Top
Best
New

Posted by rom1v 1 day ago

What we talk about when we talk about sideloading(f-droid.org)
1161 points | 492 commentspage 2
endgame 19 hours ago|
Australian users of alternative app stores should make a complaint to the ACCC: https://www.accc.gov.au/about-us/contact-us-or-report-an-iss...

In the past, they forced Steam to implement proper refund policies, and they are currently suing Microsoft about the way subscribers were duped into paying more for "AI features" they didn't want.

marak830 19 hours ago|
Done, thank you for the link.
ef2k 1 day ago||
On MacOS it warns you when you're about to open an app you've downloaded and installed yourself. "Foo has been downloaded from the internet, are you sure you want to open it?". It doesn't stop you from installing it. Why should doing so on your phone be any different?
bpfrh 1 day ago||
Depending on your app this is not all.

If i send a golang binary to someone with a mac via signal or other mediums, apple simply displays a dialog that the app is damaged and can't be run.

You need to use chmod to manually remove the quarantine flag to run it.

That for me is something that should be fined ad infinitum, because it is clearly designed to disallow non technical people to run custom apps.

Zak 1 day ago|||
On the other hand, it used to be very common for malware on Windows to email itself to all your contacts using your real email client. It's probably reasonable for an OS to add a little friction to the process in the modern era, though it probably shouldn't lie and claim the binary is damaged when that's not the problem.
makeitdouble 23 hours ago||
chmod to dequarantine doesn't sound like "a little friction" to me.

On your point about security, this kind of aggressivity from the platform owner tend to backfire.

The user was already convinced to open that mail, download that file, and try to run it. Pushing the process to the terminal just means your clueless users now run the provided incantations in the shell instead, and the attack vector now becomes huge (the initial program doesn't even need to be malware)

Zak 23 hours ago||
I agree having to go to the command line is too much friction. Just clicking `overdue-invoice.doc.pif` is too little. About right is somewhere between a prompt and setting the file executable in the GUI.
makeitdouble 22 hours ago||
I wish it would run in a stricter sandboxed mode and prompt the user on the first network requests and file writes outside of it's directory.

That wouldn't be perfect, but at least the user could be prompted for a concrete action instead of a vague "this script is scary" warning.

bpye 1 day ago|||
> If i send a golang binary to someone with a mac via signal or other mediums, apple simply displays a dialog that the app is damaged and can't be run.

Has this changed? I thought it failed to launch, but if you go to Privacy & Security in Settings it would give you the option to allow it to run?

Though yes, macOS doesn't prompt you to do that, you have to know where to find it.

spcebar 1 day ago|||
I believe they are saying that this update will remove the ability to decide if you want to install it and will require developers to register and pay for their applications to be installable at all. It's been several years since I developed for Mac, but they operated a similar way, secretly marking a file as quarantined and saying "XYZ Is Damaged and Can’t Be Opened. You Should Move It To The Trash" if you didn't pay to play. Maybe this has since changed, or maybe I'm just a dummy. Regardless, whether a platform has any business funneling a user into their walled garden is another philosophical argument altogether.
WorldPeas 1 day ago|||
I sure hope they still allow `xattr -r -d com.apple.quarantine /Applications/*`
LoganDark 1 day ago|||
Quarantine is for any executable downloaded from the Internet. It doesn't prevent it from being opened, it only marks it to be checked for malware.
pirates 1 day ago|||
In my experience the quarantine flag gets added if the file is downloaded via browser, chat program, email, or some other way that isn’t curl/wget/other CLI tool. At least for the past 6-8 months this has been my experience. Not that it excuses anything, but for what I have had to deal with it’s been somewhat helpful.
jagged-chisel 1 day ago|||
It definitely adds hurdles to running it.
LoganDark 17 hours ago||
Usually the hurdle is just a pop-up informing you that it's been downloaded from the Internet. Sometimes the malware checks go wrong though and try to prevent you from opening it at all.
conradev 1 day ago|||
This is the key and only difference. Scanning is great, and security is great.

but macOS lets you override any system determination, iOS does not, and Google is proposing the iOS flavor.

bloomca 1 day ago|||
macOS warns you literally about every downloaded app not from MAS (signed!), unless you build it yourself or remove quarantine manually.

I think it is mostly about expectations, macOS trained people that it is relatively safe to install signed apps. If your app is unsigned, Gatekeeper will refuse to run it.

bpye 1 day ago||
Do they have to be from the App Store, or "just" notarized?
LoganDark 1 day ago||
Notarized works just fine.
greatgib 22 hours ago|||
If you install the binary directly, but obviously it does not ask when you are installing through a store like brew...
WorldPeas 1 day ago|||
it also sometimes says `"Foo" Not Opened` `"Apple could not verify “Foo” is free of malware that may harm your Mac or compromise your privacy."` This is frankly pretty insulting to the intelligence of the user and /does/ stop them. I think the paradigm is flowing towards "less" rather than "more"
CrossVR 1 day ago||
> Why should doing so on your phone be any different?

