79 comments

  • FiloSottile 33 minutes ago

    This sort of breathless outrage rhetoric would be a lot easier to take seriously if it spent even a minute acknowledging the very real risk to users that this is meant to mitigate: tech support scams where people are walked through installing an app that takes over their phone and steals their money, private data, and identity.

    You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

    Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.

    Tech is cool, but it's not an end in itself. Serving people should be. And if people are getting hurt, it's not working well, even if those people are not the ones that read Hacker News.

      Mr_Modulo 18 minutes ago

      I don't think you can just do anything you want in the name of security and protecting users. This will make installing apps needlesly difficult. There is already a warning when enabling installation of apps from unknown sources. That should be enough. If users don't read that's on them.

      The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.

        neilalexander 2 minutes ago

        Users don’t read warnings. Most scams capitalise on urgency. When given more time to stop and think something through, it often becomes obvious what’s happening.

      GolfPopper 24 minutes ago

      Phone carriers can't be bothered to police their networks to mitigate flagrant bad actors, who can't be shut down by state law enforcement, so your software company needs to take control of your device away from you. "For your own safety."

      It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.

        skrebbel 7 minutes ago

        Huh? You’re arguing for carriers to inspect all traffic to block scammers? That’s way more intrusive than google blocking sideloading. The outrage on places like HN would be deafening.

        gjsman-1000 12 minutes ago

        Are you kidding?

        Small businesses getting blocked by Gmail, Twilio, etc. for legitimate activities is constant.

      Frieren 24 minutes ago

      Many scams are committed thru apps like AnyDesk, TeamViewer, RustDesk... That are apps already in the store. That is a very cheap, easy, proven way of doing it.

      Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.

      People are getting hurt. Mass spying should stop now.

      rpdillon 6 minutes ago

      After researching this for some time, the majority of scams are perpetrated with apps that are already in the Play Store and are remote access apps. The entire premise that the Play Store is safe and everything else is dangerous is not borne out by the empirical evidence.

      > You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

      I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.

      karussell 16 minutes ago

      > Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.

      The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.

        catgirlinspace 4 minutes ago

        The 24 hour wait happens once, not on every app install.

          karussell a few seconds ago

          Oh, ok, thanks for the information. But if it is a one-time, device-level wait, not per source and not per app, then I'm unsure how this should prevent scammers in the long term?

      bunderbunder 15 minutes ago

      That is a real concern, but I don’t for a minute believe that it’s Google’s only motivation. This is also securing a revenue stream and making it harder for others to compete.

      Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering snd dying on Android, too.

      kelvinjps10 3 minutes ago

      There is already many warnings and if the can get you to do that they can get you to other types of scams rather don't require installing an app like sharing data, putting info on websites.

      49369201837 19 minutes ago

      Google, who gladly take the money from criminals in exchange for funneling victims to their scam websites have the moral high ground and are unfortunately forced to take away the user's freedoms?

      aestetix 11 minutes ago

      This sounds like know-it-all propaganda as well. Why not make it opt-in? Google (and other Big Tech companies) seem to think they know better than everyone else, even though they are also completely untransparent about what they do.

      blfr 20 minutes ago

      Is this really just a 24h cooldown once?

        collinmanderson 6 minutes ago

        I think that's what they said it's going to be. A one time 24 hr cooldown to turn on the "Allow Unverified Packages" setting, not 24hr per app.

        And then you have the option:

        - unverified packages either temporarily (7 days)

        - or indefinitely

      silverFork 29 minutes ago

      Is it for safety or for collecting more rent. Certainly google can withhold installation till the new app is tested with their super duper Ai.

        criddell 23 minutes ago

        Do you really think there are enough affected developers that it will move the revenue needle at all for Google?

        I think this was probably a very easy decision for Google after they weighed benefits and harms to users and developers.

          silverFork 17 minutes ago

          I am certain that its not about harm but rather US supremacy doctrine. They are tightening their noose. You have to be approved to live in their digital world and pay rent.

      misnome 6 minutes ago

      It's exactly the same as the people crying conspiracy about parts-locking for repairability, not acknowledging the real effects it had on phone thefts and the pressure at the national and governmental level to help solve the epidemic.

      functionmouse 28 minutes ago

      So this will end tech support scams, then?

      Also. I regularly remove malware from people's android phones pro bono in and around my community. It all comes from the play store.

      sophrosyne42 25 minutes ago

      It's like locking people out of their own home, and then when people express outrage the concern troll steps in from out of frame to point out that they're not acknowledging the very real risk that if they could access their own house gasp they might accidentally let the wrong person in, or break something, or whatever.

      spwa4 24 minutes ago

      What would help a lot from Google side is:

      1) make it optional

      2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?

      Rooster61 20 minutes ago

      > You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.

      The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.

      There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.

  • NackerHughes an hour ago

    Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.

    Every app and every device, worldwide, with no opt-out.

    This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.

    Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.

    Registration requires:

    - Paying a fee to Google - Agreeing to Google's Terms and Conditions - Surrendering your government-issued identification - Providing evidence of your private signing key - Listing all current and all future application identifiers

    If a developer does not comply, their apps get silently blocked on every Android device worldwide.

      rjh29 37 minutes ago

      I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.

      As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.

      KMnO4 3 minutes ago

      I can’t stand this sort of hyperbole.

      Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.

      electric_mayhem 40 minutes ago

      Is it safe to assume that GrapheneOS will not be affected by this?

        other8026 4 minutes ago

        Not at all. The app that is enforcing the change is a privileged Google app. Even if someone tried installing it on GrapheneOS, it wouldn't be able to do anything like remove apps, block installation, or disable apps.

        nkjoep 17 minutes ago

        GrapheneOS or other similar OS won’t be the issue.

        The issue will be your bank, your gov, your uni, and school not releasing a compatible app for you.

        And nowadays a device that cannot communicate or be trusted by other actors of the network (internet) is pretty much useless.

        I hope those entities will wake up and start serving equivalents functionalities via the open web.

        That is why we have the good old WWW for.

          cheesemonk66 8 minutes ago

          I already have to tell everyone I don't have a smartphone because stuff doesn't work so we'll on graphene and I don't want to explain.

          echelon 9 minutes ago

          > That is why we have the good old WWW for.

          We can use AI to take back the entire tech stack.

          Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.

          We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.

          We don't need big tech anymore. We just need to be able to run our models.

        Aozora7 29 minutes ago

        Yes, because GrapheneOS completely controls app installation and google play services is just an optional module.

  • max-privatevoid a few seconds ago

    The last couple of Android phones I bought, I rooted within 1 hour of owning them. The current one will probably be my last Android phone.

  • silverFork 30 minutes ago

    I guess the an alternative open unix based operating system that can upload existing apps from both android as well as apple is needed or the greed will not ever end. This is about corporations that constantly need growth using new ways to collect rent from the rest of the world. They are chocking the world to collect new monies.

    They are recommending installing F-droid.. and not accepting android's demands. Its time to have open source smart phone operating system that can not be taken hostage.

      Aerroon 27 minutes ago

      The problem is that these OSes have achieved regulatory lock-in. Your bank app won't work on an alternative OS because it's not trusted. In some countries that means you can't access online government services through the standard path either.

        silverFork 20 minutes ago

        You are right. They can go through approval or have dual operating systems that can be installed on smart phones. No separate booting is required

  • chilipepperhott 3 minutes ago

    Android allowing sideloading is the single biggest reason I've been an android die-hard my entire life.

  • aestetix 9 minutes ago

    Incidentally, with this update, Android will lose any edge it had, and become a shittier and less polished version of iOS.

  • accountrequired 31 minutes ago

    Let's be real, it was always theirs. Wish it wasn't so, though.

  • erelong 36 minutes ago

    Alternatively the duopoly hard block might push linux mobile development in to overdrive (with AI assistance?)

  • randyrand 38 minutes ago

    Maybe stop using Android? I feel like there are a lot of decent distros these days. This helps accelerate it.

      skinfaxi 36 minutes ago

      Which ones did you have in mind?

  • everdrive 30 minutes ago

    The phone was never yours. You have a nice, granular set of permissions which (attempt to) control what apps can do ... but you don't really have any permissions that prevent you from _Google_ spying on you and selling your data or giving it up to law enforcement. It's like the propaganda radio you can turn down, but never off. You're given just enough control to feel like you have a choice.

  • kykat 23 minutes ago

    And this is why I've been recommending iPhones to my family when I always recommended Android

      ericyd 13 minutes ago

      Could you elaborate? This tactic feels identical to the way apple locks down apps to the app store, which requires paid developer accounts

      habitue 17 minutes ago

      Why exactly? Even after this move, iPhone is less open. Apple doesn't have the 24h escape hatch.

        cesarb 6 minutes ago

        Or the adb escape hatch. IIRC, their adb equivalent is limited to having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.

        Even with Android becoming much more closed, it's still more open than Apple.

      fooqux 7 minutes ago

      That's like recommending amputation to fix a bad knee. IOS is categorically worse in this department.

      everyday7732 10 minutes ago

      Ah, Apple, that true bastion of open software and not screwing over developers or customers.

      ...

      30 cents out of every dollar, you say?

      lawn 12 minutes ago

      ... Because they've been less open from the start?

  • ezequiel-garzon 39 minutes ago

    I thought Google was adding more hoops to jump through for F-Droid, Termux and the like. Did that change? Obviously the more hoops the less happy we will be, but it'd be nice to know.

  • tosti 38 minutes ago

    How does this work on lineageos?

    I'd just turn off my phone before midnight, boot it into fastboot and reflash lineage 2 days later, missing the window for them to push anything. No gapps btw.

  • Aozora7 28 minutes ago

    I got a used pixel 10a and installed GrapheneOS on it partly due to this.

