With developer verification, Google’s Apple envy threatens to dismantle Android’s open legacy

Questions remain as Google prepares to lock down Android app distribution in the name of security.

See full article...

 

[Causification]

God I hate these bastards.

 

[Tactical Finesse]

It turns out when you have an operating system written by an advertising company that makes money via surveillance capitalism....they don't like it when you do things that deny them more data.

 

[macosandlinux]

It turns out when you have an operating system written by an advertising company that makes money via surveillance capitalism....they don't like it when you do things that deny them more data.

On the other hand, there has been a shitload of spyware-laden apps on Android. Yes, I know, spying for the other guys, not for Google.
I am cautiously optimistic, as the Google Play Store is really our only other option to Apple's Store front. This duopoly just sucks.

 

[SunnyD]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

 

[Yeay right]

People don't install malware because they want to do so, they are tricked to do so. More often than not, by ads. Since ad networks don't even care about manual reports then the right move is to block all ads on OS level. That isn't happening when Android development is lead by biggest advertising company in the world.

 

[85mm]

If I have to have a locked down system, I'll move to Apple. They do far better with privicy than Android. I'm only with Android in the first place because way back when Apple didn't let me swap out the stock keyboard.

 

[Tactical Finesse]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

I was on Android dev teams for my phones for over a decade. I gave up around COVID. I got tired of fighting an unwinnable war to root and ROM the phone I bought--for an experience that was more bug prone and increasingly almost as locked down as Apple in the name of "security'....all while having my data mined by the Home Shopping Network of the internet and sold to anyone with a credit card.

 

[kimbykip]

There is a difference between solving a problem for users and solving it for Google. In this case, developer verification could help shift the blame for mobile security woes away from Google.

“The problem with creating this kind of verification program is that it necessarily creates a database,” she [Corynne McSherry, legal director at the Electronic Frontier Foundation] said. “That is then going to be vulnerable to subpoenas, warrants, government demand, and sometimes private demands.

Straight to the point. I've been hearing chatter about these security changes for a while, and I really appreciate this article breaking it down. Thank you Ryan for an excellent piece of journalism!

One thing I would want to know more about -- near the end of this article, it seems like alternative operating systems like GrapheneOS aren't as affected as it initially sounded they might be from online chatter. Could anyone more knowledgeable than I elaborate on this?

I've also heard before that banking/wallet apps tend to have difficulties too, but I'm not as up-to-date on these details as I'd like, and as a layman, it's difficult to sort wheat from chaff when attempting to educate myself with info online.

Edits: clarified mid-quote attribution

 

[WildGunman]

In 2026, I kinda think open source android is a bit of a sham already. Outside of its state sponsored Chinese version, does anyone actually use AOPS for anything? It’s not exactly Darwin Unix, but it’s starting to look like it.

 

[AverageDutchGuy]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

I've stuck with Android for now (ordered a new Pixel 10 yesterday as the battery on my Pixel 5 dies in hours now ) but... I might give it another go next time. I've never been happy with the Apple products have had the displeasure of operating. They just never felt right to me and I gelled with the "flow" and operational principles of Android much better than iOS. But Google keeps making Android more and more shit. At some point things are going to break.

 

[Efw100]

Agreed

People don't install malware because they want to do so, they are tricked to do so. More often than not, by ads. Since ad networks don't even care about manual reports then the right move is to block all ads on OS level. That isn't happening when Android development is lead by biggest advertising company in the world.

Agreed, I flag spam in gmail and it’s pretty much certain to be blocked. But when I flag obvious bad faith ads in YouTube such as fake disk space warning popups I’ve seen pretty much 100% rejection of my reports by YouTube

Malware advertising is a big business for Facebook and YouTube/Google and neither are willing to shut it down

 

[Slackenerny]

I wrote an app for my wife that I side-loaded for her. Will I have to create a dev account and cough up some money to Google just so she can have it in future? We still don't have a good answer.

 

[WildGunman]

Well there's also a third way, albeit slightly more difficult:

Don't have a (smart)phone.

Yeah, it's virtually impossible because [service/job] requires us to have one.
But we should start to think about changing that requirement, no?
If anything, we could at least start having serious discussions about this, for example through forum posts or comments at certain well known tech related news outlets.

I would have called this a fanciful pipe dream 10 years ago, but I think it might actually be possible. The rise of Home Assistant has given me some cause for hope that nice things are possible without a race to the bottom. I could see a world in which we have “smart-enough” phones that can do 2FA, scan QR codes, do basic messaging and such. They’d be niche devices, where the companies making them made millions but not billions, but I could see it.

 

[Tactical Finesse]

In 2026, I kinda think open source android is a bit of a sham already. Outside of its state sponsored Chinese version, does anyone actually use AOPS for anything? It’s not exactly Darwin Unix, but it’s starting to look like it.

The thing with AOSP master.... Googlers view it as a "starting point" to build stuff with. I've chatted with a few of them and ranted to them about it.

