Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.
Every app and every device, worldwide, with no opt-out.
This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.
Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.
Registration requires:
- Paying a fee to Google
- Agreeing to Google's Terms and Conditions
- Surrendering your government-issued identification
- Providing evidence of your private signing key
- Listing all current and all future application identifiers
If a developer does not comply, their apps get silently blocked on every Android device worldwide.
I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.
As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.
IIRC it is a cooldown to prevent less tech-savvy individuals from being tricked into installing malicious apps.
I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
There are plenty of problems with walled gardens, but IMO this isn't one of them.
The stated intention is to discourage scams. Bur this is exactly the same way Xiaomi makes their devices "unlockable" and in reality they just turned off their unlock server years ago and the button doesn't do anything, so you can't unlock.
It's like how saying the best way to avoid STDs is to not have sex, like the best way to avoid ski injuries is to not go skiing. Even though they're not remotely comparable (sex and skiing), the comparison holds in that neither offers practical advice to avoid the injury.
> Calling that an opt-out is so rich, like calling suicide an opt-out method. 24 hour waiting period to do something on a device I own.
What?
You only have to change that setting once, and you can do it in advance (before the restriction takes effect). So you don't even have to wait 24 hours at all.
I can see this change having negative effects on the android ecosystem, but the direct impact on your freedom to install apps on your device is basically zero. If that's not the case, please tell me what I've missed.
you don't think they're going to yank that option away in, say, a year? or make it even more onerous, like "you have to send us a letter saying you want to develop apps"
Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.
We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.
We don't need big tech anymore. We just need to be able to run our models.
I want to see every *aaS’s functionality required to be offered -on reasonable and non-discriminatory terms- as an API
Who is Ford to tell me I can’t have a widget for each of my ford EVs visible at the same time? Or even that the single-car widget thry do allow has has to be four times bigger than I want it to be, and waste screen real estate on dead space and things that I don’t want?
Not at all. The app that is enforcing the change is a privileged Google app. Even if someone tried installing it on GrapheneOS, it wouldn't be able to do anything like remove apps, block installation, or disable apps.
And my experience has been that it's frequently harder to sidestep Google's bullshit on GrapheneOS because you don't have as much control of your phone, in the interest of security.
Honestly at this point, I'm just gonna start transitioning to Ubuntu Touch. The Android experiment has run its course.
Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.
At best it gets rid of some scams, certainly not most of them or poorly written apps, which continue to flood the Google PlayStore.
Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.
Removing freedom, and control will never get rid of scammers. Nor will it get rid of the plethora of poorly written corporate owned apps that will still be allowed to fester. It won't even get rid of the apps that scammers use to scam.
This sort of breathless outrage rhetoric would be a lot easier to take seriously if it spent even a minute acknowledging the very real risk to users that this is meant to mitigate: tech support scams where people are walked through installing an app that takes over their phone and steals their money, private data, and identity.
You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
Tech is cool, but it's not an end in itself. Serving people should be. And if people are getting hurt, it's not working well, even if those people are not the ones that read Hacker News.
I don't think you can just do anything you want in the name of security and protecting users. This will make installing apps needlesly difficult. There is already a warning when enabling installation of apps from unknown sources. That should be enough. If users don't read that's on them.
The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.
Nobody reads warnings or errors. StackOverflow is full of questions where someone pastes a clear error message and asks what they have to do when the very error message tells them the solution.
Also, scammers just tell people to ignore warnings and they do it. If someone is able to convince you that your child is in danger and that you have to bypass all warnings to help them, you _will_ do it.
Users don’t read warnings. Most scams capitalise on urgency. When given more time to stop and think something through, it often becomes obvious what’s happening.
> That should be enough. If users don't read that's on them.
The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.
Should Google be less than an asshole in all things? Yes.
I think there’s this like “something must be done now!” attitude of self-important, busybodies I can’t get behind… even if they’re right.
Why have people convinced themselves into thinking now is the most important thing in the world? That if it doesn’t happen now so that it makes me happy instantly it isn’t an option?
Evolution; social, tech, biological, legal, just fucking takes time, and that’s a feature.
There will be a period in which there’s a ton of food over there but your little fishy fins can’t get to it, and that sucks, but deal with it yourself, or just chill and let things happen. I promise if it’s important someone will solve it eventually and the scales do not need to be tipped for every little thing like phone app permissiveness.
In the meantime, you are free to not buy an android phone if you don’t like the system that Google has produced. You seem to think that because you can see its insides that it is collectively owned. It isn’t. Google owns it. Talk of talking it from its owners, is theft. In this case, justified entirely because you don’t like a process they decided on.
Don’t make me defend Google, I fucking hate Google.
I’m all for trying to stop those who are getting harmed from being harmed, but at what point do we acknowledge the ignorance of those people? Installing random apps, provenance truly unknown, to your phone is a bad idea because of the security risk in doing so. I’d have the same advice for someone operating a windows PC. Don’t be downloading and installing random .exe to your environment, you’re gonna have a bad time. The former seems to be this mysterious new idea, unable to comprehend. Most people seem to know the latter and you get flamed for admitting “I installed this random .exe recommended to me by this dude on the phone who said he’s helping me.”
People gotta learn. Sometimes the best teacher is pain and suffering. I wish that weren’t true, but in my time on this planet, there has never been more truth to “you can lead a horse to water, but you certainly can’t make it drink it.”
Trying to save people against their will just doesn’t seem the best path. I’d rather more effort be put into education on best practices, or investment in an app sniffer that can try and identify common attack vectors. Idk, anything other than “some people are too stupid for their own good, so now we all have less freedom.” I mean truly, if you’re worried about grandma’s phone safety, only let her buy an iPhone. No android for mi-ma.
All I see here is Google snatching at the opportunity to get some of that scrumptious walled garden money.
> the very real risk to users that this is meant to mitigate:
The risk of people cutting themselves is not a responsibility nor a concern for the knife manufacturers. I would be very upset if one day all kitchen knives would be sold blunt just to mitigate some clueless people from cutting their fingers off.
Similarly, I seriously and absolutely don't get it why people falling for scams should be a reason to require KYC to distribute apps.
Especially given that KYC-passed accounts are easily obtainable online for pennies.
Phone carriers can't be bothered to police their networks to mitigate flagrant bad actors, who can't be shut down by state law enforcement, so your software company needs to take control of your device away from you. "For your own safety."
It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.
Huh? You’re arguing for carriers to inspect all traffic to block scammers? That’s way more intrusive than google blocking sideloading. The outrage on places like HN would be deafening.
Many scams are committed thru apps like AnyDesk, TeamViewer, RustDesk...
That are apps already in the store. That is a very cheap, easy, proven way of doing it.
Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.
