This is the future; partially fuelled by malware, partially fuelled by the desire for platform control, and partially fuelled by government regulation.
This regulation of NSW, Australia considers rooted devices with extra non-Google/non-Apple approved security features such as a duress/wipe PIN (a standard feature of GrapheneOS[2]) as a "dedicated encrypted criminal communication device". How the device is being used doesn't matter. It's how it _could_ be used.
[1] https://classic.austlii.edu.au/au/legis/nsw/consol_act/ca190...
"(3) A dedicated encrypted criminal communication device does not include-- (a) a device if-- (i) the device has been designed, modified or equipped with software or security features, and (ii) a reasonable person would consider the software or security features have been applied for a primary purpose other than facilitating communication between persons involved in criminal activity to defeat law enforcement detection,"
It's not automatic: depending on what a reasonable person thinks and the definition of criminal activity.
Does the jurisdiction matter? For example, if an activist was using a device to do things in another country that would be legal in Australia but were crimes in the other country.
So "the government only considers a duress PIN illegal if it is used to facilitate crime" seems like a potentially tricky standard to apply.
But this is just legal fiction, so not a barrier to "automatic"
Basically, they're not really setting up for a blanket ban on personal security features, that interpretation is obviously catastrophizing. Not that there aren't hamfisted laws somewhere like this, but NSWs implementation seems OK I guess
It is always the human mind that dictates the action, not the tool. It is futile to try and ban the tool, and I bet 100% they knew that.
They tried to pull a similar move with WinRT/UWP, but nobody wanted it, so now you can continue with Win32.
They would love to do so, but legacy compatibility is a major business advantage.
They did a bunch of terrible inept rollouts with confusing technology for both users and developers and effectively shot themselves in the foot. But it did not have to go down that way.
Sounds like a nightmare universe.
I've got a hobby app in kotlin multiplatform with iOS/Android/Windows/WASM builds and while I have no issues with Apple's App Store or Google Play, I've had nothing but problems trying to support Windows Store.
The MSIX installer format is horrendous to deal with and the certification process for new releases on Windows Store is always far too long and in the cases they do find issues the reports of the issue that they log are entirely worthless.
I ended up just pulling the app off the Windows Store entirely and making it a downloadable *.msi installer. While the extra layer of presumed integrity of the app being on the Microsoft Store would be nice it wasn't remotely worth the effort for the tiny amount of people who were using the Windows version in the first place, especially given the app is free.
A lot of legacy software was killed off with the move to 64-bit Windows. Consumers survived that and for businesses registering their software with MS isn't a problem. They're already handing Microsoft all of their company email, their documents, their spreadsheets, etc. and paying Microsoft for the privilege. MS doesn't care at all about consumers.
Windows was never going to go another way than this.
Users who care about hardware and/or software freedom should be on linux.
What a lovely granny that totally exists.
This doesn't make much sense to me.
To put the strongest face on it, by "cracked" youtube, you mean a version that shows the cracker's ads and maybe somehow generates extra clicks (or whatever) so they can get money out of it?
Cracked spotify? In my mind that's just like YouTube, almost entirely server-side. I guess you're talking about hijacking ads here, too? I feel like a "real" crack of Spotify would let you listen to music for free, but that should be impossible (unless their SWE's are incompetent).
My favorite was a local "discover which on your contacts is on the leaked Covid quarantine list[1]" scam app. It claimed that the extra permission dialogs are just fearmongering by Google, who is in cahoots with big pharma, and wants covid to spread to sell more medications.
[1] In fact, no such leak has ever taken place, its existence was just part of the setup for the scam.
But in practice, these “apps that lookalike popular apps” are not intended to just be adware-less versions of the popular apps. They are frequently “hide the ads, inject the malware with more permissions” Trojan horses.
Google is doing the same thing the fake apps are doing. Real problem: bad ads. Solution: cracked app. Trojan: too many permissions, steals data.
Google: problem: bad apps. Solution: advanced Google DRM. Trojan: too many permissions, steals data.
It will not happen in the next 10 years. Right now people would just make generic launchers and then use them to manually load and execute any binary they please. Options include just writing your thingy in a scripting language and run it in node.exe, python.exe, or compile it to WASM, use native bindings of a scripting language, abuse a random verified electron app, etc etc.
Even remotely getting to the point where locking Windows down to that degree would be possible is going to take MS a long time, fighting friction from users all the way. The whole ecosystem would have to change drastically for that sort of control to even be possible and make sense.
The saddest part is this is to the detriment of literally everyone except a couple rich owners of those companies. And everyone has the right to vote. But western democracy is so indirect the people who understand and care have no way to change the law because their signal is lost in all the noise by those who don't know or don't care.
If the vote came down to people in favor of walled gardens or in favor of forcing companies to open their platforms, with everyone else not voting, it would be a landslide. But there's no way to vote on it this way.
