7 ms·

> We heard from developers who were concerned about the barrier to entry when building apps intended only for a small group, like family or friends. We are usin

> We heard from developers who were concerned about the barrier to entry when building apps intended only for a small group, like family or friends. We are using your input to shape a dedicated account type for students and hobbyists. This will allow you to distribute your creations to a limited number of devices without going through the full verification requirements. In classic Google fashion, they hear the complaint, pretend that it's about something else, and give a half baked solution to that different problem that was not the actual issue. Any solution that disadvantages F-Droid compared to the less trustworthy Google Play is a problem.

idiotsecant 8mo ago
I think you've omitted the next section, which seems more relevant. It seems like they will still allow installs, just hide it behind some scare text. Seems reasonable?
- Xelbair 8mo ago
  No, because it isn't something that should be up to google's control.
  - tux1968 8mo ago
    Why not? It's their operating system, and they're trying to balance quite a few competing priorities. Scammers are not a threat to dismiss out of hand (i've had family who were victims). For it to be truly considered open source, you should be able to fork it and create your own edits to change the defaults however you wish. Whether that is still a possibility or not, is a completely separate issue from how they proceed with their own fork.
    - yjftsjthsd-h 8mo ago
      > Why not? It's their operating system It's my phone.
      - mturilin 8mo ago
        What makes it “yours”? You paid for it but Google still has the control. I understand that you prefers things to be different (as do I) but the reality is that we don’t have control over devices we paid for.
        ImPostingOnHN 8mo ago
        > What makes it “yours”? You answered the question here: > You paid for it If you paid for hardware, legally that makes it yours. > Google still has the control Therein lies the problem. Google should not exercise such control over devices which are yours, not theirs.
        hunter2_ 8mo ago
        I think it's reasonable for Google to control what happens in their version of Android (which can be installed by default) but it's not reasonable for Google to lock the bootloader (preventing installation of a non-Google OS). Perhaps this is why Google hardware doesn't have locked bootloaders; Samsung et al can get away with locked bootloaders since it's not Google forcing the consumer in that case. Whether the bootloader is or isn't locked should be very conspicuous before purchase, for consumer protection.
        pastage 8mo ago
        You might choose to not have control. The reason people protest is because we should have more control over the things we own. Sure this might create a better market for alternatives but it is worse for most people. F-droid is spectacular.
        eptcyka 8mo ago
        Microsoft got penalized for way less.
        1718627440 8mo ago
        > What makes it “yours”? The law. The contract. The money I paid. > the reality is that we don’t have control over devices we paid for So, the reality is that a company is exerting ownership rights on things they don't own. If that is exclusive, then that is called theft.
    - krzyk 8mo ago
      It's their only if they use it.
- yjftsjthsd-h 8mo ago
  > We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands. I've lived through them locking down a11y settings "to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer", and it's a nightmare. It's not just some scare text, it's a convoluted process that explicitly prevents you from just opening the settings and allowing access. I'm not giving them the benefit of the doubt; after they actually show what their supposed solution is we can discuss it, but precedent is against them. > Seems reasonable? No. As I said before, any solution that disadvantages F-Droid compared to the less trustworthy Google Play is a problem.
- Macha 8mo ago
  It's deliberately written to be vague and not say anything, and given the original intention, it's hard to believe that means it should be interpreted generously.
- joecool1029 8mo ago
  > It seems like they will still allow installs, just hide it behind some scare text. This was already the case for enabling sideloading at system level: it warned you. Nobody really says having this toggle is a bad thing, basically the user shouldn't get an ad network installing apk's just browsing around the web without their informed consent (and android has been found to be vulnerable to popunder style confirmations in the past). They also already had the PlayProtect scanning thing that scans sideloaded APK's for known malware and removes it. People already found this problematic since what's to stop them pulling off apps they just don't like, and no idea what if any telemetry it sends back about what you have installed. There have been a handful of cases where it proved beneficial pulling off botnet stuff. Finally, they also have an additional permission per-application that needs to be enabled to install APK's. This stops a sketchy app from installing an APK again without user consent to install APK's. The question is: How many other hurdles are going to be put in place? Are you going to have to do a KYC with Google and ping them for every single thing you want to install? Do you see how this gets to be a problem?
- Zak 8mo ago
  > It seems like they will still allow installs, just hide it behind some scare text. That describes the current (and long-established) behavior. App installation is only from Google's store by default and the user has to manually enable each additional source on a screen with scare text.
- bityard 8mo ago
  The whole point of TFA, if you read it, is that they SAID they would do that, but there has since been ZERO evidence that they actually will. This feature is not present in anything they have released since that statement.
  - lern_too_spel 8mo ago
    On the other hand, blocking installation of non-notarized apps is not present in anything they released since that statement either, as far as I know.
    - m4rtink 8mo ago
