594
This is Android's new 'advanced flow' for sideloading apps without verification, includes one-day waiting period (9to5google.com)
submitted 7 months ago by to c/technology@lemmy.world
194 comments fedilink hide all child comments

top 100 comments

sorted by: hot top controversial new old
[–] 412 points 7 months ago* (last edited 7 months ago) (80 children)

A one day wait period to install an app on your mobile pocket computer. Fucken bullshit.

Edit: to all the "its one time" defenders, its one time for now. Stop falling for it. It always starts with an inch.

  • permalink
  • fedilink
  • source
  • hideshow 80 child comments
    •
  • [–] 63 points 7 months ago* (1 child)

    I mean, it always starts with an inch but what people dont get is that compared to the 2000's we are a mile deep and compared to rhe 80's we are already in a dystopia.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 7 months ago

    In the '80s we'd need a building to do a fraction what our phones do now. Even in the 2000s they would qualify as a supercomputer. I guarantee you wouldn't be able to install whatever you wanted on any of those computers and even if you could, a days wait would be lightning fast in comparison.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 7 months ago (44 children)

    It appears that the "security wait" will be a one time thing when you first allow installing from unverified sources. After enabling it it will remain on indefiniately.

    Not quite as bad as I was fearing, but will kinda annoying.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 44 child comments
    •
  • [–] 128 points 7 months ago* (last edited 7 months ago) (42 children)

    "Not quire as bad"? My dude, you have to ask for permission from a corporation to install an app on your phone that you supposedly own and paid for. On what planet is this not awful?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 42 child comments
    •
  • [–] 12 points 7 months ago (10 children)

    This is happening to PCs now too, eg. with the OS 'age-gating' laws that IMO only exist to quell competition for MS, Google, and Apple.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 1 point 7 months ago (8 children)

    I sincerely doubt that will actually come into fruition. There's no way to force all linux distros to have that. At least I hope there isn't.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 9 points 7 months ago* (7 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 7 months ago (5 children)

    So its time to move to a distro without systemd?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 7 months ago (4 children)

    That's an option, and one I already took having recently moved to Artix.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 7 months ago (3 children)

    Yeah I think I will. This change alone isn't actually that bad but it shows an eagerness to comply which I can't accept. I'm not sure which distro to choose though, it's probably between Gentoo, Artix and Void

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 7 months ago* (last edited 7 months ago) (2 children)
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 7 months ago

    For real! I used to redo my phone all the time, especially before big trips. I can imagine myself getting ready to go to (insert remote designation here) and I'm sitting in my home office the day before prepping my phone with a fresh slate of travel apps after clearing out all the stale user data. Now if I start too late, I would theoretically have to finish 24h later, perhaps when I'm in Nigeria (frequent power outages) or Germany (different play store rules and feature availability). Just leave me alone already. If someone is really very very scam-prone, you buy them one of those fisher price phones with big huge numbers and no screen, or you put parental controls on the phone.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -1 points 7 months ago (4 children)

    Yep, it's pretty bad, it sets a bad precedent, and has me looking for alternatives.

    When it was originally announced I got the impression that Google would soon be removing the ability to sideload apps altogether and as I almost entirely use apps installed from "untrusted" sources this would have been a nightmare for me.

    So while I think this whole situation is shit, and will almost certainly lead to Google removing the ability to sideload apps in the future, for me the immediate anxiety has been lifted.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 15 points 7 months ago* (last edited 7 months ago) (2 children)

    You do realize that what you're saying might've been the goal all along? It's literally an "I'm altering the deal, pray I don't alter it further" vader moment and you're saying you're relieved. Make no mistake, you, me and every single Android user was just fucked over and it'll only get worse.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 7 months ago (1 child)

    I don't think I made myself clear; I am relievd because I thought I was going to lose access to my apps in the next update cycle. The thought of that filled me with anxiety, but now I have more time to prepare.