Wow, how fix (WITHOUT intelligence tests as voting requirement) :(
The real issue is that western societies are built on individualism and the is that everyone is equal when they are obviously not and this would expose the lie.
---
However, the real issue is that decisions are packaged together. People vote for a party which they agree with on a few issues (or just one) and the rest become the noise.
So we need to split voting by issue. You could have one vote to determine which issues people care about most, then have multiple separate parlaments - but there would need to be a mechanism to force them to only write laws for the specific issue which is hard.
---
We could also allow people to override the votes of their representatives. The more people vote directly, the less weight the representatives have.
I am so sick of Google.
This is a monopoly with annual gross revenues bigger than all but 42 countries behaving this way.
They have conspired to control the web, browsers, mobile computing, and soon AI. It's sickening how much bad behavior they get away with.
They were able to use YouTube to bludgeon Windows Phone to death and become the de-facto mobile duopoly. Then they were able to get their shitty search engine on all the panes of glass, didn't care one iota about search quality (just ads), but were able to leverage their browser engine control to remove adblocking capabilities.
I hope the DOJ/FTC split Google into a dozen companies.
Sincerely.
There's no chance of that under the current regime. It loves bribery and Google has the money to get whatever they want.
Trump was a breath of fresh air talking about frustrations with the status quo that other politicians wouldn't acknowledge. But the only reason he was bringing them up was to use as a cudgel to shake down companies to enrich himself. He will very most certainly go after big tech monopolies and break them up... iff those big tech monopolies don't put bribes into his pocket. As long as his pockets get fatter, then the status quo is just peachy. It's called "making a deal".
This is just such an insane thing to say. It's like a Russian posting "I really hope our DOJ/FTC splits up Lukoil into a dozen companies!". But Russians don't post that because they're actually sensible.
Someone should hit surveillance-alt-delete!
Are there still people who like using Windows?
You are assuming that everyone knows about or ever experienced the alternatives. Windows way is the only way for many.
On average my game library works much better under Linux than Windows (Mac is a distant third — probably worse than FreeBSD).
Anyway, at 1 in 20, most people probably know someone that runs Linux.
There's no law against a more democratic way to implement the broker either but it requires interesting methods of coordination and/or decision making that doesn't seem to exist yet?
Seems like it wouldn't be much of a stretch to compare that statement to not starting a business because the economy is unfair. People indeed don't start businesses when the bureaucratic or tax overhead outweighs the financial benefit, but nobody loses sleep over an individual's hypothetical missed opportunity to learn a new skill but them. Doesn't matter to the platform owners unless it also stops being profitable, so it's their job to maintain the profitability for their ecosystem despite whatever barriers they put up.
It's not enough to not have a law against it, we need to have and enforce laws requiring it.
Developers are businesses and the economics need to work. For that, safety and security is much more important than openness.
Meanwhile, you're not looking at those who left, or those who decided to never enter a broken market dominated by players convicted of monopolistic practices.
This seems much more intuitive than a hypothesis where somehow people would prefer to enter a closed market over a fair and open market with no barriers to entry.
Remember, monopolists succeed because they are distorting the market, not because they are in fact the most efficient competitor.
Before the App Store, the picture was mostly a disaster of security, reliability and quality. There was no trust and so people didn't bother parting with their credit card information to buy software...especially not on their phone.
Apple's App Store model dramatically grew the pie because it was one of the few platforms that people were willing to actually transact confidently on and trusted. This is why millions of developers flocked to the platform. This is also why Apple has traditionally maintained an iron grip on it; it was beneficial for everyone involved.
Over time, they are being proven right as more open platforms realize that openness at the expense of trust doesn't work for the masses.
Once that happened, they gradually tried the idea with other disabled children, eventually progressing to deceiving the parents to get the permission. Then it got extended to teenagers and eventually adults, including disabled war veterans. Then there was a backlash and it stopped for a while. But it reappeared eventually, this time on an industrialized scale - the final solution. Disabilities were not the limit anymore. Arguably the worst genocide in human history started with the reluctant murder of a 5 month old infant, just 6 years before reaching its peak at the end of the war.
This is the classic example of a slippery slope. One hesitant misstep is the beginning. But as they realize its benefits (to them), they double down and gradually expand the scope until nothing is exempted. The consumer electronics industry and the software industry are certainly no exceptions to this. Is it too dramatic and hyperbolic to compare them to the Nazis? Admittedly, a bit. But perhaps it's not a bad idea to shame them like that, because clearly nothing else is working (with all due respects to the victims of the original). And it's not like they hesitate to shame us when it suits them.
[1] Gerhard Herbert Kretschmar (20 February 1939 – 25 July 1939): https://en.wikipedia.org/wiki/Gerhard_Kretschmar
Google's behavior is utterly and entirely disgusting, unacceptable, despicable, and dishonorable. Everyone who even glances near this decision should feel overwhelming shame. If you have a shred of political power to fight this internally, you are a failure to yourself, your customers, and the world if you choose to stay silent. They'll read comments like these and think "we're right, we're being brave", because they have convinced themselves that there is bravery in wielding overwhelming power against their users.
