These online petitions are worse than useless. They don’t do anything because they fail to communicate either conviction to a cause or the relevance of the signers. And they may take someone who would otherwise do something useful, like call their elected or participate in public comment, and make them complacent.
An open letter from the lead developers and decision makers of top-rated apps in the Play Store would be useful. But that takes work, unlike an online petition.
> What do I need to do to make a difference, and how much time will this take?
EU or US?
> what's the path? Legislation?
Send them a letter explaining why this is bad for you. Keep it strictly factual and ideally concise. Copy Google’s legal [1] and any relevant digital or markets regulators. (If in the US, don’t forget your state regulators.)
Wait two weeks and then call the elected. Make sure they’re aware, and talk through your options. Send a letter thanking them for the call, incorporating any new information and actions they said they would take, and copy all of the previous parties again.
More work: reach out to other top developers and organise an open letter. This will be hard because everyone wants to include their pet issue and everyone will fight over scope and language.
what about EU?
ChatControl has a website, but I am having trouble finding out who the hell to contact for the requirement for google play integrity in our goverment apps (which was recently changed from requiring hardware integrity, as graphene can only do the latter.), both national and comunitary, and whoever is in charge of the repositories is not responding to the tens of issues opened for it.
Now there's also this new requirement, and it's shocking the EU hasn't responded yet. Weren't we supposed to make ourselves more independent from US technology? But i wouldn't be surprised someone would be lobbying on google's behalf to convince the politicians that "trust me bro, google play is more secure"
JumpCrisscross's reply was really good, and I would like to add additionally that US congress representatives and senators usually maintain local offices in cities in their constituency, and a visit to these offices (usually you can make an appointment by calling them) to discuss issues in person is a very powerful way to be heard. If you aren't in the US, you'll need to find out if your government has anything similar.
You can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma, who lost a large sum of money by installing malware after ignoring multiple warnings.
If you want to make a difference, try to communicate with someone from OEM companies. Google is making their phones inferior and they'll loose money and market share because of it.
After this change, "I can install NewPipe and Ad blockers" will become a major selling point for Chinese phones among large and profitable segments of the population. And that high-end manufacturers might as well give up and let Apple take that part of the market. If OEMs can be made to understand that, that's going to be the end of this initiative.
> can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma
You’re correct, but for the wrong reasons. Privacy framings don’t work because people who care about privacy are unusually politically nihilistic and/or lazy. I’ve worked on privacy legislation. I’ve also worked on other laws. Nobody calls or writes about the former. With the latter, it was almost trivial to demonstrate to the elected that there was real political capital in embracing the issue.
Well, depending on the sort of other laws you've supported, that shouldn't be very surprising.
The special interest of a particular group always result in far more intense support than any law that benefits the public at large. And privacy is usually a general concern.
Also, am I the only one who finds the idea that you need to demonstrate the existence of political capital to elected politicians concerning? (As opposed to persuading them that it's the right thing to do.) I don't want to sidetrack the whole discussion, but this makes me doubt the future of western democracy in a hundred different ways.
Petitioning EU lawmakers would be better. American control of European data is already a bit issue at the moment in the face of US threats over Digital taxes and Microsoft being used to punish ICJ members.
EU (and the rest of Europe) are more concerned with controlling their own populations than keeping their data safe from the US. They are very much pro-big business dominance on the internet BECAUSE it makes it easier for them to regulate.
A lot of governments want to use American AI systems to run things to cut costs.
The EU is almost ready to sign off on Apple's DMA compliance as sufficient, despite sideloading being similarly restricted, and despite 15-20% commissions remaining. The DMA was never written to allow completely anonymous sideloading, or even commission-free sideloading, another law is needed for that.
Yes. Not a rando online petition: “we have succesfully escalated complaints on this problem to consumer agencies in France, Germany, and Australia, and have brought forth petitions for new law on this problem to various countries.”
Petitions from verified voters are powerful. Triply so if done in person, because the infrastructure that can collect signatures in person can also e.g. back a primary challenge or plebiscite.
Such petiotions also fail to communicate legitimacy in a sense that authentic members have signed the petitition. Hence it can also be used adversely to steer the public opinion (although unlikely for the given situation).
Please bear in mind that Google was perfectly aware how much negative feedback they will receive from developers and they are completely and fully prepared for it. In other words, this decision was made with full awareness that developers and "screeching voices of minority" won't like it.
Yep. In the announcement, they already got full green light approval from various governments basically saying this was a great idea and the clear path ahead.
> …with Indonesia’s Ministry of Communications and Digital Affairs praising it for providing a “balanced approach” that protects users while keeping Android open.
> …Thailand’s Ministry of Digital Economy and Society sees it as a “positive and proactive measure” that aligns with their national digital safety policies.
> In Brazil, the Brazilian Federation of Banks (FEBRABAN) sees it as a “significant advancement in protecting users and encouraging accountability.”
The "feature" isn't being rolled out to the US yet, so it doesn't appear that any official statement has been made one way or the other by the US government.
Google is orchestrating buy-in with world governments. They've already signaled that this is happening everywhere, no matter what, and its just a paced rollout unfortunately.
They can still miscalculate the intensity of the backlash or the willingness of people to do something about it. Many such stories. "The enemy has a plan so let's do nothing" is a great way to get consistently rolled in the world. As the saying goes, everyone has a plan until they are punched in the face; dishing out the occasional (and in this case fully metaphorical) punch in the face is not a hopeless endeavor.
(I agree with some other threads that merely signing a random petition is not a punch to the face. That's just whining. Systematic and organized, perhaps, but just whining.)
The nerds are the ones who pave the way for technology, enabling people around them to adapt more easily to it. They find new paths into the undiscovered land that then get either shut down or commercially exploited. Companies like Google have piggybacked on this volunteer work.
I have the feeling that these companies don't need nerds anymore. Who needs pioneers if everything is paved and regulated?
Do you have evidence that they have accurate estimates of the potential for backlash? It is not that uncommon that people in power take decisions without thinking them though properly
You might be right, but didn't same thing applied to Web Environment Integrity stuff, that they ended up stepping back on (for how short of a time stretch is another story)?
First, web environment integrity was about the web as a whole, not about something that is completely owned and under their control. Second, they will not stop trying. It was not their first approach and it won't be the last.
So, I believe that if they decided this is the path they want to take - they will find one way or another. It's not that resistance is futile (it's not!) but I believe that petitions are not a good tool for the case.
I mean, who is going to stop them, USA doesn't have a functioning government any more -- for large corporations just pay Trump a bribe (eg a "settlement" for a court case; or a very expensive meal ticket) and do what you like.
Google pay fealty to Trump, who is going in to bat for consumers over this when they won't even protect the constitution or rule of law?
Yes. A decision like this creates the impetus to move to alternatives like Jolla OS that have an Android-compatible layer.
20 years in, the so-called "smartphone" duopoly have jointly converged towards a "dumb terminal" strategy, where almost nothing can be done without cloud-based authentication from a centralized third party. And this was the case prior to the AI horse manure they're baking into the OS.
I use the Fossify forks of Simple Mobile Tools apps (Gallery, File Manager, Calculator) because these can be installed via APK files and just be left alone. My Google Calculator app on the other hand seems to want to download new updates every single month.
And what alternative would that be?
iOS? hah. Hardware and vendor lock in.
AOSP / Graphene, or the equivalent of linux on a smartphone would be a better chance, but first and foremost you need hardware support. Something is happening like eos, pinephone and the like but we are a long, long way toward that goal.
"Almost completely boiled frog petitions against raising the water temperature another degree"
It's great to see that some more people who were previously complacent are outraged about this move. But let's look back a bit:
In the early 1990s, Linus Torvalds started writing an OS kernel for 386-class PCs. He didn't need the approval of some corporation to allow him to run code on his own machine, or distribute it for others to run on theirs. The code didn't have to run as an "app" in some restricted sandbox under Microsoft's OS (not that back then, DOS or Windows were even in any way locked down the way modern operating systems are). Documentation for all the "standard" hardware like video, keyboard, hard disks, etc. was openly available, so it didn't have to rely on proprietary drivers.
