Skip to content(if available)orjump to list(if available)

Uncomfortable Questions About Android Developer Verification

userbinator

This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile.

"debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read, 1997

teekert

Why is it so complex to have a foss mobile OS.

I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that).

For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in them, is it on me? IDK, our government even has an identity app for iOS and Android. I should not be using it, I should stick to web. But its so much more convenient. I'm just weak, aren't I?

Maybe I should go for Ubuntu touch, with an iPad on the side or something. At least my most personal device is something I control then. Or just keep my Linux laptop handy (or make a cyberdeck!). But I want a computing platform that does not require carrying a bag. It's kinda sad. Even GrapheneOS (one of the most personal and secure mobile computing experiences out there)'s future is in the hands of its greatest adversary, the one that does not want you to have a personal computing experience.

rattyJ2

I could be one of the people running an ungoogled phone, but my bank refuses to have an app that runs on an ungoogled OS for "security"

SanjayMehta

My bank used to block VPNs “for security reasons.”

Now they very kindly just display a warning.

t_mahmood

My bank blocks my mobile with Lineage OS, and it's not even possible to login to the web site without the mobile app. Absolutely pathetic.

Now I have to keep my 4 year old phone with 2 year outdated Android to access the bank application. Which deemed more safe then my mobile with latest security updates. Haha

preisschild

Write them. My bank's app had safetynet, but they disabled it and now it is usable over GrapheneOS.

Unfortunately no NFC Payments though, since they are only available for Google Wallet (which uses safetynet)

nine_k

> Why is it so complex to have a foss mobile OS.

This is not too hard. What is hard is to trust it enough. A FOSS OS, by definition, allows to install whatever software, and allows for modification of itself. It is built to overcome limitations, not impose them. In this regard, it's a perfect tool for a criminal who wants to circumvent security measures, because these are limitations. It's the same problem as with cheaters in online games, only with more than games on stake. Banks and payment systems want guarantees of integrity and protection, including protection from user's actions.

A FOSS OS also assumes that the user values the freedom, and is competent in its technical aspects. This is emphatically not true about many users. They choose iOS because it's locked down and thus they cannot inadvertently do something they don't understand, and can't be bothered to learn. More importantly, their grandmother cannot do something she doesn't understand but scammers persuade her to do.

It's a bit like driving on public roads. If you want to drive yourself, you have to reveal your identity and obtain a license. If you want the hassle, take a bus, but buses only go along their routes. Letting unlicensed people drive cars where they see fit was found unacceptably dangerous for everyone eround. Maybe mainstream mobile software development will follow this model, too :(

_Algernon_

All this is true about Linux on desktop, though my bank still allows me to log in to online banking.

At least for now.

I'm not aware of any major issues this has caused.

The trust isn't the issue. Google and Apple has made DRM easy for these companies to integrate, and therefore they do it. There isn't more to it than that.

mac-mc

It's pretty obvious, it's costly to make one that is up to the level of quality of commercial ones. It's not a mistake that the 2 mobile oses are owned and created by some of the largest and most profitable companies in the world.

shermantanktop

It’s costly, but those two companies also operate in a hierarchical manner (like the military or a feudal kingdom) which makes decision-making and accountability much easier. The FOSS world has been rife with petty agree-or-fork squabbles, often over relatively abstract philosophical concerns about license language.

potamic

It's the ecosystem. Without an ecosystem there will be less adoption and consequently less investment in the OS. Where I stay, so many services offered exclusively through Android/iOS apps with no alternative. Even government services are slowly excluding the web and becoming app only. There is an implicit expectation from everyone that one will have either an Android/iOS device and this only becomes stronger with time.

I don't know how many people realize but what can result from this can be very dystopian and is scary. But the best possible outcome from this I hope is that some day a wise government realizes how much of daily life is dependent on two corporations and passes regulations to standardize app runtimes. You should be able to publish applications that can run on any OS. Only then we'll see competition in the OS market.

benrutter

Interestingly, we are, and have been, at a point were you can publish applications that run on any OS for a while, with PWAs.