I don't know if I got this wrong, but the 'slippery slope' argument by itself never appeared to be a logical fallacy to me. There are numerous valid examples of it, and that's the context of its use in my previous reply. There certainly is a 'slippery slope' logical fallacy, but I thought it meant that you are misapplying/misusing the slippery slope argument where it isn't valid or doesn't apply.
> Google's behavior is utterly and entirely disgusting, unacceptable, despicable, and dishonorable.
I was going to apply the Nazi label on them everyone else who use such sleazy tactics. I hesitated because a lot of people are still emotional about the holocaust (it has been 80 years) and object to equating anything with Nazism. But I sometimes wonder if the objection is meant only to silence the critics. While their actions haven't yet reached the magnitude of atrocities committed by the Nazis, their actions certainly are consistent with the Nazi tactics. Besides, it's not as if they had any qualms labeling ordinary people 'Pirates' for sharing media. Therefore I feel it's quite appropriate to apply to them and promote the label of 'Supply Side Nazis'.
While what the Nazis did was extremely barbaric, I feel that people gate keep their references too much - especially when talking about their tactics and methods, rather than the magnitude of their cruelty. For example, you don't have to be Joseph Goebbels or someone as vicious as him to follow his tactics. And I don't find an issue in invoking his reference if someone does this.
It worked because the majority of German doctors were full on board but there were talks of that way before nazi got in power.
I believe even in the USA there was program like sterilization of « degenerates » and « negro » At these times.
https://www.ndtv.com/world-news/us-sterilisation-program-tri...
(Édit : After checking the source, these programs went on from 1929 so 4 years before nazi were elected, and lasted until 1974 !!!)
I’m not sure all of that is in any way comparable to a company abusing its monopolistic position to enforce rules that will benefit it.
so much extra work involved that isn't building the app.
I worry how this will affect fdroid etc.
Just look up how to skip the "OOTB (out of the box) experience" and you can still bypass having to set up a cloud account on Windows 11 and can just set up a local account like normal. :)
These sorts of hurdles exist to push more and more users to their favorite workflow until the dissenting voice is too feeble to notice when they finally pull the plug on the straightforward method. The intent is certainly there, since they are quite evidently boiling the frog. Just wait for the fine day when you wake up in the morning to see an HN story just like this one about Windows login as well.
Doesnt this pretty much describe the entirety of the Linux experience though?
Setting things up was much more complicated as well. But I stuck it out, still hate Windows, but I've gotten a bit used to it.
> But there is no way an average system user is going to have the patience or often the skill necessary to do it.
It's like two commands. Super easy.
So you tolerate it. Matches what I felt. But it was more the stuff I couldn't control - like the timing of the updates and the incessant ads.
> It's like two commands. Super easy.
For you, yes. But problem for the average user is the patience required to figure it out. Also, I think the edition I used didn't have that option at all. Because I vaguely remember searching for a solution and not finding one that worked for me. Whatever it was, it will soon be like that for more or less everyone.
https://www.tomshardware.com/software/windows/microsoft-elim...
It's still possible to set up using only a local account, but who knows for how long.
Have a login. Pin features to a login. Mandate a login but w/ backdoor. Close the back door. "It's a backdoor, why not use the front door?"
But I agree about the trend. Microsoft will probably block this workaround eventually.
I think they might just get away with it.
I'm currently researching Android alternatives, including Librem and Jolla C2, and I'm skeptical that those will be compelling. It's just so sad.
But not every developer, of course, would agree to register.
All of those will disappear also on F-Droid because of that.
I think we tend to underestimate our ability to get used to stuff.
If they have anything on the platform that is subject to the CRA, they are a distributer:
https://www.cyberresilienceact.eu/cra-guide-for-importers-di...
You can try it, but don't cry if it bricks.
The newish one I bought got GrapheneOS instead. That worked without a hitch, but it's got more than a few problems.
The browser doesn't handle dark mode well.
The launcher is primitive. Why didn't they just take Trebuchet?
I was also very used to pattern unlock.
Use some other browser if dark mode is really important to you.
I think the launcher is good and I can't think of anything to improve on it. I'm happy it's the default, but I'm sure you can switch to a different launcher if you want.
Pattern unlock is also not there because of security.
It didn't used to be like this but started maybe a year ago.
Use an iPhone, minimize my use of it. Continue to emphasize Linux on all my other devices. Move away from Google and Apple services to as much self-hosting as possible. Leverage TailScale to make my services accessible, globally, without actually exposing them on the internet. I'm just assuming that I will have to have some kind of attested device in order to run banking and payment apps and that might as well be a locked down device like an iPhone.
Samsung recently stopped allowing the bootloader unlocking. HTC stopped allowing bootloader unlocking in 2018.
My bet is on Nothingphone or Fairphone remaining open for a while.
In Brazil? In Malaysia? In Singapore? I highly doubt it.
That's if they're available at all. In my country, only cell phones certified by the telecommunications government agency (ANATEL) can be imported, so the alternatives (Jolla, PinePhone, Fairphone) simply don't exist.
They do marvellous things like mandate weird Brazilian Android games on the phone I bought in Brazil.
Atlanta or Tbilisi?
Maybe I think too highly of people, but I'd also imagine most would be able to get say... 6/10 right, for which countries the following list is from:
- Flanders
- Nova Scotia
- Brandenburg
- Guangzhou
- Tasmania
- Minas Gerais
- Catalonia
- Chechnya
- West Bengal
- Bali
Uhm, this sounds more like something from the Ministry of Culture, maybe some tax incentive for manufacturers promoting local productions.
I could be wrong though. Curious to know if Anatel has issued any ordinance in this regard, just did a quick search but could find nothing so far.
I'm not sure Google still has the ecosystem by the balls. It's very possible whatever Googlers who made this decision are the type of folks who don't comprehend they work for a monopoly that like actually can't do things like this anymore.
The intentions behind all the security hardware they introduced in pixel phones first, and is now required by play integrity to function might've been well-meaning, but that doesn't really matter in the end. Security features that the user can't control and bypass aren't security features - they're digital handcuffs.
https://learn.microsoft.com/en-us/windows/apps/develop/smart...
If google does that then it’s not the worst.
Worst is having to get my ID and all details scanned and processed by Google.
It's a huge pain to set up initially, but it's smooth sailing after that. There's a good tutorial at https://melatonin.dev/blog/code-signing-on-windows-with-azur...
For what it's worth, in my experience it was even worse with EV certs though - all the same steps including removing WHOIS privacy, plus some extra ones like voice phone number validation that had to be repeated every single year.
And then there were extra WTFs with the EV cert expiration being 365 days after an issue date which is several days before you actually receive the hardware token. Or one year they sent the hardware token fairly promptly, but forget to send the password needed to use it, and it took a week to get a response from support etc. Then again, Azure Trusted Signing has similar ridiculousness with billing being based on calendar months, with no proration for your first month even if you started at the end of the month... I mean it's just $10 but it really adds insult to injury after that signup gauntlet.
Anyway, I've heard that if your Azure Trusted Signing process gets stuck in limbo, it can be best to submit a different document, but I'm not sure if there's any alternative permitted for the DUNS step. That's especially annoying because trying to update outdated info with Dun & Bradstreet is problematic in my experience, i.e. their web forms just plain did not function properly.
How will it go? Where are people going to go? People who draw a hard line on this can’t go to iOS for more freedom. Linux phones aren’t ready for prime time. So what’s left? Going back to a flip phone that doesn’t even have the capability of running apps in the same class?
It could also make jailbreaking more commonplace, which on the Android side has died down in recent years because sideloading is enough for most users.
I don't think the average user feels like they are really missing anything, which makes it a hard sell.
I definitely fly less now, because I am tired of the Orwellian circus at the airports. I guess same mechanism will reduce my smartphone use
we need more OEM unlockable phones, though. GOS is looking at getting one made, I'm planning to throw money at them to make it happen.
It's the implementation that OEMs used to support VoLTE isn't compatible with AOSP APIs.
If it wasn't for Google here you'd never have VoLTE on custom ROMs, if it exists in any shape or form it's thanks to them.
And maybe a separate one to root while they still can be.
Or a f.u.Google step. I'll despise the straight-jacketing of Apple but my anger about Google's dick-move will keep me going.
This isn't even going to be some sort of an ideological decision. It's simply the intelligent choice.
Yes, I've cherry picked from the minority of countries with near or over half iOS market share. But, they're all high GDP countries with a very valuable customer base. Apple and Google care about these markets, they don't care about global market share.
[1] https://gs.statcounter.com/os-market-share/mobile/australia [2] https://gs.statcounter.com/os-market-share/mobile/united-sta... [3] https://gs.statcounter.com/vendor-market-share/mobile/united... [4] https://gs.statcounter.com/os-market-share/mobile/japan [5] https://gs.statcounter.com/vendor-market-share/mobile/canada [6] https://gs.statcounter.com/os-market-share/mobile/denmark [7] https://gs.statcounter.com/os-market-share/mobile/switzerlan... [8] https://gs.statcounter.com/os-market-share/mobile/sweden
Microsoft would love to do that too, but it just has too much of legacy software to introduce such a major hurdle.
Even with a signature they can't guarantee it doesn't have malware. The fact that signed malware exists should be enough to put an end to the argument that it's for our own good.
My original statement had nothing to do with motorcycle helmets, but if using them required us to give up enough of our freedoms they could also become unacceptable for the level or protection they provide (or fail to provide) us.
"It doesn't actually protect us though, so it isn't worth it and we shouldn't accept it."
That is completely false and dangerous misinformation.
You will need to boot to recovery mode, go through utility and enable it: https://support.apple.com/en-ca/guide/mac-help/mchl768f7291/...
Basically average users will never be able to pull this off.
To meaningfully challenge it, developers need to agree to withheld supply like a cartel (illegal?) or union.
I think it’s probably close to the union scenario in an industry with a single employer, as there is that one too many relationship (all developers vs Google). Whereas a cartel is a few suppliers conspiring against all consumers.
I’m not sure developers would go to those lengths, and I’m not sure it would work either as the benefit is too high from defecting from such a coalition.
Apple will disagree and the first company doing worst than this, and is the world's first trillion dollars company.
Money talks.
Nowhere does that require you to go and get a DUNS number, which is onerous for a single developer to do without the infrastructure of a company.
It seems kind of odd to me to rely on some kind of external hidden "credit agency"-style company for this? And why would DUNS want to know about some kid in their basement in Bangledesh making (non-malicious) apps, and why would the kid want Dun & Bradstreet to know about them? It makes no sense at all.
It's not that the identity prevents malware/abuse, but publishing any malware to the store burns the identity and establishing another is harder than simply coming up with a new email address. It's not necessarily the best scheme out of there, but it makes sense given their apparent goal.
They do a lot of other horrible things too, they could expand the definition of malware.
Youc an see the zeitgeist forming around corporations wanting to lock out any small unlicensed company from working on phones.
The key is mostly fascism in the guise of "security". Witness stuff like the ICE tracker app. Google would love a way to freeze out both it's appearance on the app store and any developer who'd program similar.
Which is exactly the same policy as Apple.
Over the years, it seems Google has been trying to have their cake and eat it too, by basically subsuming others to use Android through this appeal of a more free and open operating system ecosystem, but have tried to slowly close and close it down now that it has won the other half of the market on that promise.
This feels more sly, because it's kind of a bait and switch. Apple never made such claim and was always upfront, so while I don't like it, I never bought into it in the first place for them to have the rug pulled under me after giving them my money as Google might be doing.
Google Play is not open source. You're still free to sideload on phone that use vanilla open-source android like the Fairphone.
They can already target malicious apps via Play Protect, including presumably all apps signed by the same signing key, so from that point of view no change would be needed. What this is presumably supposed to achieve is rather making it harder to rotate your signing key after it has been burnt…
One of those would be in corrupt countries you don’t have the „trusted 3rd party”
The real heroes are the people that facilitate alternatives, not those who talk, and Stallman was of the talking variety.
I know quite some people who live this way, and are very willing to overcome inconvenient hurdles to avoid having to use such a spying device.
This is kind of a lazy approach, and it's a good thing Stallman did not have that attitude towards personal computers.
But it's a bummer that there's no real equivalent for mobile devices. I use an Android device and I already consider it to be more locked down than Windows. Generally more irritating than Windows as well (maybe not Windows 11)
I also use it as little as possible (unfortunately more and more things require it) and try to get the smallest functional (for me) Android devices.
To actually free yourself requires both commitment on your end and work on other people's end, those people who help facilitate alternatives and guide others to having more freedom and privacy. We need more of that work.
The speakers of the world have their place, of course, but that's not the most important part of the solution.
Such people both lead by example, and try to inspire others towards following their example/lifestyle. The problem rather is that most people want a different lifestyle (in the particular example of privacy and freedom "one with less radical consequences", which I consider to be rather contradictory, but this discussion shall be off topic).
To give an analogue: many vegetarians both lead by example, and inspire others to become vegetarians. But many people nevertheless don't want to become vegetarians.
I've edited my post to not claim that all Stallman did was talk, which would've been wrong.
Like GNU?
https://www.bbc.com/news/magazine-26328105
https://en.wikipedia.org/wiki/Parents_Music_Resource_Center
https://en.wikipedia.org/wiki/Seduction_of_the_Innocent
https://www.nytimes.com/1997/02/27/business/job-insecurity-o...
Yanking the leash of the proletariat
TikTok is "brain rot" even though the real economy runs on physical statistics, the semantics have to be recognizable to the elders, or it's not democratic so they will force the semantics to be regurgitated as-if they are religious catechism.
People that think this is unacceptable are not remotely average users. Average users benefit greatly from their pocket appliance not being a full fledged computer.
Fundamentally, it is a trust issue. Why should I be forced to trust Google or Apple has my best interests in mind (they don't)? That is not ensuring 'device integrity', it's ensuring that I am at the whims of a corporation which doesn't care about me and will leverage what it can to extract as much blood as it can from me. You can ensure 'device integrity' without putting any permanent trust in Google or Apple.
You are not.
It's certainly convenient in this modern world to pay for and use one of their devices though.