People are getting hurt. Mass spying should stop now.
Or even Whatsapp, which people already have installed on their phone. No need to go to the store to install anything.
A scammer managed to convince a relative to share their screen during a Whatsapp video call. Luckly, said relative didn't use banking apps on the phone, the bank rejected as suspicious the transaction on the computer which would have sent money to the scammer, and the relative asked me for help before going to the ATM to unblock the account (I then contacted the bank and had them fully block the account as a precaution, and told my relative to go to the bank branch the next day to change the passwords and unblock the account).
After researching this for some time, the majority of scams are perpetrated with apps that are already in the Play Store and are remote access apps. The entire premise that the Play Store is safe and everything else is dangerous is not borne out by the empirical evidence.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.
The topic has been discussed multiple times, and propaganda really feels like not acknowledging past discussions. You might not have seen past discussions so I'll give you a pass and restate my argument.
One important way that scams reach end users are through the willing participation of ad platforms, and even before DSA (not that much has changed) people (myself included) have done countless reports of straight up scam ads with no recourse and a templated "we have found nothing wrong with the ad".
As a data point, have you not seen the Tai Chi AI ads on YouTube that will "make you a different person by the end of the week" which where run by a company that sold you a subscription via dark patterns with all the surprises that brings (like a big headache of an unsubscribe process).
Or the fact that Meta knows that X% of it's ads are scam/phising and do nothing about it because it hurts the bottomline (an AI chat will help you with references).
The hypocrisy is too much coming from Google since they are owners of the machine that feed scams right to your doorstep.
And let's not ignore all the other fronts they are fighting on to further lock down the Android platform (such as not making source available immediately and moving more of the runtime in their play services and platform integrity nonsense).
I'm somebody who likes lifting weights. I often lift weights heavy enough that, if done improperly, could harm me greatly and grossly.
There are people at my gym who often have very bad form who I worry about. I will occasionally chat them up so they're not, for example, shoulder pressing with their arms outside of the scapular plane [0] or benching without any arch in their back [1]. Sometimes they appreciate it and ask me more questions. Sometimes they give me a terse 'thanks' and go back to doing it the way they want to do it.
If somehow every gym started forbidding people from using any equipment with which they could harm themselves unless they could prove, with a 24h cooling off period, that they knew the form and dangers in detail, I'm sure it would probably save a few people from suffering temporary injuries. I think it would also drive a lot of people away from any kind of sustained resistance training and be an overall net negative for public health.
Personally, I don't think such a nanny-state implementation is necessary? That you should be able to easily toggle off such a feature if you like and what happens to you happens. Perhaps there should be a 'tech-illiterate' mode toggled on by default but easily toggled off if you know how to access Developer Options with a little more forewarning about common scams. Perhaps gyms (or Google) could pay people to proactively assist and help people they see as the most vulnerable to certain kinds of exploits. Perhaps instead of spending time training Gemini to be a general-assist LLM they could train a very small local model to hyperspecifically guard against known intrusions.
There are so many more pro-social, less-draconian ways of tackling safety issues, from socialization to ongoing support to education efforts. A lockdown that just happens to also help ensure that they can extract their pound of flesh inside the abattoir that is Google Play seems at best overly protective and at worst just more corporate extraction of surplus value from individuals.
So Google is going to tackle scams on youtube too right? Because they care so much about the poor scam victims, and this has nothing to do with establishing overarching control.
I'm fine with this as long as F-Droid and other stores are treated equally.
If I have to wait 24h to install an app from another store, I demand the same to apply to AppStore. I see app stores just like browsers: users must have the ability to choose which browser they want when installing an operating system, and for Android, users must be able to select which app store they want and they should work the same way.
> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.
Oh, ok, thanks for the information. But if it is a one-time, device-level wait, not per source and not per app, then I'm unsure how this should prevent scammers in the long term?
I'm pretty convinced it is just Google testing boiling the water steady and slowly :)
Scammers often create a sense of urgency/emergency, especially over the phone, and putting a 24hr limit on it gives the person more time to possibly realize they're getting scammed.
It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.
If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.
-
Edit: Google explains this more:
In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.
According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.
> I think the 24h cooldown is an excellent compromise
I don't. An hour would make the same point and provide the same level of protection. So would clicking through a few screens with very simple and easy to understand warning messages about the risk of scams. Sure, it's a compromise, but it's pretty much the opposite of excellent.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I strongly agree with this statement.
If a piece of public communication is intended to sway the reader's opinion without informing them (or while selectively informing them, which is close to the same thing), it is propaganda.
That is a real concern, but I don’t for a minute believe that it’s Google’s only motivation. This is also securing a revenue stream and making it harder for others to compete.
Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering and dying on Android, too.
When I was still on android, I installed F-Droid to avoid the google app store entirely, since the google app store's vetting is -uh- not very good.
The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)
Unfortunately, that's exactly the move that now gets sabotaged by this google change.
So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.
Google, who gladly take the money from criminals in exchange for funneling victims to their scam websites have the moral high ground and are unfortunately forced to take away the user's freedoms?
If that's really what it is, Google should put their money where their mouth is. I'd be ok with this change if you had to go through all the same hoops to install apps through the Play store.
There is already many warnings and if the can get you to do that they can get you to other types of scams rather don't require installing an app like sharing data, putting info on websites.
This sounds like know-it-all propaganda as well. Why not make it opt-in? Google (and other Big Tech companies) seem to think they know better than everyone else, even though they are also completely untransparent about what they do.
I am certain that its not about harm but rather US supremacy doctrine. They are tightening their noose. You have to be approved to live in their digital world and pay rent.
Sorry, I get where your emotions are coming from with this, but it is just technically wrong on every level.
The vast majority of tech support scams come through apps on the Play Store. Not only that, but malicious apps get approved on the Play Store constantly.
There is no reason to take any claim that this change is meant to mitigate scams seriously, because there's no evidence to support that it makes a noticeable dent in such activity.
What this change does noticeably and impactfully do, is prevent, via chilling effects, users from being able to use their phones in ways that could lose Google and its partner vendors post-sales revenue.
As you said, serving people should be the end in itself, and this change doesn't do that - it hurts people.
It's like locking people out of their own home, and then when people express outrage the concern troll steps in from out of frame to point out that they're not acknowledging the very real risk that if they could access their own house gasp they might accidentally let the wrong person in, or break something, or whatever.
This is nothing but a business decision to extort money from developers and you know it. It's anti-competitive at its core, locking out other, more reliable app stores and taking control of an open source operating system. It's just one more measure in a long trend of fulfilling the wet dreams of large tech, namely killing personal computing and controlling everything people can do with devices they've bought.
