People who realized they actually owned the thing they bought wanted to do what they wanted, which required circumventing Apple's control or "jailbreaking". This differentiator stimulated Google to "allow" installing on Android without "jailbreaking" the device aka "sideloading", giving the illusion of the kind of freedom that was never in question on normal computers.
It is interesting though how this same conversation doesn't exist in the same way in other areas of computing like video game consoles or other embedded computing devices where the controls against arbitrary applications is even stronger.
The fact that mobile phones aren't yet just a standard type of portable computer with an open-ish harware/driver ecosystem that anybody can just make an OS for (and hence allow anybody to just install what they want) is kind of wild IMHO. Why hasn't the kind of ferver that created Linux driven engineers to fix their phones? Is Android and iOS just good enough to keep us complacent and trapped forever? I can't help but think there might be some effect here that's locking us all in similar to how the U.S. healthcare system can't seem to shake for profit insurance.
I'm sometimes surprised at the plethora of cheap handheld gaming systems coming out of China that support either Linux, Android, or sometimes both, and seem to be based on a handful of chipsets. If anybody ever slapped an LTE module and drivers onto one of those things we'd have criminally cheap and powerful, open phone ecosystem.
Historically, when the first game consoles with game cartridges existed, the hardware was much more niche than the available personal computers. Game system developers designed hardware specifically for games, and game developers developed for those specific systems. Also, physical media for games provided an ownership model and DRM.
In 2003, Apple released the iTunes Music Store partnering with music labels to counteract the prevalence of music pirating. That was the first major digital marketplace with DRM and way before the App Store in 2008!
In 2005, digital distribution for video game consoles came with the Xbox 360, PlayStation 2, and Wii. Being game consoles with unique hardware, they kept their restricted licensed development model of previous generations.
The iPhone and App Store just followed that pattern. Unique hardware and a licensed digital marketplace to go with it.
Now, the hardware between video game consoles, smartphones, and personal computers are mostly unified; and the only real difference is software, but the restricted marketplace model still remains.
---
> The fact that mobile phones aren't yet just a standard type of portable computer with an open-ish harware/driver ecosystem that anybody can just make an OS for (and hence allow anybody to just install what they want) is kind of wild IMHO. Why hasn't the kind of ferver that created Linux driven engineers to fix their phones?
DRM. There are already devices where you can unlock the bootloader and install any OS on it. But then you won't be able to install apps that use the Play Integrity API to ensure DRM. Companies/developers want revenue and develop apps that require Play Integrity.
Any device that doesn't have DRM will never support a paid digital marketplace or paid content streaming.
> Is Android and iOS just good enough to keep us complacent and trapped forever?
Probably. Microsoft tried a DRM supported OS with Windows Phone and that failed.
---
That being said, digital marketplaces and DRM have there place to prevent piracy and allow developers and creators to make a living.
If someone has a solution to prevent piracy without a root of trust that would be ideal.
If someone has a solution to prevent piracy without a root of trust that would be ideal.'
This is the equivalent statement to inspecting everyone's bag at any point because they might have something illegal. It's not an acceptable move from google.
Yet here am on linux buying games on steam
Not really in regards to consoles, the hardware is still tailormade for game development, even if some components seem common.
None of the attestation stuff actually works for that.
For streamed content the pirates only need one person to crack one device and then everything is on The Pirate Bay. Notice that it's all still available in such places despite the DRM and the people still paying for it are still paying for it despite its availability there.
And apps are the same. If you put some attestation in your app, the pirates would just disable it in the copy they distribute, because attestation does nothing to prevent copying.
What it's nominally supposed to be for is so that a server can verify that the device is approved before providing some service. But that only works if a) the thing the server is providing is individualized rather than generally available, and b) the attacker can't get an approved device. The first is what makes it useless for copy protection. The second is what makes it useless for e.g. a bank app, because the attacker will just steal the user's credentials on a compromised device that never even attempts attestation because it's only connecting to the attacker's servers, and then put the stolen credentials into an approved device in order to transfer the money.
The only party to benefit from any of this is the incumbent platform if they can fool useful idiots into using it in order to lock customers into their platform.
Or at least ten years earlier with a Japanese SNES:
Do you have examples?
All the ones I see that "support Linux" are locked to a single kernel build, and so aren't much better than a hacked Android ROM, which is because the SoC manufacturer makes a "sort of working" version and dumps it over the wall, and this is exactly the same thing they do with the crappy Android phones which are never mainlined.
There are massive projects to bring all of these in mainline such as SunXi, which makes AllWinner look supported even though they actively work against it.
Yes, there needs to be a lot more uproar for these cases as well. One of the most appalling cases is that of macOS. To distribute your app (as a .dmg for instance), you need to sign up and pay for a Developer ID, sign the app with a Developer ID certificate and then notarize it, EVEN if you don't intend to use their App Store.
If you want to sign using a cert trusted by apple, and distribute on their infrastructure, you do need a paid account.
This seems like a reasonable compromise, quite honestly. That is based on remembering the bad old days of just having to trust that the software you downloaded from some random shareware site hadn't been modified maliciously.
One of the things that really worries me is that this seems to be creeping in to desktop OS's as well. It's still possible, for now, to install software on Windows 11 without going through the "Microsoft Store", but I remember having to tweak some security settings to make that possible... and was really alarmed the first time I tried to install software on a fresh install and got blocked and directed to the Microsoft Store.
I've always had mixed feelings about RMS and FSF, mostly due to their hardline attitudes (I'm not opposed to proprietary closed-source software even if I have a preference for FOSS... I think there's room for both) but this trend of software installation gate-keeping that came from mobile has me really worried (and I've never been much of a mobile user either, so any creep from mobile into desktop is always unwelcome and alarming to me).
I’ve done several fresh Windows 11 installs lately and haven’t seen this at all.
As the other comment said, you must have used a machine that had a special mode set.
I could order the most random stuff from aliexpress and it would work but not the competitions controller at the time.
Yup. The Amish have had no trouble implementing a single payer healthcare system in the USA. It can be done, where the people want it. But, by and large, the people really don't care. In the back of their minds they might think it would be nice to have in the same way they think it would be nice to have a muscly six pack, but when it comes down to putting in the effort to see it happen...
Yes, the people could care more and could stand up for it, but it's so easy to blame them and that's exactly what the corporations & politicians want.
I'd argue the fact a significant minority of US citizens are cheering on the assassination of healthcare executives (something that does not happen in countries with socialized healthcare systems) mean they are quite motivated for changes but can't find a political outlet for this motivation.
It is worth mentioning that the push against open phones never came from big tech but from governments everywhere in the world. Tightly controlled communications was and still is the status quo. People sometimes forget that e.g. in Germany telecommunication used to be a government authority and it was prohibited by penal law to even open a telephone. Things like weak encryption standards and tightly closed down proprietary communication chips inside phones were always intentional.
None of this justifies or explains Google's actions but it puts things into perspective. Personal computing is an outlier, and if home computers had been connected to a network from the start they would probably have been as tightly controlled as all other communication devices have always been.
Unfortunately, the control authorities still exist and seek to gain more power over computing devices and their goals mostly align with the commercial interests of large tech companies, who have basically just become alternative telco providers. So, I estimate that personal computing will be more or less eradicated relatively soon.
This is part proprietary pedigree too.
You had to buy Nintendo cartridges to play Nintendo games, so no one ever questioned the Nintendo seal.
It's because the "killer app" of phones is that they are a phone, aka a remote communications tool that relies on a subscription payment to access someone else's infrastructure. People don't care that phones are not general purpose platforms, because the point of having a phone is to communicate with others, which currently requires paying for that privilege.
If you didn't have to pay for access to a network, and the phone still worked as a phone, then you might see a change.
My computer's killer app is to be a remote communications tool that relies on a subscription payment to access someone else's infrastructure.
