News for hackers. Stuff that matters.

A comment on Re: Moxie on Web3. Parent comment

Re:Re: Moxie on Web3 by searchableguy on Sunday January 09, 2022 @06:27AM (#29862346)
> Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you can sideload that.

Actually, for both the commercial app stores - you cannot. Google requires app bundles where they package different APK for devices and sign it using their keys for new apps from 2021, August.

[ Parent | on HN ]
Re:Re: Moxie on Web3 by mjg59 on Sunday January 09, 2022 @06:31AM (#29862362)
Google is pushing towards that, but for apps that already exist you can absolutely still upload stuff signed with your own keys.
[ Parent | on HN ]
Re:Re: Moxie on Web3 by doublerebel on Monday January 10, 2022 @01:47AM (#29871399)
Google is far more than 'pushing': currently any app added after August 2021 is required to let Google manage the keys. I expect it's a just a matter of time before it applies to all apps. Really disappointing that they are using their market position to completely ruin developers' ability to provide security.

Source: I have been developing on Android since Android 1.0. Also see https://stackoverflow.com/questions/68710048/no-opt-out-opti...

[ Parent | on HN ]