Android 15 sideloading restrictions are a raw deal for users
Android 15 sideloading restrictions are a raw deal for users
Are Google's new security measures the end of sideloading?
If Google is going to turn Android into iPhone, why tf I shouldn't get an iPhone itself?
If Google is going to turn Android into iPhone,
It's not. The change is definitively for the worse but still a far cry from Apple where you cannot just download an app off the internet and install it which you can even on Android 15, the permission management is just worse in such a case.
Also, surely community ROMs will probably change this.
why tf I shouldnāt get an iPhone itself?
Why TF would it be a benefit over Android? Still worse compatibility, still more expensive, still no innovation.
I donāt understand why you are being downvoted. that is simply the truth.
I have been using an iphone 12 pro for the past 3 weeks ,while my pixel 6 is getting its battery replaced and itās been painful.
iām missing a lot of apps, the ones I do find are limited or asking for monthly subscriptions.
i am unable to play a downloaded mp3 unless i go through hoops&hurdles .
i am no longer able to watch a youtube video without ads (unless I do 3 steps of passing them to adguard), or using sponsorblock ( i am on ios 18.2, otherwise I would have jail broken it to oblivion).
android is simpy better in terms of freedom. IF or when itāll become a locked garden like ios, itāll truly be a sad day for the mobile world.
Android has been getting worse and worse every iteration. Are you asking me to wait until it is an identical clone of iOS?
Also, surely community ROMs will probably change this.
I don't have time or desire to fiddle with it, just like mods for Bethesda games. It should not be acceptable to shrug at enshittification and hope some volunteers fix it.
POV: You're Google and think EU didn't fine you enough lately.
"Cost of doing business"
Not really with the huge EU fines. Google eventually does what EU wants, though it takes a while because EU is fucking slow.
all it does is prevent sideloaded apps from having access to sensitive permissions by default, which is a good thing.
True, but if it's good for users, it should be the rule for ALL apps
This is why I decided to not use Google services this Graphene install. I have zero doubt Google is going to try and lock down the ability to use anything outside of the PlayStore in an IOS type move. Just hope a better Linux based phone gets done quickly because I'm not sure how many iterations of alternate Android OS generations will be able to exist as they lock things down.
I'm holding on to mine until a Linux phone comes Along. If not, you know what? Fuck it. I'm not replacing my phone with some spyware OS Android. Fuck that shit.
Sideloading is the only reason i use android over ios...
Ironically sideloading is pretty easy on iOS nowadays
But if you need notifications Gl and gl with apple removing the app
Same
Though I understand the reason, I find this ironic given how invasive play store apps can be. My cars official app requires full location access all the time, otherwise it pops up asking for it every time you open it. Meanwhile some FOSS app that can be code reviewed and sideloaded is more difficult to give needed acess.
and FOSS apps that can be fully code reviewed and confirmed safe, unlike anything proprietary, will still cause banking apps to refuse to run on your unrooted device. I had to go back to carrying a physical key around with me. (the foss apps were there first)
Not to defend the shitty app, but it's probably Google's fault. Location access is needed to just query WiFi or do a hotspot. Probably features the app needs. They should've make that more granular.
They need it for 2 things I believe.
- They show a map where vehivle last parked compared to you.
- They could use it for their proprietary phone as key feature that doesn't work and is unreliable compared to using UWB.
- Gonna add this one since its totally the reason, sell your data. They store the car data, why not get the phones location data so you can get them all the time!
I don't think it's quite a bad as the title implies, though I wonder how long this slow process of locking down Android will
containedcontinue for. Hopefully the EU demands from the likes of Epic will stop too much control being taken away from the user.Is control really taken away? It seems as though it simply added a couple steps to help people avoid giving default permissions to bad actors.
Yeah that's the thing, as an isolated change it seems like a good step for security, but I'm concerned it could be part of a larger frog-boiling.
Anything short of "it's your device, it obeys you" is theft.
Personally, I like the first one and wouldn't use an option to automatically give those permissions to all apps.
Being a power user doesn't make anyone immune from malware, it just needs to pass some sniff tests. It was by luck that that backdoor in the Linux kernel was found and it's naive to believe every single malware app is going to be obvious with unrealistic promises and/or bad grammar and spelling. Permissions requests are a clue that an app is doing something it shouldn't be. And Facebook is considered trusted by many despite an insider even confirming the "talk about something near your phone and fb will advertise it to you" being real.
When you download an app, unless you either wrote it yourself (including all libraries) or have checked the source for open source apps (again including libraries), you can only guess at what it is really doing. And just because an app does what it claims to do doesn't mean it isn't doing anything else, so the "well, it does work" test isn't a great security test.
For the app developers being able to block side loading, it says it uses meta data to enforce that. Couldn't modders just modify that meta data so that it doesn't realize X' app is actually a modified X app? It would need to do something more complex than a checksum or hash to detect it's the same app.
I mean, I love "fuck Google" bandwagons, but either I'm missing something or this one doesn't seem like that big of a deal.
despite an insider even confirming the "talk about something near your phone and fb will advertise it to you" being real
When was thisā½
Wait, am I to understand they're intending on making it that you cannot just install any apk you choose because it's your phone and your business? Is that going to be no longer possible?
If you were to read the article you'd find that sideloaded apps will have restricted permissions that the user will have to un-restrict one by one.
Ewww. Such fucking useless imposition of restrictions that should be the user's decision. Like almost everything else in technology nowadays where control is being taken away from the user.
I'm only ever going to use devices that I can put whatever custom ROM I want on or that natively supports the options I want.
As long as the general public just bends over and accepts this shit, they'll keep doing stuff like this.
Will the permissions still be allowable by goinv to the app info page from the settings, clicking the 3 dot menu in the corner and taping to allow restricted settings?
The pros for Android is sadly gone :(
For what it's worth, iOS sure has a lot of cons.
- Camera app has icons at top of screen to control things like flash, but to adjust all the settings like "flash always on" you have to tap an arrow at the top, that then exposes another second flash control at the bottom with the same icon for the full menu.
- Music app has a checkbox in albums and playlists that when tapped brings up a menu to delete your music, wat?
- eSIM-only is terrible, cell service falls apart from time to time and you have to go deploy a new eSIM to make your phone be a phone again.
- Dual-SIM support is convoluted. You'll find yourself accidentally calling people on the wrong SIM until you manually configure every. one. of. your. contacts. to use the line of your choosing.
- Touch is anemic, especially if using a screen protector. Try to take that photo? It will be zero or three photos, thanks!
- Their swipe UI is barbaric, difficult, and mostly stupid, twitch your finger wrong and you go directly back to the previous app, or go into app switcher view, or nothing happens. Trying to "go home" you're basically trying to give it an orgasm with all the up-swipes.
- Missing common software buttons like Android's back/app switch/home buttons means you're constantly tapping at the very top, then the very bottom, or trying to use the back-swipe gesture, the UX is maddeningly inconsistent.
- Left/middle swipe brings down notification drawer, right swipe brings down control center. Not nearly as consistent a behavior as swipe down once, or twice, for the respective drawers in Android.
- New AI junk has added menus in settings for "Apple Intelligence & Siri" to every. single. app. that you have to switch 3 switches off per app to disable. Even if you don't have their AI crap installed.
- The silly FaceID waste of space dent makes it so you can't see all icons like "am I on a VPN or not? Gotta check one of those top drawers to find out."
- Lack of in-screen fingerprint sensor and use of FaceID makes the phone unlock on you without intent if your face is near and it wakes for a notification, and also not unlock when you actually want to use it, in general.
- The screen randomly wakes during phone calls if you're using a headset and nowhere near the phone and just stays on for the duration of your lock timeout unless you manually force it to sleep, and then it'll just wake again.
- Trying to swipe out of active phone calls to get to the lock screen or apps will take multiple swipes dangerously close to the call hangup button, godspeed!
Those are just the things I can recall off the top of my head.
We need more mobile OSes. This duopoly is pure stagnation.
Extra cons:
Sidelining is not a option(yes you can do sideloady way but it will get deleted later the sideloaded and libre app support (like a invidious client for ios)
Now I'm actually glad I'm stuck on Android 13.
I've been an Android user since the HTC Desire in 2010.
I'm unsure what the author of the article is advocating, since the "raw deal" appears to be geared towards making the Android environment more secure.
The author laments that they now have to manually enable security bypass settings and that some (they call it developers, but I'm not sure if they're referring to Application Development or Phone Platform Development) "developers" can lock down with further API checks.
I've been an ICT professional for over 40 years and security is always a balance. On the one end it looks like a phone in a locked room, inaccessible to anyone, on the other end it's a free-for-all, open to anyone.
I'm not at all sure what the author wants, except for wanting to roll back time to something less secure.
Ultimately, the user should be able to decide for themselves how much security they are willing to compromise for power and flexibility. Whether this particular compromise is acceptable would depend on just how annoying it is in practice, but it's a trend I'm not a fan of.
On the plus side, if this compromises third party app store usage even more, it may be more fuel for the anti-trust lawsuits aimed at Google (although who knows how that will play out given who is becoming president).
As someone who's always been side loading apps and doing custom configs, it's just so much harder compared to what it used to be. So many hidden settings. So many menus you have to go through in the right order. So many reverts that happen each update.
You say it's in the name of security, but I don't see it. Something is fundamentally broken here, if Google really believes this is the best path forward
Edit: and btw, I work in big tech too. I know how this update came to be. Some L6 looking for his packet decided to "decrease infected devices by 10%" by adding this friction, and everyone nodded along since the negative impact isn't measurable.
Users are further forced to sacrifice their privacy to Google and Google Play rather than use something like F-droid.
It makes it frustrating to use, not secure. When installed program stops working after 30 or whatever days of me not using it because my great white master decided that it doesn't need what was granted by me at installation is not security it's just spitting in my face. I don't care about what "developers" want why should anyone?
they are most likely not white tho
Somehow No One needs that much Holding Hand or "Security" on the Computer, where No revenue streams of Google/Apple are affected
I've been the person people came to (and paid money to) when they installed something stupid on Windows XP in 2003. Quite a few people do need their hand held to use a computer effectively.
Until that era, app developers were generally considered trustworthy. Malware existed, but anything that openly advertised itself, that users would install intentionally was unlikely to work against their interests. "Spyware" was a new category. App permissions in smartphones represent a recognition that app developers do not necessarily share the users' interests.
I certainly don't want knowledgeable users locked out of making decisions for themselves (even bad ones), but arranging the UI so that someone with a limited understanding will have a hard time finding the dangerous settings isn't a bad thing.
As an It professional I must disagree. Dumbing down the platform isn't good. Let's hope Magisk Deny list keeps working.
Happy to debate.
According to the article there are now more than 3 billion Android users. I have no information to the contrary.
How do you expect to attempt to secure that many devices by allowing the platform to continue as it was?
You call it dumbing down, which I understand, but how do you stop all the click-happy people from installing the next nefarious "game", when they already have little to no chance to avoid email spam and SMS scams, let alone LLM generated "custom targeted" exploits.
I get that there are users who use this (now) vanishing functionality, but are they representative of the total user base, or edge cases? Neither you nor I have any hard data on that, but I know that as an ICT professional, I'm an outlier.
I'm no friend of Google's business model, but I don't believe that they're purposefully shooting themselves in the foot,mind you, I'll concede that it has a poor track record in the past few years.
Let's progress the conversation.
How would you protect essentially computer and security illiterate users from malware in a scalable and sustainable manner?
As an aside, I'm a long term (25+ years) Linux user and have used pretty much everything since the 6502 was part of the picture. In my professional opinion we haven't begun to figure out how to do this in the desktop world, Android is so far the closest we've managed and I'm not seeing anything here (yet) that makes me see this as a mistake.
I just wish the system had a global setting for "I know what I am doing, stop trying to protect me". Stop revoking permissions you think I don't need. stop restricting everything. Just turn all of those things off by default. I only have a couple apps installed, let me be the judge of me. And stop having me reconfigure every app individually just so you'll let it run for as long as I want it to.
Yeah, the author and people are fussing over without reason. Regular users do not understand the implication of sideloading apps. I have had people get their telegram/whatsapp hacked because someone sent them a malicious link and they sent their login credentials to that website/app.
Restricting sensitive permissions will mean such people are better protected from such mistakes. Advanced users can still bypass the requirements even though it may be slightly complicated.
One can justify it however they like but it's going to end up making the experience worse for competent users anyway. Much like this Android 12 security change that made it permanently more annoying to manipulate files.
Iām not at all sure what the author wants, except for wanting to roll back time to something less secure.
I'm not sure what the author wants either because the article is written in such a both sides style.
I know what I want though, and it definitely includes access to "dangerous" permissions; I've had root on my smartphone pretty much as long as I've been using one. I don't mind making those a bit awkward to turn on though, and it seems like that's what's going on here. If anything, I'd like to see that broadened to all apps rather than just installs outside app stores.
What I don't want, and what I'm concerned about is that this is a stepping stone to is a system where some permissions are only available to apps from Google-approved app stores, or a scenario like iOS where apps can only be installed from stores or with Google-approved developer credentials.
Iām unsure what the author of the article is advocating, since the āraw dealā appears to be geared towards making the Android environment more secure.
"These tighter security measures protect average users from malicious apps but risk alienating power users, amateur developers, modders, and enthusiasts who depend on Android's flexibility."
The author acknowledges this in literally the second sentence.