Since F-Droid (i.e., the repositories, not the app) builds all apps, a practical solution would be for the repositories (i.e., their signing keys) to be recognized by El Goog. Whether and how much help / obstacle the "maybe we do evil" company puts up for / against this is a different question.
The Emacs version for Android makes uses of something like this IIRC by signing a version of Termux with the same key and distributing it in the same SourceForge repo such that Emacs on Android can access CLI tooling like git for example.
It seems to me this is a blocker to use if google can restrict sideloading like this. Its not going to end with just get people requiring to register their app with an identity. Wont they be able to put presser on f-droid devs to lock out software they consider a threat to some business model?
That newspeak term should just disappeared. It only contributes to the image that downloading and installing an app is something that is outside the "happy path". Installing software of your choice on a device you own shouldn't be demonised
Surely you see how installing unvetted software on a device that holds your entire life, bank info, photos, etc. probably shouldn't be part of the "happy path" for most people. You shouldn't even install software you haven't fully vetted from the google play store. This should be drilled into non-technical people.
Those of us who want to can easily bypass it. My mom who doesn't know what she's doing and gets a phishing email with a fancy apk attached should probably have a hard time using it.
> a device that holds your entire life, bank info, photos, etc.
I'd see it the other way around and say that a device running an operating system controlled by some company shouldn't hold your entire life, bank info, photos, etc.
How do you get around this? Literally every bank, brokerage, etc... is hell bent on you using your phone for everything from 2FA to passkeys, etc... They dont even imagine people have computers anymore or want two+ physical devices/controls on what can be done with which factors
It requires collective action. Ideally with laws to force interoperability, so folks can move among platforms with ease. Then standards will arise to keep that feasible for app makers.
Without regulation markets coalesce as the winners eat each other like a game of snake. It's a miracle Apple hasn't yet eliminated Android. Although I suppose for some institutions there is only iPhone.
Certainly you can use those, but they're not mandatory (here in Canada at least). Can easily get a card and use physical bank and ATM to do everything, and website logins use email as 2fa.
Have you ever tried to educate a 70+ year old person on this kind of stuff? Their eyes gloss over and they don't care. I've told my mother not to install random apps on her phone several times yet she still does it. I could probably send her a phishing e-mail right now that 'looks like' it's from me (so long as my name is in the from: field that's enough) and she'd follow the instructions to install a malicious apk too.
"Everyone should just be smarter/more educated" is what I used to think as well. I now fully understand some people have no desire to be educated in any way and it's a net good for society to not have a large % of devices compromised.
It is like saying that you should not have free speech because someone might influence 70+ to say stupid stuff (well, that is already happening...).
Family should be responsible on education or making phone of people that are not educated enough (minors, elderly, etc.) limited - I do that using Family Link. I have there my child and also my in-laws - both of them can't install new apps without my permission.
So the tech is already there, one just needs to use it.
yes, got my father on linux a decade (or more) ago. He's 84. No problem. Most recently we discussed being vigilant against vishing.
Now my in-laws (similar age) one very demented, the other thinks he knows best because he was a chemical engineer...they could use some built in protections
so ultimately I think some default level of "guardrail" is appropriate, but it should have a not too burdensome escape hatch
>so ultimately I think some default level of "guardrail" is appropriate, but it should have a not too burdensome escape hatch
Which is really exactly what google is implementing here and why I'm so perplexed so many people are upset. You or I or smart parents (my mother has never used a computer in her life and wouldn't want to) will have absolutely no issue sideloading apps after the proposed changes.
Given Google's track record, I don't think it's just "being upset" to have serious doubts about the probability of this escape hatch staying indefinitely.
But that's just a completely different discussion that we could've had a long time ago when they introduced it as a on/off security setting ~15-20 years ago too (and I bet people did). IMO nothing has changed except I bet more people will take going into developer options, being sternly warned, then having to wait 24 hours as a sign this is something maybe they shouldn't be doing. And I'd argue if you come to that conclusion and don't look into it further you're probably right,
Given that google is now forced to have competing app stores due to Epic v. Google and the ninth circuit courts went into long and arduous detail in that anti-trust case about sideloading restrictions I don't think they have a leg to stand on if they get rid of sideloading completely. Oddly Apple continues to get away with it no problem.