It's exactly the same as the people crying conspiracy about parts-locking for repairability, not acknowledging the real effects it had on phone thefts and the pressure at the national and governmental level to help solve the epidemic.
2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.
There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.
I guess the an alternative open unix based operating system that can upload existing apps from both android as well as apple is needed or the greed will not ever end. This is about corporations that constantly need growth using new ways to collect rent from the rest of the world. They are chocking the world to collect new monies.
They are recommending installing F-droid.. and not accepting android's demands. Its time to have open source smart phone operating system that can not be taken hostage.
The problem is that these OSes have achieved regulatory lock-in. Your bank app won't work on an alternative OS because it's not trusted. In some countries that means you can't access online government services through the standard path either.
I moved to Android in 2022 from the iPhone ecosystem. I've been thru one phone replacement cycle and it was glorious. I got by without ever using Google Play and never had to tie my phone to any "ecosystem".
I had "sideloaded" all the APKs for the software I used on the old phone and saved the APKs. Moving to a new phone was just a matter of loading all the software and copying my rsync'd backups onto the new phone. It was wonderful. Just like moving to a new PC.
I guess I'm happy I got to have this experience for a little while.
The thing that this enables are governments locking down apps used for protesting, e.g. Indian government petitioned to take down the „BitChat“ app by Jack Dorsey, as it was (successfully) used to circumvent the mobile carrier shutdown: https://en.wikipedia.org/wiki/BitChat#Usage
App takedown requests from India were ignored but similar cases from China were not. Coming soon to a country near you.
To echo other comments, it would be really good if posts on this subject were more complete about the details of what's happening if for no other reason then it's difficult to understand the situation without those details. I'm pretty anti-corporate but it's hard to be anti-corporate without a level, complete picture.
Concretely in my case, I read all the fdroid materials that were linked to from the fdroid pop-ups and they just left me hanging, trying to understand what was actually happening, and when? I finally looked it up. It was like what are these people even talking about? Obviously Google's motives are quite clear, but I had to work pretty hard to figure out what was going on and it doesn't make sense that they communicate like this.
"Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID."
Will not apply if updates are blocked
Good to have old phones, i.e., not primary phone, where user can block updates
Some users may want a portable, pocket-sized computer that the user can reasonably control (old phone) in addition to one controlled by Google (primary phone)
For some users, the "threat model" may be Google and the long list of governments, corporations, etc. who partner with Google
Maybe some users just want relief from data collection, surveillance and ads
Not every user is the same
Some (not all) users may be willing to sacrifice some alleged "security" provided by an ad services company (wtf) in exchange for more _user control_
This is not the problem it is presented to be, and I see more benefits to this than prejudice.
There is a very concerning amount of illegal apps/scams distributed through ads that I've casual users install somewhat banally with the aid of short walkthroughs.
Any sufficiently advanced user is barely affected by this, as the procedure is just complex enough to block average people from getting scammed/using illegal services unknowingly, but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.
"This is barely an inconvenience, it's just a 9-step, 24h-long step through a proprietary service, and mandatory sign-up with governmental ID for the developers, everyone technical enough can easily bypass it"
I believe this is usually referred to as "boiling the frog".
it's not hard to imagine Google stating "we're removing this opt-out path because next to no-one uses it, and it will help streamline Android, which will protect the children!"
I've already said this, but here is roughly how this progression is going to go:
1. You own your device and can install anything you want on it (what we have today)
2. Google gently yanks you away from the simple workflows, leaving you with ADB or their 24 hour hoop to jump through. If you opt for the second, you get a choice between allowing 'unverified' installs for 7 days or indefinitely. Huh, that's weird, who would ever pick the 7 day option, right?
3. The dust settles and some time passes. Google decides that the indefinite option is just way too dangerous, the users are not safe if they are allowed to use this freedom. They'll just claim there's countless clueless grandmas getting entangled in multi-day-long scams that hinge on the sideloading feature, and they simply can't let them suffer so much. They will generously disable the 'indefinite' option.
4. 7 days may still be too much, maybe the sensible decision is to move to a 24 hour countdown per app. I mean, if you want it so badly, you have to work for it - that means you'll have more time to mull over the security of every single app you put on your phone.
5. Huh, for some reason it looks like almost no users are installing apps from outside Google Play anymore. We'll keep the feature on life support for a while, and then retire the legacy unverified installation workflow, to be replaced by a temporary limited permission for verified developers to briefly install their own in-development apps on their device. That ought to be enough.
This pathway for extinguishing features that are inconvenient for massive corporations isn't new. I really do not understand how everyone supporting Google's side here doesn't see this, and why they're so willing to wholeheartedly and without reservation believe them on matters of security where pushing one opinion also happens to conveniently align with their profit motive.
The phone was never yours. You have a nice, granular set of permissions which (attempt to) control what apps can do ... but you don't really have any permissions that prevent you from _Google_ spying on you and selling your data or giving it up to law enforcement. It's like the propaganda radio you can turn down, but never off. You're given just enough control to feel like you have a choice.
I thought Google was adding more hoops to jump through for F-Droid, Termux and the like. Did that change? Obviously the more hoops the less happy we will be, but it'd be nice to know.
I'd just turn off my phone before midnight, boot it into fastboot and reflash lineage 2 days later, missing the window for them to push anything. No gapps btw.
Or the adb escape hatch. IIRC, their adb equivalent is limited to having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.
Even with Android becoming much more closed, it's still more open than Apple.
Free install by ADB, and Developer-moding once per device, not once per app / install? Yeah, OK. I don't quite get the outrage, then.
Before you @ me, HN, I run GrapheneOS. I fully understand and practice "own your own hardware". Most people probably shouldn't, though, because they lack the technical ability / interest to do so safely, and throwing them to the wolves strikes me as ideology pushed to the point of foolishness.
We don't know that it's once per device. It's been said by Google that it'll be once per device, but we haven't seen the code and we don't know the method of tracking that. What if I wipe my OS? What if I wipe data in play services? Will a future silent play services update conveniently break my p2p messaging app during a protest?
The 24 hour waiting period is absolutely ridiculous. The article says to download alternative stores but I thought they too are impacted as it is the installation mechanic.
The waiting period is the best way to combat coercion. If I’m setting up a new phone, the setup already takes multiple hours that adding 24 hours doesn’t really mean much. It does a wonderful job of making sure you actually really want this app.
Google play store was ruled a monopoly and the Apple App store was not. Google allows alternatives on their platform and Apple strictly forbids it.
If the legal system dictates that open = monopoly and closed = fair game, then you get dumb shit like this.
Probably one of the dumbest rulings in tech ever, but few people know about it. Basically set precedent to never share your platform if you don't want legal scrutiny.
