What you call dark patterns are ways to ensure users don't accidentally load malware onto their device. They can definitely do better though - I think a good first step would a dialog to choose trusted alternative app stores such that installing apps does not require a separate confirmation step (as is currently the case.)

The Google Play Services moves are unfortunate, but required. Most device manufacturers do not provide updates for Android on time, so any code that is part of Android itself becomes harder to update.

> What you call dark patterns are ways to ensure users don't accidentally load malware onto their device.

They are still dark patterns, that they also have found excuses for those dark patterns does not make them any better. In fact most of the stuff (not just Google's) we see nowadays that take control away from the users - very often in ways that entrench monopolies and the status quo - use "but security" as their primary defense.

And they aren't secure, like at all. How much chinese scam is published there. And https://news.ycombinator.com/item?id=20818177

And it's a pretty good defense. Say those dark patterns are removed - and loading a .apk from the web on a completely new pixel 3 shows the "do you want to install this app?" dialog. What's stopping any of those apps from masquerading as official Google/banking apps and stealing user credentials? Or what if the app is named "get any app free app store" and, along with providing cracked apps from Google Play, it enrolled your android in a botnet?

Totally agree. Open source software is possible on Android, but it's nowhere near the level of say Linux.

> What you call dark patterns are ways to ensure users don't accidentally load malware onto their device. They can definitely do better though - I think a good first step would a dialog to choose trusted alternative app stores such that installing apps does not require a separate confirmation step (as is currently the case.)

Note that since Android P or so, only explicitly whitelisted apps are even allowed to ask for app install. There's a user setting for each. So this is effectively already in place.

"Most device manufacturers do not provide updates for Android on time"

Only because Google lets the device manufacturers off the hook. It's a problem of Googles own invention. Trading away customer security for market share.

Adding: very successfully too, this isn't the first time I hear how you should almost feel sorry for Google that they have to put so much into google services instead of Android, all because of the evil device manufacturers! Nothing can be done no... wrings hands

Maybe it will change a little but now that Huawei happened.

True. And about as helpful as offering a coat to a dead man.

It is not a problem that is retroactively fixable by other means than by what they are doing now.

They could take Android closed source and put a restrictive license on it demanding that timely updates as a condition of use. All that would achieve is that the large vendors will either stick with the old, still free to use, Android or start working on their own systems they would control again - Samsung's Tizen, Huawei is developing their own, etc. It doesn't take much to piss a large vendor like Samsung off sufficiently to jump ship. They aren't married to Android and have plenty of resources to pour into proprietary alternatives. Google doesn't have much leverage there.

The result would be only a market fragmentation, collapse of the app market and loss of market share for Google. That would benefit exactly nobody.

Phone vendors are not interested in system updates - that's a pure cost they don't want to pay, they would rather have you buy a new phone or at least not have to spend money and engineering time on preparing patches.

Everything you said rings true, except the part about proprietary license. That's orthogonal to enforcing updates. That is a contractual issue, not a licensing issue.

Google could for instance not allow the manufacturer to connect to their Google Play store unless the manufacturer played ball.

But where does this all put us? We are OK with crap, insecure devices being shoved all over the markets? What can be done.

> Google could for instance not allow the manufacturer to connect to their Google Play store unless the manufacturer played ball.

Very true but I think the point GP was trying to make was that Samsung is bigger bthan Apple and would have enough influence to get a lot developers to work on its platform instead.

I guess Apple->Google?

They already have contracts with licensing for the Play Store and other apps. Those are not included with the base images and require a contract to be in place.

Great. Do you know what those contracts do not say?

"Must keep firmware updated with security fixes."

I think the point being made is that they could add that to future contracts.

They could, but they won't, because security is not what is lining Googles coffers.

I hope manufacturers start adopting Android One widely. It will both take the burden of maintenance off them and make the problem of timely system updates go away for their users.

There are multiple problems here:

1. As you stated, Google forces devs to rely on presence of the Google Play Services

2. Devs don't care: I don't see why e.g. Discord should not run properly on MicroG (I get push messages after logging in, but the app itself shows all friends as offline, no servers and a "can not connect to discord" message; from what I found online, it doesn't seem to be intermittent).

3. I wouldn't even know which 3rd party app store to use (okay, besides F-Droid for FOSS and some Google Play Store Proxy)

> 1. As you stated, Google forces devs to rely on presence of the Google Play Services

Not forcing per se. Google just provides a convenient services that devs are happy to use.

That time has passed. There's functionality on Android that can only be reliably provided through play services these days (push notifications being the big one).

Not really. Apps in China are mostly don't need Google Play Service, so it is totally up to developer to decide whether use it or not.

It's just an optimization/convenience to use Google services for push notifications, no?

Basically: Back in the day a ton of apps used their own notification servers, with each one clashing, waking the device up, etc..

Google Cloud Messaging was then set to be the only service that could wake the device up when it was sleeping. Supposedly it batches messages and sends them at optimal times to save battery.

I'm not convinced that other network io is blocked. There seem to even be commercial competition for GCM: https://pushy.me/

It's not when the device is awake or has a wakelock. But since Android's Doze (basically deep sleep battery saving state) GCM is the only service that can wake it up.

I thought the device wakes up from Doze regularly, and then you can poll for the notifications. The SDK docs sound this way too: "While the device is in Doze, apps' access to certain battery-intensive resources is deferred until maintenance windows"

But it seems these maintenance windows aren't frequent enough (every 15 minutes?) for some apps.

The minimum interval for periodic jobs is 15 minutes. When the device is in Doze mode, the jobs are defered to the next maintenance window. The longer the device remains in Doze mode, the greater the distance between two maintenance windows.

Do you want to use a messenger or any other social media app where the worst case scenario is that it takes 15 minutes for the message to reach the recipient?

Certainly not, so the app vendor is forced to use FCM to display notifications immediately even if the recipient's device is in Doze mode.

You are correct, but how many applications need push notifications?

If you've an android phone, just count your apps? I did, and expected 8 of my 20 apps to use GCM. MicroG revealed it to be 11 (actually 12 due to "MicroG services core" registering with GCM as well).

I might be an outlier though.

That's not true anymore, for notifications it's now mandatory.

3. uptodown

DuckDuckGo/Googling for that yields only the site, no review or some 3rd party information if it is safe to use. I mean, as a side-project, I could setup a website that pulls APKs from Google, infests [some] of them with a virus and puts them on a fancy looking website or "alternative app store"-app.

The Play store is not available in China and there is a thriving app ecosystem there.