It's because each phone SoC is essentially its own bespoke architecture. You can't build one arm64 Linux ISO that will work on all phones like you can an x86_64 ISO on a PC. Each and every model of phone requires 0) unlocked bootloaders and either 1) full support from the vendor for Linux or 2) dedicated hackers willing to reverse engineer the board to get it to boot Linux in the first place & then developers willing to write missing device drivers & then maintainers willing to keep the fork up to date or mainline the changes.
It will always be cheaper for phone manufacturers to develop bespoke SoCs than it is for them to implement protocols and interfaces that make booting and hardware discovery standardized like they are on the PC. Making a phone as accessible as a PC to booting generic operating systems inherently means increasing costs at every level from the design up.
> I'm sometimes surprised at the plethora of cheap handheld gaming systems coming out of China that support either Linux, Android, or sometimes both, and seem to be based on a handful of chipsets. If anybody ever slapped an LTE module and drivers onto one of those things we'd have criminally cheap and powerful, open phone ecosystem.
On the surface it seems like that, but all of those devices suffer from the same issues I described above. There will be thousands of devices that "support" Linux, but only nominally.
What happens is, if the manufacturer even releases the kernel source, you get a git dump of a forked kernel that was never modified to be upstreamed with the vanilla mainline kernel. That essentially means you are stuck using that fork unless you have the time, knowledge and skill to port that fork over to the mainline, which is a lot of work. This applies to every SoC, and SoC modification, in gaming systems. Barely any of this work crosses over or can be standardized like it is on a PC.
None of that makes a platform a real open ecosystem.
Source: I'm involved in porting and maintaining a Linux distro for those cheap Chinese handheld gaming systems. The only reason Linux runs on them is because weird nerds spent time getting it to run on them. When they get bored, your Linux "support" ends.
The best we can hope for is for ARM servers to scale down to the point we can use them in small form factors, as ARM servers implement the same standards PCs do to run generic Linux ISOs. We aren't going to get this from the mobile hardware ecosystem, there just are no incentives to make such an investment. Maybe we'll get them if ARM PCs truly take off.
> It is interesting though how this same conversation doesn't exist in the same way in other areas of computing like video game consoles or other embedded computing devices where the controls against arbitrary applications is even stronger.
The conversation takes place all the time, there are tons of people who want to, and do, run homebrew and Linux on their consoles, same thing with embedded devices. Getting Linux or Doom to run on an embedded device is a rite of passage.
Linux is the answer though on mobile it’s just starting to be a little competitive.
“Steve Ballmer: We said ooh, IBM's probably not going to like this. This is going to threaten OS 2. Now we told them about it, right away we told them about it, but we still did it. They didn't like it, we told em about it, we told em about it, we offered to licence it to em.
Bill Gates: We always thought the best thing to do is to try and combine IBM promoting the software with us doing the engineering. And so it was only when they broke off communication and decided to go their own way that we thought, okay, we're on our own, and that was definitely very, very scary.”
Right, but that's a choice from manufacturers, not a requirement of building a mobile platform.
> It will always be cheaper for phone manufacturers to develop bespoke SoCs than it is for them to implement protocols and interfaces that make booting and hardware discovery standardized like they are on the PC.
This... seems suspect? I'm not doubting you, but I do wonder if it's a question of robbing Peter to pay Paul; perhaps it is cheaper to design a bespoke chip than it is to develop a standard for it, but over the course of many generations the benefits of standardizing would kick in?
I do know that RISC-V can support UEFI, so perhaps that's where we need to look to see how developments work out in the long run.
Well that is the consumers choice. A friend who has no desire to mess with computers and said hands down he will spend money on a console any day of the week because all he . He has a desktop and a laptop but rarely games on them.
Me, I don't buy game consoles because it kills me to own a powerful compute device that is crippled by the manufacturer to only run certain blessed software. No thanks. I prefer to game on open platforms like my Linux PC running open source games (e.g. gzdoom), DOSbox, Steam games and so on.
Such phones exist:
It wouldn't, you need drivers for your modem, gpu, gps etc. It's encumbered with patents and "prohibited" software circumvention techniques, you're right about one thing it would be regarded as criminally offensive by our current legal system.
Speaking of android, if iOS had jailbreaking, maybe we need a bigger prisonbreaking from Google
Far less technical people from my perspective
Not fun if you work I.T. whatever you role is
I obviously can't speak for all "Linux driven engineers", but only about myself, as someone who's daily driven linux for a long time and who enjoys tinkering with computers.
I consider phones in the same category as a gaming console: a "single purpose" device.
I find they're not practical for much more than mindless scrolling and the occasional text (and even that's a pain, to the point I usually do it from my computer). I just hate staring at a tiny screen and obscuring half of it with my hand when I need to interact with it.
I'm all for geeking out on things, and love to tinker. But the phones are simply not attractive to me. I used to have Android phones with custom roms, but that was only because samsung had atrocious support for older devices. My current iphone is supported until it can't be used anymore and does everything I need.
Whenever I get the itch to tinker, I'll do it on a computer with a full keyboard and big screen.
> Is Android and iOS just good enough to keep us complacent and trapped forever?
I think they are, especially since us "linux driven engineers" are a tiny fraction of the market. Basically nobody but us cares about these things. Just like almost nobody wants a small phone, or thick phone. Even with regular computers, most people didn't tinker, they would just install a few programs, which would have been on an hypothetical app store anyway.
Yeah. It's called capitalism, where the reasoning behind everything is "How can businesses make a profit?". And in the U.S., it's also, if the business doesn't make a profit I'll starve.
Well that is the consumers choice. I have a friend who is a hard core gamer and said hands down he will buy a console any day of the week because all he wants to do is play a game. He doesn't want to deal with Windows updates (or god forbid, fiddling with Linux), driver issues, things suddenly not working, and so on.
Personally, I don't buy video game consoles because it kills me to own a powerful compute device that is hamstrung by the manufacturer to only run blessed software. No thanks. I game on open platforms like my Linux PC running open source games like gzdoom, classics on DOSbox, emulators for classic consoles/arcades, Steam games and so on. And I can run whatever I damn well please.
What is needed is: Once I have purchased a device, the transaction is over. I then have 100% control over that device and the hardware maker, the retailer, and the OS maker have a combined 0% control.
> Thanks to DMCA 1201, the creator of an app and a person who wants to use that app on a device that they own cannot transact without Apple's approval. [...] a penalty of a five year prison sentence and a $500,000 fine for a first criminal offense, even if those tools are used to allow rightsholders to share works with their audiences.
https://www.eff.org/deeplinks/2020/09/human-rights-and-tpms-...
_____________
In some ways, I think this is even more important than attempting to bar companies from putting in the anti-consumer digital locks in the first place: It's easier to morally justify, easier to legally formulate, and more likely to politically pass. The average person won't be totally stuck lobbing the government to enforce anti-lock rules for them, consumers can act independently to develop lockpicks.
Plus it removes the corporations' ability to bully people using your tax-dollars and government lawyers.
It's called "installing apps".
the problem is transaction not done once you own the device, you must use the ecosystem
Google and Apple create this ecosystem and they own it, so even if you have 100% control of your device but you cant live without their ecosystem
OS is just "half the battle", if its so easy Microsoft would not let windows mobile died
The bare minimum so that I can use the device I bought as I wish, even if the manufacturer later decides to "alter the deal".
Android, in particular, is a finished product. It doesn't need yearly updates. It may need an occasional update to patch a vulnerability, but this whole "we changed the notification shade UI for tenth time because we're so out of ideas" thing has to stop.
Most of the time, software updates remove features, change things around for no good reason (breaking our workflows), or add unwanted features.
We really should separate pure bugfix updates (which include security updates) from feature updates. We nearly always want the former, but not necessarily the latter.
You should be able to set auto update, auto update with confirmation, manual update only, for any or all apps.
What someone does with that, and why, isnt something anyone should have to explain or excuse.
It could be as simple as not wanting any new features beyond but what an original version of an app has. Or not wanting an update that takes user data surveillance to another level.
Obviously saying "Apple shouldn't be allowed to touch my device after I purchase it" as well as "Apple should be compelled to provide security updates" is nuts.