This is how it was at one time, and what should have remained the standard today, but instead it's turned into some utopian dream that those who grew up with "smart" devices can't even conceive as possible anymore.
Google has taken what became of this code, and turned it into an "open" system that is pretty much designed to track every aspect of people's lives in order to more effectively target them with psychological manipulation, which is what advertisements really are. And you're not really getting "free stuff" in return for this invasion either, since pretty much everything you buy includes a hidden "tax" that goes to support this massive industry.
"A supercomputer in everyone's pocket"? Yes, but it's not yours, nor can you even know what it does. Even the source code that is available is millions of lines that you couldn't inspect in all your lifetime. Online 24/7, with GPS tracking your every move and a microphone that listens to what you say. Every URL you visit is logged. Your photos uploaded to "the cloud" and used to train AI.
The only solution is to no longer accept any of this, even if almost everyone else does. Even if it means giving up some convenience.
Apple showed the world that a smartphone that was enjoyable to use was possible.
I know it's hard to remember today, but in 2007, Apple was still the perennially-"beleaguered" underdog whose only big success story in marketshare terms was the iPod.
If the public had not loved the iPhone, it never could have "normalized" anything.
There are definitely aspects of the iPhone that it is fair to criticize Apple for. The rest of the world's wholesale embrace of its design—to the point of slavishly copying it, for several manufacturers at different points in time—can only be blamed on their lack of imagination and willingness to take risks, and on the public's unwillingness to give up the benefits of the iPhone just to get the much-less-obvious benefits of something more "open" or different.
"Installing software" is the cause of malware problems where it is allowed to take place indiscriminately. Restricting which software can be installed is pro-end-user.
I am actually super exited about Google's decision. I only used Android because it was the least-worst option. I always hated how restrictive its OS is, and the Play Store, the locking-down of tethering, etc. But I never had enough reason to try a totally open-source smartphone. Until now.
I'm so excited that I might even jump back into open source development to make a new OS that isn't as bloated and slow as Android. There is a need for an OS that only gives you minimum capabilities, to run on cheaper, simpler, smaller devices. I would love to help make that a reality.
I just realized how powerless we are. The situation is almost unavoidable. Majority people will just accept this. They are unaware how restricted they are, thus they don't care.
are there enough devs to make "non-certified" phones? also i wonder if you'll be able to disable the verification check similar to bootloader unlocking.
Non-certified phones won't be sold in Western markets. This whole scheme has one goal only, and that's to snuff out DRM-unfriendly third party apps like alternative Youtube clients, videogame emulators and P2P file sharing apps.
They're being sold and enough people are buying them to keep these companies alive. Fairphone said they're not delivering to USA because they don't have the manpower, not because there's no demand. Every release again you see people asking in the comments when/if it'll finally be available to them
That's not to say it's a big market where you get big economy of scale benefits. The devices are expensive but they're yours (and some of them try to do ethical resource mining and/or pay fair wages as well). Some of these will also have Googled variants available, but it's a choice
They don't have the manpower to drop off some USA-bound boxes at the same shipping carrier they use for their EU deliveries? I highly doubt that. They likely don't want to bother with FCC approval, opposition from Google about selling de-Googled Android or produce separate SKUs for US-specific 5G frequencies.
what i'm saying is it's time to make a new company. this is a matter of maintaining good technology and avoiding enshitification so it's quite important.
That's my point. Who is going to create a company to compete with Google and Apple on the smartphone front? They already ran everybody else out of business (Palm WebOS, BlackberryOS, Windows Phone). The alternatives are already here but they don't operate in North America (Huawei HarmonyOS, Jolla OS, Pinephone).
yeah that's what i'm saying. but obviously the problem is funding.
so do we have enough engineers who care about maintaining useful tools that aren't handicapped or compromised to be able to support this endeavor? i think we do. there have to be many good eggs within these companies who die a little inside each time something like this goes through.
> They already ran everybody else out of business (Palm WebOS, BlackberryOS, Windows Phone).
Only because those alternative mobile OSes were, frankly, crappy in comparison to iOS and Android.
I don't recall Google or Apple doing anything particularly anticompetitive to cause any of those OSes to fail to keep up in the market, aside from just plain "being the 800lb gorillas in the room". (Not saying they never do anything anticompetitive, just that those particular market failures can't be laid at their feet.)
It would be great to have some really good alternatives to the mobile duopoly. Hell, if we had more fragmentation in the market, that would even lead to more impetus for interoperability and common standards—which we desperately need more of everywhere in tech these days. But those three, in particular? They lost because they were worse at being a good mobile OS for most people.
It’s not purely social. A lot of web apps are legitimately poor, probably because the web has become the go-to platform for those looking to cut costs, who aren’t willing to pay for quality talent. This why there’s such a gulf between VS Code (not technically a web app, but built with web tech) and MS Teams for example: the former has had no expenses spared to woo devs and give MS legitimacy in software dev while the latter only needs to technically function since its audience is captive, so quality can be an afterthought.
So really, people need to start rejecting poor quality or poorly performing web apps. The collective bar for “good enough” is far too low, and so cheapskates will continue to churn out garbage.
Whether web or native is better is hardly relevant to the core of this issue IMO, which is about fundamental rights to admin our own devices. Having to make a network request to fetch an external resource every time you want to run code on your own device is sort of a non-solution to this problem.
For a while, I had stopped flashing custom ROMs because the default Android experience was good enough for me, but it looks like this is now necessary again.
one of my banks requires an app on my phone or desktop. the android app does not work on /e/OS, it needs an original google android system. the desktop app runs only on original windows (tested wine, it doesn't work) for any payment i make. only withdrawing cash from an ATM doesn't need 2FA.
Re DJI Fly: a combination of WebBluetooth, WebRTC, the normal location API, offline web pages (through managed caches), regular browser video features, and a bunch of other web technologies.
Re SyncThing: there's the File System Access API. You can ask the user for a folder and then operate on the files and directories inside it. Also from a locally cached offline copy, of course. Serviceworkers are there to run in the background, though I'm not 100% sure if the FS API and service workers can be combined to be honest.
It'll need as much effort or maybe even more to port it to the web as it has taken to develop the Android app, but it's almost definitely possible, at least on Chrome.
As part of Google's attempt to break free from the iOS app store, they accidentally invented an alternative to their own draconic measures.
FS API is Chrome only though, and a lot of people use Firefox for Android for access to real uBO since Chrome for Android conveniently never gained support for extensions.
With apps on the web you are inherently dependent on the respective web site operating. Local software provides more independence for users (in addition to certain UX benefits).
Then is now. Projects like Anubis and OpenStreetMap explicitly don't support uncommon setups, you just don't get to use those parts of the internet. When talking to e.g. OpenStreetMap sysadmins, the reason given was that they see no other way to keep the site online and available for anyone
The web is dying at the same time as mobile OS freedoms, while important organisations such as governments and banks are moving away from browser access and towards doing everything (including 2FA in one device) on a phone
I thought the Digital Markets Act in the EU would make it illegal for Apple and Google to prevent people from sideloading apps. Is there some kind of loophole that allows Google to do this anyway?
The EU has lots of laws, including some that were made after the DMA. One of them is the CRA, which says that by the end of 2027 all app marketplaces are required to provide developer contact info to people who download software. If the contact info is fake or wrong, the app marketplace can face fines.
So the app marketplace should probably verify the contact info, right? Would you take on that kind of risk to protect the anonymity of some rando you’ve never met and will never give you any money? I wouldn’t.
I don't understand how side-loading would impact information marketplaces should provide. If it's side-loaded, that's no longer marketplace responsibility.
Good catch. Yes, side-loading directly from the developer website isn’t going to trigger marketplace obligations. Those obligations still exist but are the responsibility of the developer directly.
Under the CRA, smartphones are considered to be much more critical from a security standpoint and, by the end of 2027, will have to follow an enhanced set of “best practices” to be able to enjoy a presumption of conformity. The best practices are due to be published by December of this year. I think Google already knows that developer attestations will be on that list and want to appear proactive instead of reactive.
The point still stands - the DMA does not exist in a vacuum. Other EU laws affect how you interpret it, and you should assume that the EU will pass more laws in the future that also affect how you interpret it.