Google is the one peddling the malware. Any changes to 'security' that don't start with them removing the oodles of malware from their store are not security but profit driven.
The answer to people refusing to care about important things in life is not to put restrictions upon everyone's freedom. Ultimately, being an adult means you have to take responsibility for your actions (or lack thereof). It isn't hard to learn how to use a computer responsibly, and I've known plenty of older people who did so just fine. There's no excuse here.
You do understand we've broadly come to the conclusion that this isn't how society should work though, correct? It's why there's warning labels on everything, liability for not warning people for even the dumbest of things they might do with your product or in your establishment, extremely strict laws for things like driving a car, flying an airplane, or using any kind of heavy machinery, responsibility of servers to cut people off if they've had too much alcohol, the list goes on. I find intelligent people often have this mindset that all "real adults" are just as responsible as they are. It's just not the case.
And I generally wouldn't care "have at it" if their phone/computer being compromised only harmed them. But a bulk amount of compromised devices harms us all.
"Think of how stupid the average person is and then realize half of them are stupider than that!" -George Carlin
That would be like requiring people taking driving lessons before driving cars - what nonsense! Just let them behind the wheel & they will figure it out just fine!
I'm not sure the situations are comparable when Windows doesn't have this permission system where the apps are still very limited in what they can access unless you grant specific directory access or access to the contact list or such
It does, but approximately nobody uses it, because Microsoft also tried to apply loads of constraints on what kinds of program could exist when they rolled it out, as part of their "all Windows software should also work on Windows Phone and Xbox" campaign.
It was true then and it is true now. Outside businesspeople and students and the middle class of OECD countries (all amounting to a low single-digit percentage of the world population), ordinary people never bought desktop or laptop computers. By contrast, everyone has a mobile one in their pocket today.
Today people get in debt to have the latest orange iPhone, for a long time before that most people in, ok, developed countries somehow got hold of a computer.
Yeah, compared to separate hardware HSMs mobile banking is a massive downgrade in both security as well as user being in control of the hardware they own (by forcing locked down closer source OS & forcing hardware updates).
If mobile banking really wanted to be secure, they would support something like a NFC yubikey for transaction verification. The fact they fully ignore separate secure HSMs tells you what you need to know about their security.
> And they used an actually secure OTP dongle, eventually ditched by most banks because, yeah SMS codes and apps are safer............
The EU mandates the 2FA method shows information about the purchase you're authenticating (timestamp, amount and cc used in my case), making unconnected dongles impossible to use. This makes me sad, but it does have merit.
FWIW I still use the website to do all my payments. I find banking apps to be madness - you're entrusting all your money to what is essentially a toy.
The world may not of ended but to of people have been hurt by malware ruining their computer, cryptolocking all of their company's files for ransom, stealing all of your login credentials, stealing cryptocurrency, taking secret photos with your webcam, screen recording what you are doing on your computer, etc.
The "personal computer" has a terrible track record.
For many decades, people have been mistakenly putting diesel fuel into their gasoline cars, yet we never outlawed diesel vehicles. You can only do so much to protect people without destroying their rights to their property.
It is much rarer since it needs 0 day to do these at the same level as possible on a pc. The play store scanning apps for malware is an important safety mechanism against this. Further more imposter apps like YouTube but with no ads that are Trojans that steal people's accounts.
Or the accessibility permission, or to some degree the access all files ones; but it's also enough for the app to pilfer the data you trust it with.
The Play Store's scanning is very far from perfect, and the amount of crap that's on it, combined with the trust that people have towards it, and apps' unfettered access to internet, makes malicious software easily more common than on PCs.
Even without considering as malicious the enormous data collection that almost everything on the Play Store does, encouraged by Google
If the issue Google has with sideloading is really just the rampant app piracy (and the malware that comes with cracked apps) that might be something F-Droid can accomodate.