    I'm hoping that something like lineageOS will be unaffected and will be available for my device before Google remove sideloading altogether

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 7 months ago

    to be fair, this is not "asking for permission". that's what xiaomi is doing, but not this. on xiaomi phones, to be able to unlock the bootloader or grant higher permissions to adb, you have to insert a live sim card, log in with an "mi account", and have the server decide whether you are allowed doing that. for unlocking you additionally have to wait for several days, if you can get the approval process started that is, and hopefully you will be allowed.

    unless it turns out this requires internet connection, a sim card, or a google account, this is just a safety procedure. and it's hard to say but this world is so full of incredibly dumb people that all both need and want to use shiny smartphones for all that convenience and social media addiction, that a safeguard like this is needed.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -31 points 7 months ago (23 children)

    It looks like a glorified 'developer mode' switch that has the 1 day wait to prevent someone from grabbing your phone, turning on sideloading, installing some hazardous app, and then having their way with your info. This appears to be the best of both worlds.

    Like when unlocking your bootloader wiped your info. Just do it first. not a year in to using your device, if thats your plan.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 23 child comments
    •
  • [–] 29 points 7 months ago

    Sure. Because as we know people grabbing your unlocked phone to sideload apps onto it is an almost daily occurrence. Which of us hasn't had a stranger install a cryto miner while we looked away for a second.

    Get real. This is an imaginary problem affecting the 0.01% they are using to tell you this action is justifiable. Getting more control is the aim of their game

  • permalink
  • fedilink
  • source
  • parent
  • [–] 33 points 7 months ago (10 children)

    If they're already into your phone there's so many legitimate ways to extract your data. The ability to sideload an app won't impact that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] -1 points 7 months ago (9 children)

    Technically installing an app allows continuous spying instead of one-time offloading. It's an actual consideration with spyware like Pegasus: it might've been used as a bug to listen to offline conversations.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] -1 points 7 months ago (6 children)

    What % of users side load apps vs what % of users had someone else install a bug on their phone?

    It's a situation that statistically doesn't happen, and now every legitimate user is being inconvenienced to stop it? This if like agree verification laws being sold as "protecting children" as an excuse to spy on and control people.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 0 points 7 months ago* (last edited 7 months ago) (5 children)

    Oh really, so the Pegasus attacks on Galina Timchenko and dozens of other people, including Jamal Khashoggi, never happened? Or, do you seriously not understand that the impact on one journalist is greater than on thousands of nobodies like you?

    Google could've implemented better measures to circumvent bugging, like iPhones' 'lockdown' mode, but claiming that infecting with spyware never happens on Android is plain disingenuous and idiotic.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] -1 points 7 months ago (4 children)

    "statistically doesn't happen" is not equivalent to "has never happened". It means the number of times it has happened is such a statistically insignificant % of the user base that it does not pass the smell test for being the reason to inconvenience every user.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 7 months ago (3 children)

    That's nice. Now please evaluate the statistical utility of the CEO of an independent opposition-aligned media outlet, like Galina Timchenko, or journalist like Jamal Khashoggi, against an average phone user.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] -1 points 7 months ago (2 children)

    Perhaps a CEO of an independent opposition-aligned media outlet should be using more strict security measures far above what is necessary or even accessible to an average phone user.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 7 months ago* (1 child)

    Oh indeed, all journalists around the world should receive NSA training, then no regular user would ever suffer inconvenience to ensure their security: they would simply be cannon fodder for the police tracking their location around the clock and scammers vacuuming their contact info, no big deal.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] -1 points 7 months ago

    The average user does not need the same level of device security and lock down as a CEO of an independent opposition-aligned media outlet. It's absurd that you seem to be arguing otherwise.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 7 months ago (7 children)

    Lmfao. I'll invent a better way and it will only take me negative 50 years to do it.

    Passcode.

    There is absolutely nothing positive about this. It is only nefarious, full stop. I could open a million dollar restaurant that served microwaved cat shit, but on the menu it's called "Tbone Steak" and with your logic, people wouldn't notice the difference.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] -5 points 7 months ago* (6 children)

    Okay, pump the breaks a second.