From what I’ve read Google’s new process sounds much like Apple’s app notarization process. Apple is still in complete control the user just isn’t required to go through the App Store.
Hardly anything left, Apple and Microsoft have their own issues, Web is basically ChromeOS aka Google, and I still cannot buy GNU/Linux or BSD laptops at the local computer store.
just making sure you understand the proposal correctly. you'd still be able to distribute the app through whatever means you want; the app just has to be signed with a key tied your identity that is verified by google, if trying to install on a "certified device" (which will be most devices).
i still disagree with the move. but it's not as bad as it could be. maybe there's a way to "unlock" a certified device (similar to unlocking the bootloader)?
- The requirement, unless I'm mistaken, would tie a real-world identity of the developer to an app, who may wish to keep that separate from a pseudonym they may normally release things with.
- Unwillingness to give Google PII or just not tie a particular pseudonymous identity to that PII on Google.
- It puts absolute control in Google's hands for whether any app is allowed to run on most devices. There may be concerns about the types of decisions that may arise from this, not merely from recognized malware. Certain governments may ask Google to regulate apps allowed on such devices via this approach.
- Once this globally rolls out in 2027 it will mean the audience for apps from devs who don't agree to this will shrink dramatically. Only those presumably with AOSP based custom ROMs will be able to use those apps which may have a knock-on effect for dev motivation.
Google probably feels they need to implement this restriction because too many people are installing apps that bypass their data collection tools and ad tech. Why they would take such a stance in the middle of an anti-trust litigation is beyond me. It makes them look even more like monopolists in light of Apple's recent App-store related foibles. (Aside, I don't personally feel that they are a monopoly, but you have to play the cards you are dealt.)
This whole episode sounds like a great opportunity for somebody to start a truly open source phone company.
Smart phones have been around for
over 15 years. Surely there's enough hardware expertise out there now for a startup to make a mass-market phone that runs Linux.
It's frustrating and sad to see the road that Google is headed down with Android and Pixels. The recent AOSP changes were a big red flag, now this.
I've had many Nexus and Pixel devices because I like the freedom that they offer me. I don't use Apple devices because they're so locked down and I can't use the hardware and software in ways that I'd like to use it. Google's about to be added to that shitlist, and there aren't really many alternatives.
If you truly want to protect your rights then don't petition Google, but instead petition FTC and other antitrust agencies. Petitioning Google just establishes that they have a choice here.
I agree, but under the current administration, the FTC isn't going to do anything to impede a megacorporation's profits. We're fucked, at least for the time being.
Better start a kickstarter or something to collect enough funds to build true open source mobile operating system. Someone will reply that's impossible, but I say it is just a matter of keeping scope small. Basic OS, few most important apps - phone, sms, maybe calendar or alarm, and let users build everything else themselves.
Google is realizing that Apple is right: Curated is better for end users. Android has had a far worse malware problem than iOS; from a security standpoint, authoritative allowlisting is the only thing proven to have significant mitigating effect against malware attacks. Nerds are getting big mad now that Google is demanding the slightest modicum of accountability from them -- nowhere near as comprehensive as the system that helped make the iPhone the premier pick of privacy-conscious folks.
Professional developers stand behind their code with their real names. If you are unwilling to do that much, you should not be able to release software to billions of users on the Android platform. That phone is not a Commodore 64. It is people's link to financial, health, educational, and government services. Compromise can have severe consequences. Just as we lock down corporate PCs to avoid leaking corporate information, phones should be locked down to avoid leaking personal information.
Don't hold your breath for the EU this aligns with the Chat Control being pushed. Banning people from side loading keeps you from escaping their plan of always listening.
Chat Control is a proposed law that will almost certainly be rejected just like the last several times it was proposed, meanwhile actual EU laws are against this.
It's mainly the lack of emergency services support in my country. Every time I called the operator can't see where I am through GPS, first question asked was what state im in.
I used GrapheneOS for about half a year as my primary phone OS. It does not scramble your GPS in any way (it has the same course/fine-grained GPS permissions as regular Android), but it does allow you to block a lot more app permissions. It's more likely that they haven't set the correct permission(s) for that information to bubble through to emergency services.
I would also be surprised if there weren't cell phone system-based fallbacks for emergency services. The carriers have a good idea of where you're at based on the towers you're connected to. There are plenty of situations where GPS doesn't work.
I agree with the spirit of the petition and I will sign it but I think it's better to be a petition to the EU to force google to stop their adversarial interoperabilty.
EU have done it with Apple and their trash lightning cable, forcing them to adopt the USB c standard. EU fined Meta and Google for mishandling our personal data (like all the time), and forced (kinda) both Google and Apple to allow alternative stores. This bs will not fly in the EU.
I will not tell you to stop using Google products and Android, since you are most likely a dev or FOSS on the Android ecosystem. But yeah, Google are pretty evil.
> Just imagine giving sensitive personal, government-issued ID to a corporation to install an app outside Google Play
In Spain, I have to give my NIE (National ID number) and show my government ID just to send or receive a package from FedEx. Why should I have to give up sensitive information just to receive a package?
Can someone articulate for me why everyone seems to be opposed to this?
You can sideload apps on non-google-certified android builds/installs just fine right? If you're going to publish an app that literally be installed on billions of devices, is this not a sensible measure? Long overdue even? Why isn't Windows and Linux distros enforcing this as well is my question!
Do you guys understand that people's lives are being ruined by malware? and the most popular way of deploying malware on the most popular platform (android) is sideloading apps!
This is a similar situation as "Freedom of speech isn't freedom of reach". You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).
I get a petition to allow alternative attestation and verification authorities. and honestly, I don't think Alphabet has much choice on that given EU and US anti-trust policies. I can't image the EU being ok with a US company collecting the IDs of all its developers.
For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example. And that has dramatically reduced rootkit abuse on the platform. Don't get me wrong, I also don't want to submit my ID to anyone. But this is a very sensible measure, one that will improve security in measurable and significant ways to millions of regular people.
> You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).
This is about users freedom to install apps on the devices they own.
> non-google-certified android builds/installs
Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).
> Do you guys understand that people's lives are being ruined by malware?
Do you have figures to back that up? There are already multiple warnings when sideload apps.
> For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example.
I don't have figures to back that up, but I did read some figures on posts regarding this. my comment was based on real-life compromises observed.
Drivers and applications are not the same thing, certainly and no application is the same as other applications. browsers aren't the same as file managers. To users what matters is impact not category. A persons entire life can be destroyed because of one side-loaded app, much less so with a windows rootkit (because you don't have phone number/2fa app,etc.. on your windows box).
Users are free to buy devices that let them install any app. Google is responsible for the majority of users who don't care about installing apps from anonymous randos, but care much much more about their livelihoods and well being suffering at the hands of criminals!
> Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).
Ok, then let's talk about that, I'm all for sticking it to Google for all that b.s., but not for the topic at hand.
I have a lot of third party apps and none of them are by 'anonymous' developers. Presenting the situation as if everyone is exposed to 'anonymous' apps and Google is here to save you is misleading and fear‑mongering.
It really, really sucks to be tricked into installing malware, and I have sympathy for the victims. But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.
We just have to educate people better about how to protect themselves online, not resort to paternalistic control regimes which just happens to give one of the largest tech giants the power to also crush anything that it sees as a threat to their business model.
> But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.
Maybe that's the disconnect here, because i don't think you/others lack empathy for regular people being victimized. You're incorrect about that figure, the people being actually impacted (not merely compromised but harmed, as in financial loss, job loss, harassment, or worse) is many times more than people who want to sideload apps.
Educating people doesn't work. We've been doing it with phishing for decades now , and it has no impact. in the moment, you're sure it's legitimate, so you won't look for obvious signs of phishiness.They use a lure to establish trust in the context, so you guards are down. Absolutely anyone can fall for deceptive lures. No amount of education changes that. You know what made a difference with phishing? Trust senders, DKIM/SPF validation, url-rewriting with sandbox detonation and global-scale reputation analysis/response (it means as soon as you hit one person, your domain/infra gets burned globally) ,etc..