  • skinfaxi 37 minutes ago

    The 24 hour waiting period is absolutely ridiculous. The article says to download alternative stores but I thought they too are impacted as it is the installation mechanic.

      kccqzy 18 minutes ago

      The waiting period is the best way to combat coercion. If I’m setting up a new phone, the setup already takes multiple hours that adding 24 hours doesn’t really mean much. It does a wonderful job of making sure you actually really want this app.

  • lookeey 34 minutes ago

    This is not the problem it is presented to be, and I see more benefits to this than prejudice.

    There is a very concerning amount of illegal apps/scams distributed through ads that I've casual users install somewhat banally with the aid of short walkthroughs.

    Any sufficiently advanced user is barely affected by this, as the procedure is just complex enough to block average people from getting scammed/using illegal services unknowingly, but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.

      ishouldnotbutk8 25 minutes ago

      "This is barely an inconvenience, it's just a 9-step, 24h-long step through a proprietary service, and mandatory sign-up with governmental ID for the developers, everyone technical enough can easily bypass it"

      I believe this is usually referred to as "boiling the frog".

      qrobit 30 minutes ago

      The page addresses it: https://keepandroidopen.org/#objections

      24h delay is not all of it, there's developer verification.

      gonzalohm 15 minutes ago

      You are assuming that the 24h cool down period is where this ends. I think it will get worse

        skeeter2020 6 minutes ago

        it's not hard to imagine Google stating "we're removing this opt-out path because next to no-one uses it, and it will help streamline Android, which will protect the children!"

      karussell 20 minutes ago

      > but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.

      Any sources for this claim? I don't buy it.

  • adelekeabdulgan 24 minutes ago

    So i wont be able to install .apk files for test purposes? thats terrible.

    whats the way forward?

      rjh29 23 minutes ago

      You can install apks via usb debugging as normal.

      You can't just click a random apk in a website and install it. At least without the 24 hour wait workaround, done once per device.

        eszed 5 minutes ago

        Free install by ADB, and Developer-moding once per device, not once per app / install? Yeah, OK. I don't quite get the outrage, then.

        Before you @ me, HN, I run GrapheneOS. I fully understand and practice "own your own hardware". Most people probably shouldn't, though, because they lack the technical ability / interest to do so safely, and throwing them to the wolves strikes me as ideology pushed to the point of foolishness.

        Now, y'all can flame my ass.

        emidln 11 minutes ago

        We don't know that it's once per device. It's been said by Google that it'll be once per device, but we haven't seen the code and we don't know the method of tracking that. What if I wipe your OS? What if I wipe data in play services? Will a future silent play services update conveniently break my p2p messaging app during a protest?

        adelekeabdulgan 19 minutes ago

        Okay, thanks.

  • WarmWash 43 minutes ago

    Google play store was ruled a monopoly and the Apple App store was not. Google allows alternatives on their platform and Apple strictly forbids it.

    If the legal system dictates that open = monopoly and closed = fair game, then you get dumb shit like this.

    Probably one of the dumbest rulings in tech ever, but few people know about it. Basically set precedent to never share your platform if you don't want legal scrutiny.

  • amelius 26 minutes ago

    In this age of AI why don't we have Linux running on random phone hardware yet?

      100percentjake 19 minutes ago

      This is increasingly becoming the case. There have been a few posts on Reddit of people successfully porting Arch and other distros to phone hardware (typically seems to be OnePlus?). My handheld game console, a Snapdragon 8 Gen2-based Android device by Retroid, just got official first-party support for running Linux on it.

  • JSRR1991 24 minutes ago

    Might have to switch to iphone...

    otherwise my next phone will be linux

      Haunt1000 13 minutes ago

      But I mean what are you saying really? An iPhone absolutely doesn't allow you to just randomly install stuff from the web unless there's been some update that I don't know about.

  • npodbielski 39 minutes ago

    i am using lineage os on some devices. It does not even have google play. On others I have GrapheneOS which is sandboxed. How that does affects me?

      phoghed 38 minutes ago

      It’ll increase your opportunities to let people know what OS you’re running by at least 10-fold. I’m running arch btw.

        skeeter2020 3 minutes ago

        >> It’ll increase your opportunities to let people know what OS you’re running by at least 10-fold.

        Two types of people will benefit: 1. the genuine & naive who want to help but don't make much progress; 2. those who attended Harvard.

        Rooster61 27 minutes ago

        You're running arch on a phone? I was unaware that was an option on mobile.

  • gjsman-1000 35 minutes ago

    > The EFF calls app gatekeeping "an ever-expanding pathway to internet censorship."

    I think what's interesting, and what our grandchildren will look back on, was how naive the early internet was. There was almost this sense of "the government is powerless" whether it be piracy or jailbreaking or casual death threats [8647 style] or who knows what else. Combined with also a sense that devices will always be exploitable, there's always a way around, resistance from government and corporations will always be futile.