Google is Adding Anti-Tampering DRM To Android Apps in the Play Store (androidcentral.com)

Google has introduced a small change to Play Store apps that could significantly protect several Android users. From a report: Earlier this week, Google quietly rolled out a feature that adds a string of metadata to all APK files (that's the file type for Android apps) when they are signed by the developer. You can't install an application that hasn't been signed during its final build, so that means that all apps built using the latest APK Signature Scheme will have a nice little chunk of DRM built into them. And eventually, your phone will run a version of Android that won't be able to install apps without it.

Comments

DRM

[Anonymous Coward]

Think of the children!!

Re:DRM

[Anonymous Coward]

The Gapps ate not part of AOSP, and AOSP isn't really that useful without at least having CRANIAL SUBSTITUTES for some of them. APK

p.s. => Like at least F-Droid, so I can easily install OpenCamera. I would appreciate a real package manager instead of an app "store" though..apk

Re:DRM

[Anonymous Coward]

I tried OpenCamera before and it didn't work.

There are camera apps out there that do actually work and aren't probably malware like OpenCamera.

Re:DRM

[Anonymous Coward]

OpenCamera works very well and you're a moron AC.

Good idea

[SuperKendall]

The article is dismissive of the direction this is heading, but in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow people to install something from anywhere.

As a technical user I absolutely want there to be way more open options where people with technical ability have a lot of freedom as to what they can do, and I'm sure some Android devices will continue to provide that. But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.

Re: Good idea

[Anonymous Coward]

This doesn't do any of that. It just makes it more difficult to install an app that the original developer hasn't signed off on.

Re:Good idea

[b0s0z0ku]

So hide the ability to install unsigned or non-Play-Store apps, but don't prevent it entirely. Hiding it in Developer Options after a big, fat disclaimer should be enough, frankly.

And no, the world doesn't need more Crapple-style paternalism where a bunch of do-gooding censoring pricks in Cupertino decide which apps are good enough for users to run. It's not only safety-based -- Apple has been known to ban political games or things which they find to be in poor taste.

Re:Good idea

[Anonymous Coward]

It probably isn't difficult to just re-sign the whole thing. Wouldn't fool anybody that it's signed by the original developer, but wouldn't refuse to install, either.

Re:Good idea

[WaffleMonster]

The article is dismissive of the direction this is heading, but in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow people to install something from anywhere.

Of course you can. It's done by creating operating systems not full of swiss cheese escalation vulnerabilities and giving users meaningful access controls that never devolve into take it or leave it demands of software.

Google refuses because it eats into profits of themselves and app developers. God forbid a user is able to feed fake location, address book and phone data into malware they downloaded from Google play store or restrict access to resources... App developers would riot. Owning users is the business model of the everything must be FREE app store market.

As a technical user I absolutely want there to be way more open options where people with technical ability have a lot of freedom as to what they can do, and I'm sure some Android devices will continue to provide that.

Damn straight!! The peasant class doesn't deserve no stinking freedom. They can't handle it. All Hail King Alphabet ruler of all teh Intertubes.

But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.

Good grief, let me know when all the malware in the Google app store is gone. Really perverse aspect of these arguments is the failure to understand app stores themselves are responsible for creating "race to the bottom" market incentive that only fuels development of malware and resulting 0wnage of millions of users.

This is nothing more than being as evil as possible for financial gain while blurting out "SECURITY" as justification for everything. No different than Facebook saying it needs to do cross site tracking of everyone everywhere in order to protect Facebook.

The ONLY problem is proliferation of defective operating system jails and associated access controls.

Re: Good idea

[bluelip]

It's not about security. Google is doing this to lock-in users to their ecosystem. They realize users are starting to look elsewhere for software because of the privacy issues. This step is about adding another course to the wall around the garden rather than protecting any user.

Re:Good idea

[Anonymous Coward]

But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.

Well, you'd think so. But.

https://www.bbc.com/news/technology-34338362

Re:Good idea

[Khyber]

"It's done by creating operating systems not full of swiss cheese escalation vulnerabilities"

Well, if people could fucking master the first three layers of OSI, the additional 4 afterwards wouldn't be a fucking requirement tacked on as an afterthought, and would be totally unnecessary.

Re:Good idea

[Anonymous Coward]

in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow these ignorant people to operate mobile devices without a license..

ftfy

Re: Good idea

[BronsCon]

Well if they do it, they lose the one advantage they have over iOS.

Re:Good idea

[mschwanke97402]

But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.

Agree completely.

This current proposal might not get us there by itself but it looks like Google is headed in the right direction.

Re:Good idea

[phantomfive]

Of course you can. It's done by creating operating systems not full of swiss cheese escalation vulnerabilities and giving users meaningful access controls that never devolve into take it or leave it demands of software.

I want to point out that Linux is full of privilege escalation exploits (as is every other OS.....even OpenBSD only brags about remote exploits, not the local ones), so this isn't really an option right now.

Re:Good idea

[phantomfive]

Well, if people could fucking master the first three layers of OSI, the additional 4 afterwards wouldn't be a fucking requirement tacked on as an afterthought, and would be totally unnecessary.

ok, I think you have an interesting point here, but it's not really clear what you are saying. Could you please expand it a bit?

Re:Good idea

[mschwanke97402]

in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow these ignorant people to operate mobile devices without a license..

ftfy

I think I might prefer ignorant people to arrogant. Anyway, it definitely should be possible for kids to Pokemon and mlilenials to Instagram with portable networked devices without worrying about how it all works. Smartphones have become, and should be, ubiquitous nearly world-wide because of their simplicity. You want complexity, go back to your PC.

Re: Good idea

[Anonymous Coward]

Isn't the idea to prevent someone from publishing a malware infected app while impersonating the developer?

Re:Good idea

[swillden]

The article is dismissive of the direction this is heading, but in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow people to install something from anywhere.

Of course you can. It's done by creating operating systems not full of swiss cheese escalation vulnerabilities

So, step one is to do what no one has ever managed to do in the history of widely-used consumer operating systems. You have an extraordinarily high opinion of Google's engineers. Thank you, but we're not that good. If you are, please send me your resume.

and giving users meaningful access controls that never devolve into take it or leave it demands of software.

That was done in Android 6.0, in 2015. Unfortunately, Android fragmentation means that it's not yet possible to force all apps to use it, because there are still too many older OS versions in active use. I think we should be able to do that in the next year or two, but that's only my guess, and it's not my area of expertise.

God forbid a user is able to feed fake location, address book and phone data

For address book data, I think the better solution is not to give apps access to the address book at all. Instead, give them a system API that allows them to request that the system throw up an address selection dialog, and then give them only the data the user chose. Unfortunately, that would be a huge change for the app ecosystem, so it would have to be done carefully, and even when done it would take time to roll out and convince app developers to adopt it. Also, users won't want to be restricted to only default address book management tools, so we'll still have to provide a permission that allows unlimited access, though hardly any of the apps that have address book access now would need it under this notional model.

As for fake data... I don't know. There's a lot of debate about that. I don't think anyone is philosophically opposed (and no one cares about the alleged financial considerations that you're so certain drive us), but no one really believes it will work, either. It'll just produce an arms race between fake data generators and fake data detectors. And it would also make spoofing of location-based games, etc., completely trivial, which negatively impacts the users of those games, as well as the developers. All in all, it seems like a lot of effort for little net gain, if any.

App developers would riot. Owning users is the business model of the everything must be FREE app store market.

Overstated, but not fundamentally wrong. It definitely is true that the Android team wants to serve developers as well as users, because a platform has to have both to exist. And device makers, too.

Damn straight!! The peasant class doesn't deserve no stinking freedom. They can't handle it. All Hail King Alphabet ruler of all teh Intertubes.

This is isn't the Android team's approach or perspective at all. There's a reason that Nexus and PIxel devices have always had unlockable bootloaders. It's because Google believes that technical users should have control of their devices. With Project Treble new devices are now in a state where you can flash a custom AOSP build onto any device you can unlock, without needing to worry about vendor binaries... it's taken a huge amount of work to get to that point, and while most of the reason for doing it is to fix the upgradability problem (and resulting fragmentation problem), making life easy for modders and makers of custom ROMs is part of it, too.

I host a regular conference call for talking to key players in the modding and rooting community, which the specific goal of helping my team to understand how we should best design to make their lives easier. I love to see technical users doing interesting thi

Re: Good idea

[Anonymous Coward]

"you canlt allow people..."