The problem with their viewpoint...AOSP master is so buggy, to start with, it takes a team of nearly-professional developers days of work to even get the AOSP master repo to even compile nevermind the product to boot. And people with that kind of skill--don't work for free. It didn't used to be that bad back with Gingerbread where everyone could just jump in and learn....now it is. Which means, today, only very large teams of skilled devs bother with it. All the small one-man shop community ROMs are basically gone.

Which...is actually a problem that bites Google. Android used to be an applied way for newbies to learn coding and OS development--and get skills to enter the workforce with. Now they've short circuited their own skills and recruitment pipeline by making it nearly impossible to work with, just so they can lock things down and serve more ads.

 

[david1024]

What good is the bully pulpit of you don't bully?

 

[clb2c4e]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

This is where I'm at. I don't have the time anymore to tinker away with lineage etc. at the same time, I'm finding my phone something I want less and less to do with, so only need something that works for day to day apps well enough I don't need to be on it a second more than I need to.

 

[K. Langoso]

What’s the state of the Chinese alternatives?

Meaning, if I’m just building a custom app for a small team of say, postgrad archaeologists, do “something” while doing their work, that would be worth buying 20 cheap-ass Chinese devices just for that set of tasks, would it possible? At what costs (mainly effort)?

Making it clear: not caring about privacy or spycraft. This is just a theoretical curiosity.

 

[RetconRob]

You can pry Graphene+Fdroid from my cold, dead hands.

 

[jplayland]

I hate Apple and avoid all their products because they are locked down. If android goes this route, I'll be finding a new OS.

 

[jplayland]

I am actually surprised at the current app store's lack of thorough verification. So as much as I don't fully trust Google, I think unfortunately that the Play Store must be locked down. Remember that malware and threat actors are only getting more sophisticated.

Locking down the play store isn't an issue. Locking out sideloading of apps from outside the play store is the issue.

The difference between a fortress and a jail is who holds the keys. Apple has always been the jailer, holding the keys and never letting you touch them. Android let you hold the keys, it isn't a jail, yet...

 

[david newall]

For most people, Google's locked-down Android is the only choice because most banks only distribute their app via Google App Store, and only Google's locked-down Android can load apps from Google App Store.

Not Google's Android means no banking app. For banks that require you to use their app to confirm payments, or to use online banking, no banking app almost means no banking.

 

[fryhole]

In the coming weeks, Google will officially debut Android developer verification, which will require app makers outside the Play Store to register with their real names and pay a fee to Google. Failure to do so will block their apps from installation (sometimes called sideloading) on virtually all Android devices. Google says this is a necessary evolution of the platform’s security model, but upending the status quo could push developers away from Android and risk the privacy of those that remain.

In other news, the Android community reaches out to the iOS jailbreak community on tips to circumvent Google's implementated lockouts.

 

[itsaunixsystem]

It's about making you watch more ads.

 

[Tactical Finesse]

Locking down the play store isn't an issue. Locking out sideloading of apps from outside the play store is the issue.

The difference between a fortress and a jail is who holds the keys. Apple has always been the jailer, holding the keys and never letting you touch them. Android let you hold the keys, it isn't a jail, yet...

Given the process of BL unlocking and rooting your phone has become something, that unless you have a degree in computer science, you probably don't understand (and the people who have the skills to write those tools are a scarce handful of humanity)...what exactly would you consider a proverbial "jail", when even games are intentionally broken if you unlock and use your device as you should be able to?

What’s the state of the Chinese alternatives?

Meaning, if I’m just building a custom app for a small team of say, postgrad archaeologists, do “something” while doing their work, that would be worth buying 20 cheap-ass Chinese devices just for that set of tasks, would it possible? At what costs (mainly effort)?

Making it clear: not caring about privacy or spycraft. This is just a theoretical curiosity.

MediaTek chips are notoriously bad is the short answer. And usually China-market devices don't have the radios to work in the USA for basic cellular use.

 

[CWO]

I am actually surprised at the current app store's lack of thorough verification. So as much as I don't fully trust Google, I think unfortunately that the Play Store must be locked down. Remember that malware and threat actors are only getting more sophisticated.

You didn't read the article. This isn't about locking down the Play Store. This is Google wanting identifying information and a payment from anyone and everyone developing apps even if they aren't in the Play Store otherwise there will be no way to install an app from them. If you really think this will stop malware, you really know nothing about how security works. Even the Play Store prominently displays malware.

Edit: missing word.

 

[Hoptimist]

Whether it is government mandated homogenization or the corporations are doing it, it's bad for users. Android should be differentiated from iOS, and core to that was always software freedom and freedom to sideload from anywhere. I'm an iOS guy because a curated system works for me, I don't need many apps, and I appreciate the restrictions imposed by Apple on 3rd party software. But I do want to be able to make that choice, not have it made for me. Wish there were more, but two completely differentiated app ecosystems is a bare minimum.

 

[OOPMan]

I see they finally found a way to stop ReVanced...