Because it's obscenely profitable for the platform holder to have complete control over app distribution.

Can we stop pretending it's about anything else than that? Just imagine if Microsoft got a 30% commission on every PC software purchase in the world...

pr337h4m 1 day ago||
Why are OEMs like Samsung just letting this happen? A lot of power users who buy flagships will leave for iPhones if Android ceases to be an open platform. (This segment is what is preventing the “green bubbles = poor” narrative from taking over.)
m3adow 1 day ago||
> This segment is what is preventing the “green bubbles = poor” narrative from taking over.

In the US maybe. In Europe, not so much. With Apple having a market share of "only" about one third and WhatsApp being the de facto default messaging app, this discussion never happened here.

Therefore your argument doesn't apply to Europe at all. Android is more than the "hacky" part. Albeit I'd really love to keep that.

eep_social 21 hours ago||
whatsapp is a different form of the same malignant cancer, or so the unremovable meta-ai overlay seems to say.
the_pwner224 1 day ago|||
> A lot of power users who buy flagships will leave for iPhones if Android ceases to be an open platform.

99.9% of people who use Android have never, and never will, install apps outside the Play Store, and aren't even aware that they can do so.

archargelod 20 hours ago||
Did you consider piracy?

I'd guesstimate that close to 50% of Android users know how to install an apk.

dmbche 19 hours ago||
You think 50% of the 3.6 billions of android users know that?
archargelod 19 hours ago|||
There are countries like China, Russia, Iran, and Venezuela where installing an APK is the primary or only way to get most software, including essential bank and government apps.

Outside of the Western market, installing Android apps not from Google Play is a completely normal and regular thing. In countries like India, Brazil, Indonesia, Nigeria, and the Philippines (which represent a massive portion of global Android users) it is a standard part of using a phone.

LambdaComplex 19 hours ago|||
https://xkcd.com/2501/
Nemo_bis 14 hours ago|||
It's not like they didn't try, but Google illegally smashed them.

> Judgment of the General Court of 14 September 2022 — Google and Alphabet v Commission (Google Android) > > The General Court largely confirms the Commission's decision that Google imposed unlawful restrictions on manufacturers of Android mobile devices and mobile network operators in order to consolidate the dominant position of its search engine

https://curia.europa.eu/jcms/upload/docs/application/pdf/202...

Press release:

https://curia.europa.eu/jcms/upload/docs/application/pdf/202...

kuratkull 1 day ago|||
I have never seen people in the EU talk about the bubble colours. Texting is virtually dead in the EU as I know it, it's all in messaging services.
Andrex 23 hours ago|||
Samsung's fought Google on a few different fronts over the years and conceded most of those fights.
tcfhgj 1 day ago||
why would I leave for IPhones? I want the other direction of freedom.
tetris11 1 day ago||
> https://keepandroidopen.org/

The UK petition link appears to be broken:

https://petition.parliament.uk/petitions/744446

Dilettante_ 1 day ago|
The EU page is also no longer accepting new feedback

* https://ec.europa.eu/info/law/better-regulation/have-your-sa...

VadimPR 1 day ago||
Right, the period closed:

Feedback: Closed Consultation period 17 July 2025 - 24 October 2025 (midnight Brussels time)

anticensor 12 hours ago||
Why wouldn't F-Droid build their own playless Android fork where this is a non-issue?
Fokamul 12 hours ago||
Easy ownership test. Try flash custom firmware on your phone. ;-)

You can't? THEN YOU DON'T OWN YOUR PHONE.

Simple as that.

glenstein 1 day ago||
>Regardless, the term “sideload” was coined to insinuate that there is something dark and sinister about the process, as if the user were making an end-run around safeguards that are designed to keep you protected and secure.

I also recall a time in the nascent era of web file hosts, like Rapidshare.de and Mega upload, and some others that came and went so quick that I don't even remember their names, some services offered the option to "sideload" (as opposed to download) straight to their file server.

nashashmi 1 day ago||
The entire App Store system is broken. It should have always been sideloadable apps by default. And app stores for verified app makers. Instead we have Google withholding play store. And now withholding sideloading.
lovelearning 17 hours ago||
I have coded some apps that are customized for my mother's usage and accessibility. I plan on coding some more. I need to install them on just 2 phones - my own for testing and my mother's.

As of now, I can create APKs of my apps and install them on my mother's phone by unchecking the "prevent apps from other sources" option.

Even after going through so many articles, I still don't know unambiguously whether I can continue this workflow in future, or I'll need Google's approval to install on just our own 2 family phones.

There's a failure in communications here from both sides.

Ambiguity suits Google perfectly fine.

