Uncomfortable Questions About Android Developer Verification

https://commonsware.com/blog/2025/08/26/uncomfortable-questions-android-developer-verification.html

by ingve • 11 months ago

400 294 11 months ago

commonsware.com

sschueller• 11 months ago

The requirement of verification to side-load any app is fascist control. It is clear as night and day.

Shame on Google and Apple, it was always clear this was the end goal and next up is also your PC.

Right after will come the removal off apps they don't like and there is nothing you can do about it.

Stallman was right

mettamage• 11 months ago

I asked an LLM, so I think I get it but could you try to mention what is meant with "Stallman was right"? The reason I'm asking you and not posting the LLM answer is because it still feels a bit icky to post an LLM answer for everything I don't understand [1].

[1] Feel free to discuss this too, if you want. I'm developing my opinion on it.

progval• 11 months ago

Probably https://www.gnu.org/philosophy/right-to-read.en.html , mentioned elsewhere in the thread.

LambdaComplex• 11 months ago

Richard Stallman has spent basically his entire career trying to convince people that all software should be free as in freedom, so that people truly control the devices that they own--preventing things like Google being able to lock users out of the ability to install applications on a device that they purchased.

Read up on the principles of the Free Software Foundation if you want all the details.

bigstrat20038• 11 months ago

Stallman has a long history of being very abrasive and ideological. He is the kind of guy who makes zero concessions for practicality, and he insists on prioritizing user freedom because he has always feared that otherwise users will be locked out of having the ability to truly control their computers. It's always been kind of easy to laugh at his crusade because of how zealous he is, and how absurd the scenarios he warns about seem to be. The thing is... he seems to have been right the whole time. Companies really do want to lock you out of controlling the devices you own, and do so at the first opportunity. So... Stallman was right.

fzeindl• 11 months ago

I find Stallmans views are best summed up by this quote from him:

“I could have made money this way, and perhaps amused myself writing code. But I knew that at the end of my career, I would look back on years of building walls to divide people, and feel I had spent my life making the world a worse place.”

Sammi• 11 months ago

In this case it worked out well as a rhetorical device to make you look it up and learn something. Sometimes leaving out something for the reader to wonder about is more powerful.

timeon• 11 months ago

next up is also your PC

Already starting on macos. Gatekeeper had setting where you could allow any app. Now it is removed. While still possible to allow individual app (you need to do it after every OS update), trajectory is now clear.

Citizen8396• 11 months ago

boot into Recovery, run "csrutil disable" and do whatever you want (not a recommendation)

enriquto• 11 months ago

The requirement of verification to side-load any app is fascist control.

Even the language we are using to describe the situation is problematic. Why do we say "side-load an app"? It should be just "run a program"!

An OS that doesn't let you run programs of your choice is laughable.

preisschild8• 11 months ago

It should be just "run a program"!

More accurate would be "run a program not approved by Google"

opan3• 11 months ago

I think I have an old comment about this, but there is an actual `adb sideload` command for installing an apk on your phone from your computer. Since it's from your computer and not the phone itself, it's sideloading and not frontloading, I guess. Weirdly, and wrongly, people have also started to use the term to refer to just installing apps from outside the official appstores, but that's not sideloading. It's just installing an app. It's a normal Android feature. You can just grab a .apk file with your browser and install it like you would a .exe file on Windows.

iOS on the other hand historically required a jailbreak for this. I think that's where the confusion started. Android doesn't need a jailbreak, it doesn't need root (privileges), it doesn't need a custom ROM. You can just install stuff, it's normal. I think iOS users don't realize how different Android is and they just start repeating words like sideload and root without knowing what they mean, assuming it's just Android-speak for a jailbreak. They don't realize there's no jail in the first place.

I am aware English is a living language, and if enough people are wrong for long enough, they stop being wrong, but it's certainly painful to witness.

pjmlp6• 11 months ago

PC only turned out open, because IBM never saw it coming, and when they tried to get control back it was too late.

pjerem• 11 months ago

Yep. PC openness is totaly a bug and not a feature of the capitalism. We should cherish this situation and fight for it because it really feels like the other long term alternative is techno-fascism.

thrance2• 11 months ago

I'm all for calling out fascist behavior when it is spotted, but let's not muddy the waters further. This word is already denatured enough.

This is not fascism, this is just a rational move from Google in a market economy. It feels like every time something like this happens, Americans rediscover what capitalism is and implies, then blame it on "human nature", "greed" or "fascism".

rchaud• 11 months ago

Google's stated reason for doing this says nothing about it being for market reasons, but rather for "security".

fsflover14• 11 months ago

This is not fascism, this is just a rational move from Google

Google is not very separable from the US government, and they use illegal monopoly everywhere without any oversight.

selfmodruntime• 11 months ago

One day people on the internet will learn what the term „fascism“ entails. This is just plain old government overreach.

tremon• 11 months ago

"Government overreach" by a private corporation? Let's see what wikipedia has to say about that:

A fascist corporation can be defined as a government-directed confederation of employers and employees unions, with the aim of overseeing production in a comprehensive manner.

https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatis...