Who are you to "allow people" to do or not do just as they wish?

Re: Good idea

[Joce640k]

Maybe so but this will only protect "several" Android users and I'm guessing we're not on the list.

Re: Good idea

[Anonymous Coward]

Says the AC who thinks licking the anus of his neighbor's dog counts as "social contact".

Re: Good idea

[Anonymous Coward]

currently the apks are already signed. you can resign them. i guess that the future signatures will be embedded within some file in the apk, making it harder to tamper with it. I don't have the know-how as to sqy what exactly will be changed, but right now you can resign any apk and the OS will not complain. the only case where you get installation errors is when you have the same package name and different signatures.

Re:Good idea

[Anonymous Coward]

Three little words...

GO.
FUCK.
YOURSELF.

Seriously. Go fuck yourself. You're part of the goddamn problem with tech in first goddamn place. And this is from someonee who's been making the tech you fucking have no fucking clue about for three plus decades.

You don't speak for anyone other than yourself you fucking Fascist (yes). Insightful? Hardly. Ignorant and arrogant. But then, this IS /.

Re:Good idea

[AmiMoJo]

You can still install apps from outside the Play store, it's just that they must be signed as part of the final build process. Most are already anyway, and it's easy to add to your build process.

The upshot of requiring signing is that apps can't be tampered with. We have seen recently some fake versions of popular apps like WhatsApp and Pokemon and Fortnight, which are the official ones with added malware. With the signing requirement it won't be possible to add the malware, because the signature check will then fail.

They could re-sign with their own cert, but then it's very easy for Google to detect and block. Easier than trying to detect obfuscated malware, for example.

Re:Good idea

[AmiMoJo]

It's done by creating operating systems not full of swiss cheese escalation vulnerabilities

People who think that's even possible are the reason why we have operating systems full of Swiss cheese escalation vulnerabilities.

Security that relies on one layer, in this case the OS being coded securely, is not secure at all. Even if you were the first person in history to code a completely secure OS, someone would just trick the user into installing some crap or use a hardware flaw like RowHammer or Meltdown to bypass your protections.

The only solution is defence in depth. That's what Android has, it's what iOS and Windows have, it's what Linux has now.

Re:Good idea

[Anonymous Coward]

> So, step one is to do what no one has ever managed to do in the history of widely-used consumer operating systems. You have an extraordinarily high opinion of Google's engineers. Thank you, but we're not that good.

On the one hand, you are right it is unrealistic. On the other hand, anyone that followed the original "Stagefright" had a distinct feeling that it's not just "not that good", but rather "0 experience in secure coding" (letting slide the original bug, the fix didn't really fix much, and it got through multiple levels of code review, which it absolutely SHOULD NOT HAVE if any of the people reviewing had had some experience with basic integer overflow issues).
Unfortunately I suspect most people who learned all that have had enough of teaching the same thing over and over and over with security really improving. I nowadays stick to writing angry letters to banks and newspapers about them not even following basic best practices and then blaming the users for when it blows up. There's millions to billions at stake and yet STILL nobody gives a shit.

Re:Good idea

[Anonymous Coward]

The upshot of requiring signing is that apps can't be tampered with. We have seen recently some fake versions of popular apps like WhatsApp and Pokemon and Fortnight, which are the official ones with added malware.

We have also seen apps modified to not show ads, and Google doesn't like that one bit.

They could re-sign with their own cert, but then it's very easy for Google to detect and block. Easier than trying to detect obfuscated malware, for example.

Not easy at all. Creating a cert can be automated. This means that the only way to reliably block that kind of thing would be to only allow apps signed by a cert granted by Google, or at least stored with Google.

Re:Good idea

[Anonymous Coward]

Something about an old network protocol that lost to TCP/IP because it was so horribly designed that you could never get two devices from different manufacturers to speak together.

Re:Good idea

[mjwx]

So hide the ability to install unsigned or non-Play-Store apps, but don't prevent it entirely. Hiding it in Developer Options after a big, fat disclaimer should be enough, frankly.

I believe this already exists and is off by default... At least in vanilla Android.

And no, the world doesn't need more Crapple-style paternalism where a bunch of do-gooding censoring pricks in Cupertino decide which apps are good enough for users to run. It's not only safety-based -- Apple has been known to ban political games or things which they find to be in poor taste.

I agree and I dont think this move is intended to implement an Apple style of 1984 content controls. Its just adding a system of verifying an applications authenticity.

Re:Good idea

[Anonymous Coward]

The upshot of requiring signing is that apps can't be tampered with. We have seen recently some fake versions of popular apps like WhatsApp and Pokemon and Fortnight, which are the official ones with added malware.

We have also seen apps modified to not show ads, and Google doesn't like that one bit.

Yeah I don't like entitled behavior from users either.

Re:Good idea

[Excelcia]

I'm not sure what I find more frightening. The fact that you are writing, ostensibly seriously, about reducing freedom being a good thing all around, or that four people modded that up. That's seriously disturbing, especially here.

DRM doesn't add end user security. It only adds central control where a single entity, one who's end motivation is not security but profit, has 100% of the decision making capability of what can end up on your device. Software-as-a-service, mandatory remote updates, and walled-garden DRM are the holy triumvirate of a loss of local decision making authority and corporate and state control. In an age where computing devices are becoming more and more not just a luxury but an absolute necessity, where computing devices are integrated into our lives, do you really think it's a a good idea to cede our freedoms like that? The more integrated electronic devices become, the more important it becomes to assert the supremacy of the user's decision.

Re:Good idea

[Khyber]

https://blog.finjan.com/applic...

Re:Good idea

[barc0001]

> Hiding it in Developer Options after a big, fat disclaimer should be enough, frankly.

You'd think, but then you haven't dealt with some end users. A percentage of them would happily follow a tutorial on disabling that in order to install this "cool new book reader/movie streamer/whatever" if asked by a popup.

As for the disclaimer, I used to work at a software company for a packaged software product. The type of database the application used destroyed records immediately so unless you had a backup, the records were GONE. In order to prevent people from accidentally deleting records in this application, when you clicked delete or hit the delete key on the keyboard, the application would pop a dialog asking to confirm that you were sure you wanted to delete the selected record(s). If the user hit yes, a second bigger more scary looking dialog popped up and said effectively "This is irreversible and the records will be fucking GONE GONE GONE. Are you REALLY SURE?" *and* we moved the default focus on the button from 'yes' in the first dialog to 'no' for the second, so if someone just mindlessly rammed the enter key twice, it would back out of the delete instead of killing the records. You want to guess how many calls a day we got from distraught users frantic about restoring deleted records? A lot.

Re:Good idea

[Anonymous Coward]

Nice try, but if Google really cared about supporting open development, custom ROMs, etc., you wouldn't have:

- Eliminated the ability to have 3rd party process managers that can access all the info about processes through /proc (while conveniently system_server still can). The correct answer to a security concern would be to make it a permission, but then you couldn't take away user freedom through false claims of security needs.
https://issuetracker.google.co...

- Same thing with eliminating the ability to get BATTERY_STATS permission without complex adb workarounds. Because how dare a user want to use a custom app to access battery stats.
https://forum.xda-developers.c...

- And most telling is the absolute abomination that is SafetyNet. Pure user restriction in the name of security -- preventing use of important apps unless the user deigns to use a ROM that is in the exact state Google wants it to be. If it were really about protecting the user from unknown malware, you would have a way to do custom signatures so the user could define what they consider "clean". But of course, that's not really the point. The point is to limit user freedom, and also to let apps dictate whether users can do things like spoof locations, take screenshots, etc.

Re:Good idea

[Anonymous Coward]

> But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.

That's why tech illiterate and basically IQ 40's just get an iPhone. Leave Linux to actual Earthlngs with clues. Android is Linux do not forget.

Re:Good idea

[Rakarra]

The article is dismissive of the direction this is heading, but in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow people to install something from anywhere.

I'm not really sure why not, considering the vast majority of people, including just about everyone who doesn't know what they're doing, already don't know how to just install something from anywhere. That's a feature that has to be unlocked in the developer options, otherwise it's just going to go through the play store and not allow side loading. It's not like we've reached this situation where average every day users are just loading apps from random websites. That's not happening. It's a solution that is in search of a problem, which makes me think the aim of all of this is not exactly what is being presented to us.

