Top
Best
New

Posted by rom1v 10/28/2025

What we talk about when we talk about sideloading(f-droid.org)
1516 points | 629 commentspage 4
blackcatsec 10/29/2025|
I think one thing the internet community, particularly the likes of folks here who dominate the HN readership, is to stop listening to Google or using Google-derived services. The problem is everyone goggles Google's googleys every time they put something out: Chrome, Android, Kubernetes, QUIC, BBR, Analytics, Gmail, GCP, Go. And y'all continue to fucking do it.

I can't even go into my workplace and get the company to not install Google Chrome and use Microsoft Edge on Windows (mind you, Edge is now based on Chromium) because everyone is so far up Google's ass that they must run CHROME and not another CHROMIUM browser because MICROSOFT. It's fucking insanity. It's taken as a default.

Stop using their products. Stop giving Google so much power over the fucking internet. Meanwhile I go on internet forums, IRC, and places like HN and people still fucking cry about Microsoft as if somehow we're in the 1990s. Like literally Gen Z wasn't even born in the 1990s and they decry Microsoft because us Millennials and Gen X continue to think Microsoft is the absolutely worst evil ever and Google is like the patron saint of the internet.

Apologies for the little bit of pro Microsoft rant here, but the point I'm trying to make is we should evaluate both Google and Apple through the same lens that we all give Microsoft shit for.

DeGooglify your brain, and then the rest of the world will begin to follow. Stop changing everything in your fucking services to kubernetes and istio. Don't switch your projects over to Go. Stop letting them run everything.

Like every time Google releases a new piece of technology the entire industry jumps on their tallywhacker. And that just continues to cement their legacy in all of these stacks.

blackcatsec 10/29/2025|
Nah screw it, it's late and I'm unable to sleep and gonna rant a little more.

Microsoft made changes to force consumer users to create Microsoft accounts to login to their PCs and you can go on Youtube and see 500 videos on how to use some bespoke tool to bypass this that has racked up thousands of views because some 'nerd' who literally walks around with a Macbook and an iPhone told them that it's the most evil thing Microsoft could make you do.

Meanwhile, once Google completes this transition on Android, you'll basically be forced to have a Google or Apple account to install any software on your devices, backup and restore the device, etc. And yet folks that dominate these boards are just like "yah that kinda sucks but like, ya know, ya know? ya know!?"

I agree that open software and even open hardware is a good thing. But both Apple and Google have done an incredible amount of damage to the open ecosystem of the web over the last 20 years in so many more ways than Microsoft could have ever dreamed of doing back in the 1990s.

And nerds not only let it happen, but embraced it, camped out in days-long lines wearing diapers to buy the latest shiny overpriced brick they could put in their pocket so they could look cool to all of their friends for a whole 12 months before the next one came out and made them look like a povo. And now walking around with a Macbook at college is like wearing the latest fashion trend because everyone has to show off that they're completely irresponsible with money and spend $2000 for something they could realistically get for under $1000 just so they can show off that they're in the same social class as everyone else.

It's the most infuriating thing to happen to the internet and technology.

Oh, and then to add on, they all get jobs in the tech industry and throw a fucking entitled childish hissy fit when their company hands them a $1000 Windows PC that's got monitoring and security software with no Admin rights on it instead of the $2500 Macbook Pro that they get root access to because mommy and daddy never told them no.

BlackFly 10/29/2025|||
DMA in Europe required Microsoft to enable offline accounts without special tricks. When a government is doing their job properly they patch up holes in the laws that allow behavior that the majority consider to be against the prevailing norms.

You can also uninstall Edge and all the other Microsoft bloatware. Google on Android is actually one of the worse offenders in Europe for not being able to uninstall software as they consider far too many things to be critical to the operating system (for example, search).

blackcatsec 10/29/2025||
Sure, but that isn't the prevailing norm anymore? What hardware doesn't effectively make you sign up for an account? Even Google does this under the hood with devices managed via Android Enterprise. Managed Google Play devices just create a device-specific account under the hood that isn't visible to the user. But it's still there. The requirement for this and the software infrastructure is still there.

Hell, even internet-of-shit devices make you sign up for an account to manage the hardware you buy (Ring, Nest, smart LEDs, etc.)

I'd give that on pure number of raw technical devices deployed to the internet today, some form of account and/or internet connectivity is a requirement moreso than not.

le-mark 10/29/2025|||
Nice rant, I’m here for it. This is what I miss from the early internet, a good old fashioned rant. It may go off the rails from time to time, but consistent in its frustration.

Note some companies give Mac books with admin, smaller companies though. It can be a real shock to go to a large company and get a locked down windows machine. What the boss can now see how much time I really spend working!?!

blackcatsec 10/29/2025||
Thanks! Happy to oblige! lol
ptrl600 10/28/2025||
Will I be allowed to add keys to verify developers over ADB?
erelong 10/29/2025||
There's a lot of things to be said on these topics, it probably is worth trying to keep android "open" here, but there's also a lot of alternative routes to consider and in the long run I think maybe Android is a lost cause (?) to be abandoned

The big alternative is mobile linux or linux mobile, which is akin to desktop linux in the 2000s maybe in lagging behind the competing operating systems. An influx of interest in these operating systems and related hardware might make this discussion more moot (software like: postmarketos, mobian, ubuntu touch, and so on. hardware like: pinephone, raspberry pi used as a phone?, librem phones, and so on.)

Some progress has been made to have android phones run on linux with projects like postmarketos and mobian. Again, more people just focusing on building these projects, especially with the help of LLMs, might make this discussion less necessary.

F-Droid could also pivot a bit to promoting more linux mobile initiatives.

Apple should be called out as much as Google here for already being closed off.

Both platforms (ios and Android) could probably be appealed to through the incentive of "developer openness being good for business" - it probably helps both companies to make more money by making "sideloading" easy. If they both essentially become closed, this opens up a giant incentive for linux mobile to take over. (Maybe that is something we should root for?)

On the hardware side, we need some ios/android alternative phones. I've seen some people post that you can attach cell dongles to raspberry pis and use those as phones (?). Maybe more diy cell phone projects would be nice to see.

I guess the FSF is trying to create a Librephone; initiatives like this are overdue: https://liliputing.com/free-software-foundation-announces-a-...

Not sure what else to add, the writing has been on the wall that Google and Apple are trying to be closed source systems, so generally linux mobile (and/or *BSD mobile, if that's to be a thing in the future) need more attention.

This is probably a good moment to consider the alternatives and the seemingly predictable trajectory of where things are going.

pabs3 10/30/2025|
Librephone is mainly about reverse engineering firmware and other binary blobs, not creating new phones.

https://librephone.fsf.org/FAQ.html

funOtter 10/28/2025||
After Google implements this, will I still be able to "side-load" (install any software) on Android-derivative OSes like GrapheneOS?
kuratkull 10/28/2025||
Currently it seems that Google is pushing for hardware attestation, so you might be able to install Graphene/Lineage if your phone manufacturer allows you to unlock your bootloader, but many Play Store apps won't work as they'll detect your root. It's actually gotten pretty insane how every low-value app considers themselves the centre of the world and unable to run on a rooted device.

Example: the loyalty card app for a local store chain - there's no money in it, I can just get some discounts when I use it. So an attacker would have to steal my phone, somehow unlock it, and then they can use my loyalty card (btw which is free to obtain for anyone and there are no tiers) to get some discounts. And for that, they have implemented a pretty decent root checker which i had to put in some effort to overcome. And there are many more like it.

Andrex 10/28/2025|||
There might be insurance and bank contracts higher up the chain that classify it as a financial dealing and thus require stricter conformance. I'm speculating tbh I have no idea for sure.
AlgebraFox 10/29/2025|||
> as they'll detect your root

A small clarification, neither GrapheneOS or LineageOS runs as root. Rooting is different from "installing an alternate OS".

zb3 10/28/2025||
Yes (but see my comment about the permission system), however, the future of bootloader unlocking and AOSP is uncertain... :(

With one switch, one nasty update (disabling bootloader unlocking on Pixels), Google could kill GrapheneOS..

nhumrich 10/29/2025||
As a power user, and software creator, I absolutely hate this decision. Side loading and power features are a main reason I use android.

