Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I suggested this a couple months ago: https://news.ycombinator.com/item?id=45084296
Android may ultimately win the arms race, but if they want to be evil, we should make their task as tedious as possible.
by p1mrx - Google doesn't need to make an argument to ban apps or developers.
- While neat, it glosses over the actual problem, while maybe not even solving it (depending on what you deem the problem to be in the first place). It solved the immediate problem today, but not in a way that's going to remain solved.
I'd imagine Google would plug any major holes in their soon to be closed garden, assuming that is their intention. So this and any other fix to the problem of 'install app through not-Google Play' that goes via technical means that Google can just cover up after a month or two doesn't actually move the needle any meaningful amount.
In the same vein, using adb isn't a real solution to that same problem for most people, since having to use adb is a massive jump in required effort that's going to leave all the normies behind, with only the super-dedicated willing to go through the hassle, and an equivalent amount of developer effort is going to be left behind as well, since their audience just got decimated, and they themselves might not even bother to develop something that even their dad or sister is going to bother/be able to install. Anything that's much more complicated than 'go to website, download thing, run thing, click your way through' doesn't solve for this.
The actual problem is to have Google not be knobheads about it, and the only way that's realistically going to happen is through the law, but that's not looking all that likely in my view.
by Telaneo - This "attack" is not even theoretical. Android apps can just download arbitrary binary code, mprotect(PROT_MAYEXEC) some area in RAM, link the code there, and run it.
Google will simply revoke the keys for the "loader" APK. But that's fine for malware, its authors will just use the next stolen credit card to register a new account.
That's also why this has nothing to do with security.
by cyberax - what does it really have to do with?by clueless
- >Google assures that it would be possible to install applications locally using ADB, but there are no details on this
It's going to be the same as Play Protect using the PackageVerifier API. Even if won't trust that Play Protect will continue to allow adb installs, if you go to the developer options you can disable package verifiers for adb installs.
>the concept
This would not really work considering you can't do a lot of things at runtime. You can't create activities, you can't create services, you can't declare permissions, you can't use permissions, etc. Pretty much everything in your manifest can't be done properly. You can't really do a job faking it. You would have to declare a ton of dummy activities with all different permutations of things like launch mode, document launch mode, intent filters, etc.
What you can do are things like game engines like how the android godot editor works where you aren't loading full android apps, but projects into the editor.
by charcircuit - This will not work because the goal of android developer verification is to prevent running Google-sanctioned code. If you actually tried to publish this, Google will revoke the signature on the loader APK.by antiloper
- Ah yes sanctioned. A word that has two opposite meanings.by NewJazz
- >My vision of the hack is to distribute a verified loader apk, which in turn dynamically loads any apk the user wants. A user obtains the loader apk once and loads apps without installing as much as they want.
Google's not going to let you keep your signing key if you do this with it.
by whatshisface - > My vision of the hack is to distribute a verified loader apk, which in turn dynamically loads any apk the user wants. A user obtains the loader apk once and loads apps without installing as much as they want.
And a day after you release, Google will say "Oh no you don't" and unverify your app, preventing it from being installed or run. Which is you know, kind of the point of this maneuver.
by bitwize - Sounds like the UEFI shim loader that's signed by Microsoft but can load an arbitrary EFI executable (with some signing checks). The difference is that the UEFI shim loader is endorsed/condoned by Microsoft. What about Google? This seems easily patchable, ostensibly for "security purposes" (eg. disabling loading dynamic code).by gruez
- Microsoft also forces manufacturers to provide an option to reset Platform Key aka SecureBoot "root of trust" key - which is supposed to be not possible in spec-compliant UEFI system.
They don't do it out of goodness of their hearts, which is why it's more solid than relying on goodwill - Microsoft simply has an offering that depends on that for certain high profile clients.
by p_l - Well, I'd rather verify myself with the government identity than accept a stock OS that literally woke me up with a fake message promoting Gemini despite me spending almost 2 hours turning every possible privacy-invasive setting off.
To me, the attention to these verification changes seems misplaced. We need to defend the ability to unlock the bootloader, pressure Google to revive AOSP and then encourage people to switch to a more user-friendly OS.
You're already unable to install what you want on a stock OS due to Android permission model treating you as a third-class citizen, after Google and OEMs.
by zb3 - The issue with government IDs is that they are, for all we know, not trustworthy, but everyone treats them like they are. And you know, I am not going to "verify" myself with Google with this kind of toilet paperwork.
If Google decides to pull this off, then I guess reflashing to a custom ROM with this crap patched out will be a very first step I'll be recommending to anyone who cares.
by sleirsgoevy - In my opinion, the only solution while keeping Google and Apple as the developing entities is regulation.
Despite that, there are some things that should not be for profit in my opinion. A good OS platform is one such thing.
by asimops - So like LiveContainer[1] which works around ios's signing requirementsby andrewcchen
- Whoa that is neat! How does that not get shut down by Apple?by IgorPartola
- I think this means we need to rely on web technologies more. PWAs are looking pretty good on mobile devices these days and you can publish any web app you want with no reviewing authority. The web has a bunch of crazy APIs now that let you build crazy things and for everything else you're a hosted server away somewhere that can run more complex jobs.
I believe devices I own should let me do whatever I want with them and I agree that the verification is BS, but I'll work around it in the ways I can which means building more for the web.
If that ever drops the open pretense (since both traffic and trust authority are largely centralized and thus easily controllable) then I'll only write for self hosted linux boxes.
We as individuals can only do so much. We'd need actual organization and some measure of political power to do anything more since normal people do not care about this.
by ianbutler - This is harmful speculation. Many PWA features are broken in small ways which add up. The caniuse database does not test that a PWA feature meets the spec and there is no better database. Nobody can say that PWAs are "looking good" without such testing.by srcreigh
- All the PWAs I've tried never really work properly, they don't integrate well with the OS for sharing and such, and often don't work well offline.by Saris
- PWAs are at the mercy of Gapple have always been handicapped in just the right places to not be viable vs installed apps. Most people don't even know how to install one.by morshu9001
- You need native apps to access specific hardware, and to run some native code. WASM may help but it's limited, too.by nine_k
- I thought Brent Simmons did a great job laying out why PWAs don't work: https://inessential.com/2025/10/04/why-netnewswire-is-not-we...
The tl;dr is that a PWA implies an app which is based in the cloud. So suddenly you need a server, and you need to store user data, which means costs and dealing with privacy and security.
by Wowfunhappy - Bad news for you, Google happens to have a tight grip on the entire web ecosystem -- browser, search, ads etc.by rs186
- While it is technically feasible, it is not a good idea to try and find a technical solution to a people/organisation problem.
Do not accept the premise of assholes.
I hope we can get the EU to fund a truly open Android Fork. Maybe under some organisation similar to NL Labs.
--- edit ---
Furthermore, the need for a trustworthy binary to be auditable to a certain hash or something would make banning this a simple task if Google would want to go that route.
by asimops - > I hope we can get the EU to fund a truly open Android Fork.
How are things in the EU on whether it's legal to buy a SIM card without showing ID?
by thaumasiotes - > hope we can get the EU to fund a truly open Android Fork
The same EU that keeps pushing for breaking encryption and chatcontrol? No thank you
by ekianjo - Technical things can affect people. Adversarial interoperability. They're using a technical thing to cause a social thing anyway, and fighting back with the same tactics is at least not surrendering.by immibis
- What's wrong with lineage?by singpolyma3
- I hope the EU actually enforces the DMA and forces Google and Apple to stop their non sense.