I don't think malware is the problem, as most malware comes directly via Google's ecosystem carried by ads. Just recently I had to uninstall some app from the play store since it tried to distribute malware through scary pop-ups and had it replaced with something from f-droid for someone I know.
> most malware comes directly via Google's ecosystem carried by ads.
Google's own Play Store is filled with outright malware too, no ads needed. The idea that Google has to control what people are allowed to install on their phones isn't really for the protection of anyone except Google.
It seems google is going to allow an "advanced flow" that is scam resistant by requiring the user to wait 24 hours before they can start installing their own apps. It sucks, but assuming they don't change the plan again, F-Droid should be able to continue working.
So basically Google is being now more of an asshole than Apple (that now allows app sideloading and third party stores, at least in the EU). I'm and Android user since the beginning and for once I'm start considering for the next phone that I could as well get an iPhone, basically all the good open stuff of Android is long gone (back in the days I used to flash a new ROM every week), and at least Apple is better in regards of privacy than Google.
It's already live, I had to go through it last week. It's in developer options, then it asks if you're moving the selector to allow the installation of non-play store apps because you're being asked to by someone.
Then it starts a 24 hour timer. When that hits zero, you have 1 hour to go back in and select that you want to install apps on a device you own and paid money to own.
It's not scam-resistant at all. Any scammer will gladly work around this and send someone to one of many malicious apps in the play store, or a malicious URL, or even just set an appointment to call Grandma back the next day.
They're not necessarily wrong about it being scam resistant, based on some of the research into the psychology of scams. Adding time defuses the urgency of phone scams, leaving plenty of time to seek a second opinion from family members or the internet, and forcing the scammer to re-explain what the original goal was. It's too much time to breathe and defuses the fight or flight reaction needed for a high success rate. You mention URLs, but a web browser based scam page doesn't accomplish much, because the scammer's goal with fake apps is to acquire persistent remote access (akin to how the AnyDesk Android app uses accessibility permissions for Teamviewer-like remote access to an entire phone).
But yeah, it's hilarious that they're pushing this so hard when the Google Play Store still has so much malware.
What? It only stays enabled for exactly 1 hour after the 24 hour timer?
I was under the impression that it would stay enabled permanently after waiting the 24 hours once.
IIRC, it's the button to permanently activate it that is only available for one hour. Once you do manage to press it, you've permanently enabled it. If you miss the window, you have to start the 24 hours again.
It looks exactly the same as now. You will have to do Google's 24 hour flow thing, but it's not like that's going to stop anyone who appreciates what F-droid brings to the table.
The current lockdown plan is that you'll need to wait 24 hours before installing the first unauthorized app, right? So probably exactly the same as it is now except setting up a phone will take 24 hours longer.
Currently, switching to GrapheneOS means giving Google money. Next year's Motorola-based alternative is also likely going to be several price classes above the Pixels you can currently put GrapheneOS on.
Then buy a Pixel second-hand or when they hit rock-bottom prices, which usually happens after 6 months or so. At some point Google is probably not making a lot of profit from the devices anymore and they want to sell it to you for tracking and to sell Google One subscriptions, which are mostly irrelevant if you use GrapheneOS.
I've tried $1000 phones before and found that they don't do anything different than my cheap phone, other than taking better quality pictures. But at least my cheap phone has an SD card slot and a headphone jack.
I followed Pixel prices for the last year, and rock-bottom for a 256gb version (the current absolute minimum for a device without an sd, to my eyes) meant 450€.
There are occasional good deals for (unused) older models on eBay, but they're surprisingly rare.
I wonder if Google demands stores to give the old models back, after the release of newer ones; they disappear from every store extremely quickly.
Interesting, here you can still buy the P10 and P10P for hundreds of Euros off and the prices are still trending down. Also many stores still have them. This is not surprising, because Google still sells them themselves, just in fewer colors and storage tiers.
The latest pixels are a complete downgrade from the previous year (worse components). That's one huge reason to buy a last year phone (as opposed to a current one).