There are very few software examples, that couldn't be distributed as PWAs, including secure things like banking, etc. With WASM in the mix as well, theoretically the sky should be the limit.

Even more interestingly it hasn't happened - mainly because Apple and Google haven't got behind PWAs for obvious reasons, so the app ecosystem just doesn't exist. It's hard to see how this will changes, when mobile operating systems are dominated by two players, with very obvious incentives to make things worse for consumers but better for themselves, by grabbing as much control of the apps on their system as possible.

raffael_de

As far as I am concerned a Raspberry Pi 4G/5G/LTE-edition would be 50% of getting there.

kelnos

> Why is it so complex to have a foss mobile OS.

In a way it's not. As you mention, we have several of them. But they won't have mass-market appeal until they can run the same sorts of apps that Android and iOS can run. And no, "just use the mobile website" is not an answer.

How do I deposit a check with my bank on my phone without the app? I can't; the mobile website doesn't have that functionality. How do I send someone money via Zelle without the app? I can't; the mobile website doesn't have that functionality.

How do I use contactless payments? I can't; the ability to build an app like Google Wallet or Apple Pay requires deep pockets and trusted payments industry connections that open source mobile OS developers will likely never have.

How do I use Google's productivity suite? I can't; the mobile websites aren't functional enough. How do I use Microsoft's? Ditto.

How do I use the remote-lock functionality of my car? I can't; that's only available through the Android and iOS apps.

I could go on, and on, and on, but I think you see the point. Many people who advocate for these alternative OSes don't get it. "Do you really need that functionality?", they ask. "Why can't you just do that stuff in a web browser on your laptop instead of on your phone?", they ask. "Just use a physical credit card like I do!" And then they wonder why their alternative mobile OS will never go mainstream.

People actually really care about those features and capabilities. It doesn't matter if the people who build these alternative mobile OSes don't care, or think they're stupid, or unsafe, or bad for privacy, or whatever. If you don't build what people want, they won't use your stuff.

Emulating Android sufficiently well enough to run Android apps is a decent start, but so many apps rely on Play Services and Play Integrity that it's a losing battle, or at best a cat-and-mouse game to keep things working.

On top of that, mobile chipset BSPs require financial commitments and being a Real Company. Most open source outfits can't cross that bar, and the likes of Qualcomm will be wary dealing with an organization that wants to do open source.

Perz1val

As Microsoft how is it so difficult to have a mobile os

csomar

Mostly because the "web" was sabotaged. I use archlinux and my only GUI application is a web browser. On mobile, I need an email app, maps app, food delivery app and a communication app. Even whatsapp doesn't work on the web (on purpose).

If the web was enabled, app stores wouldn't be possible and you could run anything without an installation. But somewhere along the line both Google and Apple realized that this isn't really to their benefit and "walled ecosystems" are an advantage.

kelnos

> I use archlinux and my only GUI application is a web browser.

Debian here, and... yup. It's so weird to realize this. I have lots of browser windows open with lots and lots and lots of tabs open, but the only other app I have open is a Matrix client (which honestly is not that great; Element's web version has more features and better polish), and a terminal. If you can call a terminal a GUI app.

Sure, I do use native apps sometimes. A calculator app, GnuCash, VLC, some others. But they're not open all the time; they're infrequent-use apps. And a lot of my VLC use has been replaced by streaming on the web.

It's incredibly sad.

cyberax

You can buy a completely open RISC-V chip and debug to your heart's content. x86 is also completely open, with only special outliers like XBox/PS5 even half-heartedly trying to disable third-party access.

