7 ms·

Sideloading is a neologism to scare users and lawmakers, it just means "Installing software" and should be a basic right. Also software installation in Android

Sideloading is a neologism to scare users and lawmakers, it just means "Installing software" and should be a basic right. Also software installation in Android has been high friction for a while. Installing an APK on my phone is at least 10 clicks.

B1FIDO 9mo ago
[flagged]
- goldenarm 9mo ago
  That is my own opinion as an Android developer and ex custom ROM maintainer, I've not read that blog post. Instead of ad-hominem, can you explain what do you really disagree on?
  - B1FIDO 9mo ago
    [flagged]
    - goldenarm 9mo ago
      You're infantilising the users. It's untrusted by Google, but it's trusted by myself. I actually trust the Termux and Kodi devs way more than Google, yet they Google has been blocking their updates. Note that the term sideloading is exclusively used by mobile OSes. On Windows MacOS and Linux you can install anything.
      - B1FIDO 9mo ago
        What I'm talking about is actual trust. Like, there are cryptographic measures taken, certificates involved, code signing, that kind of thing. You claim that you "can install anything" on Windows, but that is simply false. The system's Driver Signature Enforcement will prohibit the install of unsigned or invalid signatures on device drivers. Windows SmartScreen will also give you trouble by blocking unsigned apps. So yeah, you can bypass these protective measures and "install whatever you want" ultimately, but it is basically the same process as sideloading on Android, isn't it? Disabling a bunch of protections that are there for your safety? Your trust, honestly, doesn't mean jack shit. There is cryptographic signing, and certificate authorities, and processes to approve the certificates that authorized developers use. You don't got jack shit with your "trust" of Termux and Kodi. It means nothing to the end-user. We do not work in "trust me bro" territory when it comes to signing software, anymore. I am sorry/not-sorry to say. It is very important to have a chain of trust that goes up somewhere above "goldenarm @ HN".
        cindyllm 9mo ago
        [dead]
        TeMPOraL 9mo ago
        Cryptographic trust is a different thing than actual trust. The latter is what makes the world work, the former is a tool people occasionally confuse for the real thing, but actually is mostly opposite to it.
        B1FIDO 9mo ago
        Look we are talking about computers here. Computers don't understand or exercise actual trust as you describe it. Actual trust doesn't make computers work at all, because it doesn't exist in their world. So you need a proxy for it. The security vetting, the authentication, the scans that are done, whether by Google Play or by F-Droid, are a process that tries to eliminate egregious abuses and basically curate the collection so that the users have something to actually trust. Now you understand that actual trust comes in degrees, right? I don't trust everything on Play equally. There are plenty of different types of trust relationships between me and the Play Store and the devs who put their apps on it. But cryptographically, cybersecurity-wise, we need that CIA triad, and we need to authenticate that developers are who they say they are. And that authentication is the crux of cryptographic code signing. That we can trust that updates came from the source, and not a 3rd party injection or supply-chain attack. If Google or F-Droid countersigns it, then it's been through their vetting process as well. That's how cryptographic signing establishes trust relationships for computers. If your computer doesn't trust an app or a driver, it won't download, install or run it. Since you cannot teach a computer "actual trust" there must be an analogue to this. And it's working fine. I don't know what you're on about "opposite to actual trust". If you don't trust Google Play, that's a you problem.
        big-guy23 9mo ago
        > I don’t trust everything on play > If you don't trust Google Play, that's a you problem. When your lack of understanding is called out you devolve into rambling self-contradiction. Two me, should I trust this app, that has “cryptography “ “security vetting “ “authentication” “scans” “code signing” etc on an App Store that you are praising ? https://apps.apple.com/us/app/termux/id6738933789 https://apps.apple.com/us/app/termux/id6738933789
    - glenstein 9mo ago
      The inconvenient fact that bursts this bubble is that installing already is the default term, and it's the emergence of "side loading" which is the anachronistic attempt to redefine the term. The idea that a precondition for something to count is installing is that it's vetted by a big company is the abberation, and the notion that it's trustworthy is belied by the avalanche of unsafe and privacy violating apps that find their way into the store. F-Droid apps are actually more carefully vetted than Play Store apps, so there goes the trust rationale. You're the one muddying the waters.
      - B1FIDO 9mo ago
        [flagged]
- Grikbdl 9mo ago
  Cromulent for describing something of secondary importance or shadowy nature yes, but the entire idea is that that is wrong.
  - B1FIDO 9mo ago
    [flagged]
    - throwaway132448 9mo ago
      The uneducated one here is the one who appears unaware that "installing software" was a thing long before app stores. Security is irrelevant to the meaning of the word, so continuing to go on about it only further devalues your point and does nothing to counter the OP's point.