But I think saying, "Apple shouldn't be allowed to touch my device after I purchase it" as well as "I should be able to provide my own security updates, if Apple doesn't want to" is totally reasonable.
But Apple would never allow that. So allowing sideloading seems like a reasonable amount of pain Apple should be forced to put up with...
wild that you seem to think this is a gotcha question. yes, all the software I want on my devices, and only software I want on my devices
Um, yes? Constant push-updates are one of the worst tech trends of the last 10-20 years.
Security Updates - They should be considered as in warranty servicing of faulty software.
Software Updates - These are turning out to be a scam in some ways. The decision to regularly introduce new APIs and forcefully obsolete old APIs/features is theirs. Consumers don't have to pay for it with the control. The cost of it should be baked into the initial purchase cost. A new feature that restricts access is an anti-feature.
But what's the point of defining these standards now? Is the world where this is the reality still feasible? It seems nearly impossible, unless you're an extremely wealthy and influential individual. What I'm seeing is that we never will move to a world where a device that you bought is truly "yours" anymore. Instead, we'll be renting one of the approved devices, ran by one of the tech megacorporations and overseen by your government. They will give no real way to execute any random code that you want, unless you're also licensed and vetted as a developer. They will be tightly surveilled, all information will be saved, every interaction between these devices will be controlled for the sake of security. It will be an entire web of trust, defined by the powers that be. We're seeing early attempts at it now, but we still haven't hit full centralization. But once we do, what happens then?
Fixing that problem might turn out to be cheaper for competitors by making their platforms more open and avoiding the full responsibility as a vendor.
Basically, combine current and future legislation about electronic waste, cybersecurity of IoT and connected devices, and the carve-outs for free software and open source platforms, and suddenly it becomes much cheaper to ship a product that will run for 20 years (say a washing machine) if you as a vendor can guarantee some of this for the warranty period (1-5 years), and open up the platform to consumers and shift the responsibility at that point. Also imagine the case of a vendor going under which needs to be covered too (this would make subscriptions infeasible too).
If legislation demands this (imagine no insecure devices for 20 years), markets will do the rest.
1. It's your damn phone and you should be able to install whatever the hell you want on it
2. Having an approved channel for verified app loading is a valuable security tool and greatly reduces the number of malicious apps installed on users devices
Given that both of these things are obviously true, it seems like a pretty obvious solution is to just have a pop up that has a install at your own risk warning whenever you install something outside of the official app store. 99.9% of users would never see the warning either because almost all developers would register their apps through the official store.
But there is a reason why Apple/Google won't do that, and it's because they take a vig on all transactions done through those apps (a step so bold for an OS that even MSFT never even dared try in its worst Windows monopoly days). In a normal market there would be no incentive to side load because legitimate app owners would have no incentive not to have users load apps outside of the secure channel of the official app store, and users would have no incentive to go outside of it. But with the platforms taxing everything inside the app, now every developer has every incentive to say "sideload the unofficial version and get 10% off everything in the app". So the platforms have to make it nearly impossible to keep everything in their controlled channel. Solve the platform tax, solve the side loading issue.
I would instead say that having a trustworthy channel for verified app loading is a valuable security tool. F-Droid is such a channel; the Google Play Store is not. So Google is trying to take this valuable security tool away from users.
It is an obvious solution, and it's a good first solution. This popup already exists.
A problem in security engineering is that when people are motivated (which is easy to achieve), they will just click through warnings. That is why, for example, browsers are increasingly aggressive about SSL warnings and why modifying some of the Mac security controls make you jump through so many hoops.
The usual take on HN is take the attitude that the developer is absolved of responsibility since they provided a warning to the user. That's not helpful. Users are inundated with stupid warnings and aren't really equipped to deal with a technical message that's in between them and their current desire. They want to click the monkey or install the browser toolbar. The attitude that it's not my problem because I provided a warning they didn't understand doesn't restore the money that was stolen from them by malware.
I think that's going to have a far more significant impact on people installing malware than developer attestation.
That said, your point about messaging is really good, and so many times I see security warnings I roll my eyes at how badly the message is written.
That's close enough to how Android already works. Google wants to additionally prohibit installation of apps unless they're signed by a developer registered with (and presumably bannable by) Google.
Android already does this. It's the thing that's going away.
> Solve the platform tax, solve the side loading issue.
I think maybe for a large part of legitimate app owners there would be no incentive, but there are other reasons/incetives for legitimate app owners to go outside the official app store even in the case of no tax, a few that pop to mind are:
- open source devs might have the preference to publish their app on a community-led store.
- users trying to keep an old phone functioning using an unofficial custom android, with no support for the store.
- developers creating apps for themselves and their friends not needing to publish the app publicly.
- companies creating apps just for work phones wanting to keep them private outside of any store.
- A company providing "build-your-app-with-AI" service preferring to just provide a final apk file.
I think it's important to remember that there are loads of other reasons outside the financial one to keep the ability to install what you want on your phone. If google dropped any tax they put on their store now, the problem with these new changes would still be there
(edits: formatting issues)
> Having an approved channel for verified app loading is a valuable security tool and greatly reduces the number of malicious apps installed on users devices
These are claims that Apple and Google make to justify their distribution monopolies, and you are repeating them as fact. I don't think it's true, and cite as evidence both major app stores and the massive amount of malware in them.
Don't parrot anti-competitive lies from monopolists.
> Given that both of these things are obviously true, it seems like a pretty obvious solution is to just have a pop up that has a install at your own risk warning whenever you install something outside of the official app store.
Google already does this. They've always done this, and it has always been a bad thing because it disadvantages app stores that try to compete with Google Play. Imagine you want to sell an app, and your marketing materials need to include instructions on how to enable "side loading" and tell people to ignore the multiple scary popups warning about vague security risks and malware.
> because they take a vig on all transactions done through those apps
This has already been litigated and federal judges ruled that they must allow devs to use third party payment processors. Look up the Epic Games cases against Apple and Google.
> In a normal market there would be no incentive to side load because...
This is nonsense. "sideload" just means to install something outside the Play store. In a normal market, there would be every incentive to do so, as consumers would be able to choose from multiple app stores. Users don't care where an app comes from, as long as they can figure out how to get it.
Having a curated channel for app loading is indeed a valuable security tool. It does exist in Linux distributions as well. It does not mean that it has to be the only channel.
And it does make total sense, IMHO, to warn the users when they install something through an "unknown" channel. The first time you install an alternative store, it should tell you "you'd better be damn sure that this thing is not malicious because it will install all your apps".
Which brings me to a few points:
1. I don't really see a problem with the Google Play Store being installed by default on Google-certified phones, just like I don't have a problem with the GrapheneOS store being installed by default on GrapheneOS. But the Play Store should allow me to install alternative stores (like F-Droid), just like the GrapheneOS store allows me to install... the Play Store.
2. I should be able to install an alternative OS on my phone and relock the bootloader. Which actually the Google Pixels allow (one of the reasons why GrapheneOS runs on the Pixels). I don't see a problem in allowing Google-certified Android, it's just that Google should not be allowed (by law) to prevent me from running GrapheneOS.
3. Manufacturers should be forced by law to make it easier to some extent for alternative OSes, e.g. by opening the device tree and stuff. If they don't, they should prove that they have a good reason not to. Other than "hmm I don't know, but to be safe I will just keep it all proprietary".
This is true, but it's also not the main vector of attack. The primary threat is that the user is intending to download $WELL_KNOWN_APP and instead downloads a compromised binary from a malicious third party and is instantly compromised. The app stores make the probability of this essentially zero.
I don't understand what you're saying. Are you saying Google is making it harder to develop an app for sideloading than to develop an app for the Play Store? I don't see how that's the case. AFAICT, the new "sideloading" requirements aren't more restrictive than the Play Store requirements.
Disclosure: I work at Google, but not on Android.
