Google wants to verify all app developers’ identities

schklom

secrec > you are using HUNDREDS or THOUSANDS of pieces that individually wouldn't exist without megacorp somewhere in the background

I am pretty sure that's not what anyone means here, or can reasonably expect. At least I don't. Redhat and others are partly funded by corporations like Berkshire Hathaway, and their devs are paid with it. That reasonably means influence.

Debian is not at all similar to a megacorp, and does not pay devs anyway.
In real life, how much closer than Debian can a big group get to being uninfluenced by megacorps? Would you expect a group of unpaid volunteers relying on donations to make their own kernel, OS, and every single piece of software they add? Even Google doesn't do that, although they half-do with Android kernel and OS.

The guy behind TempleOS did, and it now belongs in a museum.

LGgos

There's no escape from the megacorps. End of the day most people can't afford to work for free and so capitalism gets involved.

I think if things go as extreme as feared with online surveillance I'd be tempted to just sack it all off and "touch grass" so to speak. Have my government-mandated surveillance/ID device (to be used also for things like banking) and otherwise give up the internet, pop that thing in a corner preferably in a metal box and go catch some sunshine before it burns us all to death or read what books we're still allowed access to.

Anyway as for AOSP the cat is already out of the bag so it'd just be forked. I mean doesn't Huawei pretty much do that already?
Wouldn't it be ironic if the Western governments got so obsessed with spying on their own citizens that those citizens let the Chinese spy on them instead (because at least they're in a different country and can't as easily hurt us)? I suspect that would be classed as the domestic surveillance idea backfiring somewhat.

vlad

LGgos because at least they're in a different country and can't as easily hurt us

it doesn’t work this way, unfortunately.

DavidXanatos

When I read that news I was really really shocked! One more reason to finally move to GOS.

LGgos

vlad care to elaborate?

NetRunner88

dc32f0cfe84def651e0e
Not everything is libre neither.
I prefer security, libre is a plus

Ammako

traveller that would make sense, if the majority of smartphone users right now weren't using years-old phones that stopped receiving updates a long time ago. It's not like a switch gets flipped overnight and suddenly there aren't any users left for your app.

TranceSeven

traveller The developer(s) of WhisperIME and other useful apps has already stated that they won't be identifying themselves to Google, so their apps won't be available "on certified Android devices" in the future.

From that, we can only hope that they'll continue to develop the apps for the rest of us. However, I wonder about what incentive they will have when there's a fraction of the user base. A lot will depend on their motivation for writing the apps.

zoe

Here you can tell Google what you think about their latest move: https://docs.google.com/forms/d/1riPsd_hN_SejtQidl9mavYQIhZhlknt6qnb7dNaiiqE/viewform?edit_requested=true

tremble1256

I think the vast majority of android users probably have no idea about the upcoming verification requirements. If google doesn't reverse their decision, the 2027 timeline for an international rollout of verification could align quite well with the grapheneos phone release. I wonder if this could have a positive impact on Graphene's market share even if the change is negative for the android ecosystem. This is just speculation but I could envision millions of new users from a Graphene marketing campaign focused on "android, the way it's supposed to be" that emphasizes freedom and security right when Google goes the opposite direction.

n3t_admin

tremble1256 think the vast majority of android users probably have no idea about the upcoming verification requirements.

I'll let you in on a secret:
A majority of Android users also doesn't care about any such requirements. Sad but true.

tremble1256

n3t_admin I completely agree. With a userbase in the billions though I think a migration of millions following such a pivotal change to android is not unreasonable

Eirikr70

Shouldn't we, the GrapheneOS community (or more precisely the european citizens members of that community), organise ourselves to write a collective letter to Henna Virkkunen, european commissionner in charge of the digital technologies ?
If there is a lawperson in the room, could they look at the arguments ?

n3t_admin

Eirikr70 european commissionner in charge of the digital technologies

Yeah, great and all - but don't forget it was the EU who tried to legislate Apple to death regarding the App Store and by doing so, set the boundaries for Google. I don't see how this decision can be challenged, when all Google does, is play by the same rules as Apple.