It really frustrates me to no end, because it is the exact audience on HN that innovate and create software/apps but the level of ignorance on this subject is atrocious. I know you guys care as much as I do when people get hurt! It's just a case of knowing a lot about one domain and assuming you also know a lot about a related domain I think.
Even if I'm in the minority it still doesn't justify it. I'm sorry, it sucks, but I don't hold this position because I lack knowledge, I hold it because I think giving up freedom to control our own devices is too much, even if it means people will get hurt. I also perfectly understand how cameras in every home will prevent so much domestic abuse and crime, but I am still against it. Not because I don't understand how many people are victim to these things, but because I think the intrusion on ME is too much.
I agree, people here have no empathy to less technical users. Peoples' lives being ruined is not a hyperbole. You have people losing their life savings due to pig-butchering scams and such. And people here think their convenience and desire to publish apps anonymously outweighs this?
You are free publish source code for your app. You are free to publish unsigned .apk and people who want it will find a way to install it. Once app is installed it's more than a speech: it's a potentially hazardous product. The analogy is how chemists are free to publish formula for any pharmaceutical but are not free to put pharmaceuticals on the market without approval.
You're still freely publishing any apps you want. You want anonymous speech which isn't the same as free speech. And the benefits of that certainly doesn't outweigh harm caused against even one innocent person.
"There's many ways to combat crime" - name one effective way to combat sideloading of apps, that is anywhere as effective as id verification of devs?
Here's one: prosecuting the devs that currently spread malware, block (or warn users for) foreign sources that don't cooperate with law enforcement
You don't need an ID to find the person behind an IP address + timestamp. The line physically goes to a subscriber (yes, also with CGNAT: ISPs are required to keep logs for a reason). The police can do that in any country. Google isn't an elected government that I want to sit on that seat of power
Besides, criminals by definition don't care about laws. Photoediting an ID is not particularly hard, but quite illegal. Tackling the source (the person) ought to help more than impacting everyone who uses a specific distribution mechanism
The devs that write malware are typically in a different jurisdiction, and how can you prosecute them if they're anonymous? That's what this measure does!
The moment they use IPs to find devs and prosecute them , every malware dev will just use a vpn or Tor. or just use a compromised device to route their connection. This is a long running cat and mouse game.
Criminals care about laws if breaking the law is difficult, because laws have consequences. ID verification isn't as simple as "hey, it's an ID, all is good", and now you're on the hook for the much more serious crime of faking IDs and defrauding. It doesn't need to prevent all criminals, it just needs to be a good enough measure that it reduces the amount of abuse significantly.
It's less about saving the concept of anonymous development, more about the tightening grip that the big three companies, Apple, Google and Microsoft (they're making their own moves in the same direction) have on home and personal computing. We would be giving up a lot; this would effectively kill any open source computing products from ever becoming viable. Platforms become fiefdoms, they become shit to use because there's no other choice and can never be. Any app that runs counter to the desires of the parent of the platform can be killed and it becomes impossible to build a competitive ecosystem because the chicken & egg software problem, something which open ecosystems can solve through compatibility laters, but that becomes unviable thanks to DRM and hardware integrity lockouts.
It's a nightmare scenario, our lives locked in to total corporate control. What do we get in return for that? Scammers won't be stopped by this, the key to grifting isn't technology but people. What you're suggesting is trading open platforms and open source and fortifying current marketplace monopolies for a marginal decrease in scams. For a while. Maybe. I suggest that is unbelievably stupid.
How does it kill open source products? The only thing required is for open source contributor who is responsible for publishing .apk to present their ID.
Yeah, and then we should also maybe install spyware on everybody's phones, so the government can scan our phones for child porn, because people are using phones to share child porn you know, and that is bad you know.
And if we're at it, we should maybe also put camera's and microphones in everybody's houses so we can see what everyone's doing all the time, because many children are being hurt in houses you know.
But don't worry, if you don't want all of this you can just get this degoogled phone just around the corner and it works perfect you know, because everybody is using them and there's a big market for it and it's very easy to use.
I can't tell if your argument is a slipper-slope fallacy or a straw-man argument, has to be one or both.
When you sell physical goods, you have to have a business license right? To a small group of people you know, nobody cares. But to mass market goods or services, you need to give the government your id, and they need to be able to hold you accountable, in the event you decide to break the law and/or harm the public.
I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers. Although, they sort of already verify identify, just not using a formal/official way.
You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege.
You can speak with a loud microrphone in public anonymously, but if you want to arrange a protest, you must give your id for the approval. If you want to start a radio or tv station, you must give up your id for the FCC license,etc... software isn't special.
These online petitions are worse than useless. They don’t do anything because they fail to communicate either conviction to a cause or the relevance of the signers. And they may take someone who would otherwise do something useful, like call their elected or participate in public comment, and make them complacent.
An open letter from the lead developers and decision makers of top-rated apps in the Play Store would be useful. But that takes work, unlike an online petition.
Hi, developer of a top-rated app in the Play Store [AnkiDroid].
What do I need to do to make a difference, and how much time will this take?
[My elected officials listen, what's the path? Legislation?]
> What do I need to do to make a difference, and how much time will this take?
EU or US?
> what's the path? Legislation?
Send them a letter explaining why this is bad for you. Keep it strictly factual and ideally concise. Copy Google’s legal [1] and any relevant digital or markets regulators. (If in the US, don’t forget your state regulators.)
Wait two weeks and then call the elected. Make sure they’re aware, and talk through your options. Send a letter thanking them for the call, incorporating any new information and actions they said they would take, and copy all of the previous parties again.
More work: reach out to other top developers and organise an open letter. This will be hard because everyone wants to include their pet issue and everyone will fight over scope and language.
[1] https://support.google.com/faqs/answer/6151275?hl=en
In the US, perhaps try complaining to the lawyers on the DOJ antitrust case as they've been considering splitting Android off from Google.
> try complaining to the lawyers on the DOJ antitrust case as they've been considering splitting Android off from Google
The way to do this is funding an amicus curiae.
what about EU? ChatControl has a website, but I am having trouble finding out who the hell to contact for the requirement for google play integrity in our goverment apps (which was recently changed from requiring hardware integrity, as graphene can only do the latter.), both national and comunitary, and whoever is in charge of the repositories is not responding to the tens of issues opened for it.
Now there's also this new requirement, and it's shocking the EU hasn't responded yet. Weren't we supposed to make ourselves more independent from US technology? But i wouldn't be surprised someone would be lobbying on google's behalf to convince the politicians that "trust me bro, google play is more secure"
> what about EU?
https://digital-markets-act.ec.europa.eu/contact-dma-team_en
JumpCrisscross's reply was really good, and I would like to add additionally that US congress representatives and senators usually maintain local offices in cities in their constituency, and a visit to these offices (usually you can make an appointment by calling them) to discuss issues in person is a very powerful way to be heard. If you aren't in the US, you'll need to find out if your government has anything similar.
You can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma, who lost a large sum of money by installing malware after ignoring multiple warnings.
If you want to make a difference, try to communicate with someone from OEM companies. Google is making their phones inferior and they'll loose money and market share because of it.
After this change, "I can install NewPipe and Ad blockers" will become a major selling point for Chinese phones among large and profitable segments of the population. And that high-end manufacturers might as well give up and let Apple take that part of the market. If OEMs can be made to understand that, that's going to be the end of this initiative.
> can't do anything with respect to legislators. In their eyes, your privacy and the consumer's rights are less important than some grandma
You’re correct, but for the wrong reasons. Privacy framings don’t work because people who care about privacy are unusually politically nihilistic and/or lazy. I’ve worked on privacy legislation. I’ve also worked on other laws. Nobody calls or writes about the former. With the latter, it was almost trivial to demonstrate to the elected that there was real political capital in embracing the issue.
Well, depending on the sort of other laws you've supported, that shouldn't be very surprising.
The special interest of a particular group always result in far more intense support than any law that benefits the public at large. And privacy is usually a general concern.
Also, am I the only one who finds the idea that you need to demonstrate the existence of political capital to elected politicians concerning? (As opposed to persuading them that it's the right thing to do.) I don't want to sidetrack the whole discussion, but this makes me doubt the future of western democracy in a hundred different ways.