      It would be foolish to depend on that & far harder to get ridd of it if they put it in place. There needs to be clear statement and verification method to make sure they really are backtracking. Anything else won't do.
    - tadfisher 8mo ago
      It's already implemented in 36.1: https://developer.android.com/sdk/api_diff/36.1/changes/android.content.pm.PackageInstaller#android.content.pm.PackageInstaller.getDeveloperVerificationServiceProvider_added https://developer.android.com/sdk/api_diff/36.1/changes/andr...()
      - lern_too_spel 8mo ago
        The API is implemented in 36.1, but the previously proposed notarization requirement is not enforced in any production build, so this error is never thrown. Even if they implement the scare text, this API will still be needed. If they implement what they said they would implement after the uproar, users will be better off. Previously, if a company wanted to distribute their app on their website, any user who installed it would have to dismiss scare text. Now, they have a way to distribute apps on their website without the scare text, and people who want to distribute apps without any tracking can still do that with the scare text.
- BadBadJellyBean 8mo ago
  Why is it reasonable that installing software is behind an "advanced flow" what ever that means? I find it not very reasonable at all that the only way to install software on my phone is by jumping through hoops. I don't think it reasonable that the Play Store is the only portal. I don't even find it reasonable to call installing software "sideloading". Downloading and installing software from a vendor's page has been the norm for decades before smart phones came along but all of a sudden when it is on a small screen the user can not be trusted? That's ridiculous and not at all reasonable.
  - llbbdd 8mo ago
    It's not the screen size, it's the demographic shift. By 2000, only half of U.S. households had a shared living room PC, mostly for work and/or games. Everybody having a phone in their pocket later was a change that we did very much have to account for. Non-technical people can be scammed very easily into life-ruining mistakes with a little social engineering and a little bit of access to powerful tools already on their devices. I remember when big sites started having to put big banners in your browser console warning you that if you weren't a dev and someone told you to paste something there, you had been scammed, and not to do it. They had to do that because the average Facebook user could be tricked very easily by promises of free FarmVille items or the opportunity to hack someone else's account, and those are fairly low stakes bait. Now people bank with real money on their phones.
    - heavyset_go 8mo ago
      And yet the Play Store and App Store are the largest vectors of scams and malware out there, to the tune of billions of dollars a year. We should be prioritizing securing our systems so that they run only what we want them to run, instead of putting all of that trust in gatekeepers who make money when they let you get scammed.
      - llbbdd 8mo ago
        They are the largest vector of scams and malware because they've centralized it and it's hard to deliver malware and scams otherwise. That malevolence will always happen and centralizing it ensures a single avenue that can be controlled and measured and importantly sued when they fuck up. I can't sue f-droid when they allow malware on my device, that's one of many reasons why I don't use it, that's why nobody uses it in real life. Every day on HN I see people who seem to unironically think "enshittification" is a real term normal people use, a generally understood term by people who don't follow links to Corey Feldman's blog. HN tends to forget that linux is not a target for general malware because nobody gives a single fuck about linux as a real malware target because they're smart, and therefore not the target of most scams. HN has the cute attitude that technology is king and that as long as you inspect it and open source it and care enough and have full control, then that's enough. Often the same people ignoring that AI has made it way easier to fuck stupid people over with no effort at all. I don't not want unlimited control over the hardware that I buy from vendors like Google but I don't know yet of any better way to keep stupid people from kneecapping themselves other than introducing harder and harder quizzes. If you think it's an advantage that third party vendors like f-droid are absolved of responsibility then you deserve and own the fault when you get hacked and fucked over. Most people don't want that. They have real life to deal with. In real life you can kill people or sue them and it's harder to kill people over the internet.
greatgib 8mo ago
Even restricting the mitigation to "students and hobbyists" is bad. I should have the right to have parents, friends or anyone use a "free" store that is not under control of Google if the user and app developer wish so. But also, somehow there should be something done to avoid the monopoly forcing to use the Google services. Like major institutions like bank, gov and co being forced to provide alternatives like a webapp when they provide app tied to the Google play store.
- echelon 8mo ago
  We deserve web installs without deep settings menu configurations, scare walls, or onerous processes. The EU and every other nation with digital sovereignty concerns need to make this happen to both Apple and Google. These are our devices. The giants are camping.
- fragmede 8mo ago
  But unfortunately, it turns out that some people you interact with aren't actually your friend. That guy that seems totally legit and just wants your sister to install his fun little game/app that he wrote is actually trying to get her to install an app that's going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course.
  - whatshisface 8mo ago
    >going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course. The guy's name? Google. ;-)
    - NewsaHackO 8mo ago
      Actually, what Google does is totally legit because they pester you constantly about "sharing your location/photos/installing Gemini" until you accidentally press yes, and they can say they have your consent. So they are actually the good guys.

idiotsecant 8mo ago

I think you've omitted the next section, which seems more relevant. It seems like they will still allow installs, just hide it behind some scare text. Seems reasonable?