Limitations because it's not just protection - you don't get to choose which authorities you trust. Defaulting to manufacturer/OS vendor as the default authority would be ok, but there is no option to choose. Users have no power over their own device. That's not ok even if most choose to never execute it or don't know about it, it will lead to abuse of power.
Considering market forces are against it, I believe the only practical way to accomplish this in the long term is for this to be a right that is enforced by legislation. I don't think it is even far from precedent surrounding first sale doctrine and things like Magnuson-Moss, that the user should be the ultimate one in control post-purchase, it just takes a different shape when we're talking about computing technology.
No one is forcing you to buy a particular device.
True. But society in practice requires a smartphone with one of two operating systems to live a normal life without significant efficiency losses in your day. Now all phones with both of those will be completely walled off. You'll be forced to participate or make your life a lot less convenient.
Surely you wouldn't defend absolutely anything happening to say roads just because you're not forced to drive, technically speaking?
Furthermore, if you fundamentally allow this behaviour, the market forces are sure to push us to an end state where users simply have no control, and there are no viable alternatives. We are most of the way there already when it comes to smartphones. The cost of entry to this market (many $billions over many years, if you can even manage to gain meaningful marketshare at all), and the amount of money that is on the table (30% of the $billions transacted on a successful platform today, but who knows how far they push with a real stranglehold) means that it is virtually impossible for competition to solve this problem.
What's being sacrificed in the name of security is not worth it imo.
Enabling side loading on android is not a standard setting you can flick on. Is there any data on the number of devices who have this enabled and are falling for hacked apps?
Android's value was always in being the open(ish) alternative. When we lose that choice and the whole world adopts one philosophy, the ecosystem becomes brittle.
We saw this with the Bell monopoly, which held up telephone innovation for three quarters of a century.
In the short term, some users are safer. In the medium term, all users suffer from the lack of competition and innovation that a duopoly of walled gardens will create.
In what way? Seriously, what benefit is there? (And don't say security...)
The world would be a much better place if we only had calls and direct messages.
> you have been infected by 3 viruses, click here in the next 5 minutes or the damage will be permanent
And they believe it. Giving them the power to run any software they want, also means giving everyone else the power to make them run any software they can be tricked into installing.
I'm deeply concerned about how this will impact users like us, especially since we're such a small minority that our desires could easily be trampled by the masses, but this is a clear win for the average user.
(And don't make the perfectionist fallacy w.r.t. Google not successfully preventing 100% of malware)
Two reasons: they are not educated about devices they use, desktop operating systems are still awful at security (exe from a mail attachment can have a pdf looking thumbnail, executed with two clicks, even if accidental, immediately gets access to all user files... the whole concept of antivirus software...). It has nothing to do with side loading, especially on Android, where sideloading is a very explicit action already, and then you need to allow the application to do harm.
> Giving them the power to run any software they want, also means giving everyone else the power to make them run any software they can be tricked into installing.
You are taking away people's agency. Either you get to control your bank account risking that you get scammed, or someone will control it for you.
So the email they get which tells them about the 3 viruses also contains a phone number where a "nice tech support person" will walk them through the steps of side-loading the "anti-virus app". You'd be surprised at what warnings/permission boxes people will blindly accept when they think they're talking to someone from Microsoft or Google's tech support.
> You are taking away people's agency.
Agency they don't want and never use. It's taking away agency from people like us but for the average user, Google is taking away nothing they've ever cared about.
> Either you get to control your bank account risking that you get scammed, or someone will control it for you.
I was just saying a couple of days ago that we need a service for old people where any transaction above a certain configurable threshold (for example, $500 in a day) has to be approved by an employee of this service who serves as a neutral 3rd party whose sole function is to try to prevent scams. That way the old folks would still have their agency so they can go out and buy all the hot-rods and transistor radios they want but if they're about to wire money to "Microsoft" then the anti-scam-company would step in and prevent that transaction (or at least require the old person have a discussion about why its an obvious scam first before eventually allowing the transaction through depending on the client).
Whether this change actually takes control away from us remains to be seen. For example, I don't see anything in the article that suggests we wouldn't be able to install a custom ROM with the signature check removed. Personally, I already run GrapheneOS so I expect I actually won't be impacted by this at all.
But I know they do, I've seen this first hand. It's lack of education (except for extreme cases of people who cannot take care of themselves. but that's not the majority)
> Agency they don't want and never use. It's taking away agency from people like us but for the average user, Google is taking away nothing they've ever cared about.
It's agency they don't know they want, until it suddenly becomes useful. I'm not expecting everyone to use side-loaded, unapproved apps every day, it's about keeping OS vendors in check, about limiting their power over devices they don't own. If they act against users, there should be a way to circumvent them. Such ideas take that away.
> I was just saying a couple of days ago that we need a service for old people where any transaction above a certain configurable threshold (for example, $500 in a day) has to be approved by an employee of this service who serves as a neutral 3rd party whose sole function is to try to prevent scams.
Enabling such a service is a choice they would have to make. The default is control. The situation with all side loading restrictions is opposite - you don't get to choose.