      - B1FIDO 9mo ago
        "installing software" sometimes still consists of curl | bash So if you want to have a conversation about trusting curl and bash and random gists... Like I said, I installed software in many ways back in the day. I typed it in; I loaded off cassette tape; I loaded off disk. One common denominator was loading from trusted sources. My Atari cartridges were store-bought and not homebrew. I went to B.Dalton mostly for the software, and got it shrinkwrapped from the publisher. I had a number of classmates and colleagues who caught viruses and malware from loading and installing cracked software or untrusted programs... or even alleged porn, from shady sources. This is still a good way to get infected. When I get on a friend's computer, I often have occasion to congratulate them for being uninfected, and it's nearly always because they "practiced good hygiene" in terms of loading only trusted software from trusted sources. So you're correct, in that really nothing has changed. Back in 1983 you could certainly "sideload" crap from a pirate BBS and then suffer the consequences. And we all had choice words for people like that.
- tomhow 9mo ago
  Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
lokar 9mo ago
I think what is missing here is the growing trend of scammers convincing people they are their bank (or whatever) and walking them through enabling side-loading and then installing malware (sometimes to address some urgent security issues with their account). This is meant to counter an actual issues that is affecting many many users.
- seg_lol 9mo ago
  Is the solution to make it harder? Or is the threat of scammers and the insecurity of the OS used as false flag to make installing software outside of the profitable walled garden much much harder?
  - lokar 9mo ago
    I doubt that side-loading impacts revenue all that much. Alternate stores are the real, potential, risk to $. I think the solution is to come up with a balance between the needs of different groups of users. People here see the phone as a general purpose computer they should be able to modify and use for all kinds of novel tasks. This is great, and should be fully supported. But there are also many, many more people who see the phone as an important way to enable a higher standard of living. Giving them access to information, government services and banking for the first time. They are not technically sophisticated, and don't need or want a general purpose computer. So, we need platform providers to come up with ways to work out who is who, and give each side what they need.
- ronsor 9mo ago
  This has been going on since the Internet became widespread and Windows users started regularly downloading random executables from random websites.
  - sofixa 9mo ago
    And many things have been done, including Windows telling you in bold red letters that this software is dangerous if it wasn't signed by a trusted signer with lots of installs.
gruez 9mo ago
>Sideloading is a neologism to scare users and lawmakers, it just means "Installing software" and should be a basic right. No it's not. The term originated far before this debacle, and carries a meaningful distinction than just "installing". Specifically it means installing from a non-first party source. You might not agree the restriction should exist, or that even the concept of first party source at all, but for communication purposes it's worth having a simple word to describe that concept, rather than something like "installing from a non-first party app store".
- archvile 9mo ago
  So... installing software? >Specifically it means installing from a non-first party source. Just like 99% of software running on computers in the world today? How is it different from "installing software"?
  - gruez 9mo ago
    >How is that different from "installing software"? It's easy to see this play out if try to replace "sideloading" with "installing software". If you apply it to OP's headline of >Google confirms 'high-friction' sideloading flow is coming to Android You get >Google confirms 'high-friction' installing software flow is coming to Android which isn't at all accurate. You still need the distinct concept of "installing software not from first party sources", otherwise it sounds like google is making it a pain to install all apps, which isn't the case.
    - glenstein 9mo ago
      Sure, you could argue it helps to express a distinction but that doesn't mean it has to live inside the verb install. Historically installing software was the general act and provenance was handled with qualifiers eg installing from "third-party sources", "manual install" etc. Android is alone among computing platforms in collapsing that qualifier into a new term that implicitly recenters the Play Store as the default meaning of "install." In other ecosystems the store path is described as "store install" not the other way around. Android chose the inverse framing and that choice isn't neutral.
estimator7292 9mo ago
This is revisionist history to make things sound scary and evil. The term sideloading was first published before Google existed. Go to the XDA forums and search for the word "sideload". You can filter for results before 2020 if you like, you get hits going back decades. It's been in common use since the day we got smartphones. The term dates back to the 1990s. I remember reading the word when I bought my HTC Evo at launch. It's an industry standard term and has been for longer than Google has existed. You know this is the internet and anyone can fact check anything at any time? Including you!

