Hacker Newsnew | past | comments | ask | show | jobs | submit | gumby271's commentslogin

Bet it won't happen twice though.

So let's say I'm F-Droid, an organization making a direct competitor to the Google Play Store and openly pointing out how much scammy shit is available in that store. My options are 1) submit my identity to Google (my competitor) so they can identify me and choose to revoke that verification at any point, or 2) I can tell all my users that they must go through these scary dialogs AND wait 1 day before they can use my competing product? That's cool, glad we've got the options laid out in front of us.

I forgot 3) instruct my users how to use ADB from another computer to install my competing app. Awesome.


It's really ridiculous.

You'd think regulators should make Google ship a 'Choose my store(s)' screen at setup, but Google thinks the opposite is the case and Google should also be able to control app distribution outside of the Playstore.


Right, if this is being built into AOSP I dont see how they wouldn't add an adb command to immediately skip the "Advanced Flow" wait. if it's safe to let uses run "adb install", then "adb skip-advanced-flow" should be just as safe to do too.

> In addition to the advanced flow we’re building free, limited distribution accounts for students and hobbyists. This allows you to share apps with a small group (up to 20 devices) without needing to provide a government-issued ID or pay a registration fee.

I don't quite understand how those installs would be tracked. If I create a "hobbyist" account and share the apk, are the devices that install that app all reporting it to Google? To my knowledge, Google only does this through the optional Play Protect system, is that now no longer optional? I'd like to know if my computer is reporting every app I install up to Google.


With this change, Android will not just send every app install to Google, but even require approval from Google before allowing app installs.

Which I also don't like, but at least that can be done offline. The signature could be verified on device without sending everything to Google. If they have to track the 20 seats for the hobbyist accounts then they have to be tracking every single install

But they're not. They're actually sending each signature to Google and asking whether that's been verified anyway.

Really? So all app installs on Android 17+ will have to be done online?

You thought it wasn't reporting every app you install?

I mean, I'm happy to be conspiratorial about it too, I give Google no benefit of the doubt, but outside of Play Protect I don't think they explicitly say "your phone is telling us every app you install." This new feature is them making that explicit.

How can you say “outside of Play Protect” when it comes enabled by default and hassles me to turn it back on every time I install an APK?

Really? I turned Play Protect off and have never been prompted to turn it back on, what phone do you have that does that?

It's this screen: https://support.google.com/googleplay/thread/230937718/annoy... (not several times per hour like this post says, but same UI)

Pretty sure this is a Play Services thing, so I don't know that the phone model really matters. But regardless this is on a few different devices: my primary REDMAGIC 9S Pro (Android 15), Surface Duo 2 (Android 12), and my YONGNUO YN455 (Android 10).


My Pixel buds from Google have been pretty good since they support Bluetooth multipoint. I'd love to find some good headphones like Beats or the airpods, but Apple doesn't seem to support those standards, it only works with other Apple devices.

That's pretty cool, I've been wanting something like this so I don't have to reach for the touchpad on my Mac all the time. But I gotta say, I did NOT expect to be scrolling in the Z axis all of a sudden on that site!

The site is a good example of looking good but being very annoying to use.

Which is very much Google's approach to Android. AOSP could be targeted directly by devs, but Google pushes everyone to use Google services in their apps (and assume it's available on any android device) which means Android with Google services is the only viable version of Android out there.

Google and Apple both.

Most "apps" in phones could be just something you install trough browser and cache in a sandbox if we developed good standards.


But the app-slop is totally fine right? Apple controlling every piece of software on my phone hasn't gone too far? Empowering the web to compete with Apple and Google's native locked down options is the only viable alternative I see.

Problem, as I see it, is that these "native locked down options" are very often just webpages in disguise, which is also webslop imo

The native locked down options are the natives apps you're advocating for, I don't understand. They're the Swift/uikit or Koltin/jetpack apps. It sounds like you don't like web technology in general and would rather everyone do it the centralized Apple/Google way?

Kotlin is not native. And yes, I don't like web technology. That doesn't imply doing it in Company A / B / C way, it implies preference for compiled programs that run natively in their respective environments with full utilization of resources those environments provide, e.g. hardware access, software standards etc.

Sorry I just saw this, if Kotlin isn't native, then what is the "native" way to write android apps?

Looks like Apple decided they need their own version of the Android mascot. Theirs is definitely a little more unsettling than the little droid guy though.


Android mascot is known as bugdroid - see https://www.androidpolice.com/every-android-bugdroid-ever/

The shape of the bugdroid changed a couple of years ago - arms became asymmetric - narrow near the shoulder, widening at the hand, among other changes.


My first thought: a rather strange copy of the en.wikipedia.org/wiki/Pillsbury_Doughboy

Google's Android robot has a much better design, IMHO. And I remember the Amazon box version of https://en.wikipedia.org/wiki/Danbo_(character) and Arielle Nadel's photo stories "365 Days of Danbo" with it. Can't imagine that with the Apple Dough boy..


I'm sure Apple would love that too. More seriously, would that also mean all editing tools would need to re-sign a photo that was previously signed by the original sensor. How do we distinguish an edit that's misleading vs just changing levels? It's an interesting area for sure, but this inverse approach seems much trickier.


CAI’s Content Credential standard accommodates what you suggest, as far as re-signing/provenance, with a chain kind of approach. It supports embedding “ingredient thumbnails” in an image’s manifest, and/or the image’s manifest can embed or link back to source images that are in turn also signed [2].

It feels like the approach assumes a media environment where a professional wants to provably “show their work,” where authenticity adds value to a skeptical audience.

In that spirit, then, I understand CAI’s intention [0] to be to vest that judgment with the creator, and ultimately the viewer: if my purpose is to prove myself, I’d want to show enough links in the chain that the viewer checking my work can say “oh I see how A relates to B, to C,” and so on. If I don’t want to prove myself, well… then I won’t.

I don’t know Adobe’s implementation well enough to know how often they save a CC manifest, and their beta is vague in just referring to “editing history.” [1] I get the impression that they’re still dialing in the right level of detail to capture by default. Maybe even just “came from Firefly” and “Photoshop wuz here.”

But if I want to prove this Nikon Z9 recorded these pixels at this time and place, or “I am the BBC and yes I published this,” or “only the flying monkey was GenAI, the rest was real” I could conceivably put together a toolchain (independently of Adobe) to prove it in more detail.

[0] https://spec.c2pa.org/specifications/specifications/2.2/spec...

[1] https://opensource.contentauthenticity.org/docs/manifest/und...

[2] https://opensource.contentauthenticity.org/docs/c2patool/doc...


You'd have to provide both images, and let the end user determine whether they think it's misleading.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: