Thing is, Play Store is already filled with malware or near malware from seemingly verified developers. I ran into several scame clone apps just today.
Comment on Google's shocking developer decree struggles to justify the urgent threat to F-Droid
Wispy2891@lemmy.world 1 week ago
What pisses me off it that they say they do this for security. It changes absolutely anything.
They really think that malware developers will say “oh no! I need to submit a picture of an id card to sign my malware! It’s literally impossible to submit a jpg of a stolen id card, I’m ruined and out of a job!”
What does it change? Waste 20 minutes of some malware developer while they register under a stolen id? They already have a system that scans for known malware and automatically remove it.
brucethemoose@lemmy.world 6 days ago
TeddE@lemmy.world 6 days ago
That was fundamentally F-Droid’s retort.
brucethemoose@lemmy.world 6 days ago
It’s absolutely insane that anyone pretends Google Play and the App Store are fine though. Has anyone scrolled through any search and not seen a sea of heavily marketed scam apps?
fodor@lemmy.zip 1 week ago
Of course they know that. It’s about power and money. After all, they already have a security program that filters out malware. If we believe their stated reasoning (which we don’t), they’re tacitly admitting that their current security program is a complete failure, and also that they will not try to fix it.
keegomatic@lemmy.world 6 days ago
Both things can be true. It definitely is better for security. It’s pretty much indisputably better for security.
But you know what would be even better for security? Not allowing any third-party code at all (i.e., no apps).
Obviously that’s too shitty and everyone would move off of that platform. There’s a balance that must be struck between user freedom and the general security of a worldwide network of sensitive devices.
Users should be allowed to do insecure things with their devices as long as they are (1) informed of the risks, (2) prevented from doing those things by accident if they are not informed, and (3) as long as their actions do not threaten the rest of the network.
TeddE@lemmy.world 6 days ago
It’s pretty much indisputably better for security.
I dispute this. While adding extra layers of security looks good on paper, flawed security can be worse than no security at all.
Android packages already have to be signed to be valid and those keys already are very effective in practice. In effect these new measures are reinventing the wheel as to what a layperson would think this new system does.
Adding this extra layer in fact has no actual security benefit beyond posturing/“deterrence”. Catching a perpetrator is not the same thing as preventing a crime. Worse - catching a thief in meatspace has the potential to recover stolen goods, but not so in digital spaces - either the crime is damage or destruction of data for which no punishment undoes the damage or the crime is sharing private data which in practice would almost certainly have been immediately fenced to multiple data brokers.
And were only getting started with this security theater:
- Nothing prevents an organization from hiring a developer for long enough to register before being flushed (or the same effect with a burner account on fiver)
- Nothing in this program does anything to get code libraries vetted - many of these developers may accidentally be publishing code from poisoned wells that they have no practical knowledge of.
- None of these measures make scams less profitable.
- None of this addresses greyware - software that could technically qualify as legal (because the user agreed to terms of service for a service of dubious value)
- All of this costs time and resources that will likely inevitably be shouldered on low paid engineers that could have put that effort to better uses.
- Metrics and statistics may likely be P-hacked to reflect that the new system as a success (because there’s internal pressure to make it look good) this turning-security-into-press-releases would have collateral of making accountability overall worse.
But you know what would be even better for security?
While we’re at it we could add the tropes of removing network connectivity, or switch to using clay tablets kept in a wooden box guarded by a vengeful god. Both of those would be more secure, too.
Users should be allowed to do insecure things with their devices
100% agree with you here - it’s fundamentally the principle of “Your liberty to swing your fist ends just where my nose begins”. Users should be given the tools and freedom to do as they want with their property - up until it affects another person or their property in an unwanted way.
keegomatic@lemmy.world 5 days ago
I think we mostly agree. And I do agree that “flawed security can be worse than no security at all.” I think, though, that this doesn’t make security worse, just that it doesn’t make it that much better.
But even simple filters can make a significant difference: maybe you remember the early-ish Lemmy debacle of turning off captchas for signups by default, ostensibly because captchas are now completely defeated… which led to thousands and thousands of bot accounts being created pretty much immediately across a bunch of instances, and the feature being turned back on by default.
TeddE@lemmy.world 4 days ago
I’ll agree to that.
And I also think that there’s no way I trust Alphabet (holding company of Google) to be the sole arbiters of who gets to run code - neither in a philosophical sense nor as a gatekeeper to one top five compute platforms used by a substantial chunk of the world population.
It absolutely does not justify creating a policy that would wholesale obliterate F-Droid, arguably one of their larger competitors.
JeremyHuntQW12@lemmy.world 6 days ago
Most Android owners don’t even know they have Android phones. They are not informed.
FreedomAdvocate@lemmy.net.au 6 days ago
I don’t think it’s going to be as simple to verify as uploading a pic of an id
Wispy2891@lemmy.world 6 days ago
If it’s like the play store verification, it’s quite simple. The main problem is that once “verified”, Google publicly doxxes individual devs by publishing their residential address + private phone number + private Gmail on their dev page, and this is unacceptable for anyone except who used stolen identities
JeremyHuntQW12@lemmy.world 6 days ago
They really think that malware developers will say “oh no! I need to submit a picture of an id card to sign my malware! It’s literally impossible to submit a jpg of a stolen id card, I’m ruined and out of a job!”
Which is irrelevant. They can block any malware - now impossible to do with sideloading of apps during pop-ups.
fading_person@lemmy.zip 1 week ago
It’s always security when someone wants to take our freedom away. Always security…
boonhet@sopuli.xyz 1 week ago
Not always. It can also be about the children.
fading_person@lemmy.zip 1 week ago
About keeping the children safe
SpaceCadet@sopuli.xyz 1 week ago
That’s also security.
boonhet@sopuli.xyz 1 week ago
Not really, it’s more about children not being exposed to things usually. Hence starting with age requirements for porn and they move forward to other things.