this post was submitted on 01 May 2026
1363 points (98.6% liked)
Privacy
9703 readers
2000 users here now
A community for Lemmy users interested in privacy
Rules:
- Be civil
- No spam posting
- Keep posts on-topic
- No trolling
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
After massive pushback. Their original plan was basically full control. It still is, but they'll allow you to install something if you ask nicely first.
The other issue is the timing. They can claim this is for security all they want, but it was announced suspiciously close to the courts ruling that Google needed to open up their ecosystem to other app stores. This is a blatant attempt to keep control of the app ecosystem by forcing devs to go through Google regardless of where they intend to release.
I still say fuck them and push back and that total control is there end goal.
However. I agree with what they're putting in place at this time. It's a one time 24 hour hold before you can install apks from unknown places.
Unfortunately, a lot of people are pieces of shit, and I know for pretty much a fact that making this move will prevent old people from getting scammed. Especially for more targeted attacks where you can use ai to fake one of their relatives voices. It pumps a brake on scammers getting people to grant access while under a panic.
So if you're tech savvy, you'll just have to wait an extra 24 hours before you can start side loading after a phone reset or new phone purchase. Not a big deal if it keeps my pops from having his bank account drained. The guy got in a panic when his Facebook billiards game lost his score data. The guy would have left his phone with someone for a week if they told him they could have gotten it back.
It's an attempt to functionally black list every android developer that doesn't want to give Google their personally identifiable information and fuck you for carrying water for this full on fucking fascist move. Your argument is bullshit.
....Do you not know what they're implementing?
All it is, is a one time 24 hour hold when you want to install a non play store apk. You click "allow apks from unknown sources" and then a day later your phone behaves just as it does right now. The end.
Except google has no business telling me what the fuck I can and can't do with my own fuckin property. Good for you that you like the taste of boot leather and the feeling of a heel on your neck but it's none of googles fucking business what I do with my devices in the first place including what I install on them. And the fact you're deliberately ignoring the clear chilling effect this will have on android open source developers by attempting to force them to register with Google proves you're engaging in bad faith and a shill. Go throat your boot somewhere they tolerate quislings.
This is clearly not designed to keep people secure. If it was, Google would not force you to make your device less secure to install apps of your choice.
The only way it reduces security is by increasing the attack surface. There is no "now anybody can get root on your phone" vulnerability for enabling developer options, and if there were, Google would patch it. I always enable developer options as soon as I get a new device.
Because of this, the audit described in the "Other" link is deprecated.
That's great for you, but you and I are not the targets that Google is supposedly trying to protect from supposed scams.
Lol at what you call "proof". Also, no one said you had to leave it enabled. Also, also, dev options is a security risk BECAUSE it allows for side loading. Hahaha
Security should not control us, we should control security. In other words, this is not the right solution.
There's a middle ground between complete disregard and complete lockdown. If you've got a better solution to scammers that isn't going to drain your battery, invade your privacy, or hog up resources, I'm all ears. Grow up a little and maybe stop being so "me" centric.
Tone it down. Do you still want to be nurtured by the big corporations like them being your mommy? A solution is already out there, it is called secure boot. Google has unnecessarily convoluted the boot chain, and even the OS VM.
Do you think UEFI on a smartphone is a bad idea?
Also, the Android VM is not even necessary, it just makes development cumbersome, cross-platform compatibility worse, and I could go on.
It's not for me. It's for the tech illiterate. Secure boot doesn't stop you from granting remote access apps from running.
Security at the userspace level should be taken care of by the company behind the apps.
You mean the side loaded app anyone could make to allow remote device use of a phone if you install it?
No, take an example of a 2FA mandatory authentication for a bank transaction, security taken care at userspace.
I'm not happy with the change, but let's at least get the facts straight, so we can argue our position better. Their original plan included a way to install apps from unknown sources, but it did not describe how that would work.
I'm honestly neutral with the change, it makes setting up a new phone a little more annoying, it will just be another step in the process and doesn't stop me from doing anything. However the small barrier will stop scammers pressuring people into installing things. It doesn't make it impossible, but will get rid of a lot of the low hanging fruit.
When would a scammer make you download an app? They could just as (more) easily make you visit a website...
It's wrong to think this will stop scammers or malware.
And where you drew the line? These things tend to move in one direction. so giving an inch may as well be giving a mile.
Of course it did.
For two reasons.
First - if anyone complains they can always say there exists a bypass, no matter how idiotically unworkable and annoying the process might be.
Another aspect is that devs will probably want to test their apps easily and quickly - App stores are notorious for updates taking a few days to be approved. Even for Google, full-on lockdown might seem overkill. They don't want to bother with speeding up their update approval process so devs can push test builds through the Ecosystem. Giving some route towards sideloading is a much saner solution.
The courts ruled that users need to be able to install competing app stores without any warning, which is different from how it works today. Obviously allowing installation without any warning would be a boon to malware authors, so they added a way for third party app developers (including app store app developers) to verify themselves and distribute apps outside the Play Store without a warning on installation. Now Epic can verify with Google and distribute its app on its own website without needing to tell the user how to dismiss a scary warning, and the same is true for Safeway and Proton and other developers that might want to self distribute. On top of that, now GrapheneOS can implement its own verification system using the same OS-level APIs. Maybe app authors can distribute apps themselves for users of GrapheneOS by registering their repo with a verification system that runs an automated security audit on the repo and ensures reproducible builds.
Now that there is a way to distribute apps safely outside the system app store, that probably prompted them to look at what was causing malware problems with the current unverified app installation flow, and they came up with that system. Saying it's some massive conspiracy won't force them to change their minds, especially since there aren't enough users who care to make a dent in their revenue. Proposing a less onerous way to stop malware and bringing that in front of a judge on behalf of the app developers who are harmed will.