zlacker

Uncomfortable Questions About Android Developer Verification

submitted by ingve+(OP) on 2025-08-27 05:14:19 | 400 points 294 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩◪
14. progva+X5[view] [source] [discussion] 2025-08-27 06:26:33
>>mettam+A5
Probably https://www.gnu.org/philosophy/right-to-read.en.html , mentioned elsewhere in the thread.
◧◩◪◨⬒
28. charci+J7[view] [source] [discussion] 2025-08-27 06:43:17
>>dns_sn+I6
Most of AOSP is licensed under the Apache 2.0 license and GPLv2 for the Linux kernel. These are FOSS licenses recognized by the FSF.

https://www.gnu.org/licenses/license-list.html#apache2

https://www.gnu.org/licenses/license-list.html#GPLv2

41. itake+F9[view] [source] 2025-08-27 06:58:27
>>ingve+(OP)
While I am against the policy, Google only publishes developer's full legal name and email address if the app is monetized [0].

If the app is monetized, then the full mailing address is shared.

If money is involved, it’s fair for users to know who they’re dealing with. Developers who want to hide their personal identity can still do so legally with a shell company.

Taking it a step further, if I am going to run your code on my device, I want to know who I'm giving access to my data/cpu/hardware.

Just like with offline transactions, customers should know who they are giving money to.

----

> Google will display your legal name, your country (as per your legal address) and developer email address on Google Play. If you decide to monetise on Google Play, then Google will display your full address.

[0] - https://support.google.com/googleplay/android-developer/answ...

◧◩◪
53. positr+Fa[view] [source] [discussion] 2025-08-27 07:08:05
>>teeker+85
Mobile OSs are very consumer focused. I have criticized the FSF for, in there lengthily argued ways, abandoning the consumer.

You have to commercialize openness if you want the muscle of the consumer to be able to produce it.

Short presentation of the basic concept: https://youtu.be/SO46oEdlkY8

Some things with massive value in excess of the cost of production cannot be pursued by capital nor bought by the individual. Your choices are government, non-profit, or something in between all three. PrizeForge aims to be between all three and to completely change how we do consumer open source, incidentally bringing billions of dollars into making it.

◧◩◪
95. fsflov+ud[view] [source] [discussion] 2025-08-27 07:32:59
>>teeker+85
> For mobile, we have PostmarketOS, Phosh, Ubuntu Touch.

Why are you only listing DEs and not operating systems? (You also missed SXMo and more.) There are many more operating systems [0] and two working GNU/Linux phones, Librem 5 and Pinephone. Why people are ignoring them on HN?

[0] https://pine64.org/documentation/PinePhone/Software/

◧◩◪◨
105. simonc+oe[view] [source] [discussion] 2025-08-27 07:40:22
>>bigstr+Xb
> He is the kind of guy who makes zero concessions for practicality...

Respectfully, this claim is incorrect. See this 2013 essay [0] for one example out of many where concessions are made to practicality.

Folks who are unfamiliar with Stallman's writing and the general philosophy of the FSF and/or the GNU Project might find spending an hour or so reading through some of the essays here [1] (perhaps starting with this 1991 essay [2]) to be informative.

[0] <https://www.gnu.org/philosophy/is-ever-good-use-nonfree-prog...>

[1] <https://www.gnu.org/philosophy/essays-and-articles.html>

[2] <https://www.gnu.org/philosophy/shouldbefree.html>

130. kstene+ah[view] [source] 2025-08-27 08:05:45
>>ingve+(OP)
I wonder if this would give Epic cause against Google?

https://en.wikipedia.org/wiki/Epic_Games_v._Apple

If Google controls verification, then Google - not Epic - controls who can distribute Android apps on the Epic store.

◧◩◪◨⬒⬓⬔⧯
135. fsflov+Ah[view] [source] [discussion] 2025-08-27 08:10:58
>>bigstr+bg
Stallman himself was using a laptop with a proprietary BIOS before truly free laptops became available. I don't understand how this isn't a compromise.

Also: >>45025116

◧◩◪◨⬒⬓
151. simonc+bj[view] [source] [discussion] 2025-08-27 08:29:29
>>bigstr+ch
> [H]e would prefer to see copyright abolished altogether, at least for software...