Regulation by 3rd parties. People use phones for payments and accessing sensitive services. But these apps work only on Android / iOS. There those who don't seek this use case, but there are rather small and increasingly shrinking minority. This is compounded by the knowhow needed to install non-stock OS on phone in the first place.
This is increasingly becoming the case. There have been a few posts on Reddit of people successfully porting Arch and other distros to phone hardware (typically seems to be OnePlus?). My handheld game console, a Snapdragon 8 Gen2-based Android device by Retroid, just got official first-party support for running Linux on it.
But I mean what are you saying really? An iPhone absolutely doesn't allow you to just randomly install stuff from the web unless there's been some update that I don't know about.
> The EFF calls app gatekeeping "an ever-expanding pathway to internet censorship."
I think what's interesting, and what our grandchildren will look back on, was how naive the early internet was. There was almost this sense of "the government is powerless" whether it be piracy or jailbreaking or casual death threats [8647 style] or who knows what else. Combined with also a sense that devices will always be exploitable, there's always a way around, resistance from government and corporations will always be futile.
Your app ecosystem might decrease as developers who don't want to register lose interest and the number of users supporting open source projects decreases.
Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID.
Every app and every device, worldwide, with no opt-out.
This includes apps shared between friends, distributed through F-Droid, built by hobbyists for personal use.
Independent developers, church and community groups, and hobbyists alike will all be frozen out of being able to develop and distribute their software.
Registration requires:
- Paying a fee to Google - Agreeing to Google's Terms and Conditions - Surrendering your government-issued identification - Providing evidence of your private signing key - Listing all current and all future application identifiers
If a developer does not comply, their apps get silently blocked on every Android device worldwide.
I understand why you didn't mention it, but there is an opt-out: you enable developer mode and wait 24 hours.
As it runs through Google Play Services, it's pretty likely they'll boil the frog and make it even harder in the future. Moving to an open platform is a good idea.
A wait of 24hrs is not an opt out, it is a demonstration of absolute control.
IIRC it is a cooldown to prevent less tech-savvy individuals from being tricked into installing malicious apps.
I don't think Google is doing this out of some egotistical obsession over "control," it's more that developers and FOSS enthusiasts are a vanishingly small fraction of their customer base.
There are plenty of problems with walled gardens, but IMO this isn't one of them.
Or might it be when a cron job runs?
The stated intention is to discourage scams. Bur this is exactly the same way Xiaomi makes their devices "unlockable" and in reality they just turned off their unlock server years ago and the button doesn't do anything, so you can't unlock.
Thanks for the comment Mr AI outrage farming bot!
[flagged]
Yes but it's not correct to say the apps are being blocked either. There is still a way to install them. You can also use adb directly.
Those things are not remotely comparable
It's like how saying the best way to avoid STDs is to not have sex, like the best way to avoid ski injuries is to not go skiing. Even though they're not remotely comparable (sex and skiing), the comparison holds in that neither offers practical advice to avoid the injury.
it's maybe histronic, but definitely drives home their point
> Calling that an opt-out is so rich, like calling suicide an opt-out method. 24 hour waiting period to do something on a device I own.
What?
You only have to change that setting once, and you can do it in advance (before the restriction takes effect). So you don't even have to wait 24 hours at all.
I can see this change having negative effects on the android ecosystem, but the direct impact on your freedom to install apps on your device is basically zero. If that's not the case, please tell me what I've missed.
you don't think they're going to yank that option away in, say, a year? or make it even more onerous, like "you have to send us a letter saying you want to develop apps"
Is it safe to assume that GrapheneOS will not be affected by this?
GrapheneOS or other similar OS won’t be the issue.
The issue will be your bank, your gov, your uni, and school not releasing a compatible app for you.
And nowadays a device that cannot communicate or be trusted by other actors of the network (internet) is pretty much useless.
I hope those entities will wake up and start serving equivalents functionalities via the open web.
That is why we have the good old WWW for.
I already have to tell everyone I don't have a smartphone because stuff doesn't work so we'll on graphene and I don't want to explain.
> That is why we have the good old WWW for.
We can use AI to take back the entire tech stack.
Every moat, every walled garden, every infrastructure piece can be rebuilt with AI.
We're seeing it with desktop apps, with games. It will happen to infrastructure and platforms. I'm itching at the opportunity to build open cloud primitives and P2P social protocols.
We don't need big tech anymore. We just need to be able to run our models.
I want to see every *aaS’s functionality required to be offered -on reasonable and non-discriminatory terms- as an API
Who is Ford to tell me I can’t have a widget for each of my ford EVs visible at the same time? Or even that the single-car widget thry do allow has has to be four times bigger than I want it to be, and waste screen real estate on dead space and things that I don’t want?
Not at all. The app that is enforcing the change is a privileged Google app. Even if someone tried installing it on GrapheneOS, it wouldn't be able to do anything like remove apps, block installation, or disable apps.
And my experience has been that it's frequently harder to sidestep Google's bullshit on GrapheneOS because you don't have as much control of your phone, in the interest of security.
Honestly at this point, I'm just gonna start transitioning to Ubuntu Touch. The Android experiment has run its course.
Yes, because GrapheneOS completely controls app installation and google play services is just an optional module.
I can’t stand this sort of hyperbole.
Obviously this does not affect “every device worldwide”. I don’t have a single Android phone, and the devices I own that do run Android are not affected.
Clearly from context they meant every android device not every device.
Good, this will get rid of scammers, poorly written apps, and ten a penny vibe coded apps. They should have done it a while ago.
At best it gets rid of some scams, certainly not most of them or poorly written apps, which continue to flood the Google PlayStore.
Despite Google's best efforts to automatically ban malicious developers, catching many legitimate developers in the crossfire, their store isn't exactly a bastion of quality or scam-free.
Removing freedom, and control will never get rid of scammers. Nor will it get rid of the plethora of poorly written corporate owned apps that will still be allowed to fester. It won't even get rid of the apps that scammers use to scam.
Because the Play Store has none of those?
This sort of breathless outrage rhetoric would be a lot easier to take seriously if it spent even a minute acknowledging the very real risk to users that this is meant to mitigate: tech support scams where people are walked through installing an app that takes over their phone and steals their money, private data, and identity.
You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
Tech is cool, but it's not an end in itself. Serving people should be. And if people are getting hurt, it's not working well, even if those people are not the ones that read Hacker News.
I don't think you can just do anything you want in the name of security and protecting users. This will make installing apps needlesly difficult. There is already a warning when enabling installation of apps from unknown sources. That should be enough. If users don't read that's on them.
The real problem here is not that Google is doing this bad thing. The real problem is that they can do this bad thing. They shouldn't have this power. Something needs to be done to rain in Google and take back Android as an open platform.
> If users don't read that's on them.