Updates on this have been slowly trickling out and the best I can discern is you will be able to still install apps from stores like F-Droid, but you have to go through a manual "advanced flow" which will most likely make you wait 24 hours before installing it and make you go through other hoops.
In short, google has referred to this as "increased user friction" to try and deter people from doing this. Essentially not making it impossible; just really frustrating for users so they get sick of the process and just install verified apps through them.
The only way I know around this is to install a custom rom like GrapheneOS or Lineage OS since this change targets Because the policy targets the Google Mobile Services (GMS) framework rather than the foundational Android Open Source Project (AOSP).
From an Android developer perspective, not good. All apps on f-droid will have to be certified by the developer with Google (it's per-app I checked) otherwise they won't work at all. And the process of not easy, even for a verified play store developer, I still have to jump through hoops to register.
Then you have to explain to users how to enable this. Not too mention the onerous F-droid requirements for publishing, it's bad enough as it is.
Average users are not going to do this, just like Google wants. Hopefully someone sues them and wins or we get Linux phones, not holding my breath though
There is an entire world of Android phones not controlled by Google, including GrapheneOS, LineageOS, and countless variations in China and other places where Google is effectively banned.
Isn't it possible, however complicated, for users to undo the lockdown to install an app? The required 9 steps are noted at https://keepandroidopen.org/ for devices that use Google Play Services.
Irrespective, people should probably be migrating to a GrapheneOS or similar OS asap once the OS ships with a device.
Honestly not as bad as I feared it would be. Still not great and it's moving us farther from the idea that people who paid for the device should be allowed to install what they want on it, but as it stands it's a workable process. We'll see how quickly it takes Google to make it worse
Users and maintained packages would probably go down due to less users being able to use it, but users of Android (see GrapheneOS, LineageOS) without Google's Rookit can and will still continue to use it.
Since F-Droid (i.e., the repositories, not the app) builds all apps, a practical solution would be for the repositories (i.e., their signing keys) to be recognized by El Goog. Whether and how much help / obstacle the "maybe we do evil" company puts up for / against this is a different question.
They have to use one key per app, otherwise independent app could end up sharing some permissions (IIRC).
The Emacs version for Android makes uses of something like this IIRC by signing a version of Termux with the same key and distributing it in the same SourceForge repo such that Emacs on Android can access CLI tooling like git for example.
It seems to me this is a blocker to use if google can restrict sideloading like this. Its not going to end with just get people requiring to register their app with an identity. Wont they be able to put presser on f-droid devs to lock out software they consider a threat to some business model?
> sideloading
That newspeak term should just disappeared. It only contributes to the image that downloading and installing an app is something that is outside the "happy path". Installing software of your choice on a device you own shouldn't be demonised
Fully agree. Installing software is installing software, signed or unsigned, app store or not.
Weird how different the mentality is from phones and computers. Or at least from what I remember when I used win 8.
Good point thanks for the clarification. I'll remember that moving forward.
Surely you see how installing unvetted software on a device that holds your entire life, bank info, photos, etc. probably shouldn't be part of the "happy path" for most people. You shouldn't even install software you haven't fully vetted from the google play store. This should be drilled into non-technical people.
Those of us who want to can easily bypass it. My mom who doesn't know what she's doing and gets a phishing email with a fancy apk attached should probably have a hard time using it.
> a device that holds your entire life, bank info, photos, etc.
I'd see it the other way around and say that a device running an operating system controlled by some company shouldn't hold your entire life, bank info, photos, etc.
How do you get around this? Literally every bank, brokerage, etc... is hell bent on you using your phone for everything from 2FA to passkeys, etc... They dont even imagine people have computers anymore or want two+ physical devices/controls on what can be done with which factors
It requires collective action. Ideally with laws to force interoperability, so folks can move among platforms with ease. Then standards will arise to keep that feasible for app makers.
Without regulation markets coalesce as the winners eat each other like a game of snake. It's a miracle Apple hasn't yet eliminated Android. Although I suppose for some institutions there is only iPhone.