I don't think it's like "MSFT didn't dare to try", but rather "MSFT was too stupid to come up with the idea". They didn't have the ability to manage it either (and till this day their Windows Store app still sucks with tons of bugs). Not to mention that Windows was already wide open, never with a restriction "you can only install these approved apps" to begin with.
Basically, not that Microsoft didn't do it, but it couldn't.
If this stops, it fundamentally disallows me to have the privacy that Apple app store can't provide. The amount of garbage apps in play store is horrible. I don't try out any new apps from there cos of this. So I will just switch to iPhone.
Already degoogled for pretty much most things. This will be the last. And maybe switch my website from netlify which I think is using google cloud (need to check).
GrapheneOS has official production support for the following devices:
Pixel 9a (tegu)
Pixel 9 Pro Fold (comet)
Pixel 9 Pro XL (komodo)
Pixel 9 Pro (caiman)
Pixel 9 (tokay)
Pixel 8a (akita)
Pixel 8 Pro (husky)
Pixel 8 (shiba)
Pixel Fold (felix)
Pixel Tablet (tangorpro)
Pixel 7a (lynx)
Pixel 7 Pro (cheetah)
Pixel 7 (panther)
Pixel 6a (bluejay)
Pixel 6 Pro (raven)
Pixel 6 (oriole)Specifically it's weird to me that those people, akin your statement about platforms, don't seem to have a sense of place within which they do their stuff, whether that stuff is talking to the friends in your neighborhood regularly or checking your email; there aren't any other reasons you prefer Android, iOS is the default?
I personally don't fucking like iOS at all, never have, but I've always let myself re-evaluate it when the opportunity comes up. I find the UI clumsy and primitive, lacking in personality, customization, versatility. It was just fine on my old iPad for a few basic tasks, and it's still just as fin and just as basic, relatively speaking, on newer devices. However I am a career-long macOS user by choice. I usually admire both macs and iPhones for their hardware design.
Likewise, even though I moved to my relatively high cost of living city for a job years ago, if my current one let me WFH exclusively, I'd move... nowhere, this is exactly where I want to be. There is always some threshold of course whereby favoring one choice over another is too costly to maintain, but even though this particular freedom topic is important to me, I'm not about to just switch platforms because I've secretly hated it otherwise.
Because that is important to them. Everybody has different opinions on different things. Their priorities are different. I prioritise privacy. I had a workflow with convenience and privacy setup I can do with Android now. It had a lot of loopholes but it is something I am satisfied with. Its something I have developed it by making compromises and adjustments based on privacy, convenience and functionality. So FOR ME, it becomes valueless after this change. And the better would become iOS. So I would change.
I could also argue that yours is a boiling frog situation where you are fine with bad changes around you but you keep getting adjusted to it and making excuses.
For example, due to my privacy setup, I rarely see ads, I rarely get scam calls. There are convenience I get because of it.
All you have to think is... If whatever these companies do online... Will you be OK with it if they do it offline and in person?
Imagine I follow you everywhere and keep telling me to buy a burger from McDonalds. Stalk you around, noting everything you do. And about your family. How long will it take for you to call the cops on me or confront me? Why are you complacent when these companies do the same online? End result is literally the same. Only difference is scale and the fact that one is happening in your face while other is out of your view.
In conclusion, Everybody's threshold (like you mentioned) to different changes are different based on their views and priorities.
And most importantly, as a software professional, we definitely should hold ourselves to higher standards. I am doing what I CAN now.
You have the right to install whatever you want on your computer, regardless of whether that computer is on your desk or in your pocket. That's a hill I'll die on. I'm dismayed to see that this sentiment is not more widespread in this of all communities.
Imagine if your car was locked to certain manufacturer-permitted destinations.
That's what our smartphones have done.
I mean, I have had instances that controlled resistance with like a manual knob, but these new devices won't let you set levels without some $30+/month subscription. It's like the planned obsolescence of the light bulb cartels of the 1920s on steroids.
Personally, I have a hard time believing markets support this kind of stuff past the first exposé. I guess when you don't have many choices or the choices that you do have all bandwagon onto oligopoly/cartel-like activity things, pretty depressing, but stable patterns can emerge.
Heck, maybe someone who knows the history of retail could inform us that it came to software "from business segment XYZ". For example, in high finance for a long-time negotiated charging prices that are a fraction of assets under management is not uncommon. Essentially a "percent tax", or in other words the metaphorical "charging Bill Gates a million dollars for a cheeseburger".
EDIT: @terminalshort elsethread is correct in his analysis that if you remove the ability to have a platform tax, the control issues will revert.
But yeah agree, this subscription thing is spreading like a cancer.
It creates a powerful incentive to seek recurring revenue wherever possible. Since it affects things like stock prices and executives and sometimes even rank and file employees often have stock, it's an incentive throughout the organization. If something is incentivized you're going to get more of it.
In the past it was structurally hard to do this, but now that everything is online it becomes possible to put a chip in anything and make it a subscription. We are only going to see more and more of this unless either consumers balk en masse or something is done to structurally change the incentives.
Could literally replace the control software with a potentiometer (a resistor)! :)
That they've convinced everyone that this is okay, and that they've maintained regulatory capture to keep doing it, is absurd.
We need web downloads and installs on Apple and Android immediately. With no "scare walls" or deeply nested and hidden menu settings to enable it.
We need the ability to run any kind of tech, including JIT runtimes. Apple and Google shouldn't be able to tell consumers or the industry what type of computing is permissible.
Smartphones are the most important device category in the world. They're how people bank, work, navigate, shop, order, communicate, date, order food at restaurants, take photos, -- life without them is impossible.
It would be nice to see as much competition as we do with the automotive industry, but the next best thing would be to rid Apple and Google of their draconian overlording of the platforms.
Consumers do not have the expertise to articulate this or really understand what is happening to them. This requires regulators and industry professionals to push forward.
The plea Google makes against so-called "sideloading" always refers to "malware"
But how much malware has been distributed via F-Droid versus "Google Play Store"
It could be that smaller, independent "app store" might be better managed than Google's
That is essentially the assertion that we made in the prequel to this post (at https://f-droid.org/en/2025/09/29/google-developer-registrat...).
> But how much malware has been distributed via F-Droid versus "Google Play Store"
There's been only a single case of malware that we know of that has slipped into distribution on F-Droid (through a supply-chain attack on a transitive dependency), and it was caught within a day. So if we were feeling glib, we might have made the claim that "there is over 224 times as much malware on the Play Store than on F-Droid".
Because Google is suggesting that "malware" is a motivation/reason/justification for their new "sideloading" policy
It can be useful to show that Google's alleged justification is bogus
It's not about immediate safety, it's about safety in the long run.
I did make a comment in this thread about the historical usage of the term sideload, although for my purposes, I was noting a historical quirk frim a unique time in the history of the internet rather than disputing any premise in your post. It was the first and only comment at the time I posted it and I was not anticipating such an unfortunate backlash that seized on terminology for the purpose of disputing your point, or for otherwise missing your point.
But it is indeed missing the point. Requiring developer registration to install is exercising a degree of control over the software ecosystem that's fundamentally out of step with something I regard as a pretty important and fundamental ideal in how software is able to be accessed and used.
I totally agree with that. BUT:
> Splitting hairs about the origin of the term "sideload" does not change
You can't start your article by splitting hairs about the meaning of the term, and then complain that people follow down that discussion :-).
> You have the right to install whatever you want on your computer, regardless of whether that computer is on your desk or in your pocket. That's a hill I'll die on
I feel like there are some phones, I will say my honest experience, I had a xiaomi phone which required me to unlock the bootloader for me to root it/ remove the spyware that I feel it has, I never felt safe really (maybe paranoia?) but I wanted an open source operating system on it and that required me to unlock my bootloader
Which required me to create an MI Unlock / MI account which then later required me to open up a windows computer and try to do things with the windows computer
I didn't have a windows computer, I am a linux guy and I didn't want to touch windows and I tried any option available on linux (there was a java thing and some other exploit too but both failed)
Later, I tried to actually install win-boat and tried to install the mi tool in it after so many nights of work and I tried and it actually opened but it asked me for the otp to sign up but I don't know if I overwhelmed their system or not but their OTP just straight up didn't show on the phone's sim I had registered on.