Google goes even further than that: they do not only control and oversee all production via the Play Store, they also control all usage of their products. And while it may currently not be government-directed, they certainly are government-protected as long as they're allowed to run the only app store in town.

maxlin2• 11 months ago

I'm absolutely against this and for similar reasons have boycotted Apple for my entire life on hard ideological grounds, but not everything is "fascist" lol. Don't misuse the term.

In any case, I hope this blows up in Google's face hard, ROMs like LineageOS become as popular they were back in their heyday, and root hiders get extra attention too so banking apps etc work seamlessly as on non-rooted phones. Requiring some developer ID crap is essentially as bad as Apple has it, reason for which I've always considered developers having Apple phones quite unserious.

JeremyNT• 11 months ago

They're not going to publish device trees for pixel phones, so what hardware will you use?

Commercial apps and services will require passkeys and device attestation, so you'll only be able to use open source software even if you have a device to run it.

The walls are closing in, and it's not just mobile. It's only a matter of time before passkeys are used to block Linux users from the commercial Internet as well.

pastage• 11 months ago

So no F-Droid?

sdex• 11 months ago

Fdroid signs builds with own key, so it shouldn't be a problem if they pass this verification.

BrenBarn3• 11 months ago

It won't be a problem. . . until Google revokes their accreditation for some reason they won't explain.

mzajc• 11 months ago

As far as I understand, verification is tied to the package name (or at least the prefix). Since F-Droid packages thousands of applications from different developers, I don't see how they could reasonably get verified.

userbinator2• 11 months ago

This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile.

"debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read, 1997

raverbashing3• 11 months ago

Stallman's fallacy is thinking every system is perfect and unbreakable and that people have a perfect understanding of software and systems (for better or for worse)

People will be running pirated debugger copies if that comes to shove

99.9% of people DNGAF about OSS. They do care about doing what they need on their phone without malware/bloatware/nagware

Also publishing and development are separate activities

superkuh3• 11 months ago

Your fallacy is thinking that authoritarian governments care about enforcement or successful enforcement of such laws. The goal is to create a status quo in which all citizens break many laws daily and so are already guilty if they ever rock the boat and disturb those in power.

Stallman's "Right to Read" is an accurate reflection of reality in that sense.

01HNNWZ0MV43FF• 11 months ago

Yeah and people had gay sex when it was illegal but it still is a shameful injustice for the government to decide what software I run on my own hardware

kazinator• 11 months ago

I doubt that Stallman, of all people, thinks literally that. But systems which are breakable have ways of improving themselves, closing off the exploitable holes. So it makes sense to regard systems as being eventually unbreakable. Or at least having an unacceptably long "mean time between cracks". The game plan cannot simply be "oppressive software and hardware systems will always have imperfections so the good people will cheerfully get around them", even if is is de facto that way at some point in time w.r.t. certain systems. That's actually a kind of defeatist attitude disguised as optimism; passively accepting crap based on the faith that you will scrape through somehow.

_imnothere• 11 months ago

They do care about doing what they need on their phone without malware/bloatware/nagware

Yeah you're absolutely right, tell that to Facebook/Instagram/Temu/TikTok/Pinduoduo/(any other _spying_ apps) users.

recursivecaveat• 11 months ago

I wouldn't bet on hackers saving us from everything. There are 150 million Nintendo Switches in the world, and nobody has figured out how to jailbreak one without getting into the hardware and shorting some wires (and even then only on early unpatched models). I don't think its out of the realm of possibility to make a best-selling phone that stays uncrackable for the general population for its entire lifecycle.

teekert6• 11 months ago

Why is it so complex to have a foss mobile OS.

I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that).

For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in them, is it on me? IDK, our government even has an identity app for iOS and Android. I should not be using it, I should stick to web. But its so much more convenient. I'm just weak, aren't I?

Maybe I should go for Ubuntu touch, with an iPad on the side or something. At least my most personal device is something I control then. Or just keep my Linux laptop handy (or make a cyberdeck!). But I want a computing platform that does not require carrying a bag. It's kinda sad. Even GrapheneOS (one of the most personal and secure mobile computing experiences out there)'s future is in the hands of its greatest adversary, the one that does not want you to have a personal computing experience.

charcircuit4• 11 months ago

Do not forget Android is also a FOSS mobile OS.

Almondsetat• 11 months ago

Linux is 30 years old, and still it has a laughable percentage of desktop usage. Plus, the only reason it's even usable is because of the relentless work by thankless developers for reverse engineering device drivers. On smartphones this is orders of magnitude more difficult. How do you properly profile and debug a random modem in a phone? What about the cameras?

So, how can anyone expect FOSS mobile OSs to ever exist unless forced by law by the US or something?

mac-mc• 11 months ago

It's pretty obvious, it's costly to make one that is up to the level of quality of commercial ones. It's not a mistake that the 2 mobile oses are owned and created by some of the largest and most profitable companies in the world.

positron265• 11 months ago

Mobile OSs are very consumer focused. I have criticized the FSF for, in there lengthily argued ways, abandoning the consumer.