    I agree a day wait is bullshit, but you think a passcode is enough to keep someone from… anything? You can shoulder surf a passcode in no time at all. Hell, it’s not even difficult. Go to a bar, talk someone up, give a legit reason to use someone’s phone, intentionally lock and force a passcode and 99% of people at bars will put their pin in within eyesight, or tell you the code.

    A passcode isn’t as big a deterrent as most people seem to think it is. It’ll keep you out of an unattended phone you found, but there are plenty of ways to socially engineer your way into having it for the vast majority of targets.

    And yes, you likely wouldn’t give your passcode out. But this is how a number of ne’er-do-wells got unfettered access to hundreds of iPhones, and prompted Apple to put a semi similar 24 hour lock on certain security actions if you aren’t in a “known to the phone” location (somewhere you frequent like home or work).

    Edit to note: passwords aren’t much better. One of my hobbies in college was shoulder surfing classmates passwords just to repeat it back to them later in the day. Though on a phone you have far fewer reasons to type in an associated accounts password.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 9 points 7 months ago (3 children)

    When you couple what you just said with what they're trying to do, your own argument can be made in my favor.

    One of my hobbies in college was shoulder surfing classmates passwords just to repeat it back to them later in the day. Though on a phone you have far fewer reasons to type in an associated accounts password.

    Never tell anyone else this again, and stop doing it. What an insane invasion of privacy.

    My security should be my choice on my device end of story. My password/passcode plus encryption with easily accessible ways to put it into lockdown mode and have lockdown mode on a continuous timer is absolutely enough for my threat model.

    I don't need any else making any addition call on it, and I definitely don't need someone that is willingly bragging about invading others privacy coaching me on what these companies are intending while actively trying to take my right to privacy away.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] -5 points 7 months ago* (1 child)

    You call it an invasion of privacy, I call it fucking with friends while teaching them to be cognizant of who is watching what they do. You realize they can (and did) just immediately change their password right?

    I’m also not sure how “the average person treats their passcodes and passwords like everyone is intentionally looking away” somehow strengthens “lock making the phone less secure behind a passcode” as an argument.

    And yes, it 100% lowers the security of the phone. Which absolutely is your choice. Which I also do, and have done with my wife and kids phones. But the idea that a passcode is somehow a solution is just silly.

    Not as silly as a 24 hour wait controlled by google, but still silly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 7 months ago

    You said classmates. And hobby implies you did it a lot, and a lot extends beyond a few friends very quickly, so I do doubt it was limited to that, but I've got no choice but to take your word. Also I had thought you were the guy previously okaying this privacy nightmare in a trenchcoat, so ignore half of what I was saying.

    Whatever it is or whatever it helps, if people want to opt into it, have at it. I will not be doing that. My solution protects me from everyone accept teams that have the funding and skill to get in through other means. I use biometrics, not perfect but it works. If I want those disabled until a password/code is in, it's a tap away. No one sees me use it because I'm using biometrics until I don't want to.

    In what world do we expect companies that have decades long track records of fucking us for profit to stop after another empty promise?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 7 points 7 months ago

    Until you have to help someone install an app not available to them.

    Xfinity stream for example is not on the Chromecast play store, even though an Android build exists on the Fire TV store. I had to guide my dad through this. In this case it wouldn't be possible for 24 hours.

    Had a similar issue with an app not available in a friend's region.

    I could live with the whole flow minus the delay. This is shit, just pure shit.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 7 months ago (1 child)

    A one day wait period to install an app on your mobile pocket computer.

    And that somehow supposed to stop users from inflicting their phones with virus software? Like, it does not make sense. Okay, force all devs to upload their IDs, no biggie (I guess). But do not lock users into the "tough luck, you cant sideload" system. 1 day wait will not prevent anything. They just added a mild annoyance for 24h, nothing more.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [+] -20 points 7 months ago (2 children)

    One day wait period to enable installing third party apps. Afterwards no extra wait time or verification.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] -66 points 7 months ago* (23 children)

    I think it is a reasonable compromise. They could have made it a day wait for any and every time you wanted to side load like this. It prevents accidental or malicious activation, while also giving you the feature you want with the smallest of roadblocks as confirmation you want it. And you only have to do it one time. I don’t think it’s the burden you do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 23 child comments
    •
  • [–] 98 points 7 months ago* (8 children)

    People this willing to let a self-enriching corporate nanny state erode their ability to use the products they paid for terrify me.

    People this willing to fall for the blatant corporate strategy of "We'll announce something unthinkable but then backpedal to something "only" terrible (and then probably do the unthinkable thing later now that we've encroached further and softened the blow)" for the millionth time confound me.

    Show some dignity; jesus christ. This isn't a "compromise". Me breaking into your house, threatening to kill you, but then "only" hitting you with a bat and leaving isn't a "compromise".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 24 points 7 months ago

    In the sales world, this effect is called "price anchoring" and is used by tons of companies. All those sales you see where something is "marked down 50%!" are using a manufacturers price that does exist in real life to get that 50% markdown. In reality, the sale price is just the actual price of the item but people see the "huge discount" and think they're getting a deal.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 7 months ago (4 children)

    Long live lineagos

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 26 points 7 months ago (3 children)

    Things like LineageOS are a workaround, not a solution.

    The solution has to be legal, not technical. Companies have to be stopped from trying to fuck with users' property rights in the first place!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 10 points 7 months ago

    Yup. I've heard this first about Home Assistant, but software like this often inadvertently acts like a pacifier for tech enthusiasts. We may have our neat solution for the moment and be content with that, but that doesn't help anyone else, or us in the long term. Things will get worse with no push-back.

    Disclaimer: That's not to say that we shouldn't advocate for those tools in the meantime as well. We just shouldn't lose track of the actual problem.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -23 points 7 months ago (1 child)

    Hyperbole much?

    This is a basic balance between the needs of the few, and the security of the many. The benefits of a one day speed bump are far more beneficial for the billions of Android users in the world, and offer no meaningful negatives to those that wish to enable this feature beyond that delay.

    I realize that many people here are in or adjacent to IT work, and so are more passionate about these sorts of topics and are well versed in the risks, but in my opinion, allowing a simple, immediate way to bypass all security checks and install whatever you want immediately is a pretty big security hole, even if it is self-created. It makes sense to put those roadblocks up to protect the 99.9% that will never use this feature, as well as those that may activate it not understanding the risk. You may be comfortable with it, and that’s great, but that doesn’t mean every Android should. This is why prompts asking about coercion and not your IT prowess.

    Finally. your example is poor. Google is not breaking into your phone and hurting you in way. If anything, it’s like a real estate agent that’s not giving you the keys until the bank opens so your check can clear. It’s a process issue, nothing more.

    Your ability to use your device, as you see fit, installing anything you want, is entirely possible with a single one-day delay. As I said, I don’t think it is an unreasonable ask, nor the enormous inconvenience you make it out to be.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 42 points 7 months ago (4 children)

    I don't need google telling me what I can put on this fucking phone I bought and paid for.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [+] -25 points 7 months ago (3 children)

    And they’re not. Load all the unsigned stuff you want after you wait one day. Again, I don’t see how this is a huge burden to ask.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 22 points 7 months ago (2 children)

    It sure is a completely unnecessary burden designed as a deterrant.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [+] -12 points 7 months ago (1 child)

    It will likely have that effect on some, yes. It will also prevent it from being enabled without knowing the full scope of your ask. But that’s kind of the point— it’s a big deal, and the user should be informed. Not everyone is capable of understanding these decisions immediately and accurately assessing risk.

    At some point, there is always, always a compromise between user experience and security, and not everyone is going to like it. But in this instance, I think the benefits of having this process and cool-down period to make the risks known far outweigh the need for immediate gratification by the minority of users that will enable and use this feature.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 7 months ago

    I don't believe that this is for the better, nor that this is done in good faith to protect users. They already tried to make it mandatory to go through Google, which is a pretty clear hint of their actual goal.