That OTP not coming after 5-6 tries, I am not sure if they had detected it was win-boat or what, but idk, that effectively locks me out of ways to unlock the device and remove some spyware functionality I think it has.
I feel like this case made me feel as if although I had a device, it feels like a license when you think about it. This is true for many other consumer devices as well and thus, people accepting the fact that their devices have become similar to licenses, not hardware which they own, but rather software which they rent
> I'm dismayed to see that this sentiment is not more widespread in this of all communities.
I feel like your message is in the right heart, and its honestly okay, sad even, that some part of the community didn't respond to your message in agreement.
But Honestly, please don't lose hope because of this, You and people/foundations like f-droid,linux etc. inspire a sense of confidence for a good future while actively working on it. I was thinking of trying to host some f-droid mirror but I didn't personally because I was a little skeptical of getting any notices or anything after the f-droid team had created a blog post about something similar.
Also one thing, I would try to tell you is that you are trying your best. And that's all that matters. What doesn't matter is the past or the future or how the community responds but rather doing what you think is right with correct intentions which I think you do a perfect job in.
Doing the right thing can be difficult but maybe in a world where doing the right thing isn't rewarded as much in even mere appreciation or sharing the sentiment whereas doing the wrong thing is financially rewarded. its a complicated world we live in, but hopefully, we all can try to make it a little more beautiful for us and our future generations by trying to do things the right way no matter how hard they are, just because its the right thing.
I may speak these things but I myself regularly contradict these. So I don't feel the best guy speaking this stuff but I just want to say that f-droid really means a lot to me, a recent example is how I ditched that xiaomi phone, used my mum's old moto phone, tried to install termux from playstore but it couldn't download for some reason from play store because it was android 8 yet theoretically it should work, but I then opened up f-droid and installed it from there and I am running a termux/gitea server on it now :)
Please, have a nice day, F-droid/you deserve it, I just hope that you recognize that there are people's lives that you have touched (like my termux thing and there are countless other stories as well) and how impactful the project is.
Lets use this comment as a way to show our appreciation to f-droid in whatever ways it has touched our lives and how effectively google's recent moves are really gonna impact f-droid/ hurt us as well. How I wouldn't have been able to run git server on my phone if it wasn't for f-droid and so much more.
> You have the right to install whatever you want on your computer, regardless of whether that computer is on your desk or in your pocket. That's a hill I'll die on.
Hear, hear!
I too am flabbergasted at the utter lack of integrity some show and vocally proclaim in this of all places… corporate shills every last of them.
No morals can be expected from publically traded companies. Finding a "PR firm" willing to do the lowly dirty job of going on HackerNews, MacRumors or wherever people are and blatantly lie and make stuff up shouldn't be too hard either, I can imagine.
You write:
> “Sideloading is Not Going Away” is clear, concise, and false_
But isn't Google saying that you will still be able to sideload via ADB? Which would mean their statement is true, and that your claim that Google's statement is files is itself false?
I'm so confused why you never even mention ADB or its relevance to sideloading, which they refer to rather explicitly in their blog post. At the very least, if you think ADB doesn't change anything, you could mention it and say so. Could you explain this seemingly critical omission?
If there's some ADB command that one can issue to install unsigned APKs for now, it's a temporary reprieve at best. Two Android versions later, the update from Google will read "Only 0.02% of users installed apps using adb, but the corresponding malware incidence rate was 873% more than the Play Store. Due to the outsized risk, we're disabling adb installations going forward"
This is so far from a realistic and acceptable substitute that I question the honesty of anyone who claims that "adb will still work, so no problem!"
I hope that explains my seemingly critical omission.
I believe f-droid strives to be a simple platform of from-source builds for non-Googled apps that anyone can use.
No, it will not. Nothing will install an application without a Google approved signature on it. They will remove ad blocks from your Android and you will like it. "The beatings will continue until morale improves" sort of behavior.
I'm hopeful that the mystery OEM that GrapheneOS is targeting is in fact Sony Xperia. If it isn't, I'm just going to stop carrying a smartphone when all my installed apps stop working on it.
agreed, but i'm not going to die on any hill. i don't see much point in this discussion, these corps will do whatever they like. for me it is simple: iphone never was an option precisely because of this reason, and i've been quite content with android, but i don't think my current smartphone will run android for much longer, and the next one will definitely not.
This surfaces in many types of discussions, including discussions where they may be prompted to defend the locked down nature of mobile devices.
I say it's just pockets. A vocal pocket. It's not everyone here. But it elicits comments justifying that stuff, which can feel surprising for those who don't share those views.
Alternatively, we've spent our lives helping our parents out. Last year my mom just got completely owned, total taken over of all her financial accounts. The most likely vector was that her phone was out of date and not receiving security patches anymore.
Luckily her bank's anti fraud systems kicked in before too much damage was done.
Prior to smart phones, many of us remember making monthly, or even weekly, trips to family members houses to remove malware and viruses from personal computers.
Things were bad.
Perhaps you meant Leviathan instead of superego?
> Google’s message that “Sideloading is Not Going Away” is clear, concise, and false
Given your(and my) definition, this statement is false. Google isn't taking away sideloading, you can still use adb. I'd say using adb to load an apk from another device is the proper use of "sideloading".
What Google is doing is much worse, they are taking away your ability to _install_ software.
And yes, HN loves splitting hairs. But if it wasn't for the hairsplitting, there probably would be be much discussion. Just most people agreeing with you and a few folks who would prefer to give up freedom for security.
.. A grateful F-Droid supporter and user.
If anything, the fact that Google feels the need to disingenuously argue "sideloading isn't going away" suggests to me that the term sideloading has a good reputation in the public consciousness, not a negative one.
Let's just focus on the fact that Google is trying to take away Android users' ability to install software that Google doesn't approve of, and not stress so much about what words people use to describe that.
1. Laptop
2. Phone
3. Car
4. Washing machine
5. Handheld GPS
6. E-reader
7. TV
Is there some intrinsic different between a device where the manufacturer has programmed it using an ARM/x86-based chip vs a microcontroller vs some other method that means in the 1st case I have the right to install whatever I want? Because that feels like what's happened with cell phones: manufacturers started building them with more capable and powerful components to drive the features they wanted to include, and because those components overlapped what we'd seen in desktop computers, we've decided that we have an intrinsic right to treat them like we historically treated those computers.
That is not a fact, that is your opinion. Lots of people say "sideload" without trying to convey such negative meanings. For better or for worse, the term has entered the common lexicon and I very rarely see it used with negative connotations attached to it.
Can you corroborate this? At least for me, the whole idea that "sideloading" has negative connotations only came up as a result of this debacle, and the only evidence I've seen are some very careful readings of blog posts from Google. The word itself hardly has any negative connotations aside from something like "not primary", which might be argued as negative, but is nonetheless correct.
>You don't "sideload" software on your Linux, Windows, or macOS computer: you install it.
Right, because those devices don't have first party stores. Windows and Mac technically do, as does some Linux distros, but they're sufficiently unpopular that people don't think of them as the primary source to get apps. Contrast this to a typical Android or iOS phone.
But I don't think they're going to do that, ultimately users who actually care about this are an absolute tiny percentage of the market.
And weirdos like us can always just import a Chinese phone that doesn't have mandatory Google verification crap.
No, we can't. One of the first countries with that mandatory Google verification is Brazil, and we can't import phones which are not certified by ANATEL, they will be rejected by customs in transit.
Obviously they'll eventually remove this because Google is hostile to things like ReVanced / some spook wants this power.
If i send a golang binary to someone with a mac via signal or other mediums, apple simply displays a dialog that the app is damaged and can't be run.
You need to use chmod to manually remove the quarantine flag to run it.