Re:Good idea

[datavirtue]

Human beings are incapable of building an operating system or any significant software without being full of swiss cheese escalation vulnerabilities and bugs.

Re:Good idea

[datavirtue]

Application security...if done properly would not need to fall back on the lower layers of the OSI model to pick up the slack you dumb monkey.

Re:Good idea

[tepples]

Define "gone". If your definition is "zero", then no app distribution channel of any size will ever reach it. Google Play has extremely low rates of PHA (potentially-harmful apps -- a somewhat broader category than "malware") now, and it's being driven down year by year.

I'd start by defining "gone" as the probability of encountering a PHA on Google Play Store being less than that on Apple's App Store during the same month.

Re:Good idea

[swillden]

Define "gone". If your definition is "zero", then no app distribution channel of any size will ever reach it. Google Play has extremely low rates of PHA (potentially-harmful apps -- a somewhat broader category than "malware") now, and it's being driven down year by year.

I'd start by defining "gone" as the probability of encountering a PHA on Google Play Store being less than that on Apple's App Store during the same month.

Do you have evidence that it is not? Serious question. AFAIK, both stores regularly have PHA, but I'm not aware of any good anlayses of the relative frequency.

Re:Good idea

[Anonymous Coward]

That osi layer shit is and always has been a kludge for stupid people. There is nothing to master. Real programmers push and pull bits right off the transistors. The rest of you need a "compiler" and a "language" and an "development enivironment".

You aren't as badass as you think you are.

How will sideloading work?

[b0s0z0ku]

Right now, you can sideload by clicking through a disclaimer. Will you still be allowed to sideload unsigned apps (say, for your own testing)?

What about installing an older version of an app if your version of Android doesn't support the new one? Will this be used to enforce regional restrictions (i.e. Facebook Messenger Lite is much less intrusive than the full Messenger, but isn't available in the US Play Store)?

Re:How will sideloading work?

[Anonymous Coward]

google is trying to wall the garden in like apple (has mostly been able to do).

soon only approved and signed software of any kind will run.

rooting your device will be a thing of the past.

side loading will be a thing of the past.

as google pushes more for delivering updates themselves instead of relying on hardware or carrier partners, expect the (forced upon you) updates to kill any hacking or rooting you've done or 'unauthorized' apps you've managed to install.

having any control of any kind over YOUR hardware will be over.

developers will probably be able to purchase a dev kit to run apps they, and only they, are working on.

expect a similar treatment for chrome browser and chromebooks.

Re:How will sideloading work?

[110010001000]

Expect a similar treatment for ALL COMPUTERS and devices connected to the Internet. Don't think it will happen? Just wait.

Re:How will sideloading work?

[Anonymous Coward]

That's not clear -- Chromebooks seem to be moving in the direction of being less crippled, not more crippled (for now). If this does happen, one can hope for a 9.0 quake to hit the Bay Area and erase both Apple and Google HQ in one powerful temblor :D

Re: How will sideloading work?

[Anonymous Coward]

which is why people are working on android / apple / javascript / browser alternatives. Google is an old extractive company. ditto Apple and all the web/browser based mega-sites. It's about non consensual exploitation, and control. Control over people, politics, and society itself.

None of the real developer energy is in these efforts anymore. None of the really creative libertarian freedom lovkng minds cares about them.

These corrupt institutions will fail, because failure is the only thing, besides suffering and injustice, that corruption "creates".

That's not my opinion. That's cosmic truth.

Re:How will sideloading work?

[Anonymous Coward]

It won't, and for very good reason: Google is taking all the heat from youtube videos instructing kids to download apps and side-load them to bypass the play store restrictions. Kids get their phones pwnt. Parents direct anger at Google. This is Google responding.

Re:How will sideloading work?

[Anonymous Coward]

> google is trying to wall the garden in like apple (has mostly been able to do).

This is a stupid strategy. If they succeed then you'd be better off buying an iOS device anyway.

Yes, only "several" will be protected

[macraig]

And the rest of us must suffer the mighty fist of dictatorial oppression?

Re:Yes, only "several" will be protected

[b0s0z0ku]

The problem is when all of the large device makers end up cramming this filth down their users' gullets.

Re: Yes, only "several" will be protected

[Anonymous Coward]

Found the Google shill!

Open source

[Anonymous Coward]

Android is open source. Good luck with that.

Re: Open source

[Anonymous Coward]

Lol, how naive

Re: Open source

[Anonymous Coward]

I didn't say Joe Dumbass wouldn't be running the locked down version, but any script kiddie can run a version of Android that's hacked up down and sideways to run whatever he wants.

Re:Open source

[Anonymous Coward]

Could you give the source of Google services package, which is need by anything more than a hello world application in Android?

APK Signature Scheme?

[b0s0z0ku]

APK Signature Scheme = A.S.S. Not the best choice of acronym.

Re:APK Signature Scheme?

[usu4rio]

There's nothing to worry about. After all Google's motto is "don't be evil" ... oh wait!

Re:APK Signature Scheme?

[Anonymous Coward]

It's a hosts file scheme, not a signature scheme.

Re:APK Signature Scheme?

[BronsCon]

That name is just to assure us that there will be a giant hole in the middle of it.

Nonsense. Just enable "other sources".

[Anonymous Coward]

I install my APKs from whatever source I want. And so do the people that I assist.

Firms can fuck right off with their nanny dictatorship and with treating us like retards until we are!

I can hardly believe

[Anonymous Coward]

That play store apps were not signed already. How is this news?

AOSP is, to be precise. But you are right.

[Anonymous Coward]

The Gapps ate not part of AOSP, and AOSP isn't really that useful without at least having substitutes for some of them.

Like at least F-Droid, so I can easily install OpenCamera. I would appreciate a real package manager instead of an app "store" though.

Re:AOSP is, to be precise. But you are right.

[b0s0z0ku]

Actually, not being forced to Stink with Google's Clown (Sync with Google's Cloud) is an advantage for some Android users. Things like GMail work fine in a Web browser or even over IMAP-secure.

Re: AOSP is, to be precise. But you are right.

[Anonymous Coward]

If you have to explain your *hilarious* wordplay it's already failed.

Re: AOSP is, to be precise. But you are right.

[b0s0z0ku]

It's not meant to be hilarious -- it's meant to be an expression of utter contempt towards the "Cloud" and the corporate scum who are attempting to nudge users to give them their personal data.

Nah

[rossdee]

I don't buy Apps from Google Play, I buy them from Amazon.

Re: Nah

[Bing Tsher E]

To expand on your message since there are people not aware of the details, you can get a brand new Android device, or factory reset an old one, and never ever set up a Google account on it.

If you want an alternative app store, configure it to load apps from 'unknown sources' and download the Amazon app store (or others that are available) which is an installable apk file. Then you log in with your amazon account and can install most of the important Android apps without ever touching Google's servers with a logged in account.

There are lots of other places to download apk installers as well, to run without an 'app store' at all. None of this is new to a lot of slashdotters, but it's not common knowledge to the world at large.

Re: Kendall is a moronic faggot who has no idea

[Anonymous Coward]

Im repub and against everything the Ken-doll is about. Dont lump us all in. Bad bad

Self-fulfilling idio(crac)y!

[Anonymous Coward]

The only reason people behave so damn retarded with regard to computers ... and I mean on a level that qualifies as literally mentally disabled ... is because tech firms have treated people like non-independent retards until they were.

Does nobody of those morons realize that whenever you make things "simper" (actually just more limited and dumber), people will just slack off even more, resulting in the Gaussian distribution curve going down, so that there is a new, even dumber, and hence even louder, more confident and more self-entitled lower end of that curve?!
Don't they realize the vicious downward spir this causes?? Or is it merely deliberate?

Re:Self-fulfilling idio(crac)y!

[Computershack]

The only reason people behave so damn retarded with regard to computers ... and I mean on a level that qualifies as literally mentally disabled ... is because tech firms have treated people like non-independent retards until they were.

No, its because there are millions of people using computers today who just 25 years ago wouldn't have the basic knowledge to even work out how to put the system they'd bought together, let alone how to get online. Once upon a time using a computer required a reasonable amount of technical knowledge or at least an IQ sufficient enough to learn.

Re:Self-fulfilling idio(crac)y!

[Anonymous Coward]

No, its because there are millions of people using computers today who just 25 years ago wouldn't have the basic knowledge to even work out how to put the system they'd bought together, let alone how to get online. Once upon a time using a computer required a reasonable amount of technical knowledge or at least an IQ sufficient enough to learn.

The grandparent was right. You are wrong because you are a part of the problem. I.e. You keep giving the idiots an excuse to continue being idiots and not have to improve themselves. See also the US education system where getting a "C" is celebrated if the idiot got a "D" last time. And you want to know why the US educational system sucks.... Look in the mirror, you'll find your answer there.

OH, and btw. It's not a toaster. It's not even close to a toaster and should never have been even remotely compared to one. Let alone mandated that they should all work with such oversimplification.

Re:Self-fulfilling idio(crac)y!

[Anonymous Coward]

All you computer geeks who really know your computers, but can't change a tire or design an airplane, please desist from using any mechanical devices. We can't have non-independent retards like you taking advantage of other people's specializations.

Re:Self-fulfilling idio(crac)y!

[Anonymous Coward]

See also the US education system where getting a "C" is celebrated if the idiot got a "D" last time.

A grade of C is an average grade. It's by definition the grade that most persons taking a course ought to receive. However, because of grade inflation and dishonesty many students receive B or A grades instead. There ought to be nothing wrong with a C, but because we prefer to be dishonest here in America we don't allow the average grade to be given to the average student.

Re:Self-fulfilling idio(crac)y!

[Anonymous Coward]

In some grading systems, a grade of C is an average grade. It's by some definitions the grade that most persons taking a course ought to receive

.
FTFY.

Also, for two different types of average, it's entirely possible for not one single person to receive the "Average" grade.
Also, any grading system based on a bell curve is meaningless. Grading should be relative to expected competencies, not to how well the other drop-kicks in your year performed.

Re:Self-fulfilling idio(crac)y!

[Anonymous Coward]

No, its because there are millions of people using computers today who just 25 years ago wouldn't have the basic knowledge to even work out how to put the system they'd bought together, let alone how to get online.

<Insert Car Analogy Here>

Once upon a time using a computer required a reasonable amount of technical knowledge or at least an IQ sufficient enough to learn.

You'll be horrified to learn what sorts of real, destructive things you can learn by reading books from your local library. Hell, in generally "reading" is just the gateway drug for those who don't have "a reasonable amount of technical knowledge" nor "at least an IQ sufficient enough to learn". Except, of course, they are sufficient inlligent to learn.

The trouble isn't an inability to learn. It's a general unwilligness to learn, vis-a-vis said car analogy. The answer isn't to weld the proverbial hood shut. It's to teach people well enough what is safe and not safe to do, when they should look under the hood and do things themselves, and when it's wise to seek outside support. As pointed out, simply putting the installation option in a sufficiently obscure place and teaching people to not install stuff is the answer.

The real problem? There's too much malware on the Google Play store, and Google encourages people to install apps off there. Add to that the issue of vulnerabilities in Google's software and the consistent push for updates to try to overcome these flaws. Put another way, the issue is less that people are stupidly installing software that doesn't have DRM validation bullshit. It's that Google is stupidly writing software that will be able to install itself even with the DRM validation bullshit.

Until Google can fix their end, the notion of sealing up the engine compartment is patently absurd.

Re: Self-fulfilling idio(crac)y!

[Anonymous Coward]

Actually different people have different skill sets. You cannot expect an accountant to havevthe know-how that is required for a windows/Linux installation or partitioning. This change might be a good thing. Try to keep an open mind

Re: Self-fulfilling idio(crac)y!

[datavirtue]

Odd...I was taught these very things by an accountant.

I'll ask the obvious...

[110010001000]

I seem to remember that developers need to sign their apps already (and have for many years). What am I missing?

Re:I'll ask the obvious...

[Anonymous Coward]

Google will now support an app bundle. One of the benefits is that Google will send an APK optimized for each user device. So, if I have a device with hdpi screen density, on ARM64, in English, then I get an APK with only those resources. Whereas, a device with xxhdpi, x86-64, and Spanish would get a different APK for the same app.

It saves download time for the user (making for a happier user) and saves Google bandwidth. I think it was at I/O 2017 that they mentioned serving up like 6 PB per day. So, I can imagine some real savings for Google doing this.

The DRM may end up being abused, but the app bundle format that facilitates it, is nice for everyone.

Re:I'll ask the obvious...

[Anonymous Coward]

If you download an APK from the Play Store then email it to all your friends, they have a copy with Google's metadata on it. Metadata of the developer, not metadata of the purchaser. If the metadata included the purchaser's account info, then you'd have DRM.

Re:I'll ask the obvious...

[b0s0z0ku]

What if the metadata tells the app not to install on (say) devices outside of certain countries? Would region-restricting be DRM in your book?

Re:I'll ask the obvious...

[Anonymous Coward]

May be abused? "MAY"?!

The entire purpose of this is to lock you in and prevent you from changing anything that google does not want you to change.

Re:I'll ask the obvious...

[complete loony]

Android used to use jar signing, which adds a file of signatures to the zip file. Then they build their v2 signing process, which adds a new block to the zip file between the compressed contents and the directory listing, signing the file hash of the rest of the zip file, directory listings and everything.

Now when you publish to the play store, google are inserting another signature into this v2 signature data block, indicating that this apk was published.

AFAIK this will simply extend their default "play store apk's only" detection to sideloaded files.

Of course it opens the possibility of sideloading an old vulnerable version of an apk...

Re:I'll ask the obvious...

[complete loony]

Another probably relevant thought. Google recently added the capability to upload your developer signing key, so they can produce apk's with irrelevant assets stripped out. I assume that this feature causes problems for people trying to share apk's between phones. Hence the need to add some extra data to a stripped apk to test compatibility.

Re:I'll ask the obvious...

[Anonymous Coward]

Anybody who uploads their secret key to Google deserves any malfeasance that may result.

Re: Kendall is a moronic faggot who has no idea

[Anonymous Coward]

I don't. There are good Republicans left in this country, it's just too bad I can count them on one hand these days. The rest are completely spineless nazi cucks like Kendall.

Hey Hey APK

[Anonymous Coward]

Hey Hey APK
How many host files did you update today?

Not DRM

[Luthair]

Adding an origin signature simply helps prevent the spread of malware as a device can verify that it is a legitimate package instead of some compromised apk. This has been an issue for a long time even in the west where users have internet access (fortnite apk!1!) and has been much more problematic where people have limited and expensive internet.

Re:Not DRM

[Anonymous Coward]

Except this is pointless unless your intent is to require that all signers be pre-approved in the future. Otherwise it's just checking that the signature that's on the apk data, matches a key that was also in the same apk. See the part about the digests must match the signers in the apk here. Also, nice chopping up of the ZIP format again, that's not going to cause parsing bugs anywhere now is it?

Malware still spreads with this, the only difference is that it's not able to claim itself as another package. Which malware authors already can't do easily, and wouldn't want to anyway. Less the Play Store "updates" the malware infested app with the legitimate one thus removing the malware.

As I already said, the only thing this is good for is a future requirement of the signer's identity being pre-approved before installation. Such a scheme is ripe for abuse, I can easily see more repressive regimes around the world mandating only their lists be allowed. Nevermind US carriers wanting to demand the same to help lock in profits. I.e. No more tethering app for you. It is DRM, it's just not fully baked yet.

Re:Not DRM

[Luthair]

Except this is pointless unless your intent is to require that all signers be pre-approved in the future. Otherwise it's just checking that the signature that's on the apk data, matches a key that was also in the same apk. See the part about the digests must match the signers in the apk here. [android.com]

If you read their blog post it seems clear that the signature will come from Google Play itself not some random signer.

Also, nice chopping up of the ZIP format again, that's not going to cause parsing bugs anywhere now is it?

How is that relevant exactly? If someone wants to crack open an APK they can make sure their parser works correctly with the format instead of relying it being similar to a zip.

Re:Not DRM

[Anonymous Coward]

The point is essentially, you don't need to enable install from thirdparty repos if you install an APK that is also available on Google Play.
That means people sharing apps between users, or using apkmirror etc. because they don't want to use the Play store etc. shouldn't need to enable third-party repos. And have a chance to notice is someone tries to give them a manipulated version instead of the original.
While it MIGHT be a path to a walled garden, it CAN also be a way to make other distribution ways both more available and safer.