Nobody reads warnings or errors. StackOverflow is full of questions where someone pastes a clear error message and asks what they have to do when the very error message tells them the solution.
Also, scammers just tell people to ignore warnings and they do it. If someone is able to convince you that your child is in danger and that you have to bypass all warnings to help them, you _will_ do it.
Users don’t read warnings. Most scams capitalise on urgency. When given more time to stop and think something through, it often becomes obvious what’s happening.
> Users don’t read warnings
Why should that be a concern to a phone OS provider? A concern so important that they are willing to cripple couple billions of devices.
> That should be enough. If users don't read that's on them.
The phone scammers who are saying the FBI/NSA/IRS will arrest you unless you install sketchy remote access software or other malware are rather convincing to a certain demographic of people and no amount of text on the screen will stop that. It all comes down to whether or not you view the tradeoff being that vulnerable people are worth protecting with this measure worldwide or not.
>Something needs to be done to [reign] in
Should Google be less than an asshole in all things? Yes.
I think there’s this like “something must be done now!” attitude of self-important, busybodies I can’t get behind… even if they’re right.
Why have people convinced themselves into thinking now is the most important thing in the world? That if it doesn’t happen now so that it makes me happy instantly it isn’t an option?
Evolution; social, tech, biological, legal, just fucking takes time, and that’s a feature.
There will be a period in which there’s a ton of food over there but your little fishy fins can’t get to it, and that sucks, but deal with it yourself, or just chill and let things happen. I promise if it’s important someone will solve it eventually and the scales do not need to be tipped for every little thing like phone app permissiveness.
In the meantime, you are free to not buy an android phone if you don’t like the system that Google has produced. You seem to think that because you can see its insides that it is collectively owned. It isn’t. Google owns it. Talk of talking it from its owners, is theft. In this case, justified entirely because you don’t like a process they decided on.
Don’t make me defend Google, I fucking hate Google.
I’m all for trying to stop those who are getting harmed from being harmed, but at what point do we acknowledge the ignorance of those people? Installing random apps, provenance truly unknown, to your phone is a bad idea because of the security risk in doing so. I’d have the same advice for someone operating a windows PC. Don’t be downloading and installing random .exe to your environment, you’re gonna have a bad time. The former seems to be this mysterious new idea, unable to comprehend. Most people seem to know the latter and you get flamed for admitting “I installed this random .exe recommended to me by this dude on the phone who said he’s helping me.”
People gotta learn. Sometimes the best teacher is pain and suffering. I wish that weren’t true, but in my time on this planet, there has never been more truth to “you can lead a horse to water, but you certainly can’t make it drink it.”
Trying to save people against their will just doesn’t seem the best path. I’d rather more effort be put into education on best practices, or investment in an app sniffer that can try and identify common attack vectors. Idk, anything other than “some people are too stupid for their own good, so now we all have less freedom.” I mean truly, if you’re worried about grandma’s phone safety, only let her buy an iPhone. No android for mi-ma.
All I see here is Google snatching at the opportunity to get some of that scrumptious walled garden money.
> the very real risk to users that this is meant to mitigate:
The risk of people cutting themselves is not a responsibility nor a concern for the knife manufacturers. I would be very upset if one day all kitchen knives would be sold blunt just to mitigate some clueless people from cutting their fingers off.
Similarly, I seriously and absolutely don't get it why people falling for scams should be a reason to require KYC to distribute apps.
Especially given that KYC-passed accounts are easily obtainable online for pennies.
Phone carriers can't be bothered to police their networks to mitigate flagrant bad actors, who can't be shut down by state law enforcement, so your software company needs to take control of your device away from you. "For your own safety."
It's just a public confession that none of these organizations - not the carriers, not the government, and not Evil Google, are fit for the responsibilities they've claimed.
Huh? You’re arguing for carriers to inspect all traffic to block scammers? That’s way more intrusive than google blocking sideloading. The outrage on places like HN would be deafening.
Are you kidding?
Small businesses getting blocked by Gmail, Twilio, etc. for legitimate activities is constant.
Many scams are committed thru apps like AnyDesk, TeamViewer, RustDesk... That are apps already in the store. That is a very cheap, easy, proven way of doing it.
Fear, uncertainty, and doubt is a propaganda technique that tech companies have used for long against open source and competitors. The propaganda is to pretend that a 24 hour cooldown and making it difficult to install externals apps is for the good of the user meanwhile stealing their data and giving it to anybody that pays for it.
People are getting hurt. Mass spying should stop now.
Or even Whatsapp, which people already have installed on their phone. No need to go to the store to install anything.
A scammer managed to convince a relative to share their screen during a Whatsapp video call. Luckly, said relative didn't use banking apps on the phone, the bank rejected as suspicious the transaction on the computer which would have sent money to the scammer, and the relative asked me for help before going to the ATM to unblock the account (I then contacted the bank and had them fully block the account as a precaution, and told my relative to go to the bank branch the next day to change the passwords and unblock the account).
After researching this for some time, the majority of scams are perpetrated with apps that are already in the Play Store and are remote access apps. The entire premise that the Play Store is safe and everything else is dangerous is not borne out by the empirical evidence.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I would turn this right around and say that until the proponents of this measure acknowledge that the Play Store is not safe and is in fact a primary vector for scams, you're just doing propaganda.
The topic has been discussed multiple times, and propaganda really feels like not acknowledging past discussions. You might not have seen past discussions so I'll give you a pass and restate my argument.
One important way that scams reach end users are through the willing participation of ad platforms, and even before DSA (not that much has changed) people (myself included) have done countless reports of straight up scam ads with no recourse and a templated "we have found nothing wrong with the ad".
As a data point, have you not seen the Tai Chi AI ads on YouTube that will "make you a different person by the end of the week" which where run by a company that sold you a subscription via dark patterns with all the surprises that brings (like a big headache of an unsubscribe process).
Or the fact that Meta knows that X% of it's ads are scam/phising and do nothing about it because it hurts the bottomline (an AI chat will help you with references).
The hypocrisy is too much coming from Google since they are owners of the machine that feed scams right to your doorstep.
And let's not ignore all the other fronts they are fighting on to further lock down the Android platform (such as not making source available immediately and moving more of the runtime in their play services and platform integrity nonsense).
I'm somebody who likes lifting weights. I often lift weights heavy enough that, if done improperly, could harm me greatly and grossly.
There are people at my gym who often have very bad form who I worry about. I will occasionally chat them up so they're not, for example, shoulder pressing with their arms outside of the scapular plane [0] or benching without any arch in their back [1]. Sometimes they appreciate it and ask me more questions. Sometimes they give me a terse 'thanks' and go back to doing it the way they want to do it.