Oh? From the "Finding the right bargain" section of this 2002 essay [0]

> So perhaps novels, dictionaries, computer programs, songs, symphonies, and movies should have different durations of copyright, so that we can reduce the duration for each kind of work to what is necessary for many such works to be published. Perhaps movies over one hour long could have a twenty-year copyright, because of the expense of producing them. In my own field, computer programming, three years should suffice, because product cycles are even shorter than that.

Has his opinion changed since then?

[0] <https://www.gnu.org/philosophy/misinterpreting-copyright.htm...>

157. notpus+Zj[view] [source] 2025-08-27 08:38:17
>>ingve+(OP)
There’s a feedback form, in case anybody wants to tell Google what they think about all this: https://docs.google.com/forms/d/e/1FAIpQLSfN3UQeNspQsZCO2ITk...

Discussion: >>45030967

◧◩◪
183. tremon+1r[view] [source] [discussion] 2025-08-27 09:45:00
>>j-krie+1n
"Government overreach" by a private corporation? Let's see what wikipedia has to say about that:

> A fascist corporation can be defined as a government-directed confederation of employers and employees unions, with the aim of overseeing production in a comprehensive manner.

https://en.wikipedia.org/wiki/Corporatism#Fascist_corporatis...

Google goes even further than that: they do not only control and oversee all production via the Play Store, they also control all usage of their products. And while it may currently not be government-directed, they certainly are government-protected as long as they're allowed to run the only app store in town.

◧◩◪◨⬒⬓⬔
194. notpus+lt[view] [source] [discussion] 2025-08-27 10:04:18
>>subscr+Jn
Fidesmo Pay is another option, though the bank support is limited: https://fidesmo.com/consumer/fidesmo-pay/

Basically it’s a passive variant of smartwatch payments: you can pay with a ring, or bracelet, or a mechanical watch. The cheapest option is this plastic thingy (currently out of stock): https://eu.k-pay.com/product/mavericks

I’m thinking about implanting one into my hand :^)

◧◩◪
206. Agrail+Jx[view] [source] [discussion] 2025-08-27 10:38:57
>>simonc+Dc
> I've not seen anyone talking about the significance of the set of countries where this is rolled out to first: Brazil, Indonesia, Singapore, and Thailand

This was really interesting and somewhere there was a comment/quote that these countries are affected most with the malware distributed with side-loading, I can't find this comment now. But while trying to find some information, I found the info about 2023 Alphabet/states $700 m. settlement. It came mostly unnoticed on HN [1] (two posts, 2 comments), but there is interesting timings coincidence in the settlement text ([2])

  ...6.9.2 For a period of at least four (4) years from the Effective Date, Google will maintain the following functionality in Android version 14+ for Mobile Devices:
  (a) Google will support APIs that enable sideloaded app stores that have received User consent to install apps to avoid automatic updates taking place while the User is using the app....
2023 (settlement) + 4 years = 2027 (mentioned for other countries). This can be related to apps like F-Droid, this ruling might prevent Google from making F-Droid comply if the US was announced to meet the new rules earlier (before 2027). There are other formulas that might end up 2026/2027 when calculating so to be on the (legal) safe side, Google probably made US join later. Probably those countries are also for beta-testing both in the technical and legal sense.

The settlement might be interesting in other other respects also. Even the forces (the states, U.S Attorney) that drove the suit in 2021-2023 might join here though during this admin it's really questionable.

[1]: >>38691926

[2]: https://www.oag.state.tx.us/sites/default/files/images/press...

◧◩◪◨⬒⬓⬔
235. NoGrav+MR[view] [source] [discussion] 2025-08-27 12:58:30
>>lawn+YH
Interesting. Does this mean that it is using a lower level of Play Integrity API checking (ie not hardware attestation), or are they using the open hardware attestation API (which... exists but is almost never used)?

https://grapheneos.org/articles/attestation-compatibility-gu...

◧◩◪◨
243. ptx+U61[view] [source] [discussion] 2025-08-27 14:09:31
>>opan+Zd
I always used "adb install" to install programs on my phone from my PC. I never heard of the "adb sideload" command, but my search results [1][2] indicate that the second command is for installing things from the recovery mode, when you don't have the full Android system running. So "install" is the command for installing programs under normal circumstances using the Android installer.

[1] https://android.stackexchange.com/a/84248

[2] https://www.androidauthority.com/how-to-use-adb-android-3260...

