upvote

points

by marcprux5 hours ago |
comments
upvoteby dfabulich4 hours ago|
next
[-]
I guess it's too late now, but I think "sufficient" is much too strong a word to use for that position, and puts Google in a position where they can disregard you because they "know" that existing measures aren't "sufficient."

"Existing measures are working," perhaps?

reply
upvoteby mirekrusin4 hours ago|
prev|
next
[-]
Would you say that iOS ecosystem suffers the same rate of malware as Android?
reply
upvoteby microtonal3 hours ago|
parent|
next
[-]
There could be many other factors, like abysmal patch policies. Many vendors still only do Android Security Bulletins (which are only vulnerabilities marked as high and critical), do them late (despite a three month embargo for patches), very delayed device firmware updates, and sometimes only for two or three years.

Many Android phones still do not have a separate secure element.

Also, the Play Store itself regularly contains malware.

In the end it is mostly about control, dressed up as protecting users. If it was about security, Google would support GrapheneOS remote attestation for Google Pay (for being the most secure Android variant) and cut off many existing phones with deplorable security.

reply
upvoteby array_key_first3 hours ago|
parent|
prev|
next
[-]
The app store does contain malware, although arguably less than the play store. Apple devices would be much more secure without the app store. Apple should remove the app store.
reply
upvoteby workfromspace2 hours ago|
parent|
prev|
next
[-]
Not OP, but my experience was most of the malware-like apps on App Store were top ads of apps with names similar to the original ones: such as Whatsapp or Office.
reply
upvoteby 3 hours ago|
parent|
prev|
next
[-]
deleted
reply
upvoteby tadfisher4 hours ago|
parent|
prev|
[-]
Of course not.

In other news, a new study shows that cutting off your feet is 100% effective against athlete's foot.

reply
upvoteby mirekrusin3 hours ago|
parent|
next
[-]
Haven't seen that one but I've seen working medication, it does exist on the market and does work, why not switching to use it?
reply
upvoteby 3 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby kodebach4 hours ago|
prev|
next
[-]
Like you said, for years now they have added more and more restrictions to address various scams. So far none of them had any effect, other than annoying users of legitimate apps, because all the new restrictions were on the user side. This new approach restricts developers, but is actually a complete non-issue for most, since the vast majority of apps is distributed via Google Play already.

In the section "Existing Measures Are Sufficient." your letter also mentions

> Developer signing certificates that establish software provenance

without any explanation of how that would be the case. With the current system, yes, every app has to be signed. But that's it. There's no certificate chain required, no CA-checks are performed and self-signed certificates are accepted without issue. How is that supposed to establish any form of provenance?

If you really think there is a better solution to this, I would suggest you propose some viable alternative. So far all I've heard for the opponents of this change is, either "everything is fine" or "this is not the way", while conveniently ignoring the fact that there is an actual problem that needs a solution.

That said, I do generally agree, with you that mandatory verification for *all* apps would be overkill. But that is not what Google has announced in their latest blog posts. Yes, the flow to disable verification and the exemptions for hobbyists and students are just vague promises for now. But the public timeline (https://developer.android.com/developer-verification#timelin...) states developer verification will be generally available in March 2026. Why publish this letter now and not wait a few weeks so we can see what Google actually is planning before getting everybody outraged about it?

reply
upvoteby Dusseldorf1 hours ago|
parent|
[-]
Because without this early resistance, there wouldn't even be vague promises of hobbyist/student exemptions. I think it's important to make community objection to the entire idea known loud and clear, especially when changes like these are absolutely ratcheting.
reply
upvoteby kodebach18 minutes ago|
parent|
[-]
Starting from their first announcement of this, Google has explicitly asked for comments and feedback from affected developers. They have a Google Form for exactly that linked on all the announcement pages.

The exceptions for students/hobbyist were always promised, but the "advanced flow" came later based on this feedback. AFAICT Google has, so far, only made things better after the initial announcement. I don't see why we shouldn't give them the benefit of doubt, at least until we have some specifics.

Pushing this open letter out just days/weeks before Google promised the next major update just seems off.

reply
upvoteby renewiltord3 hours ago|
prev|
[-]
> all evidence points to them working fairly well.

What is this evidence? Please share it.

reply