They are placebos to make people feel better. https://en.wikipedia.org/wiki/Slacktivism
Petitioning EU lawmakers would be better. American control of European data is already a bit issue at the moment in the face of US threats over Digital taxes and Microsoft being used to punish ICJ members.
EU (and the rest of Europe) are more concerned with controlling their own populations than keeping their data safe from the US. They are very much pro-big business dominance on the internet BECAUSE it makes it easier for them to regulate.
A lot of governments want to use American AI systems to run things to cut costs.
Honestly, I'll be surprised if this plan doesn't break the DMA/DSA already.
Someone will need to collect the necessary resources to bring the fight to the courts, though.
I would be surprised if it did. Aren't they allowing certain verified third party stores, to the likes of the samsung store?
Just like chrome is not a monopoly because firefox exists
The EU is almost ready to sign off on Apple's DMA compliance as sufficient, despite sideloading being similarly restricted, and despite 15-20% commissions remaining. The DMA was never written to allow completely anonymous sideloading, or even commission-free sideloading, another law is needed for that.
https://www.reuters.com/sustainability/boards-policy-regulat...
Wasn't this fairly successful at rasing the profile of the issue? https://www.stopkillinggames.com/
Yes. Not a rando online petition: “we have succesfully escalated complaints on this problem to consumer agencies in France, Germany, and Australia, and have brought forth petitions for new law on this problem to various countries.”
Petitions from verified voters are powerful. Triply so if done in person, because the infrastructure that can collect signatures in person can also e.g. back a primary challenge or plebiscite.
How to plebiscite in 25 states https://ballotpedia.org/Initiated_state_statute
Has legislation been created as a result of that awareness?
And the vast majority of their awareness actually came from a failed counter-campaign by the opposition.
There's also a form here for direct feedback on this topic to Google that may or may not be worth filling out:
https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk...
Such petiotions also fail to communicate legitimacy in a sense that authentic members have signed the petitition. Hence it can also be used adversely to steer the public opinion (although unlikely for the given situation).
Please bear in mind that Google was perfectly aware how much negative feedback they will receive from developers and they are completely and fully prepared for it. In other words, this decision was made with full awareness that developers and "screeching voices of minority" won't like it.
Yep. In the announcement, they already got full green light approval from various governments basically saying this was a great idea and the clear path ahead.
> …with Indonesia’s Ministry of Communications and Digital Affairs praising it for providing a “balanced approach” that protects users while keeping Android open.
> …Thailand’s Ministry of Digital Economy and Society sees it as a “positive and proactive measure” that aligns with their national digital safety policies.
> In Brazil, the Brazilian Federation of Banks (FEBRABAN) sees it as a “significant advancement in protecting users and encouraging accountability.”
The fact that they haven't cited any endorsement from a first-world organization or government is interesting.
I'd be curious to know, if it was because they never asked for one or because they never got one?
FEBRABAN is an association that represents the banks at the federal level, but it's not a government entity.
Did the US government not give endorsement?
The "feature" isn't being rolled out to the US yet, so it doesn't appear that any official statement has been made one way or the other by the US government.
Google is orchestrating buy-in with world governments. They've already signaled that this is happening everywhere, no matter what, and its just a paced rollout unfortunately.
The restrictions are initially limited to those countries.
They can still miscalculate the intensity of the backlash or the willingness of people to do something about it. Many such stories. "The enemy has a plan so let's do nothing" is a great way to get consistently rolled in the world. As the saying goes, everyone has a plan until they are punched in the face; dishing out the occasional (and in this case fully metaphorical) punch in the face is not a hopeless endeavor.
(I agree with some other threads that merely signing a random petition is not a punch to the face. That's just whining. Systematic and organized, perhaps, but just whining.)
The nerds are the ones who pave the way for technology, enabling people around them to adapt more easily to it. They find new paths into the undiscovered land that then get either shut down or commercially exploited. Companies like Google have piggybacked on this volunteer work.
I have the feeling that these companies don't need nerds anymore. Who needs pioneers if everything is paved and regulated?
Do you have evidence that they have accurate estimates of the potential for backlash? It is not that uncommon that people in power take decisions without thinking them though properly
I've got no evidence that they have an estimation of the volume or scale of the feedback.
But I reckon we can all make an educated guess that they did anticipate negative feedback.
You might be right, but didn't same thing applied to Web Environment Integrity stuff, that they ended up stepping back on (for how short of a time stretch is another story)?
First, web environment integrity was about the web as a whole, not about something that is completely owned and under their control. Second, they will not stop trying. It was not their first approach and it won't be the last.
So, I believe that if they decided this is the path they want to take - they will find one way or another. It's not that resistance is futile (it's not!) but I believe that petitions are not a good tool for the case.
What an excellent reason to not mobilize on this issue...
...No. Giving them the loud protest they deserve is the bare minimum
I mean, who is going to stop them, USA doesn't have a functioning government any more -- for large corporations just pay Trump a bribe (eg a "settlement" for a court case; or a very expensive meal ticket) and do what you like.
Google pay fealty to Trump, who is going in to bat for consumers over this when they won't even protect the constitution or rule of law?
I think the biggest impact we can have, besides getting government regulation involved, is building the market share of an alternative.
Yes. A decision like this creates the impetus to move to alternatives like Jolla OS that have an Android-compatible layer.
20 years in, the so-called "smartphone" duopoly have jointly converged towards a "dumb terminal" strategy, where almost nothing can be done without cloud-based authentication from a centralized third party. And this was the case prior to the AI horse manure they're baking into the OS.
I use the Fossify forks of Simple Mobile Tools apps (Gallery, File Manager, Calculator) because these can be installed via APK files and just be left alone. My Google Calculator app on the other hand seems to want to download new updates every single month.
And what alternative would that be? iOS? hah. Hardware and vendor lock in.
AOSP / Graphene, or the equivalent of linux on a smartphone would be a better chance, but first and foremost you need hardware support. Something is happening like eos, pinephone and the like but we are a long, long way toward that goal.
That, and staying away from anything that funnels money to Google.
"Almost completely boiled frog petitions against raising the water temperature another degree"
It's great to see that some more people who were previously complacent are outraged about this move. But let's look back a bit:
In the early 1990s, Linus Torvalds started writing an OS kernel for 386-class PCs. He didn't need the approval of some corporation to allow him to run code on his own machine, or distribute it for others to run on theirs. The code didn't have to run as an "app" in some restricted sandbox under Microsoft's OS (not that back then, DOS or Windows were even in any way locked down the way modern operating systems are). Documentation for all the "standard" hardware like video, keyboard, hard disks, etc. was openly available, so it didn't have to rely on proprietary drivers.
This is how it was at one time, and what should have remained the standard today, but instead it's turned into some utopian dream that those who grew up with "smart" devices can't even conceive as possible anymore.
Google has taken what became of this code, and turned it into an "open" system that is pretty much designed to track every aspect of people's lives in order to more effectively target them with psychological manipulation, which is what advertisements really are. And you're not really getting "free stuff" in return for this invasion either, since pretty much everything you buy includes a hidden "tax" that goes to support this massive industry.
"A supercomputer in everyone's pocket"? Yes, but it's not yours, nor can you even know what it does. Even the source code that is available is millions of lines that you couldn't inspect in all your lifetime. Online 24/7, with GPS tracking your every move and a microphone that listens to what you say. Every URL you visit is logged. Your photos uploaded to "the cloud" and used to train AI.
The only solution is to no longer accept any of this, even if almost everyone else does. Even if it means giving up some convenience.
Google has to be destroyed.
>Google
Apple too, they're the ones who normalized smartphones.
Apple showed the world that a smartphone that was enjoyable to use was possible.
I know it's hard to remember today, but in 2007, Apple was still the perennially-"beleaguered" underdog whose only big success story in marketshare terms was the iPod.
If the public had not loved the iPhone, it never could have "normalized" anything.
There are definitely aspects of the iPhone that it is fair to criticize Apple for. The rest of the world's wholesale embrace of its design—to the point of slavishly copying it, for several manufacturers at different points in time—can only be blamed on their lack of imagination and willingness to take risks, and on the public's unwillingness to give up the benefits of the iPhone just to get the much-less-obvious benefits of something more "open" or different.
By utilizing anti-user language like "sideloading" you are already submitting to their desire to own all hardware.
This. It’s nothing but corporate Newspeak for “installing software”.
"Installing software" is the cause of malware problems where it is allowed to take place indiscriminately. Restricting which software can be installed is pro-end-user.
I am actually super exited about Google's decision. I only used Android because it was the least-worst option. I always hated how restrictive its OS is, and the Play Store, the locking-down of tethering, etc. But I never had enough reason to try a totally open-source smartphone. Until now.
I'm so excited that I might even jump back into open source development to make a new OS that isn't as bloated and slow as Android. There is a need for an OS that only gives you minimum capabilities, to run on cheaper, simpler, smaller devices. I would love to help make that a reality.
Me too. The idea of not being forced to write apps in shitty languages like Java or shitty IDEs like Xcode makes me positively giddy.
whatever you build, it will need to be able to run android apps seamlessly. otherwise it's nonstarter for many users.
I just realized how powerless we are. The situation is almost unavoidable. Majority people will just accept this. They are unaware how restricted they are, thus they don't care.
are there enough devs to make "non-certified" phones? also i wonder if you'll be able to disable the verification check similar to bootloader unlocking.
Non-certified phones won't be sold in Western markets. This whole scheme has one goal only, and that's to snuff out DRM-unfriendly third party apps like alternative Youtube clients, videogame emulators and P2P file sharing apps.
Like Fairphone.nl, Shift.eco, Murena.com...?
They're being sold and enough people are buying them to keep these companies alive. Fairphone said they're not delivering to USA because they don't have the manpower, not because there's no demand. Every release again you see people asking in the comments when/if it'll finally be available to them
That's not to say it's a big market where you get big economy of scale benefits. The devices are expensive but they're yours (and some of them try to do ethical resource mining and/or pay fair wages as well). Some of these will also have Googled variants available, but it's a choice
They don't have the manpower to drop off some USA-bound boxes at the same shipping carrier they use for their EU deliveries? I highly doubt that. They likely don't want to bother with FCC approval, opposition from Google about selling de-Googled Android or produce separate SKUs for US-specific 5G frequencies.
They likely don't want to bother...
or they don't have the manpower to take care of...
what i'm saying is it's time to make a new company. this is a matter of maintaining good technology and avoiding enshitification so it's quite important.
That's my point. Who is going to create a company to compete with Google and Apple on the smartphone front? They already ran everybody else out of business (Palm WebOS, BlackberryOS, Windows Phone). The alternatives are already here but they don't operate in North America (Huawei HarmonyOS, Jolla OS, Pinephone).
Why not you? The beauty of open source is that you don't need to wait to make something happen if you really want it to happen.
A phone OS is not a hobby project. Just because something is open source doesn't mean there are no development costs.
yeah that's what i'm saying. but obviously the problem is funding.
so do we have enough engineers who care about maintaining useful tools that aren't handicapped or compromised to be able to support this endeavor? i think we do. there have to be many good eggs within these companies who die a little inside each time something like this goes through.
> They already ran everybody else out of business (Palm WebOS, BlackberryOS, Windows Phone).
Only because those alternative mobile OSes were, frankly, crappy in comparison to iOS and Android.
I don't recall Google or Apple doing anything particularly anticompetitive to cause any of those OSes to fail to keep up in the market, aside from just plain "being the 800lb gorillas in the room". (Not saying they never do anything anticompetitive, just that those particular market failures can't be laid at their feet.)
It would be great to have some really good alternatives to the mobile duopoly. Hell, if we had more fragmentation in the market, that would even lead to more impetus for interoperability and common standards—which we desperately need more of everywhere in tech these days. But those three, in particular? They lost because they were worse at being a good mobile OS for most people.
Build for the web. App stores are overrated. They will continue to make the same mistakes until they are irrelevant. Eventually.
It is a social problem which is hard to reverse.
People use app stores because they are used for artificially worsened web pages. They are used to find apps with similar properties from app store.
And Google search is artificially so bad that they won’t even try it to find some apps. And most won’t use other search engines.
It’s not purely social. A lot of web apps are legitimately poor, probably because the web has become the go-to platform for those looking to cut costs, who aren’t willing to pay for quality talent. This why there’s such a gulf between VS Code (not technically a web app, but built with web tech) and MS Teams for example: the former has had no expenses spared to woo devs and give MS legitimacy in software dev while the latter only needs to technically function since its audience is captive, so quality can be an afterthought.
So really, people need to start rejecting poor quality or poorly performing web apps. The collective bar for “good enough” is far too low, and so cheapskates will continue to churn out garbage.
Whether web or native is better is hardly relevant to the core of this issue IMO, which is about fundamental rights to admin our own devices. Having to make a network request to fetch an external resource every time you want to run code on your own device is sort of a non-solution to this problem.
For a while, I had stopped flashing custom ROMs because the default Android experience was good enough for me, but it looks like this is now necessary again.
And then you cannot use your phone for payments.
> And then you cannot use your phone for payments.
That's why you have a debit card. And if your bank won't give you a debit card, you find a better bank.
one of my banks requires an app on my phone or desktop. the android app does not work on /e/OS, it needs an original google android system. the desktop app runs only on original windows (tested wine, it doesn't work) for any payment i make. only withdrawing cash from an ATM doesn't need 2FA.
How would this work with say my syncthing fork or DJI fly? Web doesn't really work here.
Re DJI Fly: a combination of WebBluetooth, WebRTC, the normal location API, offline web pages (through managed caches), regular browser video features, and a bunch of other web technologies.
Re SyncThing: there's the File System Access API. You can ask the user for a folder and then operate on the files and directories inside it. Also from a locally cached offline copy, of course. Serviceworkers are there to run in the background, though I'm not 100% sure if the FS API and service workers can be combined to be honest.
It'll need as much effort or maybe even more to port it to the web as it has taken to develop the Android app, but it's almost definitely possible, at least on Chrome.
As part of Google's attempt to break free from the iOS app store, they accidentally invented an alternative to their own draconic measures.
FS API is Chrome only though, and a lot of people use Firefox for Android for access to real uBO since Chrome for Android conveniently never gained support for extensions.
With apps on the web you are inherently dependent on the respective web site operating. Local software provides more independence for users (in addition to certain UX benefits).
The same web we can then only access via approved browsers?
Then is now. Projects like Anubis and OpenStreetMap explicitly don't support uncommon setups, you just don't get to use those parts of the internet. When talking to e.g. OpenStreetMap sysadmins, the reason given was that they see no other way to keep the site online and available for anyone
The web is dying at the same time as mobile OS freedoms, while important organisations such as governments and banks are moving away from browser access and towards doing everything (including 2FA in one device) on a phone
I thought the Digital Markets Act in the EU would make it illegal for Apple and Google to prevent people from sideloading apps. Is there some kind of loophole that allows Google to do this anyway?
The EU has lots of laws, including some that were made after the DMA. One of them is the CRA, which says that by the end of 2027 all app marketplaces are required to provide developer contact info to people who download software. If the contact info is fake or wrong, the app marketplace can face fines.
So the app marketplace should probably verify the contact info, right? Would you take on that kind of risk to protect the anonymity of some rando you’ve never met and will never give you any money? I wouldn’t.
I don't understand how side-loading would impact information marketplaces should provide. If it's side-loaded, that's no longer marketplace responsibility.
Good catch. Yes, side-loading directly from the developer website isn’t going to trigger marketplace obligations. Those obligations still exist but are the responsibility of the developer directly.
Under the CRA, smartphones are considered to be much more critical from a security standpoint and, by the end of 2027, will have to follow an enhanced set of “best practices” to be able to enjoy a presumption of conformity. The best practices are due to be published by December of this year. I think Google already knows that developer attestations will be on that list and want to appear proactive instead of reactive.
The point still stands - the DMA does not exist in a vacuum. Other EU laws affect how you interpret it, and you should assume that the EU will pass more laws in the future that also affect how you interpret it.
From what I’ve read Google’s new process sounds much like Apple’s app notarization process. Apple is still in complete control the user just isn’t required to go through the App Store.
I am not an iOS user, so I wasn't aware of how it worked. In that case the DMA is completely worthless.
Isn't Apple already getting sued for having that process?
It's too late. As a developer, I'm pulling all my Android apps away from the Play Store.
If Google is hostile to me an my users, I prefer to dedicate my volunteer time to respectful plateforms instead.
Hardly anything left, Apple and Microsoft have their own issues, Web is basically ChromeOS aka Google, and I still cannot buy GNU/Linux or BSD laptops at the local computer store.
Which platform though?
just making sure you understand the proposal correctly. you'd still be able to distribute the app through whatever means you want; the app just has to be signed with a key tied your identity that is verified by google, if trying to install on a "certified device" (which will be most devices).
i still disagree with the move. but it's not as bad as it could be. maybe there's a way to "unlock" a certified device (similar to unlocking the bootloader)?
I think there are a few main contentions:
- The requirement, unless I'm mistaken, would tie a real-world identity of the developer to an app, who may wish to keep that separate from a pseudonym they may normally release things with.
- Unwillingness to give Google PII or just not tie a particular pseudonymous identity to that PII on Google.
- It puts absolute control in Google's hands for whether any app is allowed to run on most devices. There may be concerns about the types of decisions that may arise from this, not merely from recognized malware. Certain governments may ask Google to regulate apps allowed on such devices via this approach.
- Once this globally rolls out in 2027 it will mean the audience for apps from devs who don't agree to this will shrink dramatically. Only those presumably with AOSP based custom ROMs will be able to use those apps which may have a knock-on effect for dev motivation.
Yeah,that's still really bad. I own the device, period.
De-anonymization is being done for the same reason manifest v3 was - to help their youtube revenue.
Google probably feels they need to implement this restriction because too many people are installing apps that bypass their data collection tools and ad tech. Why they would take such a stance in the middle of an anti-trust litigation is beyond me. It makes them look even more like monopolists in light of Apple's recent App-store related foibles. (Aside, I don't personally feel that they are a monopoly, but you have to play the cards you are dealt.)
This whole episode sounds like a great opportunity for somebody to start a truly open source phone company.
Smart phones have been around for over 15 years. Surely there's enough hardware expertise out there now for a startup to make a mass-market phone that runs Linux.
There has been a dozen attempts already.
Does Google ever care about petitions? Maybe stop using Google products is a better start.
So what phone manufacturer should we go to? Apple, who has always heavily restricted software installation on their devices?
It's frustrating and sad to see the road that Google is headed down with Android and Pixels. The recent AOSP changes were a big red flag, now this.
I've had many Nexus and Pixel devices because I like the freedom that they offer me. I don't use Apple devices because they're so locked down and I can't use the hardware and software in ways that I'd like to use it. Google's about to be added to that shitlist, and there aren't really many alternatives.
When I was back there in Seminary School
There was a person there
Who put forth the proposition
That you can petition the Lord with prayer
Petition the Lord with prayer
Petition the Lord with prayer
You cannot petition the Lord with prayer!
If you truly want to protect your rights then don't petition Google, but instead petition FTC and other antitrust agencies. Petitioning Google just establishes that they have a choice here.
I agree, but under the current administration, the FTC isn't going to do anything to impede a megacorporation's profits. We're fucked, at least for the time being.
Better start a kickstarter or something to collect enough funds to build true open source mobile operating system. Someone will reply that's impossible, but I say it is just a matter of keeping scope small. Basic OS, few most important apps - phone, sms, maybe calendar or alarm, and let users build everything else themselves.
The users are gonna build replacements for Uber, car parking apps, bank apps, etc?
Do you really have to give personal details, or can't it just be company details?
What would a company fill in for these details for the developer deployment account they are using to deploy the apps made by their software team?
Is the account that publishes Spotify or Facebook app etc really going to be personal information for some person? I highly doubt that.
Clickable: https://chng.it/MsHzSXtJnw
This whole debacle is going to make me buy a dumbphone, there is literally no reason to buy a modern smartphone if you can't sideload apps.
Only government intervention will matter, petition EU regulators instead, perhaps: https://www.europarl.europa.eu/petitions/en/home
Save your effort and invest it in making alternative OS better.
Google is realizing that Apple is right: Curated is better for end users. Android has had a far worse malware problem than iOS; from a security standpoint, authoritative allowlisting is the only thing proven to have significant mitigating effect against malware attacks. Nerds are getting big mad now that Google is demanding the slightest modicum of accountability from them -- nowhere near as comprehensive as the system that helped make the iPhone the premier pick of privacy-conscious folks.
Professional developers stand behind their code with their real names. If you are unwilling to do that much, you should not be able to release software to billions of users on the Android platform. That phone is not a Commodore 64. It is people's link to financial, health, educational, and government services. Compromise can have severe consequences. Just as we lock down corporate PCs to avoid leaking corporate information, phones should be locked down to avoid leaking personal information.
Petitions to big corporations are a waste of time. You're just keeping change.org alive. Good luck regardless.
change.org is useless
Hello, I'm Connor Murphy, a student at gsu Atlanta GA. I have had android since the first came out, don't make me an apple guy please.
Was it prevent side loading fully or was it just publishing on Play store will require verification?
From the OP: "It affects independent developers, FOSS contributors, and even regular users who want to install apps outside of Google Play"
Google ki ma ki chut
That's nice, but they won't care
Well I signed the petition, not holding my breath.
If anything this just gives me more reasons to seriously look at linux phone options.
Don't hold your breath for the EU this aligns with the Chat Control being pushed. Banning people from side loading keeps you from escaping their plan of always listening.
Chat Control is a proposed law that will almost certainly be rejected just like the last several times it was proposed, meanwhile actual EU laws are against this.
Did a petition ever worked ?
I'll switch my Pixel over to GrapheneOS if this happens
Why wait? I’ve never installed many apps on my phone, but I don’t have any problems using graphene. My bank nor credit card apps have any problem.
It's mainly the lack of emergency services support in my country. Every time I called the operator can't see where I am through GPS, first question asked was what state im in.
That might be because GrapheneOS by default scrambles your GPS location but I think you should be able to turn that off?
I used GrapheneOS for about half a year as my primary phone OS. It does not scramble your GPS in any way (it has the same course/fine-grained GPS permissions as regular Android), but it does allow you to block a lot more app permissions. It's more likely that they haven't set the correct permission(s) for that information to bubble through to emergency services.
I would also be surprised if there weren't cell phone system-based fallbacks for emergency services. The carriers have a good idea of where you're at based on the towers you're connected to. There are plenty of situations where GPS doesn't work.
Step 1: Block non-approved install of apks in my devices
Step 2: Block non-approved install of Operating Systems in my devices
Deeply mine: Alphabet Inc.
I expect the only entity powerful enough to create a fork of android, hardware included, is the CCP. Between a rock and a sword.
Why would you kneecap yourself on hardware and get a Pixel over an iPhone if not to install Graphene as the very first action post-unboxing?
Graphene is the only reason I own any pixel devices.
I agree with the spirit of the petition and I will sign it but I think it's better to be a petition to the EU to force google to stop their adversarial interoperabilty.
EU have done it with Apple and their trash lightning cable, forcing them to adopt the USB c standard. EU fined Meta and Google for mishandling our personal data (like all the time), and forced (kinda) both Google and Apple to allow alternative stores. This bs will not fly in the EU.
I will not tell you to stop using Google products and Android, since you are most likely a dev or FOSS on the Android ecosystem. But yeah, Google are pretty evil.
- sent from my Android - /s
> Just imagine giving sensitive personal, government-issued ID to a corporation to install an app outside Google Play
In Spain, I have to give my NIE (National ID number) and show my government ID just to send or receive a package from FedEx. Why should I have to give up sensitive information just to receive a package?
Bombs, mostly. Also drugs, which are cash-adjacent.
What a great example of whataboutism. This has nothing to do with the subject.
Can someone articulate for me why everyone seems to be opposed to this?
You can sideload apps on non-google-certified android builds/installs just fine right? If you're going to publish an app that literally be installed on billions of devices, is this not a sensible measure? Long overdue even? Why isn't Windows and Linux distros enforcing this as well is my question!