You have to commercialize openness if you want the muscle of the consumer to be able to produce it.

Short presentation of the basic concept: https://youtu.be/SO46oEdlkY8

Some things with massive value in excess of the cost of production cannot be pursued by capital nor bought by the individual. Your choices are government, non-profit, or something in between all three. PrizeForge aims to be between all three and to completely change how we do consumer open source, incidentally bringing billions of dollars into making it.

csomar• 11 months ago

Mostly because the "web" was sabotaged. I use archlinux and my only GUI application is a web browser. On mobile, I need an email app, maps app, food delivery app and a communication app. Even whatsapp doesn't work on the web (on purpose).

If the web was enabled, app stores wouldn't be possible and you could run anything without an installation. But somewhere along the line both Google and Apple realized that this isn't really to their benefit and "walled ecosystems" are an advantage.

rattyJ2• 11 months ago

I could be one of the people running an ungoogled phone, but my bank refuses to have an app that runs on an ungoogled OS for "security"

kelnos2• 11 months ago

Why is it so complex to have a foss mobile OS.

In a way it's not. As you mention, we have several of them. But they won't have mass-market appeal until they can run the same sorts of apps that Android and iOS can run. And no, "just use the mobile website" is not an answer.

How do I deposit a check with my bank on my phone without the app? I can't; the mobile website doesn't have that functionality. How do I send someone money via Zelle without the app? I can't; the mobile website doesn't have that functionality.

How do I use contactless payments? I can't; the ability to build an app like Google Wallet or Apple Pay requires deep pockets and trusted payments industry connections that open source mobile OS developers will likely never have.

How do I use Google's productivity suite? I can't; the mobile websites aren't functional enough. How do I use Microsoft's? Ditto.

How do I use the remote-lock functionality of my car? I can't; that's only available through the Android and iOS apps.

I could go on, and on, and on, but I think you see the point. Many people who advocate for these alternative OSes don't get it. "Do you really need that functionality?", they ask. "Why can't you just do that stuff in a web browser on your laptop instead of on your phone?", they ask. "Just use a physical credit card like I do!" And then they wonder why their alternative mobile OS will never go mainstream.

People actually really care about those features and capabilities. It doesn't matter if the people who build these alternative mobile OSes don't care, or think they're stupid, or unsafe, or bad for privacy, or whatever. If you don't build what people want, they won't use your stuff.

Emulating Android sufficiently well enough to run Android apps is a decent start, but so many apps rely on Play Services and Play Integrity that it's a losing battle, or at best a cat-and-mouse game to keep things working.

On top of that, mobile chipset BSPs require financial commitments and being a Real Company. Most open source outfits can't cross that bar, and the likes of Qualcomm will be wary dealing with an organization that wants to do open source.

preisschild8• 11 months ago

For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in them, is it on me? IDK, our government even has an identity app for iOS and Android. I should not be using it, I should stick to web. But its so much more convenient. I'm just weak, aren't I?

Don't forget GrapheneOS, LineageOS and other de-googled FOSS Android Versions

RicoElectrico• 11 months ago

Foss people are on the spectrum and so never understand the common man. Simple as that I guess.

cyanydeez• 11 months ago

Money

potamic• 11 months ago

It's the ecosystem. Without an ecosystem there will be less adoption and consequently less investment in the OS. Where I stay, so many services offered exclusively through Android/iOS apps with no alternative. Even government services are slowly excluding the web and becoming app only. There is an implicit expectation from everyone that one will have either an Android/iOS device and this only becomes stronger with time.

I don't know how many people realize but what can result from this can be very dystopian and is scary. But the best possible outcome from this I hope is that some day a wise government realizes how much of daily life is dependent on two corporations and passes regulations to standardize app runtimes. You should be able to publish applications that can run on any OS. Only then we'll see competition in the OS market.

fsflover14• 11 months ago

For mobile, we have PostmarketOS, Phosh, Ubuntu Touch.

Why are you only listing DEs and not operating systems? (You also missed SXMo and more.) There are many more operating systems [0] and two working GNU/Linux phones, Librem 5 and Pinephone. Why people are ignoring them on HN?

[0] https://pine64.org/documentation/PinePhone/Software/

nine_k• 11 months ago

Why is it so complex to have a foss mobile OS.

This is not too hard. What is hard is to trust it enough. A FOSS OS, by definition, allows to install whatever software, and allows for modification of itself. It is built to overcome limitations, not impose them. In this regard, it's a perfect tool for a criminal who wants to circumvent security measures, because these are limitations. It's the same problem as with cheaters in online games, only with more than games on stake. Banks and payment systems want guarantees of integrity and protection, including protection from user's actions.

A FOSS OS also assumes that the user values the freedom, and is competent in its technical aspects. This is emphatically not true about many users. They choose iOS because it's locked down and thus they cannot inadvertently do something they don't understand, and can't be bothered to learn. More importantly, their grandmother cannot do something she doesn't understand but scammers persuade her to do.