If somehow every gym started forbidding people from using any equipment with which they could harm themselves unless they could prove, with a 24h cooling off period, that they knew the form and dangers in detail, I'm sure it would probably save a few people from suffering temporary injuries. I think it would also drive a lot of people away from any kind of sustained resistance training and be an overall net negative for public health.
Personally, I don't think such a nanny-state implementation is necessary? That you should be able to easily toggle off such a feature if you like and what happens to you happens. Perhaps there should be a 'tech-illiterate' mode toggled on by default but easily toggled off if you know how to access Developer Options with a little more forewarning about common scams. Perhaps gyms (or Google) could pay people to proactively assist and help people they see as the most vulnerable to certain kinds of exploits. Perhaps instead of spending time training Gemini to be a general-assist LLM they could train a very small local model to hyperspecifically guard against known intrusions.
There are so many more pro-social, less-draconian ways of tackling safety issues, from socialization to ongoing support to education efforts. A lockdown that just happens to also help ensure that they can extract their pound of flesh inside the abattoir that is Google Play seems at best overly protective and at worst just more corporate extraction of surplus value from individuals.
[0] https://brookbushinstitute.com/glossary/scapular-plane
[1] https://www.strongerbyscience.com/how-to-bench/#:~:text=it%2...
So Google is going to tackle scams on youtube too right? Because they care so much about the poor scam victims, and this has nothing to do with establishing overarching control.
I'm fine with this as long as F-Droid and other stores are treated equally.
If I have to wait 24h to install an app from another store, I demand the same to apply to AppStore. I see app stores just like browsers: users must have the ability to choose which browser they want when installing an operating system, and for Android, users must be able to select which app store they want and they should work the same way.
> Personally, I think the 24h cooldown is an excellent compromise to allow user freedom while slowing down attackers sufficiently to mitigate the harm.
The best solution would have been to be able to mark ANY alternative app store like fdroid as trusted and no such cooldown period would hit every time people install an app from there. This avoids that people can immediately use installed apps downloaded from an arbitrary URL but at the same time keeps the alternative app stores as a good alternative. Google decided to play unfair again.
The 24 hour wait happens once, not on every app install.
Oh, ok, thanks for the information. But if it is a one-time, device-level wait, not per source and not per app, then I'm unsure how this should prevent scammers in the long term?
I'm pretty convinced it is just Google testing boiling the water steady and slowly :)
Scammers often create a sense of urgency/emergency, especially over the phone, and putting a 24hr limit on it gives the person more time to possibly realize they're getting scammed.
It's not 100% perfect, but it helps reduce scams. And with AI, scams are probably going to get more frequent and harder to realize it's a scam.
If you know you want your phone unlocked, just start the process as soon as you get your phone, and then it's yours. It's like an extra day of shipping.
-
Edit: Google explains this more:
In these scenarios, scammers exploit fear – using threats of financial ruin, legal trouble, or harm to a loved one – to create a sense of extreme urgency. They stay on the phone with victims, coaching them to bypass security warnings and disable security settings before the victim has a chance to think or seek help.
According to a 2025 report from the Global Anti-Scam Alliance (GASA), 57% of surveyed adults experienced a scam in the past year, resulting in a global consumer loss of $442 billion.
https://android-developers.googleblog.com/2026/03/android-de...
Thanks for taking the time to explain this. This sounds reasonable to me too. However, it might be just the start :)
> I think the 24h cooldown is an excellent compromise
I don't. An hour would make the same point and provide the same level of protection. So would clicking through a few screens with very simple and easy to understand warning messages about the risk of scams. Sure, it's a compromise, but it's pretty much the opposite of excellent.
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
I strongly agree with this statement.
If a piece of public communication is intended to sway the reader's opinion without informing them (or while selectively informing them, which is close to the same thing), it is propaganda.
That is a real concern, but I don’t for a minute believe that it’s Google’s only motivation. This is also securing a revenue stream and making it harder for others to compete.
Full disclosure, I am an iPhone user in part because I personally like living in the walled garden. But I also acknowledge that it has its downsides. I have a separate Android device just for language learning because the open source language learning app ecosystem is basically nonexistent on Apple’s locked-down platform. I’m not thrilled about the possibility of that ecosystem withering and dying on Android, too.
When I was still on android, I installed F-Droid to avoid the google app store entirely, since the google app store's vetting is -uh- not very good.
The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)
Unfortunately, that's exactly the move that now gets sabotaged by this google change.
So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.
Google, who gladly take the money from criminals in exchange for funneling victims to their scam websites have the moral high ground and are unfortunately forced to take away the user's freedoms?
Google has an entire org dedicated to detecting and preventing bad ads.
I have many coworkers who work very hard on this problem.
The claim that Google does not care about ads integrity runs counter to my experience.
There have been a ton of scams my Customers have reported over the years that I've traced back to users clicking bad ads.
Google may care a lot, but if my experience is any indicator they don't care enough.
Work smarter, not harder.
If that's really what it is, Google should put their money where their mouth is. I'd be ok with this change if you had to go through all the same hoops to install apps through the Play store.
There is already many warnings and if the can get you to do that they can get you to other types of scams rather don't require installing an app like sharing data, putting info on websites.
This sounds like know-it-all propaganda as well. Why not make it opt-in? Google (and other Big Tech companies) seem to think they know better than everyone else, even though they are also completely untransparent about what they do.
Is this really just a 24h cooldown once?
That's what they said it's going to be. A one time 24 hr cooldown to turn on the "Allow Unverified Packages" setting, not 24hr per app.
And then you have the option:
- unverified packages either temporarily (7 days)
- or indefinitely
Official docs here:
https://android-developers.googleblog.com/2026/03/android-de...
Yes. Visit https://keepandroidopen.org/ and ctrl+f "escape hatch" for more info
This comment is legitimately just "think of the children!?!!" with extra steps.
Simply add a setting to the phone for the technologically illiterate and/or young and old.
I can't even imagine how locked down and terrible the internet would be if we had this rhetoric around in the 90s.
Is it for safety or for collecting more rent. Certainly google can withhold installation till the new app is tested with their super duper Ai.
Do you really think there are enough affected developers that it will move the revenue needle at all for Google?
I think this was probably a very easy decision for Google after they weighed benefits and harms to users and developers.
I am certain that its not about harm but rather US supremacy doctrine. They are tightening their noose. You have to be approved to live in their digital world and pay rent.
Sorry, I get where your emotions are coming from with this, but it is just technically wrong on every level.
The vast majority of tech support scams come through apps on the Play Store. Not only that, but malicious apps get approved on the Play Store constantly.
There is no reason to take any claim that this change is meant to mitigate scams seriously, because there's no evidence to support that it makes a noticeable dent in such activity.