So the "Right to read" is still bonkers.

raverbashing

Stallman's fallacy is thinking every system is perfect and unbreakable and that people have a perfect understanding of software and systems (for better or for worse)

People will be running pirated debugger copies if that comes to shove

99.9% of people DNGAF about OSS. They do care about doing what they need on their phone without malware/bloatware/nagware

Also publishing and development are separate activities

kazinator

I doubt that Stallman, of all people, thinks literally that. But systems which are breakable have ways of improving themselves, closing off the exploitable holes. So it makes sense to regard systems as being eventually unbreakable. Or at least having an unacceptably long "mean time between cracks". The game plan cannot simply be "oppressive software and hardware systems will always have imperfections so the good people will cheerfully get around them", even if is is de facto that way at some point in time w.r.t. certain systems. That's actually a kind of defeatist attitude disguised as optimism; passively accepting crap based on the faith that you will scrape through somehow.

godelski

What an absurd ask. How is a $2.5 trillion dollar company supposed to make any money if it has to spend a bit of time on security? Did you even think about the economy?

Clearly it wasn't doing fine in 2018 when Apple became the first trillion dollar company. Nor was it when in 2012 when Apple's market cap exceeded oil companies, barely breaking half a trillion dollars. And the economy was definitely in shambles back in 2005 when no company even had a 400bn market cap! Seriously, how could the economy ever survive?!

Where would the wold be without all those innovations. Like the 2005 invention of YouTube, the 2007 release of the iPhone. Where would we be without such world changing technologies that followed with tech's rise in global dominance? Technologies like, Bitcoin, VR, and an even thinner iPhone? Do you even know how many peoples' lives these technologies have saved? Seriously? Because I don't...

raverbashing

> I doubt that Stallman, of all people, thinks literally that

Yeah I agree his opinion is probably more balanced, however Right to read is a short story displaying characters with too much learned helplessness and too little agency so I'm just going based on what he literally put to paper

_imnothere

> They do care about doing what they need on their phone without malware/bloatware/nagware

Yeah you're absolutely right, tell that to Facebook/Instagram/Temu/TikTok/Pinduoduo/(any other _spying_ apps) users.

raverbashing

Their spying doesn't prevent anyone from using their bank app, or using other apps on their phone, or consume (too) much battery

recursivecaveat

I wouldn't bet on hackers saving us from everything. There are 150 million Nintendo Switches in the world, and nobody has figured out how to jailbreak one without getting into the hardware and shorting some wires (and even then only on early unpatched models). I don't think its out of the realm of possibility to make a best-selling phone that stays uncrackable for the general population for its entire lifecycle.

superkuh

Your fallacy is thinking that authoritarian governments care about enforcement or successful enforcement of such laws. The goal is to create a status quo in which all citizens break many laws daily and so are already guilty if they ever rock the boat and disturb those in power.

Stallman's "Right to Read" is an accurate reflection of reality in that sense.

01HNNWZ0MV43FF

Yeah and people had gay sex when it was illegal but it still is a shameful injustice for the government to decide what software I run on my own hardware

sschueller

The requirement of verification to side-load any app is fascist control. It is clear as night and day.

Shame on Google and Apple, it was always clear this was the end goal and next up is also your PC.

Right after will come the removal off apps they don't like and there is nothing you can do about it.

Stallman was right

pjmlp

PC only turned out open, because IBM never saw it coming, and when they tried to get control back it was too late.

pjerem

Yep. PC openness is totaly a bug and not a feature of the capitalism. We should cherish this situation and fight for it because it really feels like the other long term alternative is techno-fascism.

mettamage

I asked an LLM, so I think I get it but could you try to mention what is meant with "Stallman was right"? The reason I'm asking you and not posting the LLM answer is because it still feels a bit icky to post an LLM answer for everything I don't understand [1].

[1] Feel free to discuss this too, if you want. I'm developing my opinion on it.

LambdaComplex

Richard Stallman has spent basically his entire career trying to convince people that all software should be free as in freedom, so that people truly control the devices that they own--preventing things like Google being able to lock users out of the ability to install applications on a device that they purchased.

Read up on the principles of the Free Software Foundation if you want all the details.

bigstrat2003

Stallman has a long history of being very abrasive and ideological. He is the kind of guy who makes zero concessions for practicality, and he insists on prioritizing user freedom because he has always feared that otherwise users will be locked out of having the ability to truly control their computers. It's always been kind of easy to laugh at his crusade because of how zealous he is, and how absurd the scenarios he warns about seem to be. The thing is... he seems to have been right the whole time. Companies really do want to lock you out of controlling the devices you own, and do so at the first opportunity. So... Stallman was right.

mrheosuper

> He is the kind of guy who makes zero concessions for practicality

Didn't he give some wiggle room in GPL license ?

simoncion

> He is the kind of guy who makes zero concessions for practicality...