It's a bit like driving on public roads. If you want to drive yourself, you have to reveal your identity and obtain a license. If you want the hassle, take a bus, but buses only go along their routes. Letting unlicensed people drive cars where they see fit was found unacceptably dangerous for everyone eround. Maybe mainstream mobile software development will follow this model, too :(

Perz1val2• 11 months ago

As Microsoft how is it so difficult to have a mobile os

raffael_de• 11 months ago

As far as I am concerned a Raspberry Pi 4G/5G/LTE-edition would be 50% of getting there.

numpad02• 11 months ago

Because PC is an American thing but phones are not. Obsession for standardization, modularity, and cross-compatibility are rather unique American cultural traits that aren't nearly as strongly manifesting elsewhere. "Fits right in" is quintessentially American thing.

The entire unitized jet engines on Boeing aircraft drops right off and swaps right into another host, sometimes even to different types of aircraft. PCI soundcards come off a i386 PC and go straight into PPC Macs. AR15 pressure bearing parts don't merely interchange between examples from different time and place but its grip and stock mounting patterns are becoming a industry standard of its own. Early Tesla battery packs come apart into bunch of 18650s and could reassemble into new packs(though it's a big no-no due to RUD risks). Meanwhile, Prius power units or front seats are for Prius only; it won't go into dozen different Toyota models, at least without substantial parts changes, modifications, and reconfiguration. Bugatti Veyron uses its own custom tires that aren't even forward or backward compatible with their own successor.

Same for phones: .apk runs everywhere, Linux do not, cameras don't interchange, internal connectors don't fit together, LCDs specific to anything are default unobtainium. microSD cards works on everything, but the moment you look away, Huawei invents a new incompatible format for absolutely no reason. Apple "reinvents everything" every time but internal organizations of components are stable at macroscopic levels for few generations unlike most other manufacturers.

It's openness of PC that is unique and precious, not closed nature of everything else being odd and inconvenient.

PeterStuer2• 11 months ago

Because the baseband chipset protocols and drivers are extremely patent encumbered. Any FOSS project will have to rely on on proprietary blobs for this part, and licensing deals from the existing patent holders, Quallcom. Nokia, Ericsson etc. .

You can see this is sort of adverserial to the FOSS way of doing things.

jasonfrost2• 11 months ago

On the cyberdeck note, I think the dawn of mobile computing is superseding smart phones and I rather move to flip phone + mobile Linux and keep them distinctly separated

superkuh3• 11 months ago

Because it's actually your telco's phone. They're the one that has the license to run the baseband computer and RF transceiver. The 'pad' computer device is sort of yours. But there's no legal way to have ownership of a cell phone unless you yourself bid for and get the RF spectrum and set up your network in a way that accomplishes the FCC coverage and timing requirements. Then run your own telco for your phone. Basically, impossible.

Smart phones try to limit and firewall the interface between the two but tight integration is required for energy efficiency. So a smart phone, or a cell phone, can never be yours. They aren't good choices for doing computing and this legal reality is becoming more and more obvious with time.

1vuio0pswjnm7• 11 months ago

"Why is it so complex to have a foss mobile OS."

What does "foss mobile OS" mean

(a) installed on a portable form factor,

(b) integrates with a cellular modem. or

For discussion purposes, assume "portable" means pocket-sized and battery-powered

When the RPi first came out I remember a blog where someone had rigged up a makeshift battery making RPi portable. At the time, HN commenters seemed impressed. Today, I connect a "phone" to an RPi running NetBSD^1 and use the phone as a battery

1. Linux provides wider assortment of drivers NB. I'm not using NetBSD to make phone calls

Today there are

non-portable VoIP phones with PoE, and

portable cellular modems running OpenWRT

Tomorrow, who knows

Convenience and control are mutually exclusive; this seems unlikely to change. Choosing the later over the former is personal preference. Every user is different

Trying to control a "phone" might be a waste of time, an exercise in futility, especially when it is running a corporate OS. Whereas controlling a gateway running an OS of the user's choice might prove to be relatively easy. Phones provide convenience, not control

pabs3• 11 months ago

The hardware and boot process for every phone is different, and some vendors block users from installing other OSes. Then most mobile apps are proprietary, and some of the apps only allow you to run them on official Google builds of Android, via attestation.

https://grapheneos.org/articles/attestation-compatibility-gu...

cyberax3• 11 months ago

You can buy a completely open RISC-V chip and debug to your heart's content. x86 is also completely open, with only special outliers like XBox/PS5 even half-heartedly trying to disable third-party access.

So the "Right to read" is still bonkers.

fsflover14• 11 months ago

"You [technically] can" is not good enough to declare the victory here. The downsides are so heavy that nobody can actually do it.

markus_zhang2• 11 months ago

In near future I’d expect locked down phones and pads become more prevalent than laptops/desktops and most people don’t even own something that is not locked down.

Even laptops can be locked down too.

sliken• 11 months ago

Great justification for switching to Graphene OS, more secure, more control, and google has to ask permission to install things and the play store is optional.

fsflover14• 11 months ago

Unless you're against giving your money to Google and depending on their hardware and software.

whs2• 11 months ago

I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block that.