Now you know your malware is legitimate.

[NextApp]

This does nothing to solve the malware problem on Android, because the malware is being distributed by "legitimate" vendors directly on the Play Store.

I get complaints of full-screen video ads in my ad-free apps from users who have never side-loaded anything. Malicious apps are launching them from the background, which is against the TOS, but technically trivial to do. If they get caught, they either call it a bug or start another company/product-line.

As far I can tell, Google promotes the highest revenue generating apps...so the dirtier the tactics you use, the more you succeed.

The bad apps do take a beating on reviews from legitimate users, but this is worked around by the developers posting massive quantities of fake reviews. It's presently somewhat easy to spot, legit apps will have reviews that are generally 1-3 sentences long, while fraudulent ones will have pages of 1-3 word reviews (often clustered together). Google doesn't seem to care though, as even some of the most popular apps are doing this to counter backlash from ever more ridiculously aggressive in-app advertising.

And then of course there's the problem that the average app today is so invasive of privacy that it would have been deemed outright malware ten years ago.

Re:Now you know your malware is legitimate.

[thsths]

I completely agree. Even generally nice and useful apps are using so many dark patterns that they technically have to called malware. And this is all perfectly "normal".

Re:Now you know your malware is legitimate.

[swillden]

Malicious apps are launching them from the background

If you know of any such apps, please report them.

Re: Now you know your malware is legitimate.

[houghi]

My malware was already on my phone and I can not even remive it. They are all g om Goigle. I do not need, hanhout, gmail, youtube, docs, druve sharing, chrome and all th rest.

Re: Now you know your malware is legitimate.

[Anonymous Coward]

You should report your keyboard app as Malware.

"eventually"

[Anonymous Coward]

Is that the same "eventually" as in the predictions some 15 years ago that TPMs will "eventually" lead to not being able to install the OS of your choice on computers you own?

Re: "eventually"

[Anonymous Coward]

It's a bit harder to install alternative operating system on newer computers. It's now at a point where only nerds would bother. Operating systems are so similar now.

Kill switch?

[rsilvergun]

that's why Mozilla started signing apps. It gives them a kill switch in case a plugin author sells their plugin to someone dishonest. There's been a few moderate profile cases of it happening (nothing more than a few hundred thousand users, which sounds like a lot until you realize how many FF users there are).

Re:Kill switch?

[usu4rio]

I trust Mozilla more than Google

Re:Kill switch?

[Anonymous Coward]

I trust Mozilla more than Google

Naive. People from anywhere literally Google, FBI, NSA, CIA, etc get jobs at all of these organizations as a matter of routine.

eg. FBI in Debian Linux in spades. They killed Ian Murdoch for no back door permissions.

Uh, what's the DRM angle here?

[Anonymous Coward]

I'm trying to understand how this is DRM, but I don't really get it. It just makes sideloaded APKs recognizable/updatable by the Play Store. The only DRM angle I can see is if they start blocking the sideload of apps that have region restrictions on the Play Store, which would be shitty. But that doesn't seem to be what people are worried about, so what gives?

Good

[Anonymous Coward]

As a developer I think this is a good thing. My apps keep appearing in other stores and I don't know if the apkin those sites has been tampered with or not. It was nice when I could roll out apps and updates to apps almost instantly, but I understand that for security reasons they need a bit of time to check that my app isn't harmful. Android has taken a beating in the press for a while now with regard to malware, so it makes sense for Google to tighten things up and show that their OS can be secure. To be honest, it may be too little too late though.

Keep turning those screws, Google

[nightfire-unique]

We - the engineers who wrote the software your company uses to generate profit - are watching. Screw us out of our own systems, and we will replace you, as we did those before you.

A new feature came out

[Actually, I do RTFA]

Will you still be allowed to sideload unsigned apps (say, for your own testing)?

Coincidentally google just released a "special internal test build" track in the Google Play store that doesn't go through malware scanning and "is only for use within your organization", but has a much faster go-live time.

Seems appropriate to me

[Leslie43]

Since it really does very little (if anything) for security anyhow.

That is an excellent point

[SuperKendall]

That proves my main point - even developers, who are extremely apt with technology and computers, managed to use 4000(!) copies of Xcode downloaded from a non-Apple source to build production versions of applications.

That's why defense in depth is so important a concept to adhere to - none of the apps affected by that could affect other apps, all they could do is obtain information each application was allowed to access (and even then it seems that ever happened).

The App Store signing is just one of many layers, but a great first layer that has protected millions of apps and users from harm.

Apple noticed it and fixed it quickly... but attacks like that are way as many layers of defense as possible are important.

Oh kid... we didn't have a clue eiter...!

[Anonymous Coward]

My dad can be described as a real moron, yet he used a PC back in the DOS 2.0 days.

You know how people did it?

THEY LEARNED!
Instead of being self-entitled retards who *demand* to be spoon-fed and keep their brains in "voter" mode (aka passive-thinking livestock).

My dad just sat down, and got into it!
Everyone did. With everything!
And they were let too! Instead of stating safety "reasons".

Every non-mentally disabled human can code in C, build a cirquit, make soap, breed livestock, fix and drive a car, build a house, etc, etc, etc!
You lazy fucks just lay down in your molds of total retards and use that as an excuse to never EVER start thinking. (Seriously, I have seen people prefer getting physically violent or pay thousands of dollars, just to avoid a minor case of turning their brains on for once in their pathetic existences. And yes, you can get graduate with a pure stream of memorize-and-play-back.)

But hey, as we recentl learned again, the average western human nowadays has an IQ that is equivalent to and IQ of 70 in the 1970s. Making people officially mentally retarded.

"Antitampering" + "Antivir" built-in ages ago

[Anonymous Coward]

See subject & a technique that does that in an executable that functions vs. both disassembly & built-in antivirus http://it.slashdot.org/comments.pl?sid=158231&cid=13257227/ since no virus is 1 byte in size (traditional type that attached to an exe @ tail end to alter function jmp tables with its own malcode instead).

* Google - ALWAYS a MILE behind me...

APK

P.S.=> PLUS, stealing MY initials (with which I did development as far back as 1994 online with no less - "imitation (on BOTH fronts noted) is the SINCEREST form of FLATTERY" if not thievery for the NO LONGER "Do No Evil" company (a CIA seedmoney operation, nothing more)... apk

Joogle tries make an ASS out of me? apk

[Anonymous Coward]

See subject: In the end I make an ass out of 'em stealing my initials I was born w/ & coded online w/ APK since 1994 + this https://tech.slashdot.org/comments.pl?sid=12270256&cid=56840068/ too!

* :)

APK

P.S.=> It's NOT EASY being "World-Class" (lol, like ME) - so much SO, that Joogle STOLE my initials I was BORN with & now they're pinching off my exe protection tech too... apk

Re:Joogle tries make an ASS out of me? apk

[Anonymous Coward]

No they aren't trying to make an ass out of you. You do that just fine on your own with your spam and BS.

When APK calls himself world class he isn't lying, he is a world class bullshitter and spammer. It takes a lot of effort to say nothing of value with as many words as he spews out.

not DRM

[Anonymous Coward]

DRM is used to verify that the intended user has the rights to use a product or service. Calling APP signing DRM is a misrepresentation. This is instead a security measure, heck signing a file is part of the PGP specification. Besides how hard is it to generate a signature ans self sign a file?

Re:Better than looking like an ILLITERATE assHOLE

[BronsCon]

Uh... that wasn't me, dipshit.

Re:Better than looking like an ILLITERATE assHOLE

[BronsCon]

Hey dipshit, wasn't me.

when I posted it before here [link to the post you're replying to for the second time]

Uh...

LAME & WEAK - another method from me

Indeed, another lame and weak method from you...

also a PROTECTIVE TECHNIQUE I use in my hosts file engine

So you invented the digital signature? Or is it someone else's invention and work that you're using, much like the hosts file and the host lists you concatenate, while bitching about people using your initials as though you're the only APK in the world? Here's a hint: you're not, and many of them are far more notable and recognizable than you.

Re: Kendall is a moronic faggot who has no idea

[Anonymous Coward]

Fuck you, you faggot INCEL traitor Russian Chinese socialist communist fascist Nazi leftist alt-right obese scrawny gay POOPY-HEAD!

break up Google

[Reverend Green]

Big Brother Google is too big, too invasive, too untrustworthy. It's time for Uncle Sam to get out his trust-busting stick and break up Google/Alphabet.