That for me is something that should be fined ad infinitum, because it is clearly designed to disallow non technical people to run custom apps.
but macOS lets you override any system determination, iOS does not, and Google is proposing the iOS flavor.
I think it is mostly about expectations, macOS trained people that it is relatively safe to install signed apps. If your app is unsigned, Gatekeeper will refuse to run it.
Because it's obscenely profitable for the platform holder to have complete control over app distribution.
Can we stop pretending it's about anything else than that? Just imagine if Microsoft got a 30% commission on every PC software purchase in the world...
I think we should focus on defending the slowly-vanishing ability to unlock the bootloader and fight for the core parts of Android to stay open source.. without these two, installing an APK will mean less and less until it might eventually become synonymous with installing a PWA.
Thankfully there's the likes of GrapheneOS, however, with Google's recent changes, unless their OEM partner pulls through, their days are likely numbered.
In the US maybe. In Europe, not so much. With Apple having a market share of "only" about one third and WhatsApp being the de facto default messaging app, this discussion never happened here.
Therefore your argument doesn't apply to Europe at all. Android is more than the "hacky" part. Albeit I'd really love to keep that.
99.9% of people who use Android have never, and never will, install apps outside the Play Store, and aren't even aware that they can do so.
> Judgment of the General Court of 14 September 2022 — Google and Alphabet v Commission (Google Android) > > The General Court largely confirms the Commission's decision that Google imposed unlawful restrictions on manufacturers of Android mobile devices and mobile network operators in order to consolidate the dominant position of its search engine
https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
Press release:
https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
The UK petition link appears to be broken:
* https://ec.europa.eu/info/law/better-regulation/have-your-sa...
I also recall a time in the nascent era of web file hosts, like Rapidshare.de and Mega upload, and some others that came and went so quick that I don't even remember their names, some services offered the option to "sideload" (as opposed to download) straight to their file server.
In the past, they forced Steam to implement proper refund policies, and they are currently suing Microsoft about the way subscribers were duped into paying more for "AI features" they didn't want.
https://keepandroidopen.org/ is about sending messages, which I have done and will continue to do. But I want to open my wallet.
As of now, I can create APKs of my apps and install them on my mother's phone by unchecking the "prevent apps from other sources" option.
Even after going through so many articles, I still don't know unambiguously whether I can continue this workflow in future, or I'll need Google's approval to install on just our own 2 family phones.
There's a failure in communications here from both sides.
Ambiguity suits Google perfectly fine.
But it's counterproductive to its opponents because every dev who's confused will remain a fence-sitter rather than an ally, even if only motivated by personal inconvenience rather than any principled stand.
I doubt I'm the only Android dev who's confused. I hope at least f-droid communicates more clearly the consequences of this policy to all types of developers and deployment scenarios.
As a person that tried the Pine64 ecosystem and not being able to will drivers/C++ apps into existence (like I can with web/cross platform), I did not contribute much other than buying the device/doing some videos on YT. (I bought: PP, PPP, PineBook, PineNote, PineTab)
It depended on few people working on it eg. through Discord communities
Anyway point is I saw Expensify I think they have these GitHub PRs which have $ values on them, would be interesting to take that approach, just pay for it literally eg. a GoFundMe for a feature.
Maybe they could make non-Google-Play-Store installed apps become installable only if the device owner toggles a switch which enables doing this risky thing?
Maybe some toggle in the developer options? And make the developer options accessible only if a user taps several times on the Android version label in the settings?
And show a message after every reboot that both of these settings are enabled, as a warning?
This costs about $12,000/yr and uses servers in the United States. Some of the staff work very part time, but still need a license at the same cost even if they only get one or two call shifts a month. The price ratchets up regularly.
There is competition, but nothing really better.
I could stand up an asterisk server and write a simple Android and iOS app for an ongoing cost two orders of magnitude lower (using existing infrastructure), but the app store impedance is too high to risk it.
I don't have the practical ability to confidently get an app into the Google play store and the Apple app store and keep it there.
The only viable alternative to bending over for these vendors for us is to go back to discrete pagers. It may come to that.
It was cheaper.
We could go back to that, but no one wants a pager again.
Install LineageOS or GrapheneOS?
I feel that the root problem is that there aren't enough highly skilled low level developers willing to spend their time writing free software for mobile phones. Why do we have Linux and things around it? Because a lot of very skilled developers decided to work on it and offer it to the world.
Whenever you side load anything, you are robbing someone's app store of income. You are not visiting their portal to be exposed to ads, you are not seeing ads in the middle of an application, you are not paying for anything.
Or at least, not paying to them. The only streaming service I pay for in my household is Japanese TV, which uses a side-loaded application. I'm freeloading on the Android TV platform because I only paid for the hardware, and for a streaming service not related any Google revenue funnels whatsoever.
That's what it's about.
It's either a derogatory term for "software loading" or an euphemism for "freeloading", or both.
I'm not sure if your comment is satire. So I'll respond as is.
"Not providing potential further income" is not "robbing"... what is being stolen from them? Something they never had in the first place? When I lose a bet I willingly entered, am I being "robbed" of the gains?
Furthermore, who is losing if I go to F-Droid to install an open source app people wrote with no expectation of income? If Google had a better app, I would have installed it from there. Too bad everything is riddled with ads detracting from the core purpose.
You used a wire, or Bluetooth that transferred the app file.
Then it ran.
This is how it was.
iPhone 1 was vehemently against third party apps of any kind.
The use of iTunes to have a “store” helped transfer and install apps digitally, and I believe using a wire too.
You either own your device or you don’t.
At a software level mobile has been a challenge to keep secure and locking it all down might not secure it either as there might be side doors still instead of side loading.
It has been 15-17 years since we got this batch of mobile operating systems, maybe we’re due for a new one since there’s a critical mass of users already on smartphones, unlike when Android/iOS began.
You mean Microsoft? No backwards-compatibility with Windows Mobile to begin with (so companies can't reuse their existing investment into line-of-business apps on actually nice modern devices either), then they reset the ecosystem 2 times (once during the WP7->WP8 transition, another time during the Windows 10 transition).
https://stackoverflow.com/questions/4229029/can-you-install-...
At least we got 10+ years of real sideloading on consumer devices thanks to WP7's death.
Microsoft UWP only Microsoft Store. Microsoft backtracked their walled garden Windows plans for a while as result of Windows Phone fiasco.
Yes, we are.
I can't even go into my workplace and get the company to not install Google Chrome and use Microsoft Edge on Windows (mind you, Edge is now based on Chromium) because everyone is so far up Google's ass that they must run CHROME and not another CHROMIUM browser because MICROSOFT. It's fucking insanity. It's taken as a default.
Stop using their products. Stop giving Google so much power over the fucking internet. Meanwhile I go on internet forums, IRC, and places like HN and people still fucking cry about Microsoft as if somehow we're in the 1990s. Like literally Gen Z wasn't even born in the 1990s and they decry Microsoft because us Millennials and Gen X continue to think Microsoft is the absolutely worst evil ever and Google is like the patron saint of the internet.
Apologies for the little bit of pro Microsoft rant here, but the point I'm trying to make is we should evaluate both Google and Apple through the same lens that we all give Microsoft shit for.
DeGooglify your brain, and then the rest of the world will begin to follow. Stop changing everything in your fucking services to kubernetes and istio. Don't switch your projects over to Go. Stop letting them run everything.
Like every time Google releases a new piece of technology the entire industry jumps on their tallywhacker. And that just continues to cement their legacy in all of these stacks.
Microsoft made changes to force consumer users to create Microsoft accounts to login to their PCs and you can go on Youtube and see 500 videos on how to use some bespoke tool to bypass this that has racked up thousands of views because some 'nerd' who literally walks around with a Macbook and an iPhone told them that it's the most evil thing Microsoft could make you do.
Meanwhile, once Google completes this transition on Android, you'll basically be forced to have a Google or Apple account to install any software on your devices, backup and restore the device, etc. And yet folks that dominate these boards are just like "yah that kinda sucks but like, ya know, ya know? ya know!?"