So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done.

I suppose this will be how we'll use F-Droid in the next year for enthusiasts.

cuu5082• 11 months ago

Perhaps using the bank's website is an option?

I don't have a banking app installed on my phone. When I need to make a bank transfer I sit down at the computer.

pmontra• 11 months ago

Not the parent poster but my bank uses its own mobile app for 2FA. No app, no website.

cenamus• 11 months ago

Don't know if it's the same there, but where live (and I guess all of the EU) most banks allow you to use the website, but require the phone to authorize logins and transactions (as 2FA basically)

silverliver2• 11 months ago

My bank retired their online banking website in favor of their app.

Not only that, but many of their core services (national payment network) are now exclusively offered in their app and no where else (yes, they will not allow you to do them in person or through their ATM). Your bank _will_ disable their website when you are the only one left using it.

I am not exaggerating. There is no way for me to use these core services if I don't use their app and they wont allow me to use their app thanks to their google play policy.

Unless otherwise mandated, their website will go away and they will have their way with your rights and make you pay for it.

Don't shrug this off. Fight this while you still can.

whs2• 11 months ago

It's not an option on most Thai banks due to Bank of Thailand's regulations.

They requires that for any transaction past 50k THB per day (not per transaction) you'll need to provide face recognition. This means banks need to develop its internet banking solution past Web 1.0 era. From what I know (and I didn't do much research) most banks simply just shutdown internet banking instead of complying with that, only business banking get a separate website. My bank they simply merge the personal banking and corporate banking into a new system, but you still need to approve the transaction on a push notification (and perform face recognition).

It doesn't help that I believe many online casinos and scammers are scraping internet banking and even mobile banking APIs. There was a bank that apparently you could find PHP classes on GitHub that emulate their mobile app, and when that was in the news people were saying that the bank doesn't have proper security even though to use the class you'd need to provide exact same information in the app itself. Scammers used those code to move money from mules to mules, obfuscating the money's movement. The banks doesn't talk to each other either, so once the money goes through a few banks the chance you could trace it is almost none.

There was a court case that the court have ruled that if you were to get scammed to install apps on your phone that scam you for money, the bank is at fault as they have improper security. So they're heavily incentivize to protect users from themselves.

As for facial recognition, disabled people sent letters to Bank of Thailand, as legally blind people are not compatible with the liveness checks, the bank apps do block screen captures and refuse to work when any accessibility services is on and all BoT says about that is "we already told banks to do something" and the disabled people just send a second open letter this week, as many banks did nothing, some banks probably have a backend account flag to bypass the checks but didn't train the branch agents to perform such changes on the account.

Also Thailand has move into cashless - most local people don't use cash now except for small mom & pop shops that are doing dodging tax. Of course credit card is not accepted (or with minimum) - Thai business owners doesn't like fee no matter how small it is.

sureglymop• 11 months ago

It's your device and you should be able to do what you want. I do want to point out though that in your specific case, your use of such tools, whether Shizuku or Dhizuku does actually affect the security of your device and could easily be exploitable. And yes, even lending the DeviceOwner permission to another app temporarily is not great...

However, it's problematic if the banking apps also block regular configurations on something like GrapheneOS, e.g. by inspecting the initial call stack of an app. There are many such trivial to bypass ways of doing root detection and most are easily circumvented anyway.

swe_dima• 11 months ago

There goes one of the main arguments why I've been using Android over iPhone

Disposal8433• 11 months ago

I also remember the early war between Androids and the iPhone. The main argument was that you don't need Google's permission to run applications.

silverliver2• 11 months ago

Can Google be sued for misleading and defrauding phone owners?

bambax• 11 months ago

Yes, and that may be something Google does care about in the end. If Android becomes as closed and as controlled as iOS, why Android??

pjmlp6• 11 months ago

Because most of us live in countries where an iPhone is two months salary at least, or a contract bound to several years before it can be cancelled, while Android is usually half of that, with the freedom of pre-pay.

bigstrat20038• 11 months ago

If anything, this is even worse than what Apple does. iPhone users frequently argue that the inability to install arbitrary software is a feature in their eyes, one of the things that attracts them to the platform. I disagree with their argument, but in fairness I must admit Apple has never pretended that an iPhone is a device you control. They have always been very up front that it is a curated experience, their way or the highway. It's distasteful to me but they're honest about it. What Google is doing is a bait and switch to so many users who chose their platform specifically because it was open.

self_awareness3• 11 months ago

I'm a nobody, but let me answer these questions in 60 seconds.

1: None, no anonymous accounts allowed. 2: None. Civil what?. 3: It's the Google's company policy, don't use our products if you don't agree to it. 4: If devs write apps for this nearly impossible to develop Mac AppStore ecosystem, I don't see even a slightest problem here. 5: Just change package IDs.