Unless you are suggesting that such service should be forced on people that match some vague "old" criteria. Our disagreement goes far besides technology in that case.
Saying "the users need to be educated" doesn't solve anything. Google could start an education campaign tomorrow and it would be ignored by most of the people that need it. If they were interested in learning then we wouldn't have this problem.
> If they act against users, there should be a way to circumvent them
Then install a custom rom. All the power you want is already available, just no longer on the official android builds. Seems silly to demand Google screw over the majority of their customers because you don't want to install a custom rom.
> The situation with all side loading restrictions is opposite - you don't get to choose.
On the contrary, you choose when you purchase your phone. If you don't like it, purchase a phone that caters to users like us. There's the librem5 which I sadly own but that phone is a joke (but tolerable if the android landscape starts looking too much like Apple). I've heard good things about the pinephone but personally I'm never touching anything that comes out of pine64 again after the disastrous pinebook pro. I love the idea behind the FairPhone but the security on that device is a joke. I'm hoping the GrapheneOS people launch a decent phone.
Of course just saying it doesn't fix anything.
I don't want Google or Apple or any other vendor to do any education campaigns (and they clearly don't even want to try), part of my point is that the issue is too deep to be solved by such technological measures. For example, not skipping such warnings (includes invalid/expired certificates in https) and basic cyber hygiene should be taught in schools. There should be more public campaigns about these issues.
So I'm not even sure if Google should be fixing that particular problem (although I can guess why they are really eager to "solve" it this particular way). I would rather they focused even more on a stronger sandbox, making sure system software on licensed phones has no vulnerabilities and making sure the users understand what power they give to an application, than pretend that this fixes much. Sideloading restrictions only barely (because it's not like they are actually going to verify the applications, nothing about that in the post) plug one way to scam people remotely, over many, many other more severe ways. The banks in many countries don't even properly verify identity of people they give loans to, why not focus on that instead? (Yes, Google won't fix this, I'm not asking them to, they shouldn't try.)
We lose more than we gain.
> Then install a custom rom. All the power you want is already available
On most phones it's not, but that's besides my point.
> Seems silly to demand Google screw over the majority of their customers because you don't want to install a custom rom.
I'm not demanding Google to screw over anyone, and the current "sideloading" situation does not screw over anyone. I just believe that the vendors should not have the sole power to decide what applications can be installed on devices they don't own. Maybe let's have multiple certification authorities besides Google, like with TLS, as a start/compromise? I see the point of actually having an expert verify if an application is legitimate, and this isn't even it.
> On the contrary, you choose when you purchase your phone.
That choice should not be made when the phone is purchased.
And also I'm not talking about what I want to do with my phone, I'm talking about what I believe people should be able to do with their phones - for example they should be able to opt out of such protections if they don't want them (and leave them on if they want them), or choose who verifies their applications. Only possible if they know what the protections do and what the risks are, going back to what I wrote about education.
In the short term, yes. In the long term, it means Google can ban any app it doesn't like, and it means governments can compel it to do so.
Governments being able to ban software without easy workarounds could have far-reaching consequences affecting people who don't even use the software in question. This is a Bad Thing even if it helps keep a few people from getting scammed.
I do think it is in everyone's interest to be able to run software of your choosing on hardware you bought to own. The manufacturer needn't make it easy (my microwave sure didn't expect to install extra software packages; I don't expect them to open up an interface for this) but they also don't need to actively block the device owner from doing it
Right until their devices start to act against their will.
The device integrity is are talking about it integral only to Google and Apple. Not to you.
Now, that may happen anyway, but they'll give up a TON to avoid that.
Me, I try to avoid using my phone for anything important, use a VPN under Linux at home whenever possible, ad blockers, privacy guard, etc, etc. I can't expect my non-technical family members to do that.
Bad car analogy coming up: MOST drivers benefit more from ABS than the few really, really good race car drivers who can do threshold braking and outbrake ABS - and even then, I doubt it's true for anything but the earliest ABS systems. I'll bet the newest ABS systems are better than almost any human - because they don't have an off day, don't get distracted, etc.
And I get the anger - I'm an old school Atari 800xl / ST / DOS / Linux user who tries to ditch Windows where possible. Restricting things seems heavy-handed - and I don't trust Google in the least. But I would NEVER tell anyone in my family to sideload an app, even though they're all Android users - I don't want that support burden.
Why, though?
There's certainly no technical reason that a pocket appliance can't be a full fledged computer. The primary reason it isn't is because device manufacturers benefit greatly from having a tight control over their products. This is not unique to mobile devices; we see the same trend of desktop operating systems becoming increasingly user hostile as well.
The claim that these features are in the best interest of users is an inane excuse. Operating systems can certainly give users the freedom to use their devices to their full capabilities, without sacrificing their security or privacy. There are many ways that Google could implement this that doesn't involve being the global authority over which apps users are allowed to install. But, of course, they are in the advertising business, where all data that can be collected, must be collected.