B1FIDO 9mo ago

[flagged]

goldenarm 9mo ago
That is my own opinion as an Android developer and ex custom ROM maintainer, I've not read that blog post. Instead of ad-hominem, can you explain what do you really disagree on?
- B1FIDO 9mo ago
  [flagged]
  - goldenarm 9mo ago
    You're infantilising the users. It's untrusted by Google, but it's trusted by myself. I actually trust the Termux and Kodi devs way more than Google, yet they Google has been blocking their updates. Note that the term sideloading is exclusively used by mobile OSes. On Windows MacOS and Linux you can install anything.
    - B1FIDO 9mo ago
      What I'm talking about is actual trust. Like, there are cryptographic measures taken, certificates involved, code signing, that kind of thing. You claim that you "can install anything" on Windows, but that is simply false. The system's Driver Signature Enforcement will prohibit the install of unsigned or invalid signatures on device drivers. Windows SmartScreen will also give you trouble by blocking unsigned apps. So yeah, you can bypass these protective measures and "install whatever you want" ultimately, but it is basically the same process as sideloading on Android, isn't it? Disabling a bunch of protections that are there for your safety? Your trust, honestly, doesn't mean jack shit. There is cryptographic signing, and certificate authorities, and processes to approve the certificates that authorized developers use. You don't got jack shit with your "trust" of Termux and Kodi. It means nothing to the end-user. We do not work in "trust me bro" territory when it comes to signing software, anymore. I am sorry/not-sorry to say. It is very important to have a chain of trust that goes up somewhere above "goldenarm @ HN".
      - cindyllm 9mo ago
        [dead]
      - TeMPOraL 9mo ago
        Cryptographic trust is a different thing than actual trust. The latter is what makes the world work, the former is a tool people occasionally confuse for the real thing, but actually is mostly opposite to it.
        B1FIDO 9mo ago
        Look we are talking about computers here. Computers don't understand or exercise actual trust as you describe it. Actual trust doesn't make computers work at all, because it doesn't exist in their world. So you need a proxy for it. The security vetting, the authentication, the scans that are done, whether by Google Play or by F-Droid, are a process that tries to eliminate egregious abuses and basically curate the collection so that the users have something to actually trust. Now you understand that actual trust comes in degrees, right? I don't trust everything on Play equally. There are plenty of different types of trust relationships between me and the Play Store and the devs who put their apps on it. But cryptographically, cybersecurity-wise, we need that CIA triad, and we need to authenticate that developers are who they say they are. And that authentication is the crux of cryptographic code signing. That we can trust that updates came from the source, and not a 3rd party injection or supply-chain attack. If Google or F-Droid countersigns it, then it's been through their vetting process as well. That's how cryptographic signing establishes trust relationships for computers. If your computer doesn't trust an app or a driver, it won't download, install or run it. Since you cannot teach a computer "actual trust" there must be an analogue to this. And it's working fine. I don't know what you're on about "opposite to actual trust". If you don't trust Google Play, that's a you problem.
        big-guy23 9mo ago
        > I don’t trust everything on play > If you don't trust Google Play, that's a you problem. When your lack of understanding is called out you devolve into rambling self-contradiction. Two me, should I trust this app, that has “cryptography “ “security vetting “ “authentication” “scans” “code signing” etc on an App Store that you are praising ? https://apps.apple.com/us/app/termux/id6738933789 https://apps.apple.com/us/app/termux/id6738933789
  - glenstein 9mo ago
    The inconvenient fact that bursts this bubble is that installing already is the default term, and it's the emergence of "side loading" which is the anachronistic attempt to redefine the term. The idea that a precondition for something to count is installing is that it's vetted by a big company is the abberation, and the notion that it's trustworthy is belied by the avalanche of unsafe and privacy violating apps that find their way into the store. F-Droid apps are actually more carefully vetted than Play Store apps, so there goes the trust rationale. You're the one muddying the waters.
    - B1FIDO 9mo ago
      [flagged]
Grikbdl 9mo ago
Cromulent for describing something of secondary importance or shadowy nature yes, but the entire idea is that that is wrong.
- B1FIDO 9mo ago
  [flagged]
  - throwaway132448 9mo ago
    The uneducated one here is the one who appears unaware that "installing software" was a thing long before app stores. Security is irrelevant to the meaning of the word, so continuing to go on about it only further devalues your point and does nothing to counter the OP's point.
    - B1FIDO 9mo ago
      "installing software" sometimes still consists of curl | bash So if you want to have a conversation about trusting curl and bash and random gists... Like I said, I installed software in many ways back in the day. I typed it in; I loaded off cassette tape; I loaded off disk. One common denominator was loading from trusted sources. My Atari cartridges were store-bought and not homebrew. I went to B.Dalton mostly for the software, and got it shrinkwrapped from the publisher. I had a number of classmates and colleagues who caught viruses and malware from loading and installing cracked software or untrusted programs... or even alleged porn, from shady sources. This is still a good way to get infected. When I get on a friend's computer, I often have occasion to congratulate them for being uninfected, and it's nearly always because they "practiced good hygiene" in terms of loading only trusted software from trusted sources. So you're correct, in that really nothing has changed. Back in 1983 you could certainly "sideload" crap from a pirate BBS and then suffer the consequences. And we all had choice words for people like that.
tomhow 9mo ago
Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