I agree that open software and even open hardware is a good thing. But both Apple and Google have done an incredible amount of damage to the open ecosystem of the web over the last 20 years in so many more ways than Microsoft could have ever dreamed of doing back in the 1990s.
And nerds not only let it happen, but embraced it, camped out in days-long lines wearing diapers to buy the latest shiny overpriced brick they could put in their pocket so they could look cool to all of their friends for a whole 12 months before the next one came out and made them look like a povo. And now walking around with a Macbook at college is like wearing the latest fashion trend because everyone has to show off that they're completely irresponsible with money and spend $2000 for something they could realistically get for under $1000 just so they can show off that they're in the same social class as everyone else.
It's the most infuriating thing to happen to the internet and technology.
Oh, and then to add on, they all get jobs in the tech industry and throw a fucking entitled childish hissy fit when their company hands them a $1000 Windows PC that's got monitoring and security software with no Admin rights on it instead of the $2500 Macbook Pro that they get root access to because mommy and daddy never told them no.
The big alternative is mobile linux or linux mobile, which is akin to desktop linux in the 2000s maybe in lagging behind the competing operating systems. An influx of interest in these operating systems and related hardware might make this discussion more moot (software like: postmarketos, mobian, ubuntu touch, and so on. hardware like: pinephone, raspberry pi used as a phone?, librem phones, and so on.)
Some progress has been made to have android phones run on linux with projects like postmarketos and mobian. Again, more people just focusing on building these projects, especially with the help of LLMs, might make this discussion less necessary.
F-Droid could also pivot a bit to promoting more linux mobile initiatives.
Apple should be called out as much as Google here for already being closed off.
Both platforms (ios and Android) could probably be appealed to through the incentive of "developer openness being good for business" - it probably helps both companies to make more money by making "sideloading" easy. If they both essentially become closed, this opens up a giant incentive for linux mobile to take over. (Maybe that is something we should root for?)
On the hardware side, we need some ios/android alternative phones. I've seen some people post that you can attach cell dongles to raspberry pis and use those as phones (?). Maybe more diy cell phone projects would be nice to see.
I guess the FSF is trying to create a Librephone; initiatives like this are overdue: https://liliputing.com/free-software-foundation-announces-a-...
Not sure what else to add, the writing has been on the wall that Google and Apple are trying to be closed source systems, so generally linux mobile (and/or *BSD mobile, if that's to be a thing in the future) need more attention.
This is probably a good moment to consider the alternatives and the seemingly predictable trajectory of where things are going.
Example: the loyalty card app for a local store chain - there's no money in it, I can just get some discounts when I use it. So an attacker would have to steal my phone, somehow unlock it, and then they can use my loyalty card (btw which is free to obtain for anyone and there are no tiers) to get some discounts. And for that, they have implemented a pretty decent root checker which i had to put in some effort to overcome. And there are many more like it.
With one switch, one nasty update (disabling bootloader unlocking on Pixels), Google could kill GrapheneOS..
That being said, as a grandchild, I also completely understand where google is coming from. A surprisingly high percentage of users do need protecting from themselves. They are so technology illiterate that someone random tells them to install something, "it will say it's not safe, but it's actually okay, just click approve" and they will. This is why HSTS exists, to prevent uneducated users from getting pwned, by preventing them from disabling safeguards.
So, having some system of "no really, I am a power user" makes sense, even if I hate it.
Why on earth do I need to register with Google to use them?
Yes, sideloading will still be viable from known developers.
Probably malware developers will still be free from prosecution -- what moron is going to distribute malware with their own identity attached to it? But it means when the malware gets caught (which it does) you can't just roll a new APK with a different signature. You've burned a developer identity and need a new one. Those are harder to come by, and so it rate-limits malware distribution.
> You'll need to prove you own your apps by providing your app package name and app signing keys
Needless to say, Google will throw out NewPipe, ad-blockers and anything else that might endanger their profits. For example, Google does not allow F-Droid to be published in Google Play (distributing competing app stores is against their ToS). This policy was in action as long as Google Play/Android Market existed.
Important corrections:
This way anyone who is known to create malware or any software which interferes with Google's current or potential future revenue, strategic interests, and unpredictable whims will not be free from prosecution in the case of distributing malware, nor from digital exile and unpersoning in the case of causing inconvenience to Google.
Over the decades, from the Apple II to the present, I've owned every imaginable kind of computer. And yes -- I owned all of them -- I had the right to use them as I saw fit. They were extensions of my intellectual creativity. I've written dozens of Android apps, including TankCalc, used in industries across the world to measure and control storage containers. TankCalc is useful, it's free, and it's about to die.
I tried meeting Google's demands, but over the years I realized that wasn't possible, because Google refused to take "yes" for an answer. This is true for all my Android apps -- all would require constant maintenance to meet Google's endless compliance demands.
We're witnessing an extinction of personal expression, of defending the rights of individuals, and the sideloading issue is a symptom of a deadly disease, one that shifts control away from individuals to giant corporations.
Sideloading is just an example. Samsung has updated its already-sold refrigerators to begin showing ads to powerless consumers. Car makers Mercedes-Benz and BMW have starting charging monthly subscription fees for access to features already present in people's cars. Farmers can no longer repair their John Deere tractors.
It's an unprecedented historical shift. Instead of being crushed by an army that invades and takes over, we pay for things that own us, body and soul.
You can't? THEN YOU DON'T OWN YOUR PHONE.
Simple as that.
And at the same time, the target audience interested in installing a custom Android fork would be much smaller than the potential target audience for F-Droid in its current form.
(Also, for the time being, a much more minimally invasive and less resource-intensive approach would be some sort of Shizuku-like approach, i.e. using the ADB network interface originally intended for wireless debugging.)
Otherwise they wouldn't buy android devices, right? Thats how freemarket works.
Its much easier for people to give away their freedom to install any software on their device in exchange of not learning all the intricacies of information security and privacy.
EVerybody still can install non native os on their device and use any store they want, right? Or fork android and maintain the OS that allows installing software from other sources.
Its just people don't really care - google is not non profit - its doing business for people who pay money and care more about passing the security reaponsibility on the manufacturer, thats why Apple thrives and nobody cares that you have to use their store only, only minority of people who are not an interesting market
When you install Git Bash, Vim or GIMP on Microsoft Windows, you are side loading.
So what happens in China? Should we buy Chinese Android phones?
They say one thing, then do another.
Of course, if they could do this with Windows, Linux et al they absolutely would. And general purpose computing will, eventually, be closed and locked down, much like what we are seeing with the internet and ID laws. People would have, and did, think such ideas would be unthinkable 10-15 years ago. Yet little-by-little the screws are being ever tightened. The government wishes to tightly control the information flow and decide what is 'best for you' to see. Preferably their chosen propaganda.
Work-arounds that exist today will likely be closed and forbidden in the future. VPNs to bypass age laws, ADB to bypass install-blocks will all be obsolete. You will be required to identify yourself at all times. I half-expect Google to deprecate and remove the concept of VPN's/ADB on Android entirely and laws will be passed to that affect (restricting the apps themselves, or access to the APIs to verified Android devices/Google accounts). If you don't believe me, you only need to see [1] for the direction of travel.
There is little interest from the regulators to stop this. Perhaps the useless CMA will 'investigate' in 5 years time, decide Google perhaps abused its monopoly and then do absolutely nothing because they have no real re-course over an American company. It's likely governments support this position and will not do anything to influence a change of direction.
Eventually, Linux itself will go the same way, people are just waiting for Torvalds to retire from the project to make their moves, but make no mistake, open general-purpose computing is under threat and there is going to be little we can do to reverse the current trends towards closely monitored and controlled computing.
[1]: https://developer.android.com/google/play/age-signals/overvi...
This will most likely be expanded in the future to limit access to certain 'dangerous' APIs like ADB/VPN's etc. This can also be used 'in app' and across the entire OS to shape your experience of what you can see and do. I wouldn't be surprised if 'unlocking bootloader' required an 18+ verified device.