Certainly you can use those, but they're not mandatory (here in Canada at least). Can easily get a card and use physical bank and ATM to do everything, and website logins use email as 2fa.
My bank tried to push an app, but I never installed it. I live in Germany.
That means education for people: don't perform actions that are in emails.
Blocking apps is like blocking buying of knifes because one can hurt themselves.
Have you ever tried to educate a 70+ year old person on this kind of stuff? Their eyes gloss over and they don't care. I've told my mother not to install random apps on her phone several times yet she still does it. I could probably send her a phishing e-mail right now that 'looks like' it's from me (so long as my name is in the from: field that's enough) and she'd follow the instructions to install a malicious apk too.
"Everyone should just be smarter/more educated" is what I used to think as well. I now fully understand some people have no desire to be educated in any way and it's a net good for society to not have a large % of devices compromised.
It is like saying that you should not have free speech because someone might influence 70+ to say stupid stuff (well, that is already happening...).
Family should be responsible on education or making phone of people that are not educated enough (minors, elderly, etc.) limited - I do that using Family Link. I have there my child and also my in-laws - both of them can't install new apps without my permission.
So the tech is already there, one just needs to use it.
yes, got my father on linux a decade (or more) ago. He's 84. No problem. Most recently we discussed being vigilant against vishing.
Now my in-laws (similar age) one very demented, the other thinks he knows best because he was a chemical engineer...they could use some built in protections
so ultimately I think some default level of "guardrail" is appropriate, but it should have a not too burdensome escape hatch
>so ultimately I think some default level of "guardrail" is appropriate, but it should have a not too burdensome escape hatch
Which is really exactly what google is implementing here and why I'm so perplexed so many people are upset. You or I or smart parents (my mother has never used a computer in her life and wouldn't want to) will have absolutely no issue sideloading apps after the proposed changes.
Given Google's track record, I don't think it's just "being upset" to have serious doubts about the probability of this escape hatch staying indefinitely.
But that's just a completely different discussion that we could've had a long time ago when they introduced it as a on/off security setting ~15-20 years ago too (and I bet people did). IMO nothing has changed except I bet more people will take going into developer options, being sternly warned, then having to wait 24 hours as a sign this is something maybe they shouldn't be doing. And I'd argue if you come to that conclusion and don't look into it further you're probably right,
Given that google is now forced to have competing app stores due to Epic v. Google and the ninth circuit courts went into long and arduous detail in that anti-trust case about sideloading restrictions I don't think they have a leg to stand on if they get rid of sideloading completely. Oddly Apple continues to get away with it no problem.
Google is the one peddling the malware. Any changes to 'security' that don't start with them removing the oodles of malware from their store are not security but profit driven.
It's full of malicious apps on google play. There are none on f-droid.
The logical conclusion is that fdroid should be allowed and google play banned by default.
The answer to people refusing to care about important things in life is not to put restrictions upon everyone's freedom. Ultimately, being an adult means you have to take responsibility for your actions (or lack thereof). It isn't hard to learn how to use a computer responsibly, and I've known plenty of older people who did so just fine. There's no excuse here.
You do understand we've broadly come to the conclusion that this isn't how society should work though, correct? It's why there's warning labels on everything, liability for not warning people for even the dumbest of things they might do with your product or in your establishment, extremely strict laws for things like driving a car, flying an airplane, or using any kind of heavy machinery, responsibility of servers to cut people off if they've had too much alcohol, the list goes on. I find intelligent people often have this mindset that all "real adults" are just as responsible as they are. It's just not the case.
And I generally wouldn't care "have at it" if their phone/computer being compromised only harmed them. But a bulk amount of compromised devices harms us all.
"Think of how stupid the average person is and then realize half of them are stupider than that!" -George Carlin
That would be like requiring people taking driving lessons before driving cars - what nonsense! Just let them behind the wheel & they will figure it out just fine!
Because education has worked so well on Windows.
There's not an easy answer, but the non-answer of "people just need to be educated" is trivially dismissed.
I'm not sure the situations are comparable when Windows doesn't have this permission system where the apps are still very limited in what they can access unless you grant specific directory access or access to the contact list or such
It does, but approximately nobody uses it, because Microsoft also tried to apply loads of constraints on what kinds of program could exist when they rolled it out, as part of their "all Windows software should also work on Windows Phone and Xbox" campaign.
> a device that holds your entire life, bank info, photos, etc
That device was called personal computer for decades, and the world didn't end for the simplicity of installing software on it.
The difference is that the only people who used those personal computers were (are) an educated subset of the middle class in developed countries.
That hasn't been true since September 1993.
It was true then and it is true now. Outside businesspeople and students and the middle class of OECD countries (all amounting to a low single-digit percentage of the world population), ordinary people never bought desktop or laptop computers. By contrast, everyone has a mobile one in their pocket today.
That's just false
No. Plenty of people with no technical knowledge.
Today people get in debt to have the latest orange iPhone, for a long time before that most people in, ok, developed countries somehow got hold of a computer.
Maybe with less brain cells burned by
> That device was called personal computer
To be fair, mobile phones being locked down probably contributed to the mass adoption of e.g. mobile payments and banking.
Web banking was offered by all banks long before banking apps, and you could of course access it from smartphones
The move to apps made things more difficult, if anything
Offered but less broadly adopted. Having a platform that doesn't tend to get infected when used by normal users helped with that.
It was adopted by everyone I knew
And they used an actually secure OTP dongle, eventually ditched by most banks because, yeah SMS codes and apps are safer............
It's now that a lot of people can't use any remote banking, because their bank's app is huge or refuses to run on their phone.
Yeah, compared to separate hardware HSMs mobile banking is a massive downgrade in both security as well as user being in control of the hardware they own (by forcing locked down closer source OS & forcing hardware updates).
If mobile banking really wanted to be secure, they would support something like a NFC yubikey for transaction verification. The fact they fully ignore separate secure HSMs tells you what you need to know about their security.
> And they used an actually secure OTP dongle, eventually ditched by most banks because, yeah SMS codes and apps are safer............
The EU mandates the 2FA method shows information about the purchase you're authenticating (timestamp, amount and cc used in my case), making unconnected dongles impossible to use. This makes me sad, but it does have merit.
FWIW I still use the website to do all my payments. I find banking apps to be madness - you're entrusting all your money to what is essentially a toy.
The world may not of ended but to of people have been hurt by malware ruining their computer, cryptolocking all of their company's files for ransom, stealing all of your login credentials, stealing cryptocurrency, taking secret photos with your webcam, screen recording what you are doing on your computer, etc.
The "personal computer" has a terrible track record.
For many decades, people have been mistakenly putting diesel fuel into their gasoline cars, yet we never outlawed diesel vehicles. You can only do so much to protect people without destroying their rights to their property.
the pump handles are green tho
Many people are partially color blind, with IIRC most people having issues with properly seeing the green color.
Society moved to having it so diesel fuel pump would not fit into gasoline cars.
Society didn't ban doing it, but put up barriers that help the average person from doing something dangerous.
The slight difference is that no one in their right mind would ever want to put diesel in a gasoline car
I think the pumps still fit where I live, btw
Just like people get robbed, it is as common as that.
It doesn't mean one can't buy nice things because one is afraid of being robbed.
Except a sane society puts rules in place against robbers and then bans such people from society.
There have already been laws against scammers and hackers for a long time.
There are such laws already, what ragequittah was proposing (and Google implementing) is handcuffing people that are not robbers.
That seems to happen on phones too
It is much rarer since it needs 0 day to do these at the same level as possible on a pc. The play store scanning apps for malware is an important safety mechanism against this. Further more imposter apps like YouTube but with no ads that are Trojans that steal people's accounts.
Or the accessibility permission, or to some degree the access all files ones; but it's also enough for the app to pilfer the data you trust it with.
The Play Store's scanning is very far from perfect, and the amount of crap that's on it, combined with the trust that people have towards it, and apps' unfettered access to internet, makes malicious software easily more common than on PCs.