Xelbair 8mo ago
No, because it isn't something that should be up to google's control.
- tux1968 8mo ago
  Why not? It's their operating system, and they're trying to balance quite a few competing priorities. Scammers are not a threat to dismiss out of hand (i've had family who were victims). For it to be truly considered open source, you should be able to fork it and create your own edits to change the defaults however you wish. Whether that is still a possibility or not, is a completely separate issue from how they proceed with their own fork.
  - yjftsjthsd-h 8mo ago
    > Why not? It's their operating system It's my phone.
    - mturilin 8mo ago
      What makes it “yours”? You paid for it but Google still has the control. I understand that you prefers things to be different (as do I) but the reality is that we don’t have control over devices we paid for.
      - ImPostingOnHN 8mo ago
        > What makes it “yours”? You answered the question here: > You paid for it If you paid for hardware, legally that makes it yours. > Google still has the control Therein lies the problem. Google should not exercise such control over devices which are yours, not theirs.
        hunter2_ 8mo ago
        I think it's reasonable for Google to control what happens in their version of Android (which can be installed by default) but it's not reasonable for Google to lock the bootloader (preventing installation of a non-Google OS). Perhaps this is why Google hardware doesn't have locked bootloaders; Samsung et al can get away with locked bootloaders since it's not Google forcing the consumer in that case. Whether the bootloader is or isn't locked should be very conspicuous before purchase, for consumer protection.
      - pastage 8mo ago
        You might choose to not have control. The reason people protest is because we should have more control over the things we own. Sure this might create a better market for alternatives but it is worse for most people. F-droid is spectacular.
      - eptcyka 8mo ago
        Microsoft got penalized for way less.
      - 1718627440 8mo ago
        > What makes it “yours”? The law. The contract. The money I paid. > the reality is that we don’t have control over devices we paid for So, the reality is that a company is exerting ownership rights on things they don't own. If that is exclusive, then that is called theft.
  - krzyk 8mo ago
    It's their only if they use it.
yjftsjthsd-h 8mo ago
> We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands. I've lived through them locking down a11y settings "to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer", and it's a nightmare. It's not just some scare text, it's a convoluted process that explicitly prevents you from just opening the settings and allowing access. I'm not giving them the benefit of the doubt; after they actually show what their supposed solution is we can discuss it, but precedent is against them. > Seems reasonable? No. As I said before, any solution that disadvantages F-Droid compared to the less trustworthy Google Play is a problem.
Macha 8mo ago
It's deliberately written to be vague and not say anything, and given the original intention, it's hard to believe that means it should be interpreted generously.
joecool1029 8mo ago
> It seems like they will still allow installs, just hide it behind some scare text. This was already the case for enabling sideloading at system level: it warned you. Nobody really says having this toggle is a bad thing, basically the user shouldn't get an ad network installing apk's just browsing around the web without their informed consent (and android has been found to be vulnerable to popunder style confirmations in the past). They also already had the PlayProtect scanning thing that scans sideloaded APK's for known malware and removes it. People already found this problematic since what's to stop them pulling off apps they just don't like, and no idea what if any telemetry it sends back about what you have installed. There have been a handful of cases where it proved beneficial pulling off botnet stuff. Finally, they also have an additional permission per-application that needs to be enabled to install APK's. This stops a sketchy app from installing an APK again without user consent to install APK's. The question is: How many other hurdles are going to be put in place? Are you going to have to do a KYC with Google and ping them for every single thing you want to install? Do you see how this gets to be a problem?
Zak 8mo ago
> It seems like they will still allow installs, just hide it behind some scare text. That describes the current (and long-established) behavior. App installation is only from Google's store by default and the user has to manually enable each additional source on a screen with scare text.
bityard 8mo ago
The whole point of TFA, if you read it, is that they SAID they would do that, but there has since been ZERO evidence that they actually will. This feature is not present in anything they have released since that statement.
- lern_too_spel 8mo ago
  On the other hand, blocking installation of non-notarized apps is not present in anything they released since that statement either, as far as I know.
  - m4rtink 8mo ago
    It would be foolish to depend on that & far harder to get ridd of it if they put it in place. There needs to be clear statement and verification method to make sure they really are backtracking. Anything else won't do.
  - tadfisher 8mo ago
    It's already implemented in 36.1: https://developer.android.com/sdk/api_diff/36.1/changes/android.content.pm.PackageInstaller#android.content.pm.PackageInstaller.getDeveloperVerificationServiceProvider_added https://developer.android.com/sdk/api_diff/36.1/changes/andr...()
    - lern_too_spel 8mo ago