 

[andygates]

For most people, Google's locked-down Android is the only choice because most banks only distribute their app via Google App Store, and only Google's locked-down Android can load apps from Google App Store.

Not Google's Android means no banking app. For banks that require you to use their app to confirm payments, or to use online banking, no banking app almost means no banking.

There's always web pages.

But also, just because you've got a non-google store doesn't mean you can't install the google store.

 

[Demento]

Given the process of BL unlocking and rooting your phone has become something, that unless you have a degree in computer science, you probably don't understand (and the people who have the skills to write those tools are a scarce handful of humanity)...what exactly would you consider a proverbial "jail", when even games are intentionally broken if you unlock and use your device as you should be able to?


MediaTek chips are notoriously bad is the short answer. And usually China-market devices don't have the radios to work in the USA for basic cellular use.

Yes on the radio band issues, but MediaTek make some really good SoCs these days. Dimensity 9400 is better than the Qualcomm equivalent, in that it's as powerful (within margin of error) and far more consistent due to less heat generation. They could still use a bit more work on their graphics drivers, but they work and the hardware is performant enough.

 

[saanaito]

I wish that real Linux phones were more viable.

I have Ubuntu Touch installed on a beat-up Pixel 3a I acquired a while back, and the OS seems slick. But I have no idea how much of the phone side of the equation works, and apps are barely there.

We’ve got a renaissance of Linux on the desktop, and I can only hope that this incoming lockdown will restart the Year of Linux in our pockets campaign.

 

[binaryvisions]

One thing I would want to know more about -- near the end of this article, it seems like alternative operating systems like GrapheneOS aren't as affected as it initially sounded they might be from online chatter. Could anyone more knowledgeable than I elaborate on this?

The APK verification happens in the OS, so if you have the option to unlock your phone's bootloader and install a new OS, there will be no more verification.

This assumes Google (or someone) will continue to provide phones whose bootloaders can be unlocked. This doesn't necessarily require Google to keep participating (i.e. if they decide Pixels can't be unlocked, another manufacturer could provide their own unlockable phones), but if they really want to push it, they could deny the Google certification to third parties that allow unlockable phones. And unfortunately, installing a new OS is somewhat of a higher bar than sideloading an app anyway.

Given the process of BL unlocking and rooting your phone has become something, that unless you have a degree in computer science, you probably don't understand (and the people who have the skills to write those tools are a scarce handful of humanity)...what exactly would you consider a proverbial "jail", when even games are intentionally broken if you unlock and use your device as you should be able to?

I think you're referring to the phones where you need to run exploits to gain access to root or the bootloader.

If your phone supports unlocking, installing a new OS definitely does not require a degree in computer science nor are the tools limited to a select talented few. Hell, GrapheneOS has a web based installer for it:
https://grapheneos.org/install/web

 

[lslpp]

Moving to webapps could work for some, but thats super limiting. It's times like this I wished FirefoxOS took off. We really fucked ourselves with this mobile duopoly.

 

[Tactical Finesse]

I think you're referring to the phones where you need to run exploits to gain access to root or the bootloader.

If your phone supports unlocking, installing a new OS definitely does not require a degree in computer science nor are the tools limited to a select talented few. Hell, GrapheneOS has a web based installer for it:
https://grapheneos.org/install/web

No. I was referring to the user ability to understand how things work. Not the simple availability of magic button tools. Also the community ability to even keep PhD level computer science people around to maintain those tools—which has been shown to be extremely fragile. The number of people left who can understand this stuff is tiny. It has been that way since COVID.

Android has become a Rube Goldberg machine WRT to both security and “security”.

 

[ZippyPeanut]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

"God, here I am arguing for the lesser of two evils. It feels gross."

Welcome to pretty much every choice you have in the postethics twenty-first century.

 

[darwinosx]

I switched to apple this past year after something like 20 years of android with this essentially being the moment of differentiation. I found the Android ecosystem free and less encumbered and have defended it against apple’s approach in countless conversations. But when I heard that google’s machinations were taking away my last bastion of what I felt as freedom, functionally they were no longer “better” than apple. While I have no idea how deep the truth goes, with apple actively trying to preserve privacy versus google being in the business of literally destroying your privacy, this became the new differentiator to me.

God, here I am arguing for the lesser of two evils. It feels gross.

You have been duped for 20 years and way too easily. It’s always been about google stealing and selling everything you do on your phone.

 

[jmpalk]

Well there's also a third way, albeit slightly more difficult:

Don't have a (smart)phone.

Yeah, it's virtually impossible because [service/job] requires us to have one.
But we should start to think about changing that requirement, no?
If anything, we could at least start having serious discussions about this, for example through forum posts or comments at certain well known tech related news outlets.

This isn't a "third way," this is just giving up tools and functionality that a lot of us use on a regular basis. You seem to be assuming that people only have smartphones because they're required to have them, and are ruling out the reality that many of us find them to be useful tools or platforms for tools in and of themselves.