Do you guys understand that people's lives are being ruined by malware? and the most popular way of deploying malware on the most popular platform (android) is sideloading apps!
This is a similar situation as "Freedom of speech isn't freedom of reach". You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).
I get a petition to allow alternative attestation and verification authorities. and honestly, I don't think Alphabet has much choice on that given EU and US anti-trust policies. I can't image the EU being ok with a US company collecting the IDs of all its developers.
For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example. And that has dramatically reduced rootkit abuse on the platform. Don't get me wrong, I also don't want to submit my ID to anyone. But this is a very sensible measure, one that will improve security in measurable and significant ways to millions of regular people.
> You can publish any android app you want, that doesn't give you the right to anonymously deploy those apps on everyone's personal tracking devices (phones).
This is about users freedom to install apps on the devices they own.
> non-google-certified android builds/installs
Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).
> Do you guys understand that people's lives are being ruined by malware?
Do you have figures to back that up? There are already multiple warnings when sideload apps.
> For about a decade now, on Windows, you are required to have an ID-verified code signing certificate so sign drivers for example.
Drivers and applications are not the same things.
I don't have figures to back that up, but I did read some figures on posts regarding this. my comment was based on real-life compromises observed.
Drivers and applications are not the same thing, certainly and no application is the same as other applications. browsers aren't the same as file managers. To users what matters is impact not category. A persons entire life can be destroyed because of one side-loaded app, much less so with a windows rootkit (because you don't have phone number/2fa app,etc.. on your windows box).
Users are free to buy devices that let them install any app. Google is responsible for the majority of users who don't care about installing apps from anonymous randos, but care much much more about their livelihoods and well being suffering at the hands of criminals!
> Those targets are rapidly disappearing. Alternative Android ROMs are dying one by one. Look at how few modern phones are officially supported by LineageOS. And many of those are Pixels which Google is no longer releasing binaries for (making ROM builders lives harder).
Ok, then let's talk about that, I'm all for sticking it to Google for all that b.s., but not for the topic at hand.
I have a lot of third party apps and none of them are by 'anonymous' developers. Presenting the situation as if everyone is exposed to 'anonymous' apps and Google is here to save you is misleading and fear‑mongering.
It really, really sucks to be tricked into installing malware, and I have sympathy for the victims. But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.
We just have to educate people better about how to protect themselves online, not resort to paternalistic control regimes which just happens to give one of the largest tech giants the power to also crush anything that it sees as a threat to their business model.
> But this measure will remove so much freedom from a much larger group of people, and therfore it isn't justified.
Maybe that's the disconnect here, because i don't think you/others lack empathy for regular people being victimized. You're incorrect about that figure, the people being actually impacted (not merely compromised but harmed, as in financial loss, job loss, harassment, or worse) is many times more than people who want to sideload apps.
Educating people doesn't work. We've been doing it with phishing for decades now , and it has no impact. in the moment, you're sure it's legitimate, so you won't look for obvious signs of phishiness.They use a lure to establish trust in the context, so you guards are down. Absolutely anyone can fall for deceptive lures. No amount of education changes that. You know what made a difference with phishing? Trust senders, DKIM/SPF validation, url-rewriting with sandbox detonation and global-scale reputation analysis/response (it means as soon as you hit one person, your domain/infra gets burned globally) ,etc..
It really frustrates me to no end, because it is the exact audience on HN that innovate and create software/apps but the level of ignorance on this subject is atrocious. I know you guys care as much as I do when people get hurt! It's just a case of knowing a lot about one domain and assuming you also know a lot about a related domain I think.
Even if I'm in the minority it still doesn't justify it. I'm sorry, it sucks, but I don't hold this position because I lack knowledge, I hold it because I think giving up freedom to control our own devices is too much, even if it means people will get hurt. I also perfectly understand how cameras in every home will prevent so much domestic abuse and crime, but I am still against it. Not because I don't understand how many people are victim to these things, but because I think the intrusion on ME is too much.
I agree, people here have no empathy to less technical users. Peoples' lives being ruined is not a hyperbole. You have people losing their life savings due to pig-butchering scams and such. And people here think their convenience and desire to publish apps anonymously outweighs this?
Yes, I do think the benefits of free speech outweigh risks from criminals who will publish bad software
There's many ways to combat crime. Banning free distribution of software is one of the options but not the one I'd pick from the menu first
You are free publish source code for your app. You are free to publish unsigned .apk and people who want it will find a way to install it. Once app is installed it's more than a speech: it's a potentially hazardous product. The analogy is how chemists are free to publish formula for any pharmaceutical but are not free to put pharmaceuticals on the market without approval.
You're still freely publishing any apps you want. You want anonymous speech which isn't the same as free speech. And the benefits of that certainly doesn't outweigh harm caused against even one innocent person.
"There's many ways to combat crime" - name one effective way to combat sideloading of apps, that is anywhere as effective as id verification of devs?
Here's one: prosecuting the devs that currently spread malware, block (or warn users for) foreign sources that don't cooperate with law enforcement
You don't need an ID to find the person behind an IP address + timestamp. The line physically goes to a subscriber (yes, also with CGNAT: ISPs are required to keep logs for a reason). The police can do that in any country. Google isn't an elected government that I want to sit on that seat of power
Besides, criminals by definition don't care about laws. Photoediting an ID is not particularly hard, but quite illegal. Tackling the source (the person) ought to help more than impacting everyone who uses a specific distribution mechanism
The devs that write malware are typically in a different jurisdiction, and how can you prosecute them if they're anonymous? That's what this measure does!
The moment they use IPs to find devs and prosecute them , every malware dev will just use a vpn or Tor. or just use a compromised device to route their connection. This is a long running cat and mouse game.
Criminals care about laws if breaking the law is difficult, because laws have consequences. ID verification isn't as simple as "hey, it's an ID, all is good", and now you're on the hook for the much more serious crime of faking IDs and defrauding. It doesn't need to prevent all criminals, it just needs to be a good enough measure that it reduces the amount of abuse significantly.
It's less about saving the concept of anonymous development, more about the tightening grip that the big three companies, Apple, Google and Microsoft (they're making their own moves in the same direction) have on home and personal computing. We would be giving up a lot; this would effectively kill any open source computing products from ever becoming viable. Platforms become fiefdoms, they become shit to use because there's no other choice and can never be. Any app that runs counter to the desires of the parent of the platform can be killed and it becomes impossible to build a competitive ecosystem because the chicken & egg software problem, something which open ecosystems can solve through compatibility laters, but that becomes unviable thanks to DRM and hardware integrity lockouts.
It's a nightmare scenario, our lives locked in to total corporate control. What do we get in return for that? Scammers won't be stopped by this, the key to grifting isn't technology but people. What you're suggesting is trading open platforms and open source and fortifying current marketplace monopolies for a marginal decrease in scams. For a while. Maybe. I suggest that is unbelievably stupid.
How does it kill open source products? The only thing required is for open source contributor who is responsible for publishing .apk to present their ID.
Yeah, and then we should also maybe install spyware on everybody's phones, so the government can scan our phones for child porn, because people are using phones to share child porn you know, and that is bad you know.
And if we're at it, we should maybe also put camera's and microphones in everybody's houses so we can see what everyone's doing all the time, because many children are being hurt in houses you know.
But don't worry, if you don't want all of this you can just get this degoogled phone just around the corner and it works perfect you know, because everybody is using them and there's a big market for it and it's very easy to use.
Or maybe not
I can't tell if your argument is a slipper-slope fallacy or a straw-man argument, has to be one or both.
When you sell physical goods, you have to have a business license right? To a small group of people you know, nobody cares. But to mass market goods or services, you need to give the government your id, and they need to be able to hold you accountable, in the event you decide to break the law and/or harm the public.
I think this is something governments should have enforced long ago. Even linux distros with > N number of users should be required by law to id-verify package publishers. Although, they sort of already verify identify, just not using a formal/official way.
You have the right to free speech, anonymity and privacy. But being able to reach and impact the public is not a right, it is a privilege.
You can speak with a loud microrphone in public anonymously, but if you want to arrange a protest, you must give your id for the approval. If you want to start a radio or tv station, you must give up your id for the FCC license,etc... software isn't special.
Company details, sure. But personal details?!