But it's counterproductive to its opponents because every dev who's confused will remain a fence-sitter rather than an ally, even if only motivated by personal inconvenience rather than any principled stand.

I doubt I'm the only Android dev who's confused. I hope at least f-droid communicates more clearly the consequences of this policy to all types of developers and deployment scenarios.

blackcatsec 13 hours ago|
I think one thing the internet community, particularly the likes of folks here who dominate the HN readership, is to stop listening to Google or using Google-derived services. The problem is everyone goggles Google's googleys every time they put something out: Chrome, Android, Kubernetes, QUIC, BBR, Analytics, Gmail, GCP, Go. And y'all continue to fucking do it.

I can't even go into my workplace and get the company to not install Google Chrome and use Microsoft Edge on Windows (mind you, Edge is now based on Chromium) because everyone is so far up Google's ass that they must run CHROME and not another CHROMIUM browser because MICROSOFT. It's fucking insanity. It's taken as a default.

Stop using their products. Stop giving Google so much power over the fucking internet. Meanwhile I go on internet forums, IRC, and places like HN and people still fucking cry about Microsoft as if somehow we're in the 1990s. Like literally Gen Z wasn't even born in the 1990s and they decry Microsoft because us Millennials and Gen X continue to think Microsoft is the absolutely worst evil ever and Google is like the patron saint of the internet.

Apologies for the little bit of pro Microsoft rant here, but the point I'm trying to make is we should evaluate both Google and Apple through the same lens that we all give Microsoft shit for.

DeGooglify your brain, and then the rest of the world will begin to follow. Stop changing everything in your fucking services to kubernetes and istio. Don't switch your projects over to Go. Stop letting them run everything.

Like every time Google releases a new piece of technology the entire industry jumps on their tallywhacker. And that just continues to cement their legacy in all of these stacks.

blackcatsec 13 hours ago|
Nah screw it, it's late and I'm unable to sleep and gonna rant a little more.

Microsoft made changes to force consumer users to create Microsoft accounts to login to their PCs and you can go on Youtube and see 500 videos on how to use some bespoke tool to bypass this that has racked up thousands of views because some 'nerd' who literally walks around with a Macbook and an iPhone told them that it's the most evil thing Microsoft could make you do.

Meanwhile, once Google completes this transition on Android, you'll basically be forced to have a Google or Apple account to install any software on your devices, backup and restore the device, etc. And yet folks that dominate these boards are just like "yah that kinda sucks but like, ya know, ya know? ya know!?"

I agree that open software and even open hardware is a good thing. But both Apple and Google have done an incredible amount of damage to the open ecosystem of the web over the last 20 years in so many more ways than Microsoft could have ever dreamed of doing back in the 1990s.

And nerds not only let it happen, but embraced it, camped out in days-long lines wearing diapers to buy the latest shiny overpriced brick they could put in their pocket so they could look cool to all of their friends for a whole 12 months before the next one came out and made them look like a povo. And now walking around with a Macbook at college is like wearing the latest fashion trend because everyone has to show off that they're completely irresponsible with money and spend $2000 for something they could realistically get for under $1000 just so they can show off that they're in the same social class as everyone else.

It's the most infuriating thing to happen to the internet and technology.

Oh, and then to add on, they all get jobs in the tech industry and throw a fucking entitled childish hissy fit when their company hands them a $1000 Windows PC that's got monitoring and security software with no Admin rights on it instead of the $2500 Macbook Pro that they get root access to because mommy and daddy never told them no.

BlackFly 9 hours ago|||
DMA in Europe required Microsoft to enable offline accounts without special tricks. When a government is doing their job properly they patch up holes in the laws that allow behavior that the majority consider to be against the prevailing norms.

You can also uninstall Edge and all the other Microsoft bloatware. Google on Android is actually one of the worse offenders in Europe for not being able to uninstall software as they consider far too many things to be critical to the operating system (for example, search).

blackcatsec 45 minutes ago||
Sure, but that isn't the prevailing norm anymore? What hardware doesn't effectively make you sign up for an account? Even Google does this under the hood with devices managed via Android Enterprise. Managed Google Play devices just create a device-specific account under the hood that isn't visible to the user. But it's still there. The requirement for this and the software infrastructure is still there.

Hell, even internet-of-shit devices make you sign up for an account to manage the hardware you buy (Ring, Nest, smart LEDs, etc.)

I'd give that on pure number of raw technical devices deployed to the internet today, some form of account and/or internet connectivity is a requirement moreso than not.

le-mark 10 hours ago|||
Nice rant, I’m here for it. This is what I miss from the early internet, a good old fashioned rant. It may go off the rails from time to time, but consistent in its frustration.

Note some companies give Mac books with admin, smaller companies though. It can be a real shock to go to a large company and get a locked down windows machine. What the boss can now see how much time I really spend working!?!

blackcatsec 44 minutes ago||
Thanks! Happy to oblige! lol
More comments...