Thank you for listening, see you again next time.

melagonster• 11 months ago

Do you work for Google?

self_awareness3• 11 months ago

No, but I was a developer of an app for iPhone, so I know the thought process.

pixelii• 11 months ago

It must be left up to the device owner to decide if they want to have side loading app of unverified developer disabled or not. Period. There is nothing more to it. If there can be setting on phone to unlock bootloader, then there can also be a setting for this.

qalmakka• 11 months ago

This is intolerable. You own the device. You must be able to run whatever you want on it. Locking or limiting your access to the stuff you bought is not only unacceptable, it's basically like saying you don't really own anything. You're basically leasing a device until the OEM decides you can't run anything on it anymore. Would people accept if a car manufacturer prohibited you from driving their cars in certain places?

p0w3n3d3• 11 months ago

Meanwhile: VW is already limiting horsepower when the yearly subscription is ceased to be paid

It's already happening. The greediness of vendors, the ignorance of users...

generic92034• 11 months ago

Do not forget the inaction and/or corruption of lawmakers.

AnonymousPlanet• 11 months ago

Back in the 90s Sun sold you computers with X amount of space. There was an option to upgrade. If you took it, they sent a technician around to do the upgrade. All they did was making the already existing space available. Sun always sold hardware with all the space installed but gave you only what you paid for.

jasonfrost2• 11 months ago

What's crazy is I can buy a video game license on steam and am permitted to mod it. Leasing precedence seems hidden in there sonewhere

llamavore• 11 months ago

Maybe we can finally spark an omarchy style user driven linux mobile OS ala DHH?

Or are users just going to face network bans and additional tracking like with grapheneos?

microtonal5• 11 months ago

Omarchy is just a set of defaults for an existing software stack. The problems here are at a much more fundamental level: getting devices that can be unlocked, getting device drivers/firmware that are also updated on a regular basis, supporting hardware attestation and getting app makers to support it without Google's support (assuming an Android compatibility layer), getting a healthy app ecosystem (if there is no Android compatibility layer).

Currently probably the best route is basing the OS on Android (so that you can benefit from all the existing apps), making a non-hostile reference device, and getting regulators' attention (the EU is probably the most likely to succeed) to break Google's monopoly on attestation.

This is largely what GrapheneOS is currently trying. I think what we can do as users is install GrapheneOS with sandboxed Google Play and for any apps that do not work, contact their developers. If GrapheneOS manages to get millions of users and get on the radar of app developers, that's the best shot I think.

But it feels like the window is closing quickly. So if you care at all about any of this, today is the day to get a GrapheneOS device and make yourself heard.

itake3• 11 months ago

While I am against the policy, Google only publishes developer's full legal name and email address if the app is monetized [0].

If the app is monetized, then the full mailing address is shared.

If money is involved, it’s fair for users to know who they’re dealing with. Developers who want to hide their personal identity can still do so legally with a shell company.

Taking it a step further, if I am going to run your code on my device, I want to know who I'm giving access to my data/cpu/hardware.

Just like with offline transactions, customers should know who they are giving money to.

----

Google will display your legal name, your country (as per your legal address) and developer email address on Google Play. If you decide to monetise on Google Play, then Google will display your full address.

[0] https://support.google.com/googleplay/android-developer/answ...

quikoa• 11 months ago

Small developers need to be easy to contact. Meanwhile Google is notorious for being difficult to get human support. Seems fair.

dns_snek5• 11 months ago

All of those are fine things to expect from Google Play but the point is moot because this verification would also apply to apps installed from external sources where they shouldn't have any jurisdiction.

Google, just like Apple, should be free to enforce any kind of verification they deems necessary on Google Play, as long as they allow third party stores to be on equal footing, which they don't.

itake3• 11 months ago

I agree. we should be able to install apps we want to install. But if you're installing them from the Google Play store (which is what is discussed) then you should be allowed to know who you're doing business with.

BrenBarn3• 11 months ago

Those questions may make some users uncomfortable, but it's wishful thinking to believe they would make Google uncomfortable. Google doesn't care in the slightest about these issues.

n4r9• 11 months ago

Agreed. PR departments are paid specifically to weasel around questions like this. If anything, it's in Google's interests because it gives them something to claim they're cooperating with.

beardyw• 11 months ago

I know I risk being down voted remorselessly but I have to put this in context. Where in the real world is anonymity considered ok? If I only put a flyer through someone's letterbox here in the UK, I have to identify myself. If I sell a physical product I not only have to identify myself but take on serious legal liability. An author can take on a pseudonym but only via an identified publisher.

In fact that latter example might provide a solution. Set up a company willing to publish apps whilst hiding the actual developer's identity.

johnnyfaehell3• 11 months ago

The thing is that so many people are used to doing whatever they want from behind the safety of their screen and are now able to do a lot of things they don’t want anyone to know about. Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world. And I think a lot of people are scared of not being able to do what they used to or being found out for doing it.

Plus, and doing what you suggest but in a country where board directors don’t need to be public really solves it.

Perz1val2• 11 months ago

Yea, cus when I write a fanfic I should show my id to the company that owns the printer I purchased and own, before I print out a copy to give for my friend, ffs. Does that analogy make sense to you?

Hizonner4• 11 months ago

Now the law and common sense is catching up and we’re starting to see things we take for granted in the physical world are coming to the digital world.