What this change does noticeably and impactfully do, is prevent, via chilling effects, users from being able to use their phones in ways that could lose Google and its partner vendors post-sales revenue.
As you said, serving people should be the end in itself, and this change doesn't do that - it hurts people.
So this will end tech support scams, then?
Also. I regularly remove malware from people's android phones pro bono in and around my community. It all comes from the play store.
It's like locking people out of their own home, and then when people express outrage the concern troll steps in from out of frame to point out that they're not acknowledging the very real risk that if they could access their own house gasp they might accidentally let the wrong person in, or break something, or whatever.
This is nothing but a business decision to extort money from developers and you know it. It's anti-competitive at its core, locking out other, more reliable app stores and taking control of an open source operating system. It's just one more measure in a long trend of fulfilling the wet dreams of large tech, namely killing personal computing and controlling everything people can do with devices they've bought.
It's exactly the same as the people crying conspiracy about parts-locking for repairability, not acknowledging the real effects it had on phone thefts and the pressure at the national and governmental level to help solve the epidemic.
What would help a lot from Google side is:
1) make it optional
2) don't put it on a timer. What's most damning, in my opinion, is that this is the very definition of a bait-and-switch. Any rational person thinks this won't apply to their existing phone because it came before the rollout, right? It's only android 15 and onward? No. That's wrong, it'll apply to YOUR phone. Google. Non-Google. Doesn't matter. Android 12, 13, 14? Nope applies to them all. That's just an accident then?
[flagged]
> You can disagree with the tradeoff, but if you don't acknowledge it you're just doing propaganda.
The propaganda I'm seeing is coming from Google. I can't tell you how many times lately I've seen ads on TV/streaming pushing the security narrative for Play Store. Google knows what it is doing is blatantly anti-consumer and they very much want public sentiment to think it's not.
There will always be means to scam individuals through technology. Pulling stunts like this is not justified simply because it closes off one means of doing so.
I guess the an alternative open unix based operating system that can upload existing apps from both android as well as apple is needed or the greed will not ever end. This is about corporations that constantly need growth using new ways to collect rent from the rest of the world. They are chocking the world to collect new monies.
They are recommending installing F-droid.. and not accepting android's demands. Its time to have open source smart phone operating system that can not be taken hostage.
The problem is that these OSes have achieved regulatory lock-in. Your bank app won't work on an alternative OS because it's not trusted. In some countries that means you can't access online government services through the standard path either.
You are right. They can go through approval or have dual operating systems that can be installed on smart phones. No separate booting is required
https://www.ubuntu-touch.io/
The apps are not approved for banking but I suppose people can use the browser interface rather than apps
Android allowing sideloading is the single biggest reason I've been an android die-hard my entire life.
iOS not allowing sideloading is probably the biggest reason I’m happy my family is on iOS.
I moved to Android in 2022 from the iPhone ecosystem. I've been thru one phone replacement cycle and it was glorious. I got by without ever using Google Play and never had to tie my phone to any "ecosystem".
I had "sideloaded" all the APKs for the software I used on the old phone and saved the APKs. Moving to a new phone was just a matter of loading all the software and copying my rsync'd backups onto the new phone. It was wonderful. Just like moving to a new PC.
I guess I'm happy I got to have this experience for a little while.
The thing that this enables are governments locking down apps used for protesting, e.g. Indian government petitioned to take down the „BitChat“ app by Jack Dorsey, as it was (successfully) used to circumvent the mobile carrier shutdown: https://en.wikipedia.org/wiki/BitChat#Usage
App takedown requests from India were ignored but similar cases from China were not. Coming soon to a country near you.
To echo other comments, it would be really good if posts on this subject were more complete about the details of what's happening if for no other reason then it's difficult to understand the situation without those details. I'm pretty anti-corporate but it's hard to be anti-corporate without a level, complete picture.
Concretely in my case, I read all the fdroid materials that were linked to from the fdroid pop-ups and they just left me hanging, trying to understand what was actually happening, and when? I finally looked it up. It was like what are these people even talking about? Obviously Google's motives are quite clear, but I had to work pretty hard to figure out what was going on and it doesn't make sense that they communicate like this.
"Starting in 2027, a silent update, nonconsensually pushed by Google, will block every Android app whose developer hasn't registered with Google, signed their contract, paid up, and handed over government ID."
Will not apply if updates are blocked
Good to have old phones, i.e., not primary phone, where user can block updates
Some users may want a portable, pocket-sized computer that the user can reasonably control (old phone) in addition to one controlled by Google (primary phone)
For some users, the "threat model" may be Google and the long list of governments, corporations, etc. who partner with Google
Maybe some users just want relief from data collection, surveillance and ads
Not every user is the same
Some (not all) users may be willing to sacrifice some alleged "security" provided by an ad services company (wtf) in exchange for more _user control_
Incidentally, with this update, Android will lose any edge it had, and become a shittier and less polished version of iOS.
Let's be real, it was always theirs. Wish it wasn't so, though.
This is not the problem it is presented to be, and I see more benefits to this than prejudice.
There is a very concerning amount of illegal apps/scams distributed through ads that I've casual users install somewhat banally with the aid of short walkthroughs.
Any sufficiently advanced user is barely affected by this, as the procedure is just complex enough to block average people from getting scammed/using illegal services unknowingly, but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.
"This is barely an inconvenience, it's just a 9-step, 24h-long step through a proprietary service, and mandatory sign-up with governmental ID for the developers, everyone technical enough can easily bypass it"
I believe this is usually referred to as "boiling the frog".
The page addresses it: https://keepandroidopen.org/#objections
24h delay is not all of it, there's developer verification.
What does this mean? An app needs developer verification or the phone needs to be in dev mode, no?
You are assuming that the 24h cool down period is where this ends. I think it will get worse
it's not hard to imagine Google stating "we're removing this opt-out path because next to no-one uses it, and it will help streamline Android, which will protect the children!"
> but simple enough to barely be an inconvenience for anyone who cares enough and can go through it.
Any sources for this claim? I don't buy it.
I've already said this, but here is roughly how this progression is going to go:
1. You own your device and can install anything you want on it (what we have today)
2. Google gently yanks you away from the simple workflows, leaving you with ADB or their 24 hour hoop to jump through. If you opt for the second, you get a choice between allowing 'unverified' installs for 7 days or indefinitely. Huh, that's weird, who would ever pick the 7 day option, right?
3. The dust settles and some time passes. Google decides that the indefinite option is just way too dangerous, the users are not safe if they are allowed to use this freedom. They'll just claim there's countless clueless grandmas getting entangled in multi-day-long scams that hinge on the sideloading feature, and they simply can't let them suffer so much. They will generously disable the 'indefinite' option.
