neither will I. I'm not too worried. My employer should be, though.

andrepd 1y ago

Correct me if I'm wrong but doesn't the EU digital markets act mandate this?

gumby271 1y ago
Isn't Apple technically complying with this even while forcing notarization? Seems like Google could get away with the same scheme.
- gpm 1y ago
  Apple says they are. The EU says they aren't. They're fighting over it.
advisedwang 1y ago
EU digital markets mandates that you can install apps through f-droid... but doesn't mandate that those apps don't to comply with Google's signing policy.

tadfisher 1y ago

There's a second path, whereby F-Droid registers as an "alternative app store", which is a new category of app created in the fallout of Epic Games v. Google [0]. This is interesting because it applies to all regions and will necessarily need more elevated permissions than the typical REQUEST_INSTALL_PACKAGES permission used today. No idea what requirements Google will impose on such apps. [0]: https://en.wikipedia.org/wiki/Epic_Games_v._Google https://en.wikipedia.org/wiki/Epic_Games_v._Google

kragen 1y ago
What would they have to offer Google in return for being granted this status? Would they have to ban NewPipe, for example?
- gpm 1y ago
  Up to what a committee of 3 people (or in the alternate district court judge James Donato) believes this means, assuming the judge approves the proposed modification to the injunction in the first place > Google may create reasonable requirements for certification as a Registered App Store, including but not limited to review of the app store by Google’s Android team and the payment of reasonable fees to cover the operational costs associated with the review and certification process. Such fees may not be revenue proportionate. One appointed by Google, one by Epic, one appointed by the other two. All three will be barred from private communications about any of this with any parties. Considering this is an anti-trust suit I suspect the judge would be extremely unamused if the committee members found that "must ban NewPipe" was a reasonable requirement.
  - kragen 1y ago
    That sounds reasonable, but I doubt F-Droid can cough up the required US$1 million to pay 12 Google L7 SWEs to spend a month reviewing F-Droid once they get enough free time. I wonder if they'd require F-Droid to comply with PCI-DSS? That seems to be the trendy thing in review and certification processes, and naturally it's important for an "App Store" to have secure payments, isn't it? (Never mind that F-Droid doesn't accept payment except donations via liberapay.)
BrenBarn 1y ago
Yes, that possibility has occurred to me as well, and is potentially a reasonable compromise (depending on those requirements).

AndrewDavis 1y ago

It all depends on how the flow is implemented. If it's a one time unlock, eg like developer mode then hopefully it'll just work. If it's a big long flow per install... Yikes, that's not much better than adb install

sowbug 1y ago

If I were designing the advanced flow, I'd require the decision to be made at phone setup time. Changing your mind later requires a factory reset. Real sideloaders (F-Droid users, etc.) know at setup time that that's how they'll be using their phone, so it works for them. But ordinary users who are targets for sideloading malware will become a lot less attractive if attackers must convince them to wipe their phone to complete the coercive instructions. Aliexpress has a similar approach to protect their accounts from takeovers. If you change or forget your password, all your saved payment methods are erased. This makes the account less valuable to an attacker, at the cost of a little pain to authentic account holders.

201984 1y ago
No, that's ridiculous. If I want to send an app to someone, now they have to wipe their phone to install it? That would kill installing non-Play apps far more than Google's original proposal.
arcfour 1y ago
I hadn't installed a non-Play Store app for something like 5 years until this year. I don't see why I should have been forced to factory reset my phone then.
g-b-r 1y ago
Great, at phone setup when many people don't know anything about the implications of the choice. And factory reset when it's impossible to backup and restore everything, or anything at all without a Google account
eviks 1y ago
But wiping your phone isn't "a little pain"
archon810 1y ago
Forgive my bluntness, but I hope you are never allowed on the Android team or near any significant UX decisions on any devices or apps I use or will use.
1y ago