Your concept of "common sense" is repulsive, as is your submissive attitude.

Mordisquitos2• 11 months ago

Where in the real world is anonymity considered ok?

I am allowed to invite guests into my home even if their identity isn't pre-registered with my landlord.

godelski3• 11 months ago

Personally I'm a big fan of not registering with the police every time a use a public restroom.

64718283661• 11 months ago

But guests can't stay over night without registering them in many countries

yjftsjthsd-h• 11 months ago

Tell you what: Sign your post with your full legal name and address, and we'll talk.

kuschku• 11 months ago

That's not even true for physical products. I can give away stuff anonymously at hackspaces, or in many other settings.

Identification is only required if I want to sell stuff, at large scale.

Google's plan would also utterly destroy fdroid and similar projects.

snerbles2• 11 months ago

A coin-op vending machine is anonymous too. As were pay phones.

bigstrat20038• 11 months ago

I don't think anyone is saying Google must allow anonymous apps on their app store. Nor is there anything wrong with giving the user of a phone the option to only install apps which have been vouched for by some trusted third party. The problem is, Google wishes to take away my choice to install apps that don't follow their rules. And that's bullshit. It's my device, which I own. Nobody except me should be able to restrict what does and does not run on that device.

simoncion6• 11 months ago

If I only put a flyer through someone's letterbox here in the UK, I have to identify myself.

Has the UK gotten rid of public postboxes? Do you have to present government-issued ID to post a letter, flyer, or other mailpiece? Do the UK post-handling companies check the sender's claimed name and address on the mailpiece and toss it in the trash if it doesn't correspond to a registered combination of name and address?

Where in the real world is anonymity considered ok?

Tons of places in the US, and I expect most everywhere else in the world... including the UK. (Or has the UK prohibited things like anonymous food pickup and late-night back-alley dalliances?)

If one is selling computer software, it makes some sense to keep track of the receiver of those funds... if for no other reason than to know who to go after if taxes on the sales aren't paid. However, if someone is giving away software perhaps on an AS IS basis and especially with NO WARRANTY, there's no reason to proactively keep track of who is offering that gratis gift. If some sort of legal problem ever arises because of the contents of that gift, go call the cops in and they can investigate after the fact.

I've been paying some attention to the conversation about Google's proposed policy for the past several days, and I've not seen anyone talking about the significance of the set of countries where this is rolled out to first: Brazil, Indonesia, Singapore, and Thailand. Perhaps there is no connection, but I haven't seen anyone asking what relevant repressive policies these four countries might have in common.

It's weird.

Agraillo• 11 months ago

I've not seen anyone talking about the significance of the set of countries where this is rolled out to first: Brazil, Indonesia, Singapore, and Thailand

This was really interesting and somewhere there was a comment/quote that these countries are affected most with the malware distributed with side-loading, I can't find this comment now. But while trying to find some information, I found the info about 2023 Alphabet/states $700 m. settlement. It came mostly unnoticed on HN [1] (two posts, 2 comments), but there is interesting timings coincidence in the settlement text ([2])

  ...6.9.2 For a period of at least four (4) years from the Effective Date, Google will maintain the following functionality in Android version 14+ for Mobile Devices:
  (a) Google will support APIs that enable sideloaded app stores that have received User consent to install apps to avoid automatic updates taking place while the User is using the app....

2023 (settlement) + 4 years = 2027 (mentioned for other countries). This can be related to apps like F-Droid, this ruling might prevent Google from making F-Droid comply if the US was announced to meet the new rules earlier (before 2027). There are other formulas that might end up 2026/2027 when calculating so to be on the (legal) safe side, Google probably made US join later. Probably those countries are also for beta-testing both in the technical and legal sense.

The settlement might be interesting in other other respects also. Even the forces (the states, U.S Attorney) that drove the suit in 2021-2023 might join here though during this admin it's really questionable.

[1] https://news.ycombinator.com/item?id=38691926

[2] https://www.oag.state.tx.us/sites/default/files/images/press...

captainepoch• 11 months ago

Where in the real world is anonymity considered ok?

It should be everywhere, no matter the place or the platform.

lioeters2• 11 months ago

That was my answer as well. Anonymity is not only "considered OK", it is a fundamental human right that must be guaranteed and protected unless there's a real need to violate the person's privacy.

The fact the question was phrased in that way is disturbing. How far the loss of personal freedom has been normalized. Like the term "side loading", it's an insult to general-purpose computing.

dns_snek5• 11 months ago

Where in the real world is anonymity considered ok?

You've listed commercial activities. The vast majority of non-commercial activities don't require any sort of registration or identification.