Maps - separate company
Search - separate company
Surveillance / "advertising" - separate company
Android - separate company
Chrome - separate company

Re:break up Google

[johnsie]

Yeah, let's do that. Just because one paranoid person on Slashdot hasn't taken his meds.

Re:break up Google

[Anonymous Coward]

Being untrustworthy is not a reason to break up a company.

The problem is, for everything other than search, Google has quite a bit of competition. Simply being a "big" company isn't a reason to be broken up.

If you dislike the invasiveness of tech companies, I believe the only solution is legislative. Europe is trying this with the GDPR. Google's advertising practices aren't really any worse than anyone else(even though they're still terrible). Again, not a reason a "trust-busting stick" is an appropriate response.

Android is in a duopoly with Apple's iOS. Not sure the mobile phone market can support more than a few mobile OSes anyways.

Chrome? Really? Do Firefox and Edge no longer exist?

There are countless vendors in the geospatial imaging business that are doing pretty good.

I'm not sure you can make a solid case that Google is abusively tying all of these products together. There isn't any real competition in the search business. I don't think their domination of search allows them to use that towards abusive ends to prop up their other products. Surely one can search Google from an Apple iPhone running Safari.

I think you'd have a pretty bad anti-trust case here. Being a crappy, untrustworthy company isn't against the law. No matter how much you want it to be. The government has no interest in destroying companies that employ their citizens. Especially a company like Google with well above average salaries. Why doesn't this make sense to some people?

Re:break up Google

[Anonymous Coward]

Um....Dude.

Uncle Shitstain IS Google/Alphabet.

Re:break up Google

[Anonymous Coward]

Pastor Peen the Pedofile is just karma-whoring, he DGAF about google. The guy is actually a fascist himself.

Re: Trump is adding years to his LIFE SENTENCE

[Anonymous Coward]

Heil Hitlary!

UNTRUE & I've done something like it...

[Anonymous Coward]

See subject: ... for decades & it WORKS vs. disassembly/'tampering' + as "built-in" antivirus https://tech.slashdot.org/comments.pl?sid=12270256&cid=56840068/

* I use it in my APK Hosts File Engine 2.0++ 64-bit for Linux https://science.slashdot.org/comments.pl?sid=12252144&threshold=-1&commentsort=0&mode=thread&pid=56816690/ & also in the Windows model before it also that did well here & worldwide (plus for code I wrote back as far as 1994 to present too for those very purposes).

APK

P.S.=> It's NOT EASY being "World-Class" (lol, like ME) - so much SO, that Joogle STOLE my initials I was BORN with & now they're pinching off my exe protection tech too... apk

LOL! Hey, all Joogle does is copy me... apk

[Anonymous Coward]

They PINCHED my initials I've used in code since 1994 online & also a technique of mine (done it for ages) https://tech.slashdot.org/comments.pl?sid=12270256&cid=56840068/ for protecting exe files vs. alteration/tampering/disassembly + that functions as BUILT-IN AntiVirus!)

* I use it in my APK Hosts File Engine 2.0++ 64-bit for Linux https://science.slashdot.org/comments.pl?sid=12252144&threshold=-1&commentsort=0&mode=thread&pid=56816690/ & also in the Windows model before it also that did well here & worldwide (plus for code I wrote back as far as 1994 to present too for those very purposes).

APK

P.S.=> It's NOT EASY being "World-Class" (lol, like ME) - so much SO, that Joogle STOLE my initials I was BORN with & now they're pinching off my exe protection tech too & TRIED "downmod hiding" this very post 2x https://tech.slashdot.org/comments.pl?sid=12270256&cid=56840112/ & https://tech.slashdot.org/comments.pl?sid=12270256&cid=56840496/ - Clue: 'm TOO STRONG for you JOOGLE & your minions, lol, OVERRIDING your CHEAT METHODS ... apk

Ordinarily I'd say YOURE RIGHT, but (lol)... apk

[Anonymous Coward]

See subject: All you FAKE NAME for your FAKE LIES of so-called "LIVES" are ALL THE SAME, lmao! Truer words were never spoken on /.!

* + there IS this from you (1 redeeming quality of yours -you = HONEST my works ROCKS):

"I've never tried to belittle (APK's work), I've flat out said it's good" - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263)

THANKS FOR THAT MUCH & since you like the Windows model (perfectly accurate)?

The APK Hosts File Engine 2.0++ 64-bit for Linux https://science.slashdot.org/comments.pl?sid=12269474&cid=56838206/ ROCKS ITS WORLD (much faster/more efficient/new merge feature) & I MEAN IT (bigtime) + if you have NOT tried Kubuntu? Do - I ditched on Windows for it!

APK

P.S.=> Lastly - Sorry for busting your balls + mistaking YOU for "Brockmire" the ILLITERATE pest (imagine that's insulting) who stalks me QUITE a lot & BLUNDERED (it's just that you ALL start looking the same under those FAKE NAMES you use, lol)... apk

Re:Only in the USA! Home of IE fans!

[johnsie]

You're talking about the nation which brought us Hillary and Donald. Why would you expect them to have any sense when it comes to computing?

Re:Ordinarily I'd say YOU ARE RIGHT, but (lol)...

[BronsCon]

THANKS FOR THAT MUCH & since you like the Windows model (perfectly accurate)?

I never said I liked it, I said the work was good. If I liked it, I would use it, and I don't (and if I did, I would admit as much; I'm not one to bit off my nose to spite my face). You should know from the rest of that conversation that I would never use software written by someone as toxic and vile as you. It may be clean and safe today, but there's no reason to believe it will remain that way, particularly when you seem to have personal vendettas against so many people, myself included, and it would be trivial to throw some nastiness in that only triggers when the software detects that it is running on a system used by one of those people (for example, by looking for browser cookies of Slashdot logins for your targeted individuals).

You see, we're not all as stupid as you think us. If we were, we'd make easy targets for exploit by your wares.

Continued in reply to your 2nd reply...

/. vs the rest of the world

[DrYak]

Congratulation, you're the typical kind of people who hang on /. (ultra curious geeks, etc.)

The thing is that, there's the rest of the world, we're a bit north of 7 billion of humans on this planet.
Out of them not every one last of them thinks the same way as us.

Some just want an appliance, a thing that just works when they push a button.

There are people who can rebuild the old faulty electrical wiring of a dilapidated house.
and there are the people who just want the light to turn on when they push a button and are happy to give money to someone else to make it happen and don't *want* to give a damn about what's going on under the hood.

Apple, and the "walled garden" type of application platforms try to solve this regarding phone.
There are people who (for a good reason) release that they have a full blown personal computer in their pocket.
And there are people who just want to talk to their friends and send funny pictures of cat, and don't want to give a flying fuck about what an "operating system" is.

The only thing which I'm not happy with and which several people have talked in this thread, is that some like Apple and lots of Android manufacturer want to give you NO ALTERNATIVE to the walled garten, they do not give you the key to the main gate of the metaphorical garden's wall.

I would prefer phone that are locked-down BUT can be unlocked and put into developer mode if desired by the owner ( <- dear phone companies, please note the word and stop considering us as rental. We paid it, we own it, thanks).

---

Also a thing to think about is that some point in the future, the big fat warning upon activating the dev mode won't be enough.
- People get desensitized by clicking "Okay" on any pop-up warning. (Same problem that windows have since they introduced UAC due to problematic software that can't run on anything but admin mode).
- The "dancing pigs" problem : people are ready to follow any weird complex instructions from shady corners of the web just to get access to the funny video of dancing pigs (like installing some horrible spyware/botnet node that pretends to be a video player and codecs for the video). You can predict that if one day when the walled garden gets a little too efficient at rejecting malware to the taste of attacker, youtube bot-channels are going to pop up with "howtos" tutorials explaining how to put the smartphone in dev mode to side load "the best app to send video of kittens around" prompting even grandma to shoot themselves in the foot security-wise.

We'll have to think and prepare how to deal with this in the future (if we don't the manufacturing companies will choose the "more DRM" solution instead for us).

Re:Ordinarily I'd say YOURE RIGHT, but (lol)... ap

[BronsCon]

(cont.) Also, it seems that much has changed in the quality of your software in the past two years and several months. You see, there appears to be a glaring bug in your Slashdot spamming script that is causing it to double-post, though the grammar modification algorithm appears to be working (despite being obvious).

