Google wants to verify all app developers’ identities

DeletedUser475

Google wants to make sideloading Android apps safer by verifying developers’ identities

This should make the sandboxed Google Play Store & Services even more important. It will be interesting to see how GOS will be able to handle this as GPS will (try to) block apps from unverified developers from being installed via 3rd party stores or side loading.

I know it's probably to early for the GOS devs to know how this will fall out. Just wondering if this will mean all apps in a profile with GPS will have to be from verified developers?

As a developer, though not for Android, this is outrageous to me.

23Sha-ger

You didn't even read the whole article right?

Only users with “certified” Android devices — meaning those that ship with the Play Store, Play Services, and other Google Mobile Services (GMS) apps — will block apps from unverified developers from being installed.

This has no effect for GOS, maybe for stock. And it's just a draft anyway.

de0u

DeletedUser475 It will be interesting to see how GOS will be able to handle this as GPS will (try to) block apps from unverified developers from being installed via 3rd party stores or side loading.

I don't see that in the article. What I see there is discussion of blocking, but not an explanation of which code will be doing the blocking.

Right now I believe that the Play Store installs apps via PackageInstaller and sideloading also installs apps via the PackageInstaller, in which case the obvious place to put these new checks would be PackageInstaller.

Is there material in the article tying the new checks to Play?

DeletedUser475

23Sha-ger Yes, I read the entire article several times before posting here.

While GOS stock, before installing Google Play Store & Service, definitely should not be affected, my wonder is what happens when GPS is installed, even if Sandboxed. Where will Google place the code to enforces these checks? I realize no one, out side of Google, probably knows this at this time.

I'm also wondering how this will affect app developers, especially those like for BreezyWeather, that don't want to be bothered with Google.

I was more trying to point out what Google was doing, didn't mean to upset you.

DeletedUser475

de0u At this point I don't see any explanation of where the checks will be implemented. Will they be in Play Services? Or some other place? I think it's anyone's guess at this time.

FlyingStars_

23Sha-ger It actually impacts the whole android ecosystem in a negative way because it discourages development of FOSS apps (If developers are not willing to dox themselves). This also grants google exclusive control over the android ecosystem, as most ppl use stock OS. I think it significantly impacts the openness of android.

Fuck You Google!

Van-de-GraaffeneOS

DeletedUser475 What happens when GPS is installed, even if Sandboxed.

They'd have to work pretty hard at succeeding in that, especially after Inter-Process Scopes become available.

Eirikr70

This other article mentions that this move would also be made to comply with the EU Digital services act. For what it's worth.

Van-de-GraaffeneOS

FlyingStars_

FlyingStars_ This also grants google exclusive control over the android ecosystem

Let's hope they're not foolish enough to throw away their brand identity like that. If they do, they're gonna lose a lot of sales to Apple if the only remaining differences are that Apple's phones are cheaper and have dating bubbles.

lynatic

Eirikr70 nope, it compares it to a move Apple did, then states the move Apple did was to comply with DMA. Those are two separate statements.

Apple had to open up and opened up as little as possible while still complying with DMA. Google is trying to close down as much as legally possible and thereby copying Apple's scheme of minimal compliance.

Google is not doing this to comply with the DMA, they are locking down despite the DMA, exploiting the same loophole as Apple. Hadn't it been for the DMA they might've completely removed sideloading/made Android Play Store-only.

LGgos

Aside from the much better launcher system (I hate the one of "just dump all the icons on your home screen", even if they do have a half-assed and horrible to use equivalent of the app drawer now) the only other advantage I really care about with Android is sideloading. If they turn it into a fully walled garden like Apple then that's a disappointment. It's good that GOS and other projects exist and can hopefully keep developing if "open" Android becomes a full fork.

I always did wonder when they'd regret making it open source. No doubt crowdsourcing helped it get off the ground quicker in the early days but their thirst for control is paying the price now.

Probably9857

From GrapheneOS social media account:

We're worried about plenty of things but not this

https://grapheneos.social/@GrapheneOS/115091275706894905

neel

lynatic Google is not doing this to comply with the DMA, they are locking down despite the DMA, exploiting the same loophole as Apple. Hadn't it been for the DMA they might've completely removed sideloading/made Android Play Store-only.

While I never had AT&T, when AT&T got the Galaxy S in 2010 they actually disallowed sideloading. Meaning you could only get apps from the then-Android Market.

jackFang

I think impact on GOS itself will be minimal.

Although it's horrible that every day we see tighter controls implemented. I think someone up there working on this is like a control freak trying to prevent freedom of choice and limit general consumer rights as much as they can lol

It's interesting that we barely see anything positive these days. I'm glad I can contribute by not using these services. With GOS help I have 0 google apps, except the leftovers that are still integrated in the system like chromium (vanadium). There might be a day I only use dumb phone and linux desktop at some point. No more stress and worries :-)

Pocketstar

There is another link to a Dutch news site about this news.
https://www.security.nl/posting/902204/Google+gaat+alleen+apps+van+geverifieerde+ontwikkelaars+toestaan+op+Android
And a discussion about it on Hacker News in English (link provided by security.nl in their article)
https://news.ycombinator.com/item?id=45017028

I think this can also be used to censor people by governments demanding Google to block access to certain apps like the TOR-browser or VPN's, like during a protest or disallow apps that do not comply to the EU chat control if that new law is in effect.

Furthermore, I just hope Google won't start locking bootloaders so they can no longer be used for other operating systems like GrapheneOS for newer devices in the future, but that is just speculation.
I don't use Google Services myself, but this news brings tons of uncertainty to many, including myself regardless.

I also don't understand why Google does not make a switch in the settings menu so at least people can choose after being warned about potential dangers. Perhaps they will, one can only hope.

For now, people using GrapheneOS should be fairly unaffected I suppose, after all it is based on the open source AOSP branch.

Pocketstar

Probably9857
This is actually quite unsettling indeed, I guess all we can do if this happens is to grab the last AOSP-version at that time and let the community keep it active and updated somehow, but it is a long shot. Also, we eventually probably need some new hardware to run it on I guess.
But we don't know anything yet about the outcome, only time will tell... However, it is important not to let this get all this bad news into our minds too much, banding together is what makes us accomplish things, not to drivel into fear and apathy which in turn leads to burnouts, I guess if the time comes, we do what we can.

de0u

Pocketstar I guess all we can do if this happens is to grab the last AOSP-version at that time and let the community keep it active and updated somehow, but it is a long shot.

Also, we probably need some new hardware to run it on I guess.

Google might release this code into the AOSP Package Installer, in which case the GrapheneOS developers should have no trouble removing it. If indeed app authors are required to demonstrate "trader status" in the EU (Eirikr70), it's not clear how that would be binding on the GrapheneOS project.

Overall it is far from clear that there is an urgent need to buy up all the used Pixels on the market to hoard them inside Faraday bags pending an upcoming apocalypse.

DeletedUser622

jackFang There might be a day I only use dumb phone and linux desktop at some point.

Same here. I'd switch to a dump phone or Linux phone like Pinephone. Freedom is all. Linux has been my daily driver for decades.

Eirikr70

Can someone explain something to me poor of man? We are talking impact on GrapheneOS? What would that be? I hardly see any. What I see is a reduction of the offer of non-Google Play apps because devs won't be willing to comply.

DeletedUser622

Eirikr70 We are talking impact on GrapheneOS? What would that be?

Locked bootloader, probably. It would effectively put an end to all non-stock OSes :(

I don't believe the we're working with a major OEM towards them producing devices meeting our security and other requirements tale either.