People who think this is unacceptable are the people who 1) understand what it is, 2) don't stand to profit from it, and 3) don't dream about locking average users into an ecosystem that they control some day.
I'm all for code signing and integrity verification. We need both technologies on pretty much all devices.
You are just conflating two different issues - side loading has nothing to do with device integrity.
So yeah, its different and more aecure
lets that sink it on how hard to make ecosystem
Installer software signing certificates that will satisfy MS are prohibitively expensive for hobbyists (hundreds per year).
If fact, the reason why MS can charge for "nearly mandatory" executable signing is because it is not mandatory at all. If they really were forced to close loopholes, they would have made it free for everyone, — just like Let's Encrypt was made free of charge to establish mandatory encryption across the Web.
Code-signing certs used to be very expensive and annoying to obtain. The situation has improved a lot since the launch of Azure Trusted Signing, and now it's roughly on par with the cost and annoyance level of code-signing for Mac binaries.
My understanding of the article is that there is nothing that a user will be able to do to install your software.
> “developers [that we approve] will have the same freedom to distribute their apps directly to users through [installation] or to use any app store they prefer.”
So, less freedom.
Currently the entire ecosystem is riddled with malware, spyware, or adware with shady source information and people have no way to verify the data practices
It's a step of questionable utility, and I suspect it comes from requirements of (not exactly freedom-loving) governments of Brazil, Malaysia, and Singapore, where the demand for registration will be enforced first. Maybe it will even remain geographically limited.
The article is very light on details. Crucially, it lacks any links to actual Google documents.
Yes, which is why it's bad.
I think it’s about damn time to have some accountability when your user base spans the intellectual spectrum from Einstein to beechnut.
Edit: Continuing… I get it, we had a great run with the Wild West on phones, but we knew the risks, and making your life revolve around a duopoly and then complaining when it acts like a duopoly? Come on. Go back to a flip phone, or make your own smartphone ecosystem. The entitlement is outrageous.
This response is unreasonable. If I'm purchasing a piece of hardware, it's not outrageous that I want to be able to compile and run software on it without asking for permission. Suggesting that I instead create my own smartphone ecosystem is absurd.
Don’t like it? Don’t by the phone. Genz mentality- whine when you don’t get what you want because it’s TOO MUCH WORK to go without. You could force Droid to reverse policy by not using it, but you’ll bend the knee and whine because you need your TikTok.
These were also years in the real world.
>it’s the one you chose by giving up your autonomy.
You are advocating for giving up autonomy. The people you are replying to are advocating the opposite.
>Don’t like it? Don’t by the phone. Genz mentality-
Oblig OK Boomer. "Dont you dare complain about big corporation, just uh go without, or buy a dumb phone, or just run all your calls through some Cellular enabled raspberry pi" Why would you defend some massive corporation crushing freedom. Shouldnt you at least beg google for some money.
>You could force Droid to reverse policy by not using it, but you’ll bend the knee and whine because you need your TikTok.
Spoken like someone who has already bent the knee, and is somehow critically damaged by people discussing methods to avoid bending the knee.
Let me just give up on banking and the proprietary 2FA app that my job requires. Guess we're going homeless to protest Google, boys.
And both companies don't do anything about it because they are loaded with money from those scams.
Give me a break, it's never been about security.
No it isn't. It's perfectly reasonable. It's my device, bought with my money, earned on my time. I didn't agree to a social contract. I bought a tool. And you're a fool if you think
>but it's the current year!
is an argument. This isn't happening because the technological cosmos demands it. It's happening because google is winding up for a monopolistic hold of the market. They seek to manipulate it for their private benefit at the expense of everyone else. If they actually push through with this, they will be broken up.
Cutting through the excuses, this is just another step in converting the US from a democracy to a fascist dictatorship.
Want to write software?
Papers please.
The US considers airports “constitution free zones”
Corporations are reading the room and pulling out any hostile tactic they've kept in their back pocket waiting for an occasion like this.
This is only the beginning with digital IDs. It's absolutely going to get worse and all of human history is available as evidence to what occurs with unchecked power.
It looks like pattern there is that a some powerful guy or company just removes rights and freedoms we had by small pieces. Those small pieces are not worth to fight for, until frog is boiled alive.
Yes, you can turn off smartscreen (for now) but opening random executables is getting harder and harder.
Starts with scary warnings for unsigned apps (with a workaround), then they start imposing extra restrictions for unsigned apps, and then they make the SmartScreen workaround more difficult to enable (maybe it needs a registry edit), then they'll remove that workaround in certain markets/editions (maybe the Home version first). Finally they'll remove it everywhere.
imagine microsoft having the moral high ground for once
This is absolutely unacceptable. That's like you having to submit your personal details to Microsoft in order to just run a program on Windows. Absolutely nuts and it will not go as they think it will.