      The API is implemented in 36.1, but the previously proposed notarization requirement is not enforced in any production build, so this error is never thrown. Even if they implement the scare text, this API will still be needed. If they implement what they said they would implement after the uproar, users will be better off. Previously, if a company wanted to distribute their app on their website, any user who installed it would have to dismiss scare text. Now, they have a way to distribute apps on their website without the scare text, and people who want to distribute apps without any tracking can still do that with the scare text.
BadBadJellyBean 8mo ago
Why is it reasonable that installing software is behind an "advanced flow" what ever that means? I find it not very reasonable at all that the only way to install software on my phone is by jumping through hoops. I don't think it reasonable that the Play Store is the only portal. I don't even find it reasonable to call installing software "sideloading". Downloading and installing software from a vendor's page has been the norm for decades before smart phones came along but all of a sudden when it is on a small screen the user can not be trusted? That's ridiculous and not at all reasonable.
- llbbdd 8mo ago
  It's not the screen size, it's the demographic shift. By 2000, only half of U.S. households had a shared living room PC, mostly for work and/or games. Everybody having a phone in their pocket later was a change that we did very much have to account for. Non-technical people can be scammed very easily into life-ruining mistakes with a little social engineering and a little bit of access to powerful tools already on their devices. I remember when big sites started having to put big banners in your browser console warning you that if you weren't a dev and someone told you to paste something there, you had been scammed, and not to do it. They had to do that because the average Facebook user could be tricked very easily by promises of free FarmVille items or the opportunity to hack someone else's account, and those are fairly low stakes bait. Now people bank with real money on their phones.
  - heavyset_go 8mo ago
    And yet the Play Store and App Store are the largest vectors of scams and malware out there, to the tune of billions of dollars a year. We should be prioritizing securing our systems so that they run only what we want them to run, instead of putting all of that trust in gatekeepers who make money when they let you get scammed.
    - llbbdd 8mo ago
      They are the largest vector of scams and malware because they've centralized it and it's hard to deliver malware and scams otherwise. That malevolence will always happen and centralizing it ensures a single avenue that can be controlled and measured and importantly sued when they fuck up. I can't sue f-droid when they allow malware on my device, that's one of many reasons why I don't use it, that's why nobody uses it in real life. Every day on HN I see people who seem to unironically think "enshittification" is a real term normal people use, a generally understood term by people who don't follow links to Corey Feldman's blog. HN tends to forget that linux is not a target for general malware because nobody gives a single fuck about linux as a real malware target because they're smart, and therefore not the target of most scams. HN has the cute attitude that technology is king and that as long as you inspect it and open source it and care enough and have full control, then that's enough. Often the same people ignoring that AI has made it way easier to fuck stupid people over with no effort at all. I don't not want unlimited control over the hardware that I buy from vendors like Google but I don't know yet of any better way to keep stupid people from kneecapping themselves other than introducing harder and harder quizzes. If you think it's an advantage that third party vendors like f-droid are absolved of responsibility then you deserve and own the fault when you get hacked and fucked over. Most people don't want that. They have real life to deal with. In real life you can kill people or sue them and it's harder to kill people over the internet.

greatgib 8mo ago

Even restricting the mitigation to "students and hobbyists" is bad. I should have the right to have parents, friends or anyone use a "free" store that is not under control of Google if the user and app developer wish so. But also, somehow there should be something done to avoid the monopoly forcing to use the Google services. Like major institutions like bank, gov and co being forced to provide alternatives like a webapp when they provide app tied to the Google play store.

echelon 8mo ago
We deserve web installs without deep settings menu configurations, scare walls, or onerous processes. The EU and every other nation with digital sovereignty concerns need to make this happen to both Apple and Google. These are our devices. The giants are camping.
fragmede 8mo ago
But unfortunately, it turns out that some people you interact with aren't actually your friend. That guy that seems totally legit and just wants your sister to install his fun little game/app that he wrote is actually trying to get her to install an app that's going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course.
- whatshisface 8mo ago
  >going to track your location and read all your messages and copy all your photos. To keep her safe from the "actually" bad people, of course. The guy's name? Google. ;-)
  - NewsaHackO 8mo ago
    Actually, what Google does is totally legit because they pester you constantly about "sharing your location/photos/installing Gemini" until you accidentally press yes, and they can say they have your consent. So they are actually the good guys.