4. 7 days may still be too much, maybe the sensible decision is to move to a 24 hour countdown per app. I mean, if you want it so badly, you have to work for it - that means you'll have more time to mull over the security of every single app you put on your phone.
5. Huh, for some reason it looks like almost no users are installing apps from outside Google Play anymore. We'll keep the feature on life support for a while, and then retire the legacy unverified installation workflow, to be replaced by a temporary limited permission for verified developers to briefly install their own in-development apps on their device. That ought to be enough.
This pathway for extinguishing features that are inconvenient for massive corporations isn't new. I really do not understand how everyone supporting Google's side here doesn't see this, and why they're so willing to wholeheartedly and without reservation believe them on matters of security where pushing one opinion also happens to conveniently align with their profit motive.
Alternatively the duopoly hard block might push linux mobile development in to overdrive (with AI assistance?)
Maybe stop using Android? I feel like there are a lot of decent distros these days. This helps accelerate it.
Which ones did you have in mind?
I got a used pixel 10a and installed GrapheneOS on it partly due to this.
The last couple of Android phones I bought, I rooted within 1 hour of owning them. The current one will probably be my last Android phone.
The phone was never yours. You have a nice, granular set of permissions which (attempt to) control what apps can do ... but you don't really have any permissions that prevent you from _Google_ spying on you and selling your data or giving it up to law enforcement. It's like the propaganda radio you can turn down, but never off. You're given just enough control to feel like you have a choice.
I thought Google was adding more hoops to jump through for F-Droid, Termux and the like. Did that change? Obviously the more hoops the less happy we will be, but it'd be nice to know.
How does this work on lineageos?
I'd just turn off my phone before midnight, boot it into fastboot and reflash lineage 2 days later, missing the window for them to push anything. No gapps btw.
And this is why I've been recommending iPhones to my family when I always recommended Android
Why exactly? Even after this move, iPhone is less open. Apple doesn't have the 24h escape hatch.
Or the adb escape hatch. IIRC, their adb equivalent is limited to having a small number of apps installed at the same time, needs each app to be periodically reinstalled at short intervals (IIRC, one week), and you need to have your expensive Apple laptop with you for that reinstall.
Even with Android becoming much more closed, it's still more open than Apple.
Could you elaborate? This tactic feels identical to the way apple locks down apps to the app store, which requires paid developer accounts
Exactly, because now they are identical. And their phones are generally better, the prices now are also comparable or even cheaper.
That's like recommending amputation to fix a bad knee. IOS is categorically worse in this department.
I mean, I am also an iPhone fan, but our phones stopped being "ours", in the sense that this page warns about, approximately 6,679 days ago.
Ah, Apple, that true bastion of open software and not screwing over developers or customers.
...
30 cents out of every dollar, you say?
... Because they've been less open from the start?
It seems to me like they mean that Android has now lost its technical advantage, so might as well use the option with the shinier UI.
So i wont be able to install .apk files for test purposes? thats terrible.
whats the way forward?
You can install apks via usb debugging as normal.
You can't just click a random apk in a website and install it. At least without the 24 hour wait workaround, done once per device.
Free install by ADB, and Developer-moding once per device, not once per app / install? Yeah, OK. I don't quite get the outrage, then.
Before you @ me, HN, I run GrapheneOS. I fully understand and practice "own your own hardware". Most people probably shouldn't, though, because they lack the technical ability / interest to do so safely, and throwing them to the wolves strikes me as ideology pushed to the point of foolishness.
Now, y'all can flame my ass.
We don't know that it's once per device. It's been said by Google that it'll be once per device, but we haven't seen the code and we don't know the method of tracking that. What if I wipe my OS? What if I wipe data in play services? Will a future silent play services update conveniently break my p2p messaging app during a protest?
> What if I wipe my OS?
Almost certainly that would reset this. Why would it not?
> What if I wipe data in play services?
No idea. Is this a thing people do?
> Will a future silent play services update conveniently break my p2p messaging app during a protest?
Google can already do that today.
Okay, thanks.
checks recent rhetoric yep looks like Google are run by racists who think just anyone can get a government ID.
The 24 hour waiting period is absolutely ridiculous. The article says to download alternative stores but I thought they too are impacted as it is the installation mechanic.
The waiting period is the best way to combat coercion. If I’m setting up a new phone, the setup already takes multiple hours that adding 24 hours doesn’t really mean much. It does a wonderful job of making sure you actually really want this app.
Google play store was ruled a monopoly and the Apple App store was not. Google allows alternatives on their platform and Apple strictly forbids it.
If the legal system dictates that open = monopoly and closed = fair game, then you get dumb shit like this.
Probably one of the dumbest rulings in tech ever, but few people know about it. Basically set precedent to never share your platform if you don't want legal scrutiny.
In this age of AI why don't we have Linux running on random phone hardware yet?
Regulation by 3rd parties. People use phones for payments and accessing sensitive services. But these apps work only on Android / iOS. There those who don't seek this use case, but there are rather small and increasingly shrinking minority. This is compounded by the knowhow needed to install non-stock OS on phone in the first place.
This is increasingly becoming the case. There have been a few posts on Reddit of people successfully porting Arch and other distros to phone hardware (typically seems to be OnePlus?). My handheld game console, a Snapdragon 8 Gen2-based Android device by Retroid, just got official first-party support for running Linux on it.
Might have to switch to iphone...
otherwise my next phone will be linux
But I mean what are you saying really? An iPhone absolutely doesn't allow you to just randomly install stuff from the web unless there's been some update that I don't know about.
> The EFF calls app gatekeeping "an ever-expanding pathway to internet censorship."
I think what's interesting, and what our grandchildren will look back on, was how naive the early internet was. There was almost this sense of "the government is powerless" whether it be piracy or jailbreaking or casual death threats [8647 style] or who knows what else. Combined with also a sense that devices will always be exploitable, there's always a way around, resistance from government and corporations will always be futile.
i am using lineage os on some devices. It does not even have google play. On others I have GrapheneOS which is sandboxed. How that does affects me?
Your app ecosystem might decrease as developers who don't want to register lose interest and the number of users supporting open source projects decreases.
It’ll increase your opportunities to let people know what OS you’re running by at least 10-fold. I’m running arch btw.
>> It’ll increase your opportunities to let people know what OS you’re running by at least 10-fold.
Two types of people will benefit: 1. the genuine & naive who want to help but don't make much progress; 2. those who attended Harvard.
You're running arch on a phone? I was unaware that was an option on mobile.
Been for a while now.
https://linmob.net/my-setup-with-danctnix-archlinuxarm/ (2021)
I'm just gonna leave this here - https://www.ubuntu-touch.io/
um my phone is not affected by this thank you very much
[dead]