lokar 9mo ago

I think what is missing here is the growing trend of scammers convincing people they are their bank (or whatever) and walking them through enabling side-loading and then installing malware (sometimes to address some urgent security issues with their account). This is meant to counter an actual issues that is affecting many many users.

seg_lol 9mo ago
Is the solution to make it harder? Or is the threat of scammers and the insecurity of the OS used as false flag to make installing software outside of the profitable walled garden much much harder?
- lokar 9mo ago
  I doubt that side-loading impacts revenue all that much. Alternate stores are the real, potential, risk to $. I think the solution is to come up with a balance between the needs of different groups of users. People here see the phone as a general purpose computer they should be able to modify and use for all kinds of novel tasks. This is great, and should be fully supported. But there are also many, many more people who see the phone as an important way to enable a higher standard of living. Giving them access to information, government services and banking for the first time. They are not technically sophisticated, and don't need or want a general purpose computer. So, we need platform providers to come up with ways to work out who is who, and give each side what they need.
ronsor 9mo ago
This has been going on since the Internet became widespread and Windows users started regularly downloading random executables from random websites.
- sofixa 9mo ago
  And many things have been done, including Windows telling you in bold red letters that this software is dangerous if it wasn't signed by a trusted signer with lots of installs.

gruez 9mo ago

>Sideloading is a neologism to scare users and lawmakers, it just means "Installing software" and should be a basic right. No it's not. The term originated far before this debacle, and carries a meaningful distinction than just "installing". Specifically it means installing from a non-first party source. You might not agree the restriction should exist, or that even the concept of first party source at all, but for communication purposes it's worth having a simple word to describe that concept, rather than something like "installing from a non-first party app store".

archvile 9mo ago
So... installing software? >Specifically it means installing from a non-first party source. Just like 99% of software running on computers in the world today? How is it different from "installing software"?
- gruez 9mo ago
  >How is that different from "installing software"? It's easy to see this play out if try to replace "sideloading" with "installing software". If you apply it to OP's headline of >Google confirms 'high-friction' sideloading flow is coming to Android You get >Google confirms 'high-friction' installing software flow is coming to Android which isn't at all accurate. You still need the distinct concept of "installing software not from first party sources", otherwise it sounds like google is making it a pain to install all apps, which isn't the case.
  - glenstein 9mo ago
    Sure, you could argue it helps to express a distinction but that doesn't mean it has to live inside the verb install. Historically installing software was the general act and provenance was handled with qualifiers eg installing from "third-party sources", "manual install" etc. Android is alone among computing platforms in collapsing that qualifier into a new term that implicitly recenters the Play Store as the default meaning of "install." In other ecosystems the store path is described as "store install" not the other way around. Android chose the inverse framing and that choice isn't neutral.

estimator7292 9mo ago

This is revisionist history to make things sound scary and evil. The term sideloading was first published before Google existed. Go to the XDA forums and search for the word "sideload". You can filter for results before 2020 if you like, you get hits going back decades. It's been in common use since the day we got smartphones. The term dates back to the 1990s. I remember reading the word when I bought my HTC Evo at launch. It's an industry standard term and has been for longer than Google has existed. You know this is the internet and anyone can fact check anything at any time? Including you!