Even without considering as malicious the enormous data collection that almost everything on the Play Store does, encouraged by Google
Block installs outside of playstore ON/OFF (ON by default) isn't any less secure. "Sideloading" is scaremongering.
[dead]
If the issue Google has with sideloading is really just the rampant app piracy (and the malware that comes with cracked apps) that might be something F-Droid can accomodate.
I don't think malware is the problem, as most malware comes directly via Google's ecosystem carried by ads. Just recently I had to uninstall some app from the play store since it tried to distribute malware through scary pop-ups and had it replaced with something from f-droid for someone I know.
> most malware comes directly via Google's ecosystem carried by ads.
Google's own Play Store is filled with outright malware too, no ads needed. The idea that Google has to control what people are allowed to install on their phones isn't really for the protection of anyone except Google.
[dead]
It seems google is going to allow an "advanced flow" that is scam resistant by requiring the user to wait 24 hours before they can start installing their own apps. It sucks, but assuming they don't change the plan again, F-Droid should be able to continue working.
So basically Google is being now more of an asshole than Apple (that now allows app sideloading and third party stores, at least in the EU). I'm and Android user since the beginning and for once I'm start considering for the next phone that I could as well get an iPhone, basically all the good open stuff of Android is long gone (back in the days I used to flash a new ROM every week), and at least Apple is better in regards of privacy than Google.
It's already live, I had to go through it last week. It's in developer options, then it asks if you're moving the selector to allow the installation of non-play store apps because you're being asked to by someone.
Then it starts a 24 hour timer. When that hits zero, you have 1 hour to go back in and select that you want to install apps on a device you own and paid money to own.
It's not scam-resistant at all. Any scammer will gladly work around this and send someone to one of many malicious apps in the play store, or a malicious URL, or even just set an appointment to call Grandma back the next day.
They're not necessarily wrong about it being scam resistant, based on some of the research into the psychology of scams. Adding time defuses the urgency of phone scams, leaving plenty of time to seek a second opinion from family members or the internet, and forcing the scammer to re-explain what the original goal was. It's too much time to breathe and defuses the fight or flight reaction needed for a high success rate. You mention URLs, but a web browser based scam page doesn't accomplish much, because the scammer's goal with fake apps is to acquire persistent remote access (akin to how the AnyDesk Android app uses accessibility permissions for Teamviewer-like remote access to an entire phone).
But yeah, it's hilarious that they're pushing this so hard when the Google Play Store still has so much malware.
What? It only stays enabled for exactly 1 hour after the 24 hour timer? I was under the impression that it would stay enabled permanently after waiting the 24 hours once.
IIRC, it's the button to permanently activate it that is only available for one hour. Once you do manage to press it, you've permanently enabled it. If you miss the window, you have to start the 24 hours again.
> assuming they don't change the plan again
Knowing Google, that's a big assumption
It looks exactly the same as now. You will have to do Google's 24 hour flow thing, but it's not like that's going to stop anyone who appreciates what F-droid brings to the table.
Alternative app stores are mandated atleast here in the EU I believe?
Yes but the process to enforce it is intentionally so difficult that nobody can do it.
Yes, but the ability to install any software isn't. goggle can still decide to allow only "official" apps in """3rd party""" stores.
The current lockdown plan is that you'll need to wait 24 hours before installing the first unauthorized app, right? So probably exactly the same as it is now except setting up a phone will take 24 hours longer.
Pretty bright. So long as you can wait at least 24 hours from making yourself a developer.
Switch to GrapheneOS or HarmonyOS
Currently, switching to GrapheneOS means giving Google money. Next year's Motorola-based alternative is also likely going to be several price classes above the Pixels you can currently put GrapheneOS on.
Then buy a Pixel second-hand or when they hit rock-bottom prices, which usually happens after 6 months or so. At some point Google is probably not making a lot of profit from the devices anymore and they want to sell it to you for tracking and to sell Google One subscriptions, which are mostly irrelevant if you use GrapheneOS.
I don't want to pay more than $150 for a phone, though. And installing an alternate OS is a real hassle.
If the current $500 pixels are too expensive you're going to hate the $1000 motorolas.
Stretching that budget to about $350 would get you a new Pixel a-series, on sale. It's well worth it.
I've tried $1000 phones before and found that they don't do anything different than my cheap phone, other than taking better quality pictures. But at least my cheap phone has an SD card slot and a headphone jack.
Not really, GrapheneOS has a nice web installer that makes all the job for the user.
you can get a pixel 7 good condition for that
I followed Pixel prices for the last year, and rock-bottom for a 256gb version (the current absolute minimum for a device without an sd, to my eyes) meant 450€.
There are occasional good deals for (unused) older models on eBay, but they're surprisingly rare.
I wonder if Google demands stores to give the old models back, after the release of newer ones; they disappear from every store extremely quickly.
Interesting, here you can still buy the P10 and P10P for hundreds of Euros off and the prices are still trending down. Also many stores still have them. This is not surprising, because Google still sells them themselves, just in fewer colors and storage tiers.
Yeah, the 10 are still sold, but hundreds off, so at what price they're sold?
There's zero reason to buy a last year phone.
The latest pixels are a complete downgrade from the previous year (worse components). That's one huge reason to buy a last year phone (as opposed to a current one).
Google getting sued again and losing again and drag their feet to unlock it again while devising a new way to go against the court order again.
Updates on this have been slowly trickling out and the best I can discern is you will be able to still install apps from stores like F-Droid, but you have to go through a manual "advanced flow" which will most likely make you wait 24 hours before installing it and make you go through other hoops.
In short, google has referred to this as "increased user friction" to try and deter people from doing this. Essentially not making it impossible; just really frustrating for users so they get sick of the process and just install verified apps through them.
The only way I know around this is to install a custom rom like GrapheneOS or Lineage OS since this change targets Because the policy targets the Google Mobile Services (GMS) framework rather than the foundational Android Open Source Project (AOSP).
Wait, it's not 24 hours per app though, is it? Isn't it 24 hours before the "allow installing apps from .apks" setting turns on once and for all?
Yes, you toggle it once and that's it. It also moves with backups so new devices don't need that step.
If I'm a developer I also need to wait 24hrs to test my app?
Pushing it with ADB isn't subject to the limitation: Will Android Debug Bridge (ADB) install work without registration? https://developer.android.com/developer-verification/guides/...
when you use adb - no need to wait for 24hours. Just use android studio or adb install
So you will think really hard about what you're doing instead of just hoping :D
It sounds like moving software devs closer to people doing hardware, they have to wait for their changes a bit longer.
From an Android developer perspective, not good. All apps on f-droid will have to be certified by the developer with Google (it's per-app I checked) otherwise they won't work at all. And the process of not easy, even for a verified play store developer, I still have to jump through hoops to register.
Then you have to explain to users how to enable this. Not too mention the onerous F-droid requirements for publishing, it's bad enough as it is.
Average users are not going to do this, just like Google wants. Hopefully someone sues them and wins or we get Linux phones, not holding my breath though
There is an entire world of Android phones not controlled by Google, including GrapheneOS, LineageOS, and countless variations in China and other places where Google is effectively banned.
Isn't it possible, however complicated, for users to undo the lockdown to install an app? The required 9 steps are noted at https://keepandroidopen.org/ for devices that use Google Play Services.
Irrespective, people should probably be migrating to a GrapheneOS or similar OS asap once the OS ships with a device.
Ah this is good to know. Awful it's required, but glad there is a work around.
Honestly not as bad as I feared it would be. Still not great and it's moving us farther from the idea that people who paid for the device should be allowed to install what they want on it, but as it stands it's a workable process. We'll see how quickly it takes Google to make it worse
no root on graphene, non starter
Users and maintained packages would probably go down due to less users being able to use it, but users of Android (see GrapheneOS, LineageOS) without Google's Rookit can and will still continue to use it.