Please cease using my moniker at least until that has been fixed. Preferably, cease using it at all, especially while you're bitching about a company using your initials, when you know damn well the Android Package isn't named after you and more than the NSA is named after Norman Stanley Alexander.

Glad u think it's good, others agree

[Anonymous Coward]

Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017

(APK's work), I've flat out said it's good by BronsCon February 11 2016

his hosts program is actually pretty good by xenotransplant August 10 2015

his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

I like your host file system by Karmashock September 09 2015

I do use APK's host file on all my systems at home by OrangeTide December 01 2017

I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

* Best part's the Linux 64-bit model's faster/more efficient (2x the work in 1/2 the time)

APK

P.S.=> See subject & /.ers quoted above + Joogle & I both make wares but I had the APK 1st before droid existed... apk

Re:Glad u think it's good, others agree

[Anonymous Coward]

I only fire back when attacked 1st (everyone knows it).. apk

No you don't you lying sack of shit. People tell you to stop spamming all the time and you go off on one of your incoherent tirades immediately. You post the same crap over and over again in the same discussion (more spam) because it got modded down previously. Then you get angry and randomly start blaming random people.

Re:Glad u think it's good, others agree

[BronsCon]

Do you not see irony in the fact that you've become what you hate? You're no different than the in-your-face, cram-their-shit-down-people's-throats, difficult-to-avoid, and hostile marketers that you so despise (and have accused my of being one of in the past). You literally get in people's faces, cram your shit down out throats, persist when people tell you they're not interested, and approach us all in the most hostile way possible; and it doesn't matter what your reason is, nor whether the reason is legitimate or simply perceived, what matters is the very behaviors you are exhibiting are the very behaviors those of us who block ads with to avoid.

So, why would we use a piece of software written by an advertiser to block ads?

The simple answer is that those of us who are sane would not. And we will not. That bridge burned the moment you started spamming and the crossing was dug wider when you started attacking people who pointed it out.

What makes me sad about this is that, one day, you'll stop. And when you do, we won't have a way to know whether it was because you finally sought treatment, were committed, killed yourself, were killed, or if you finally realized the irony in your actions.

At this point, the only way I would say your software was worth a damn is if it were also miraculously able to block your posts here on Slashdot. If that happened, honestly, that would make it the best fucking piece of software ever written. Of course, the advertiser only ever wants to block everyone else's ads, and never their own.

Glad u think it's good, others agree

[Anonymous Coward]

Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017

(APK's work), I've flat out said it's good by BronsCon February 11 2016

his hosts program is actually pretty good by xenotransplant August 10 2015

his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

I like your host file system by Karmashock September 09 2015

I do use APK's host file on all my systems at home by OrangeTide December 01 2017

I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

* Best part's the Linux 64-bit model's faster/more efficient (2x the work in 1/2 the time)

APK

P.S.=> See subject & /.ers quoted above + IF you don't use it (you project you won't admit it)? Try the Linux model (better) & I only fire back when attacked 1st (everyone knows it).. apk

Highly confusing...

[GuB-42]

That thing doesn't look like DRM. It is a way for people to download play store apps from outside the play store, and still have the guarantee that they get the original. There is absolutely no mention of any restriction on the user. The signature can be stripped off and unsigned apps can still be installed if you check the "unknown sources" option.
What will happen in the future is another subject. Google needs more than a simple signature in order to lock down the system.

Also, Android already has DRM ( https://developer.android.com/... ).

Re:Only in the USA! Home of IE fans!

[Anonymous Coward]

Maybe I should practice my Canadian...

I'm sorry.

UNIDENTIFIABLE anonymous stalker, please

[Anonymous Coward]

See subject: You make an ass of yourself STALKING me constantly by UNIDENTIFIABLE anonymous constantly & you prove you're an obsessed loon too JEALOUS "Lil' Jowie" *snicker*...

APK

P.S.=> By the way/Lastly: Registered /.ers CLEARLY disagree w/ you JEALOUS "Lil' Jowie" https://science.slashdot.org/comments.pl?sid=12269474&cid=56838194/ (lol, makes me LAUGH MY YOU-KNOW-WHAT OFF everytime I get to call you that & makes you "RaGe" cuz you KNOW it's true (we all do laughing @ you as I "PWN" you EASILY getting you to run DRY of your abused "downmodpoints" easily + making you look a FOOL vs. others saying QUITE DIFFERENT from your SAD little "ne'er-do-well" DO-NOTHING zero self - hahahaha)... apk

Re:Better than looking like an ILLITERATE assHOLE

[Anonymous Coward]

Don't you know, you control the accounts of Zontar the Mindless, arth1, Brockmire, Khyber, Ol Olsoc, whipslash, and countless others who have rightfully pointed out the deficiencies with APK, and its work? You are on the Soros dole or work with the Vatican and Hillary Clinton on the grand bump-stock conspiracy.

This is not DRM

[l2718]

Cryptographically signing applications to ensure integrity and authenticity may be a good idea (as long as phone owners retain the option, existing today, of installing apps from other sources if they wish). This scheme has nothing to do with DRM (Digital Restrictions Management), which is a name for methods intended to prevent users from copying works which are protected by copyright. DRM is technology that's supposed to prevent users from copying content (movies, e-books, etc), or more generally enforce whatever restrictions the supplier would like to enforce. Since DRM generally prevents users from doing things they would otherwise be able to legally do (make fair use of portions of the works; make backup copies; copy works in the public domain etc) it is justifiably considered a bad thing. I suspect that putting the DRM moniker on this possibly beneficial technology is motivated by encouraging users to think of DRM as something that protects their rights instead of something that violates them.

Registered /.ers disagree w/ you (even YOU)

[Anonymous Coward]

Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017

(APK's work), I've flat out said it's good by BronsCon February 11 2016

his hosts program is actually pretty good by xenotransplant August 10 2015

his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

I like your host file system by Karmashock September 09 2015

I do use APK's host file on all my systems at home by OrangeTide December 01 2017

I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

* Best part's the Linux 64-bit model's faster/more efficient (does 2x the work in 1/2 the time)

APK

P.S.=> Enjoy a faster/safer/more reliable internet & See subject: PEOPLE USE IT since it's the BEST way... apk

Re:Registered /.ers disagree w/ you (even YOU)

[BronsCon]

Thank you for proving my point.

Fake Linux

[Anonymous Coward]

There's no reason for Android and no reason to carry the crap box in your pocket.

Bullshit

[HeckRuler]

Google has introduced a small change to Play Store apps that could significantly protect several Android users.

What the fuck is with this weaselly bullshit advertising?

This part here. This one. This is the part that you need to focus on: "your phone will run a version of Android that won't be able to install apps without it."
This is the part you should be mad about. That's control. By a monolithic corporation that does not have your best interest at heart.

And the article itself is talking out of it's ass and throwing around doublespeak willy nilly. Observe:

DRM means you are being treated like a thief before you buy any software.

EA doesn't trust that we paid for the software title so it forces us to present our papers when demanded.

and every other entertainment publisher which decides where in the world you are allowed to listen to music or watch a movie that you paid for, or how many times you are allowed to do so.

Yeah, that's right, DRM is bad. Abusive. Annoying. A bad stance to have with the business-customer relationship. We're all on the same page. ....And then it does some mental gymnastics and says this:

So DRM is bad to the core. But not really. DRM is simply a way for a developer or publisher to keep track of software versions and authenticity.

. . . wtf? That's EXACTLY what those examples above are doing. "Keep track of authenticity" as in "This is not an approved app, SO YOU CANNOT RUN IT". How can you possibly acknowledge the pitfalls of DRM and then immediately turn around and say Google is doing this for the right reasons? That's utter delusional fan-boy bullshit.

There is certainly potential for abuse there, but we have to wait and see if any developers get any bad ideas.

No we don't. We've been to this rodeo before. And it's NOT the developers we have teo worry about. It's Google decided to flip on the walled garden bit of disallowing people to install what applications they want.

It's like how a knife in the back certainly has potential for worry. But we'll have to wait and see if google twists it on the way out.

Re:Bullshit

[digital_fiz]

https://www.androidpolice.com/...

you don't know Jack

[epine]

Damn straight!! The peasant class doesn't deserve no stinking freedom. They can't handle it. All Hail King Alphabet ruler of all teh Intertubes.