Respectfully, this claim is incorrect. See this 2013 essay [0] for one example out of many where concessions are made to practicality.

Folks who are unfamiliar with Stallman's writing and the general philosophy of the FSF and/or the GNU Project might find spending an hour or so reading through some of the essays here [1] (perhaps starting with this 1991 essay [2]) to be informative.

[0] <https://www.gnu.org/philosophy/is-ever-good-use-nonfree-prog...>

[1] <https://www.gnu.org/philosophy/essays-and-articles.html>

[2] <https://www.gnu.org/philosophy/shouldbefree.html>

progval

Probably https://www.gnu.org/philosophy/right-to-read.en.html , mentioned elsewhere in the thread.

enriquto

> The requirement of verification to side-load any app is fascist control.

Even the language we are using to describe the situation is problematic. Why do we say "side-load an app"? It should be just "run a program"!

An OS that doesn't let you run programs of your choice is laughable.

opan

I think I have an old comment about this, but there is an actual `adb sideload` command for installing an apk on your phone from your computer. Since it's from your computer and not the phone itself, it's sideloading and not frontloading, I guess. Weirdly, and wrongly, people have also started to use the term to refer to just installing apps from outside the official appstores, but that's not sideloading. It's just installing an app. It's a normal Android feature. You can just grab a .apk file with your browser and install it like you would a .exe file on Windows.

iOS on the other hand historically required a jailbreak for this. I think that's where the confusion started. Android doesn't need a jailbreak, it doesn't need root (privileges), it doesn't need a custom ROM. You can just install stuff, it's normal. I think iOS users don't realize how different Android is and they just start repeating words like sideload and root without knowing what they mean, assuming it's just Android-speak for a jailbreak. They don't realize there's no jail in the first place.

I am aware English is a living language, and if enough people are wrong for long enough, they stop being wrong, but it's certainly painful to witness.

preisschild

> It should be just "run a program"!

More accurate would be "run a program not approved by Google"

timeon

> next up is also your PC

Already starting on macos. Gatekeeper had setting where you could allow any app. Now it is removed. While still possible to allow individual app (you need to do it after every OS update), trajectory is now clear.

Citizen8396

boot into Recovery, run "csrutil disable" and do whatever you want (not a recommendation)

fsflover

How many people would be able to use this workaround?

thrance

I'm all for calling out fascist behavior when it is spotted, but let's not muddy the waters further. This word is already denatured enough.

This is not fascism, this is just a rational move from Google in a market economy. It feels like every time something like this happens, Americans rediscover what capitalism is and implies, then blame it on "human nature", "greed" or "fascism".

qalmakka

This is intolerable. You own the device. You must be able to run whatever you want on it. Locking or limiting your access to the stuff you bought is not only unacceptable, it's basically like saying you don't really own anything. You're basically leasing a device until the OEM decides you can't run anything on it anymore. Would people accept if a car manufacturer prohibited you from driving their cars in certain places?

p0w3n3d

Meanwhile: VW is already limiting horsepower when the yearly subscription is ceased to be paid

It's already happening. The greediness of vendors, the ignorance of users...

AnonymousPlanet

Back in the 90s Sun sold you computers with X amount of space. There was an option to upgrade. If you took it, they sent a technician around to do the upgrade. All they did was making the already existing space available. Sun always sold hardware with all the space installed but gave you only what you paid for.

generic92034

Do not forget the inaction and/or corruption of lawmakers.

lioeters

Now is a time in history where any corporation worth its ill-gotten billions should take advantage of the government's whole-hearted encouragement to push through anti-competitve and anti-consumer decisions to dominate the market and the public.

whs

I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block that.

So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done.

