Most active commenters
  • charcircuit(4)

←back to thread

Uncomfortable Questions About Android Developer Verification

(commonsware.com)
400 points ingve | 16 comments | 27 Aug 25 05:14 UTC | HN request time: 0.616s | source | bottom
Show context
userbinator ◴[27 Aug 25 06:06 UTC] No.45035952[source]▶
This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile.

"debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read, 1997

replies(5): >>45035983 #>>45036017 #>>45036375 #>>45037682 #>>45048988 #
teekert ◴[27 Aug 25 06:17 UTC] No.45036017[source]▶
Why is it so complex to have a foss mobile OS.

I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that).

For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in them, is it on me? IDK, our government even has an identity app for iOS and Android. I should not be using it, I should stick to web. But its so much more convenient. I'm just weak, aren't I?

Maybe I should go for Ubuntu touch, with an iPad on the side or something. At least my most personal device is something I control then. Or just keep my Linux laptop handy (or make a cyberdeck!). But I want a computing platform that does not require carrying a bag. It's kinda sad. Even GrapheneOS (one of the most personal and secure mobile computing experiences out there)'s future is in the hands of its greatest adversary, the one that does not want you to have a personal computing experience.

replies(21): >>45036070 #>>45036112 #>>45036243 #>>45036360 #>>45036380 #>>45036382 #>>45036412 #>>45036460 #>>45036478 #>>45036483 #>>45036501 #>>45036535 #>>45036675 #>>45036711 #>>45036838 #>>45037138 #>>45037190 #>>45037762 #>>45040244 #>>45041234 #>>45046932 #
charcircuit ◴[27 Aug 25 06:26 UTC] No.45036070[source]▶
Do not forget Android is also a FOSS mobile OS.
replies(2): >>45036086 #>>45036115 #
dns_snek ◴[27 Aug 25 06:34 UTC] No.45036115[source]▶
Android is not FOSS in any sense of the word and doesn't produce any user benefits that FOSS is meant to produce.
replies(1): >>45036178 #
1. charcircuit ◴[27 Aug 25 06:43 UTC] No.45036178[source]▶
Most of AOSP is licensed under the Apache 2.0 license and GPLv2 for the Linux kernel. These are FOSS licenses recognized by the FSF.

https://www.gnu.org/licenses/license-list.html#apache2

https://www.gnu.org/licenses/license-list.html#GPLv2

replies(3): >>45036200 #>>45036241 #>>45036376 #
2. danieldk ◴[27 Aug 25 06:45 UTC] No.45036200[source]▶
I think that they are pointing at that using Android in daily life in a meaningful way requires installing Google Play Services because many apps require it.
replies(3): >>45036223 #>>45036286 #>>45036387 #
3. charcircuit ◴[27 Aug 25 06:48 UTC] No.45036223[source]▶
And my point is throwing out all of AOSP because of that is throwing out the baby with the bathwater. Whatever other FOSS OS someone comes up with won't have Google Play Services built in either.
replies(2): >>45036275 #>>45036505 #
4. dns_snek ◴[27 Aug 25 06:50 UTC] No.45036241[source]▶
Android is a proprietary operating system developed by Google. Try running your "free" modified AOSP in the real world, on a real device, like a real person would and see how far you get before being blocked and restricted due to hardware attestation.
replies(1): >>45036486 #
5. danieldk ◴[27 Aug 25 06:56 UTC] No.45036275{3}[source]▶
Oh yes, I fully agree. AOSP is the best shot at getting an alternative OS and sandboxed Google Play (like in GrapheneOS) is a good transition method.
6. BrenBarn ◴[27 Aug 25 06:57 UTC] No.45036286[source]▶
I wouldn't say that means it's not FOSS, it just means things being FOSS isn't enough to ensure things are good.
replies(1): >>45038837 #
7. pjmlp ◴[27 Aug 25 07:10 UTC] No.45036376[source]▶
AOSP is only a subset of what makes Android, an actual mobile phone OS.
8. cyberax ◴[27 Aug 25 07:12 UTC] No.45036387[source]▶
You can use microG which provides a lot of Google Play Service functionality.
replies(1): >>45036678 #
9. preisschild ◴[27 Aug 25 07:25 UTC] No.45036486[source]▶
I have been running AOSP-based LineageOS and now GrapheneOS for more than a decade now. While some apps are restricted to Google-certified operating systems, most are definitely not. I can use my countries eID apps and my banking app without issue. The only thing not working is nfc payments (since they are limited to Google Wallet)
replies(1): >>45037137 #
10. m4rtink ◴[27 Aug 25 07:27 UTC] No.45036505{3}[source]▶
Isn't AOSP developed behind closed doors, with infrequent code drops & zero community participation ?

Good luck building anything on top of that & keeping it in sync long term.

replies(1): >>45037402 #
11. umbra07 ◴[27 Aug 25 07:51 UTC] No.45036678{3}[source]▶
at the mercy of Google, yes.
replies(1): >>45043881 #
12. scheeseman486 ◴[27 Aug 25 09:10 UTC] No.45037137{3}[source]▶
It doesn't matter if it's only some apps if those apps are critical. MyGov in Australia for example requires Play Integrity or it crashes. Your government's app does not... for now.

The grip of Google, Microsoft and Apple are tightening. Microsoft's TPM requirements for Windows 11 are ostensibly for security, but they're also a mechanism to enforce hardware/software integrity and authentication. Google wants to extend their integrity APIs to Chrome and I doubt Microsoft would object to implementing something similar.

Soon enough computing and the web may end up segregated, with there being devices authenticated and controlled by a central authority and those that are not. In a lot of ways this is already the case, I can't access the 4K Netflix streams I'm paying for on Linux because of DRM and using anything other than stock Chrome can often get you flagged for annoying captchas. But it can get so much worse than that.

replies(1): >>45037811 #
13. charcircuit ◴[27 Aug 25 09:48 UTC] No.45037402{4}[source]▶
AOSP has yearly releases for the new major versions, but you can contribute code upstream.
14. preisschild ◴[27 Aug 25 10:41 UTC] No.45037811{4}[source]▶
> Your government's app does not... for now.

My govt's app did, but after bugging them a lot they removed safetynet.

15. fsflover ◴[27 Aug 25 12:40 UTC] No.45038837{3}[source]▶
This is a very misleading wording. FOSS is enough for everything unless a monopolistic megacorp forces you into their proprietary software (and your government stays silent).
16. cyberax ◴[27 Aug 25 19:22 UTC] No.45043881{4}[source]▶
???

No. microG is an ABI-compatible replacement for Google libraries, just like wine is a replacement for Win32 APIs.