You CAN'T HANDLE your own stinking privacy.

Only this is the Jack from The Shining and not the Jack from A Few Good Men.

(Or perhaps the Apple store is Jack from The Witches of Eastwick; none of Cher, Susan Sarandon, or Michelle Pfeiffer are dating Jared, so in that sense, at least, he got off light.)

ssdd

[Anonymous Coward]

Use the excuse of "saving children, people, animals, Jews, whatever" to change your original dissertation.

Eg. YouTube. Sure upload and share all you want. Now though? Pay unless you want a commercial in between every song track. Google/YouTube didn't pay anybody for the content either. Some real fucking talk.

Re:Your straw man fails. Hard.

[Rakarra]

Seriously... who cannot change a tire?

Me? I mean, sure, I could probably do it if given instructions, but I sure don't carry the tools around with me, nor am I interested in doing so and spending the afternoon getting proficient. I just have better things to do with my time.

I built my own furniture, mechanical toys, a semi-analog synthesizer, made my own soap, created my own pants and shirts, fixed almost everything on my bike, bred a special new kind of mint, saved a kind if melon from extinction, invented a new kind of bonbon/chocolate, know my way around quantum field theory, and came up with the most effective type of (neuro-)psychotherapy known to man

You sound like a guy who has a ridiculous amount of time on his hands!

Re:Your straw man fails. Hard.

[datavirtue]

Imagine starting off for vacation. A little bell goes off telling you there is a flat tire. Do you not go on vacation? Do you call a man to get your family back on the road? Jesus fucking Christ.

It's not DRM jeez people.

[digital_fiz]

https://www.androidpolice.com/...

Re:Your straw man fails. Hard.

[Rakarra]

Imagine starting off for vacation. A little bell goes off telling you there is a flat tire. Do you not go on vacation? Do you call a man to get your family back on the road? Jesus fucking Christ.

I call AAA, because that's why I have the service in the first place, and no matter what it's going to require a real change with a real tire. I don't have any sort of tire wrench in my car, and.... you know, the emergency tire that comes in the car is NOT for long distance use. It's just strong enough to get your car to a shop to get a real replacement. I have no idea if that was the case 30 years ago, but the emergency tire that comes with cars these days is weak and will not last long.

Likewise thank YOU for helping prove mine

[Anonymous Coward]

See subject & a quote/salient excerpt from the HORSES' MOUTH: "I've never tried to belittle (APK's work), I've flat out said it's good" - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263) - Couldn't have said it better myself!

* "NUFF SAID", as the saying goes/says it all for me (better than I can)!

APK

P.S.=> "Onwards & UPWARDS" & let me tell you 1 thing: It's NOT EASY being "World-Class" (like me)... apk

Re:Likewise thank YOU for helping prove mine

[BronsCon]

Yes, and now that my perspective has changed I see that it is the work of an abject madman. Or do you not change your opinions as new facts arise?

No lies here Khyber/Alex McCLOWN... apk

[Anonymous Coward]

See subject:... Alias JEALOUS "Lil' Jowie" my UNIDENTIFIABLE anonymous stalker PSYCHO jailbird homo deviant druggie loon https://news.slashdot.org/comments.pl?sid=12266978&cid=56843354/

* How's THAT? You LIKE??

(It's nobodies' FAULT but your OWN, you pitiful f'ing LOSER that your "so-called 'LIFE'" is a fucking WRECK of TWISTED DEGRADATION & sodom and gomorrah filth, fucker!)

APK

P.S.=> YOU are the MOST (by far no less) DISGUSTING reprehensible FUCKED UP wretch I've ever had the misfortune to run into online (in 25++ yrs. or so online, /. has the WORST of the WORST dregs (not in all cases, some good folks here for sure, the majority I feel) but when they're LOON WASTES it takes the cake & YOU are the crowning "anti-jewel" piece of crap Khyber/Alex McQuown - so I think EVERYONE should read all about it & you (even BarbHudson/TomHudson, who @ least used "its" own name, f'd up as 'it' was, was FAR more decent than a FUCKED UP TWISTED LITTLE FREAK like you))... apk

Alex McCLOWN/Khyber, alias...

[Anonymous Coward]

See subject: ... JEALOUS "Lil' Jowie" anonymous STALKER of me & worst of the lot from reputable LEGAL sources & "lil' Jowie" (lol) himself https://news.slashdot.org/comments.pl?sid=12266978&cid=56843354/

APK

P.S.=> YOU are the MOST (by far no less) DISGUSTING reprehensible FUCKED UP wretch I've ever had the misfortune to run into online (in 25++ yrs. or so online, /. has the WORST of the WORST dregs (not in all cases, some good folks here for sure, the majority I feel) but when they're LOON WASTES it takes the cake & YOU are the crowning "anti-jewel" piece of crap Khyber/Alex McQuown - so I think EVERYONE should read all about it & you (even BarbHudson/TomHudson, who @ least used "its" own name, f'd up as 'it' was, was FAR more decent than a FUCKED UP TWISTED LITTLE FREAK like you))... apk

Re:Alex McCLOWN/Khyber, alias...

[BronsCon]

Dude, when the hell did you find the time to write the Linux version? Seems like you're here posting this shit 24/7.

Re: Your straw man fails. Hard.

[Anonymous Coward]

Any car since the 90's now come with the tools to change the tire. It's hidden somewhere in your car, but reading the manual will give you the location... Changing a tire is almost like changing your pants, it's quick and easy and generally does not need to call anybody!

You said it best in this quote of you

[Anonymous Coward]

See subject & "I've never tried to belittle (APK's work), I've flat out said it's good" - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263) & I couldn't agree more + so do others https://tech.slashdot.org/comments.pl?sid=12270256&cid=56843160/ w/ us BOTH!

* :)

(No changing facts written in stone long ago...)

APK

P.S.=> Yes, I've gotta tell ya BronsCon - It's NOT easy being "World-Class" like me & THANK-YOU for your words of praise on the quality of MY work too... apk

Re:You said it best in this quote of you

[BronsCon]

(No changing facts written in stone long ago...)

No, just opinions written in bits.

LOL "that's just your opinion"... apk

[Anonymous Coward]

See subject (joke) & I'm glad you say I do GOOD WORK "I've never tried to belittle (APK's work), I've flat out said it's good" by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263) - I know I do & others think so too https://tech.slashdot.org/comments.pl?sid=12270256&cid=56843160/

* :)

APK

P.S.=> Thanks again BronsCon & like I said before? It's NOT EASY being "World-Class" (like ME)... apk

I make the time man... apk

[Anonymous Coward]

See subject: ... & I've been (for the MOST part other than contracting & consulting work gigs @ year end typically) RETIRED since 2007 so I have the time available to pursue "hobby projects" that usually do fairly well & have over time - see, I was a lucky one man - I actually LOVED my work writing code (well, most of the time - sometimes you 'hit walls' that piss you off but WHEN YOU BREAK THRU? It's like Golf - you can ONLY be upset w/ yourself but when you get that double eagle/bogie? As satisfying as sex (well... you know)).

* My time's mine man - that's the GOAL isn't it? I just got lucky & arrived earlier than most...

(Also - Remember: I did the BULK of the hard work in Delphi LONG ago (heck, 2001 or so & released it to the public in 2012 when the "Malware + Malvertising" epidemic REALLY 'exploded'. That said, FreePascal + Lazarus 1.8.2 IDE are an AMAZING CLONE of Delphi (exact same as I'd say, Delphi 2-5, good enough to do the job) @ both IDE & Object Pascal language level - so this port? VERY fast (hardest part was getting past IP Stack ICMP diff. between Linux RAW (real imo) IP stack & limited (to most users other than admin) WinSock2)).

APK

P.S.=> I wish anyone the same - see, when you get there? You can pursue YOUR OWN IDEAS/DREAMS (especially to help others since I've found WHEN YOU DO? God's GOOD to you) instead of those of others + enriching them while they pay you PEANUTS (believe me, I was there 16-48 yrs. of age like MOST folks too)... apk

Google Nazi bs

[RetepGuh]

I have a permit to carry weapons, but I am treated like an idiot who doesn't own my phone.google Nazi play store can sniff through my phone like pigs they are.time for a change sooner the later.to all idiots who need protection come to me I sell u bunch of story's to make u feel safer.