Nah. The only reason Google has decided to lock-down Android is because they think they can get away with it. They would have done it from the first minute except that not doing it gave them a competitive advantage in the market over Apple - back when pretending to be into FOSS and to "not be evil" was a major part of their marketing. They're ready to make the move. If it fails, they'll try to make the move again a few years from now. They don't give a shit about ICE or whatever.
That's why the solution CAN'T be more regulation ...
Again, I don’t really see Google as a ‘moral’ or ‘pro-user’ company since they just pushed out Manifest V3. But unlike ad blockers, they’re not losing millions from sideloaded apps, so the only reason for their sudden policy shift is probably government pressure. With all the ongoing antitrust lawsuits, they’re just trying to stay on the good side of whatever the current or next administration wants.
Thankfully, we can take the last GPL commit of Linux and fork it.
I think defining sideloading as "the transfer of apps from web sources that are not vendor-approved" is a good definition, because "not vendor-approved" is precisely the part I care about. The owner being able to install stuff without Google or anyone else's approval is a good and important capability for every computing device to have.
In any case, I fully agree with the substantive portions of this article. What Google is doing here is a terrible attack on consumer freedom.
And the fact that `adb sideload` is where the concept originated does nothing to dispel the way the term is frequently used in a derogatory fashion these days. It's wielded as a bogey man to make people afraid of unsigned applications. Despite the fact that many perfectly signed applications are full of malware and dark patterns.
Also, FFS, this is hacker news. Why on Earth would be arguing in favor of Google locking down how I can install software on my device.
From the post:
> Regardless, the term “sideload” was coined to insinuate that there is something dark and sinister about the process, as if the user were making an end-run around safeguards that are designed to keep you protected and secure. But if we reluctantly accept that “sideloading” is a term that has wriggled its way into common parlance, then we should at least use a consistent definition for it. Wikipedia’s summary definition is:
> the transfer of apps from web sources that are not vendor-approved
The opening two sentences of the linked-to Wikipedia page on sideloading:
> Sideloading is the process of transferring files between two local devices, in particular between a personal computer and a mobile device such as a mobile phone, smartphone, PDA, tablet, portable media player or e-reader.
> Sideloading typically refers to media file transfer to a mobile device via USB, Bluetooth, WiFi or by writing to a memory card for insertion into the mobile device, but also applies to the transfer of apps from web sources that are not vendor-approved.
The phrase after the "but" in the second sentence isn't the "summary definition". It's the part of the definition that best supports your argument. Cutting the Wikipedia definition down to that part is deceptive.
Also in the post:
> Regardless, the term “sideload” was coined to insinuate that there is something dark and sinister about the process, as if the user were making an end-run around safeguards that are designed to keep you protected and secure.
Immediately later in the same Wikipedia page is a paragraph that is literally about how the word was coined:
> The term "sideload" was coined in the late 1990s by online storage service i-drive as an alternative means of transferring and storing computer files virtually instead of physically. In 2000, i-drive applied for a trademark on the term. Rather than initiating a traditional file "download" from a website or FTP site to their computer, a user could perform a "sideload" and have the file transferred directly into their personal storage area on the service.
That's funny. The history of how the word was coined and the post's claim about how it was coined aren't similar at all. Weird.
Wat?
Everything after the "but" is what Google means when they use the term sideload and is the only important part of the definition for f-droid's purposes. The other definition is completely irrelevant and, I would argue, hardly ever used anymore.
But that isn’t the point people are angry about. The point is that sideload was a misnomer. Correctly Android users were able to install packages and now cannot. This is anti consumer and breaks the social contract.
Anyway this is so disingenuous that I think it’s astroturf. Here’s the meme we should’ve spreading: Chrome and Android should be broken off from Google. Apple should be forced to allow sideloading, at a minimum, same as any other computer. Phones and tablets should be valid targets for custom OS.
Per the original definition, how exactly am I "side loading" if I go to the epic games store and download and install their epic game store APK?
Features aren’t rights, if you want a phone that let’s you run whatever you want, buy one or make it yourself.
What you’re trying is to use the force of the state to make mandatory a feature that not only 99% users won’t use, it vastly increases the attack surface for most of them, specially the most vulnerable.
If anyone were trying to create a word that gives a “deviant” feel, they wouldn’t use “sideload”, and most people haven’t even heard the term. There’s a world of difference between words like “pirate”, “crack”, “hack” and “sideload”.
If anything I’d say it’s too nice of a term, since it easily hides for normies the fact that what you’re doing is loading untrusted code, and it’s your responsibility to audit it’s origin or contents (something even lot’s of devs don’t do).
If you want to reverse engineer your devices, all the power to you, but you don’t get to decide how others people’s devices work.
"Features aren't rights" > see: Consumer Rights.
"Force of the state making sideloading mandatory is bad" > ...Except we have antitrust laws? The Play Store becomes the only source of apps, all transactions are routed through Google Billing? Not a problem for you?
"99% users won't use" > Except for when Google demands that transactions happen exclusively through Google Billing, which resulted in the release of the Epic Games Launcher for the world's highest grossing games by download.
"Sideloading is too nice" > Listen, either it's the case that "sideloading" is a threat to normies or it's not. Are normies your 1% or 99% of users? I thought according to you 99% of users won't sideload.
"You don't get to decide" > That language ties in pretty well with your fear of the use of the 'force of the state'; that tells me that you support freedom. Great-- you're right, why not let corporations be corporations and do anti-consumer things, they'll be very good to us (while they lobby the state).
Perfectly reasonable. It's important that people can decide how their devices work for themselves. No one else should decide for them.
But I'm genuinely curious how you see this principle working in practice when there's effectively a duopoly. What's the path for someone who wants to still have any choices for their device? I'm not seeing an obvious answer, but maybe I'm missing something.
-- edit --
Apparently after checking this term in the internet, I am not so sure that this process had been called this way. Maybe I'll leave it here to provoke a correct answer according to the internet rule #1 - to learn what is the correct answer, just post an incorrect answer in the internet and wait
There's just no way at this time in which a single computing device can run software with high reliability expectations (emergency calls), high security expectations (controlled calling/texting, banking, money transactions) at the same time as random crap from the internet and keep the user safe and secure.
The HN community is far to fixated on their own use cases to properly understand this issue and its implications which can potentially upset a person's entire existence.
It's not like it was somehow possible to accidentally sideload apps. You have to first find the correct option from the system settings to enable sideloading, and then approve the specific app source you want to install from.
It is not like how things are/were on Windows. Back in the turn of the millennium, it was easier to catch malware than it was to install useful apps. For former, you only needed to double-click on an email attachment, for the latter, you needed to actively to go look for the website of the app developer, and download it from there.
Android already was pretty much at the sweet spot between security and freedom, what it came to sideloading. What Google should have done was to crack down on the scam apps in Play Store. However, they are not going to do that, since it would cut their profits.
The version of the your view that we are actually getting is _incredibly_ paternalistic and condescending to the general populace. The kind of society that is capable of protecting everyone from every conceivable harm comes with the kinds of tradeoffs that no one, not even the people who actually need the protection, are going to want.
I think users should be able to install whatever software they want, without any charge or other external permissions, but at the same time device and OS makers should be able to make it difficult to do so, within reason. Apparently scam apps are more common in some countries than others and is actually a problem in some countries, although I'm not sure.[1] Google did cite that as the reason for the change.[2] However, combined with the way Google has been locking down Android APIs more and more, (eg. the file system, but other APIs as well) it is concerning. At the same time those changes were also about security. I think every phone should be able to have full root permissions if you go through enough hoops without having to install another ROM. That seems to solve most of the issues here.
[0] https://android-developers.googleblog.com/2025/09/lets-talk-...
[1] see eg. https://techcrunch.com/2024/02/07/google-starts-blocking-use... at the end of the article for some examples
[2] https://android-developers.googleblog.com/2025/08/elevating-...