That being said, as a grandchild, I also completely understand where google is coming from. A surprisingly high percentage of users do need protecting from themselves. They are so technology illiterate that someone random tells them to install something, "it will say it's not safe, but it's actually okay, just click approve" and they will. This is why HSTS exists, to prevent uneducated users from getting pwned, by preventing them from disabling safeguards.

So, having some system of "no really, I am a power user" makes sense, even if I hate it.

qwertox 10/29/2025||
I have 3 personal apps, which are not published anywhere, which I have installed on all of my own 10 Android devices. They are the reason why I have not switched to an iPhone/iPad and i absolutely rely on those apps.

Why on earth do I need to register with Google to use them?

nashashmi 10/28/2025||
Is this seeking Google’s approval for the app? Or is the condition app be signed by a verified user? The latter means side loading is still viable for apps from known developers. This way anyone who is known who may create malware and will not be free from prosecution
blueg3 10/28/2025||
It is the latter. The app has to be signed, and the signer has to register "real" identity with Google. Approval of the app itself is not a part of the process.

Yes, sideloading will still be viable from known developers.

Probably malware developers will still be free from prosecution -- what moron is going to distribute malware with their own identity attached to it? But it means when the malware gets caught (which it does) you can't just roll a new APK with a different signature. You've burned a developer identity and need a new one. Those are harder to come by, and so it rate-limits malware distribution.

Andrex 10/28/2025||
Fwiw I've been getting random email offers over the years to buy my old dev account for like $100-300. Dev accounts are going to become a prized commodity on the black market with this move.

(I didn't sell my acct, for the record.)

altfredd 10/29/2025|||
Approval is tied to individual apps. From https://developer.android.com/developer-verification:

> You'll need to prove you own your apps by providing your app package name and app signing keys

Needless to say, Google will throw out NewPipe, ad-blockers and anything else that might endanger their profits. For example, Google does not allow F-Droid to be published in Google Play (distributing competing app stores is against their ToS). This policy was in action as long as Google Play/Android Market existed.

sfRattan 10/28/2025||
> The latter means side loading is still viable for apps from known developers. This way anyone who is known who may create malware and will not be free from prosecution

Important corrections:

This way anyone who is known to create malware or any software which interferes with Google's current or potential future revenue, strategic interests, and unpredictable whims will not be free from prosecution in the case of distributing malware, nor from digital exile and unpersoning in the case of causing inconvenience to Google.

hakube 10/29/2025||
It's not "sideloading". It's called installing software on your own device!
zombot 10/30/2025||
This article is written really well and spells it all out. What Google is doing is a travesty and an abomination but the thing about power is, you can do what you want even if everyone hates you for it.
lutusp 10/29/2025|
You're all missing the point! This is not about whether an app can be installed on an Android device, it's about whether the device's owner has any say in the matter. It's about freedom of choice.

Over the decades, from the Apple II to the present, I've owned every imaginable kind of computer. And yes -- I owned all of them -- I had the right to use them as I saw fit. They were extensions of my intellectual creativity. I've written dozens of Android apps, including TankCalc, used in industries across the world to measure and control storage containers. TankCalc is useful, it's free, and it's about to die.

I tried meeting Google's demands, but over the years I realized that wasn't possible, because Google refused to take "yes" for an answer. This is true for all my Android apps -- all would require constant maintenance to meet Google's endless compliance demands.

We're witnessing an extinction of personal expression, of defending the rights of individuals, and the sideloading issue is a symptom of a deadly disease, one that shifts control away from individuals to giant corporations.

Sideloading is just an example. Samsung has updated its already-sold refrigerators to begin showing ads to powerless consumers. Car makers Mercedes-Benz and BMW have starting charging monthly subscription fees for access to features already present in people's cars. Farmers can no longer repair their John Deere tractors.

It's an unprecedented historical shift. Instead of being crushed by an army that invades and takes over, we pay for things that own us, body and soul.

More comments...