I suppose this will be how we'll use F-Droid in the next year for enthusiasts.

cuu508

Perhaps using the bank's website is an option?

I don't have a banking app installed on my phone. When I need to make a bank transfer I sit down at the computer.

silverliver

My bank retired their online banking website in favor of their app.

Not only that, but many of their core services (national payment network) are now exclusively offered in their app and no where else (yes, they will not allow you to do them in person or through their ATM). Your bank _will_ disable their website when you are the only one left using it.

I am not exaggerating. There is no way for me to use these core services if I don't use their app and they wont allow me to use their app thanks to their google play policy.

Unless otherwise mandated, their website will go away and they will have their way with your rights and make you pay for it.

Don't shrug this off. Fight this while you still can.

pmontra

Not the parent poster but my bank uses its own mobile app for 2FA. No app, no website.

cuu508

Perhaps there's another bank you can switch to? Here we have a few mobile-only banks, but traditional banks with websites and physical MFA devices as an option too.

cenamus

Don't know if it's the same there, but where live (and I guess all of the EU) most banks allow you to use the website, but require the phone to authorize logins and transactions (as 2FA basically)

kalaksi

I live in EU and my bank also offers a separate MFA code generation device

notpushkin

There’s a feedback form, in case anybody wants to tell Google what they think about all this: https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk...

Discussion: https://news.ycombinator.com/item?id=45030967

morpheuskafka

Presumably this won't apply to Chinese OEMs, since even though their devices do ship a disabled by default Google Mobile Services (without the user facing Play Store APK), it obviously would not be suitable to require Google involvement for developing internal apps. The OEMs could set up such a debug licensing service themselves, but each of them would have to do it themselves, and then it would be impossible to debug Google-based apps on the devices.

xyzal

Many Chinese OEMs are not Google certified, so it won't for sure apply to them. Some (Huawei) even had to implement their own app store and replacement for Google services. They are basically de-googled devices, though, sadly, often loaded with spyware from the other camp.

pixelii

It must be left up to the device owner to decide if they want to have side loading app of unverified developer disabled or not. Period. There is nothing more to it. If there can be setting on phone to unlock bootloader, then there can also be a setting for this.

BrenBarn

Those questions may make some users uncomfortable, but it's wishful thinking to believe they would make Google uncomfortable. Google doesn't care in the slightest about these issues.

eviks

> To Google, these questions might be uncomfortable.

Not really, there is no discomfort from something they can easily ignore.

kstenerud

I wonder if this would give Epic cause against Google?

https://en.wikipedia.org/wiki/Epic_Games_v._Apple

If Google controls verification, then Google - not Epic - controls who can distribute Android apps on the Epic store.

casenmgreen

Individual privacy and anonymity matter substantially less when Governments are basically decent and play by the rules, and so it seems there is a tendency to value convenience and utility over privacy and anonymity.

When Government goes bad, suddenly we are faced with the utmost need for privacy and anonymity, but we may by then be in a situation where privacy and anonymity are difficult to obtain, with all the consequences that then flow from that.

swe_dima

There goes one of the main arguments why I've been using Android over iPhone

bigstrat2003

If anything, this is even worse than what Apple does. iPhone users frequently argue that the inability to install arbitrary software is a feature in their eyes, one of the things that attracts them to the platform. I disagree with their argument, but in fairness I must admit Apple has never pretended that an iPhone is a device you control. They have always been very up front that it is a curated experience, their way or the highway. It's distasteful to me but they're honest about it. What Google is doing is a bait and switch to so many users who chose their platform specifically because it was open.

Disposal8433

I also remember the early war between Androids and the iPhone. The main argument was that you don't need Google's permission to run applications.

silverliver

Can Google be sued for misleading and defrauding phone owners?

bambax

Yes, and that may be something Google does care about in the end. If Android becomes as closed and as controlled as iOS, why Android??

pjmlp

Because most of us live in countries where an iPhone is two months salary at least, or a contract bound to several years before it can be cancelled, while Android is usually half of that, with the freedom of pre-pay.