◧◩◪
273. pabs3+bV2[view] [source] [discussion] 2025-08-28 00:24:41
>>teeker+85
The hardware and boot process for every phone is different, and some vendors block users from installing other OSes. Then most mobile apps are proprietary, and some of the apps only allow you to run them on official Google builds of Android, via attestation.

https://grapheneos.org/articles/attestation-compatibility-gu...

◧◩◪◨⬒⬓⬔⧯▣
277. notpus+Th3[view] [source] [discussion] 2025-08-28 04:18:09
>>aspenm+R92
It is possible, but very unlikely. You’ll need to know where my chip is (I guess for an average thief an implant is not the first idea of where to look for an NFC card), and then get quite close to me to pull this off. Even if you do, I think it’ll take about one chargeback to get your merchant account blocked.

> roll out tap to pay from card to phone and phone to phone

It’s already here! Stripe has supported it for a while now, and I’ve seen a bunch of other payment providers have it, too: https://stripe.com/terminal/tap-to-pay

◧◩◪◨⬒⬓⬔⧯▣▦
278. simonc+Xk3[view] [source] [discussion] 2025-08-28 04:56:04
>>bigstr+Wf1
> No harm whatsoever is done by running a piece of closed source software on your computer.

So, I'm confused. What do you believe that Stallman is right about? If there's never any harm done by running nonfree software on your computer, then what's the problem? I must have misunderstood your commentary here [0] because this statement

> The thing is... he seems to have been right the whole time. Companies really do want to lock you out of controlling the devices you own, and do so at the first opportunity. So... Stallman was right.

certainly seems like you were claiming that there are harms inherent in the practice.

> It is ideological, not practical, to say that the only reason to deviate from one's ideology is if doing so advances the ideology even faster.

Not making a concession to practicality would be saying "There is no circumstance in which one should use nonfree software. Not even in the service of replacing that nonfree software with free software.". You're simply incorrect about this... especially when you also consider point #2 of the section you've quoted from.

[0] <>>45036440 >

◧◩◪◨⬒⬓⬔⧯
281. lawn+CA3[view] [source] [discussion] 2025-08-28 07:38:54
>>dijit+LI
Yes.

The only issue I had on GrapheneOS was that I had to play with the location permissions a bit when I wanted to copy the BankID to GrapheneOS from another phone (I've got some pictures of that in this blog post: https://www.jonashietala.se/blog/2025/08/28/ill_only_buy_dev...).

All other Swedish bank accounts I've tried have also worked great (including Swish).

◧◩◪◨
285. fsflov+VD3[view] [source] [discussion] 2025-08-28 08:13:14
>>PeterS+3o
> You can see this is sort of adverserial to the FOSS way of doing things.

Example of the real-word problems with creating a FLOSS phone: https://puri.sm/posts/breaking-ground/

◧◩◪◨⬒⬓⬔⧯▣▦
287. aspenm+mY3[view] [source] [discussion] 2025-08-28 11:44:04
>>notpus+Th3
> It is possible, but very unlikely.

Life, uh, finds a way, after all.

> Even if you do, I think it’ll take about one chargeback to get your merchant account blocked.

Well, someone's merchant account might be blocked, but carders don't necessarily use their own accounts; in fact, I would doubt that many do, but criminals are often underestimating risks and overestimating rewards. It's almost a truism at this point that folks who do crime are not usually acting rationally, but I don't want to stereotype.

> It’s already here! Stripe has supported it for a while now, and I’ve seen a bunch of other payment providers have it, too: https://stripe.com/terminal/tap-to-pay

Finally! This feature is going to help a lot of small businesses in isolated areas where mobile phones are the primary (or only) computing devices that are commonly owned. This can create virtuous cycles that are somewhat unpredictable, which should help make these markets more dynamic and competitive.

Thanks for posting that Stripe link. Here's some more tap to pay links I was able to find, eventually. The search terms match too much, so it is a bit hard to disambiguate legacy NFC payment flows that use traditional or modern terminals from the new device to device payment flows. I remember hearing about Stripe's work on this feature, but since I didn't hear much after that, so I wasn't sure if the feature had ever shipped. I'm glad that this tech is getting in the hands of end users.

Apple-specific roundup of apps and vendors that support the feature:

https://apps.apple.com/story/id1620226212

https://www.apple.com/business/tap-to-pay-on-iphone/

These two are available on both iOS and Android, in case that is important for folks:

https://squareup.com/us/en/payments/tap-to-pay-android

https://www.paypal.com/us/business/pos-system/tap-to-pay

[go to top]