    Google pushes the safety narrative, but this also conveniently entrenches Google as the authority over alternatives and hurts not only FOSS, but also competing app stores from other companies like Amazon, Samsung, or whatever Chinese manufacturers.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 38 points 7 months ago (6 children)

    What is it a compromise between? People who think they own the thing they paid for and people who don't?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 7 months ago (5 children)

    Obviously we need to find a middle ground between owning the things we purchase, and not owning them. Having access, but making it annoying is a very reasonable option.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 12 points 7 months ago (3 children)

    Why? We are paying full price for these devices and nothing in any agreement made at the time of purchase suggests that you don't own them. Why is it necessary to meet a middle ground between "you got what you paid for" and "you didn't"?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 7 months ago

    I realize you are making a joke, and I agree that purchase is always better than subscription. Everyone in this situation owns their device.

    But that doesn’t mean an easy to activate security bypass should be made available to everyone with no guardrails, either, should it?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 7 months ago

    No. Fuck all of that. I will not have some fucking Corp tell me what I can install and when on my own goddamn hardware.

    If they want to implement something like this, make it an opt-in toggle during device setup to put the phone into nanny mode

  • permalink
  • fedilink
  • source
  • parent
    • load more comments (-1 replies)
    • load more comments (1 reply)
    [–] 108 points 7 months ago (2 children)

    So, the idea is to make the process as annoying as possible.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 83 points 7 months ago (1 child)

    "This is Android's new 'advanced flow' for INSTALLING apps without verification". Sideloading is such a bullshit term made only to confuse consumers. They can wrap that in sparkling wrapper, but it's still security theater at best and definetly misleading. Apps from F-Droid or any other app 'store' are not any less safe than the ones at googles own offering.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 78 points 7 months ago* (3 children)

    To those who think it is a fair compromise: It is not.

    Android already had one layer of this shit before. When installid freshly dowloaded apk, android would prompt you to confirm that the source of the apk is trusted. This was not like this before. Before you'd just install apk.

    And I agree to a certain amount. But thing is, it was added for no specific reason. People who install apks form outside source, will keep doing it and they 99% of the time know what they are doing or being told to do so by someone who knows what they are doing.

    Adding another layer to this wont solve the problem, except make users annoyed for 24h wait time. And this is only adding 1 layer now. Who the fuck knows what is going to be 1 year later. 5 years later?

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 2 points 7 months ago

    The thing is, people who do it and trust others to say, “just do it” - are the crazy ones.

    It’s like the bs Tech Talk in TikTok. Always telling you to run RegEdit and such… oof.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 58 points 7 months ago

    It's so weird that they don't take comments on the android developer blog post... Almost like they think it'll be hugely unpopular.

  • permalink
  • fedilink
  • source
    •
    [–] 58 points 7 months ago (3 children)

    So it's on the same scale as buying a gun in the states.

    I didn't realise it was so dangerous.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
    • [–] 117 points 7 months ago (3 children)

    I teach digital literacy and 99% of unsavory software I encounter on people's phones come from the play store or app store

    I will believe that they're serious about protecting users when I see them do something about the crap ton of borderline scam solitaire and weather apps infesting their stores

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 20 points 7 months ago (2 children)

    Your wish is fulfilled. Google now requires the government id, full biometrics and shared gps location to publish apps in the store.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 29 points 7 months ago*

    See, that is fine. If Google wants to have a safe and curated, high quality store, (which it doesn't), it is very logical that it would want to have the origins of software very well identified.

    AS LONG AS it provides a mechanism for users to access other sources of software.

    They are doing the opposite, allow bullshit apps in the "safe store" while hindering the independents.

    We desperately need a decently competent OSS phone OS, if possible with a compatibility layer for Android apps.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 164 points 7 months ago

    Stop fucking calling it sideloading. It is called installing an app

  • permalink
  • fedilink
  • source
    •
    load more comments
    view more: next ›
    36 comments in c/android@lemmy.world view that post