Installing an app that your friend or internet stranger developed in their spare time is not a commercial activity and people shouldn't be forced to publish their personal information in order to do so.

morpheuskafka2• 11 months ago

Presumably this won't apply to Chinese OEMs, since even though their devices do ship a disabled by default Google Mobile Services (without the user facing Play Store APK), it obviously would not be suitable to require Google involvement for developing internal apps. The OEMs could set up such a debug licensing service themselves, but each of them would have to do it themselves, and then it would be impossible to debug Google-based apps on the devices.

xyzal• 11 months ago

Many Chinese OEMs are not Google certified, so it won't for sure apply to them. Some (Huawei) even had to implement their own app store and replacement for Google services. They are basically de-googled devices, though, sadly, often loaded with spyware from the other camp.

morpheuskafka2• 11 months ago

But some, like Oppo and Vivo are--they ship with a Google-OKed copy of GMS, and redistribute the Play Store on their own app store as a way to install it (ostensibly for use when traveling outside the mainland, though it can also be used with a VPN). So clearly they are on some level Google certified.

However, they also contain switches to disable background GMS, which makes them almost de-googled. All of them, not just Huawei, have their own app store/updater, and have some sort of push notification to replace Firebase Cloud Messaging (as I understand, Tencent provides a one touch service so devs don't need to hardcode each OEMs notifications). Otherwise, it would be impossible to get apps or notifications without a VPN/proxy.

m00dy• 11 months ago

This is the most terrible thing that I read in this year.

casenmgreen• 11 months ago

Individual privacy and anonymity matter substantially less when Governments are basically decent and play by the rules, and so it seems there is a tendency to value convenience and utility over privacy and anonymity.

When Government goes bad, suddenly we are faced with the utmost need for privacy and anonymity, but we may by then be in a situation where privacy and anonymity are difficult to obtain, with all the consequences that then flow from that.

Hizonner4• 11 months ago

Yeah, that's what a lot of us have been saying for decades.

But notice that Google is doing this as the government in its home country is going bad (or at least getting dramatically, qualitatively worse than it has already been).

Some people see features where others see bugs.

supermatt• 11 months ago

They know the days of the app-store monopolies are ending so they are now implementing apple-style notarisation - which they could have done years ago, but never seemed to need to until now...

IMHO, thats is them still having an unfair control over the android market so the EU will come for them eventually - and no doubt they will implement some other devious bullshit.

Ideally the world will wake up and realise multi-sector megacorps simply should not exist and split them all up accordingly - but I'm not holding my breath.

tommica• 11 months ago

Very good questions, and hope that they can get answers to them.

nolist_policy• 11 months ago

Did you actually reach out to Google?

TheChaplain• 11 months ago

Trying to get hold of the correct person to get proper answers is a bit harder than you think.

self_awareness3• 11 months ago

The hard part is who does it, not that the process is complicated.

If you have an influenctial social account with lots of followers, Google reaches out to you. They only react if something has a potential to hit their PR.

So in order to get in contact with Google, you reach out to influencers, not Google itself.

kstenerud• 11 months ago

I wonder if this would give Epic cause against Google?

https://en.wikipedia.org/wiki/Epic_Games_v._Apple

If Google controls verification, then Google - not Epic - controls who can distribute Android apps on the Epic store.

Andrex2• 11 months ago

That case is why I don't think Google will actually roll this out in the US (and the EU for different reasons).

But I was wrong about them even ever attempting something like this so who knows.

eviks• 11 months ago

To Google, these questions might be uncomfortable.

Not really, there is no discomfort from something they can easily ignore.

akomtu• 11 months ago

I'd guess that the main reason Googel has done this is to prevent side-loading of messenger apps, such as Signal, with true end-to-end encryption. Such messengers would be very difficult to surveil at scale. You might ask why not to simply install these apps from Play Store? The reason is Google demands signing keys for all apps, so it can impersonate the developer, inject any spyware, rebuild the app, sign it and make it look untampered. Side-loading bypasses this entirely.

blueg3• 11 months ago

Google doesn't demand your signing keys, and transforming your app in that way is easily detectable by the developer.

notpushkin3• 11 months ago

There’s a feedback form, in case anybody wants to tell Google what they think about all this: https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk...

Discussion: https://news.ycombinator.com/item?id=45030967

Varelion• 11 months ago

Android is no longer open-source, with a move like this. In the past few years, it has become obscene how emboldened the corpos have gotten with how far they are willing to push to mine every last crumb of data, eager to sell it to dangerous government bodies.

curt15• 11 months ago

The developer of ICEBlock disclosed his identity. In addition to receiving threats of federal prosecution over the app, the developer has faced other backlash, including his wife being fired from a federal government job.

This is the sort of thug behavior you see in CCP China. If the govt can't directly detain overseas dissidents or other "undesirables", it goes after their families back in the mainland.

jerome-jh• 11 months ago

You americans are strange. Your government makes arbitrary arrests, illegally searches phones, massively de-funds science and health projects, and only a handful of people demonstrate.

Now a company wants the identity of the companies it works with because it distributes their software, and it looks like a massive "scandal". Well at least I am realistic that the "scandal" is only within certain circles.

lII1lIlI11ll• 11 months ago

Google always knew the identity of companies whose software it distributed (via Google Play), now it also want to know the identity of software developers it has nothing to do with. Get your facts straight next time before writing a snarky comment!

Uncomfortable Questions About Android Developer Verification

Related Stories