Eirikr70

I would propose something as follows (English is not my mother-tongue, please correct) :
Madam (or whatever you would call a commissionner in English),
I by this letter represent a group of European citizens involved in IT security, freedom and privacy. We specifically are users of the GrapheneOS operating system.
We would like to draw your attention on a recent move by Google, through which they state that they will require from de the developers of "side-loaded" Android apps to lift the veil on their identity. This move is supposedly motivated by the necessity to increase the security of their system.
We see that this move is discouraging individual developers, happy to share the fruit of their work, to withdraw from that activity, in order to avoid stalking or other negative eventual impact on their lives. Thus, it will reduce the offer of alternative software and pave the way to increased domination of the big actors.
We question the compatibility of that move with the spirit and the letter of the actual legislation of the EU.
...

n3t_admin

Eirikr70 that's not the approach you want to take.

You need to outline the monopolistic (and abusive) position Google finds themselves in.
You need to outline the difficulties European citizens will encounter from this move.
You need to clarify technical details in clear terms (no side-loading or whatever).

Here's a corrected version for you:

Dear (commissioners name),

as EU citizens and users of devices running the Android operating system, we would like to inform you of changes being introduced by Google that would undermine choice and threaten digital sovereignty in the European Union.
The proposal made by Google would force developers to reveal their identities if they wanted to distribute apps outside the Google Play Store on almost all electronic devices running Android.

While Google claims this step will increase security, it will also force developers of apps deemed as "problematic" by Google, to reveal their identities and might lead to the refusal of certain apps to be installed on Android devices entirely. Intended or not, this proposal will endanger the future of free and open source developers.

As users, we will have no choice to circumvent this measure. If Google were to implement these changes successfully, they would have complete control over the software we could run on our devices.

In our opinion, this would further centralize control over the software landscape and be a direct violation of the DMA, since this change would not simply strengthen security, but seriously harm developers and end-users. Less-restrictive means should be implemented here that would allow end users who are well versed, to install the applications of their choosing.

As stated in the DMA, Section 47,
"In order to ensure that third party software applications or software
application stores do not endanger the integrity of the hardware or operating system
provided by the gatekeeper the gatekeeper concerned may implement proportionate
technical or contractual measures to achieve that goal if the gatekeeper demonstrates
that such measures are necessary and justified and that there are no less restrictive
means to safeguard the integrity of the hardware or operating system".

We believe Google needs to provide clear evidence, that there are no other less restrictive measures that would achieve the same goal. The installation of third party software is possible on most commercial operating systems without the requirement of identification. We believe Google should abide by the same rules.

We believe it is necessary to bring this to your attention, so that proper measures can be taken before these changes go into effect.

We thank you collectively for your efforts.

Sincerely,

(name of signee)

Eirikr70

n3t_admin I wanted to say exactly this from the very beginning, but thought I'd let someone else be that brilliant 😅

Divby0

Bruce Schneier wrote everything there is to know about the topic for politicians and judges:

https://www.eff.org/document/letter-bruce-schneier-senate-judiciary-regarding-app-store-security

Eirikr70

So, everyone is screaming about the moves of Google but when someone comes out with an actual action, no one is interested?... 😂

Pocketstar

Good news!
Sideloading without verification remains possible according Google and the Dutch news site Tweakers;
https://tweakers.net/nieuws/238658/google-hobbyisten-moeten-op-android-kunnen-sideloaden-zonder-verificatie.html

Translated article;

Author: Arnoud Wokke.
"Hobbyists should be able to continue sideloading Android apps without verification, according to a Google executive. Starting in 2027, Android will verify whether apps users want to sideload come from verified developers.

Android CEO Sameer Samat tells a developer that it will remain possible to install custom APKs on their own devices without verification. Google announced last week that it is working on separate rules for hobbyists and will announce them in the coming months.

Last week, Google announced that developers of apps that users sideload will have to verify themselves with Google. This way, the company wants to prevent malicious apps from being installed on devices without user intervention. This happens frequently in India and Thailand, for example, the company says. The downside is that all developers, small and large, will have to verify themselves with Google, even if they don't want to have anything to do with Google. Many developers of open-source apps, for example, target users who want to separate themselves from big tech companies like Google.

General access for registration will begin in March 2026. The identity verification requirement will take effect in September 2026, starting in Brazil, Indonesia, Singapore, and Thailand. Google will roll out the requirement for Android app developers globally starting in 2027."

dc32f0cfe84def651e0e

Pocketstar Nothing changes, there are no good news.

Eirikr70

Pocketstar I don't understand the article. Does it mean that anyone will be able to install apps from unidentified developers ? And in that case, what is the point of the registration ? Or does it mean that there will be restrictive conditions for sideloading ?...

« Previous Page