What happens if you "accidentally" become persona non grata with both Google and Apple?

If you want to participate in the society, you will forever have to resort to shady tactics. Shady can be defined something as arbitrary as using GrapheneOS.

A temporary workaround like using alternatives like GrapheneOS for those affected will only delay the inevitable but it doesn't stop it at all.

The blast radius is far worse than any "malware" Google could protect you from.

TFA is playing it up, but it is arguable that this is a real virus, except the shady hackers are Google.

All service providers above some scale should be obliged to create a transparent processes or be taken for external jusges.

Even better: all providers of services with more than 100K users or 10% of country internet users should be forced to provide API to export / import data in open format.

> And you’ll never reach a human to sort it out.

Unless you blog about it angrily enough that you somehow make it to the HN front page and some insider sees it and solves the problem for you.

Getting my own domain and setting up email on it is one of the best things I've ever done.

That happened to me, lost 16 years old gmail account, which is my main account for my digital life. It happened after I disabled some tracking, and Google was no longer able to recognize me, even though I had my phone number registered, it was not enough.

One of my best friend has a Jolla phone.

He never had WhatsApp. He refuses to use google. Only till recently he started using signal. He has been using an old Nokia phone till he was forced to upgrade by his operator. He is European and here in Europe WhatsApp dominates. Despite all that and having a very social life, driven by work, he manages.

I recently ordered a Jolla phone. I don’t want to know about android. I might tolerate iOS. But shelling thousands of $ for a phone that is controlled by an external company…

I am looking out for messaging alternatives. I am at a point where I think linking your identity to a phone number is not right either.

Let’s say we should all wake the fuck up. This is not right. Having a phone with such spyware is a potential attack vector I don’t want to have on the most important device I own.

We experienced this with Anthropic, not the same blast radius obviously, but out of nowhere account was terminated. No support available. It was via someone’s 30+ year old classmate via LinkedIn the account got reinstated.

As a counterpoint to the right to the repair there should be a right to recover.

it's a nightmare.

It's not just shameful, it's stupid. Freedom was the whole point of tolerating the shittiness of Android. If they get rid of that, then there is no point, and I'll just buy an iPhone instead. If I must be in a walled garden, I'll choose the better kept garden, and it sure as hell isn't Google's.

This is worse than Apple. With Apple you knew where you stood day 1.

AFAIK you can still install any random APK but the process will require enabling developer mode and one time 24 hour wait period. But the problem is many stupid Apps check that developer mode is on and refuse to work.

> We need to resist this!

I agree. What do you suggest? How can we contribute to the resistance?

Shame isn’t an applicable concept for a corporation.

Google has been attempting to license the right to write.

There are a lot of poor people, mostly brown people, who do not have the ability to get one of these licenses.

Some of them are feeding themselves with their ability to write, and Google is literally stealing that food from their mouths.

There's also FuriOS with the FuriPhone.

That's debian based with gnome and seems to be built by capable people.

And all are useless because you can't use your mandatory bank or gov id app.

Which phones are supported by which of these operating systems? And can you provide some relevant links?

GrapheneOS is currently the blessed child. Like CyanogenMod previously. They are "permitted" to access to Google Play Services because their work hardening Android currently benefits Google.

Once Google feels like there is sufficient stability and compatibility with hardened memory allocator and tagged memory (and when they can get Qualcomm to support it across their range), they will make harder, until impossible, for Graphene.

An old article [1] but:

> Google’s Android—and [Open Handset Alliance] members are contractually prohibited from building non-Google approved devices

So to compete you'd have to create a compatible Google Play Services as well as find a supporting manufacturer. Samsung managed their own competing apps and store [2] for a while along with Tizen, likely for leverage or theoretical pivot. But has since dropped that effort.

[1] https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

[2] https://arstechnica.com/tech-policy/2021/07/google-bought-of...

> Android users need to switch to Graphene.

Doesn't GrapheneOS supports only Google Pixel smartphones now? For most of the users, that would mean changing their phones beforehand. And if we're talking about common people (especially not in US), it's not even everyone who can afford that. Moreover, in my opinion, by buying Google phones you're feeding Google, and I, personally, would like to avoid that.

I keep hoping for something more radical like Jolla and SailfishOS taking off or postmarketOS becoming a true viable alternative but as things are looking like now there's a better chance we'll ditch phones altogether in 10 years when smart glasses will replace them instead.

I tried. But then I didnt get access to essential services like banking and national resources.

I would say Ubuntu Touch + a Fairphone. Graphene is too reliant on Google.

I know Graphene has innovative security measures, do you happen to know whether that includes anything wrt. phishing or social engineering?

(For those who haven't been following along: this whole affair started with phishing. People were social-engineered into installing an app and a little later their bank accounts were empty. A big issue in various poor countries.)

The only reason I have not switched Graphene is because for reasons I do not understand, Graphene OS is very closely tied with Google hardware.

I bought a /e/os Fairphone instead.

> Android users need to switch to Graphene.

Which supports only Pixel devices.

I get it, but it really sucks that Graphene only works on Pixel hardware. I switched to Samsung with my last phone.

> Linux based mobile OS

So, Android?

Not really a solution at the moment if you do not want to give money to Google by buying a Pixel (hopefully the deal with Motorola will work).

Long term I would probably have more hopes in https://postmarketos.org/

I wonder if it makes sense to create an independent hard-fork of AOSP in the future. But probably the only option to keep this somehow maintainable is to replace many android-specific components with other userspace linux components that are already well maintained (systemd, networkmanager, wayland)

Well… you can run android without google? The problem is that essential security services require apple or google devices and you as a member of society need the security services.

I thought the same thing but he apparently has a point. The stated purpose covers only a tiny sliver of the capabilities. The agreement points to the TOS where it (last time I looked) says service may be terminated at any time without stating a reason. Nothing guarantees it won't be used for things other than security. And finally he has a point where it also doesn't really do much for security.

If we ask their fine search engine, the AI helpfully explains malware to be software designed to gain unauthorized access to disrupt, extort payments and/or hijack devices.

If you still think the shoe doesn't fit, imagine what would happen if one managed to create an app with the same capabilities. Google would remove it immediately for being malware. Obvious malware.

I think the point they are trying to make is that in the terms of service Google says they get to define what is malware (halfway through article) so the author is trying to point out that exact danger: what happens when Google gets to randomly call things malware.

The article provides enough evidence for that label. Unlike Google, who can arbitrarily call anything "malware". This is the contrast the article attempts to point out.

I have the opposite opinion, Google is doing a lot of garbage in the name of "Security", time to play their game and report their control on Android as security vulnerability

There is a good solution. A big disclaimer and the user accepting the risk of running the software they want. The same solution they've been doing for years that did not need change. The new developer program is only here because it is more convenient to Google and governments.

The Librem phones do exist and people use them.

Did it take the world by storm ? No.

But it exists, has users & is building the case (together with Sailfish OS and others) that having an abusive mobile OS duopoly is not the desirable state of matters.

Installing via adb is not affected.

What's their interest in you building side-loaded apps instead of using their data hungry services?

well they can swat you, order pizza, send you packages (who knows with what inside), spread false info about you if you've given out more info etc...

all it takes is one guy who gets too mad for some reason

and it's gonna be a lot more costly for you to do anything about it vs. that guy who gets to be completely anonymous about it

It's because of a law in California. Don't remember the reason behind it, but Google decided to apply it everywhere. It's also why I let my app die years ago instead of publishing the updated version.

This is so that you can be sued or prosecuted if the app is malicious.

But they did. EU formally allows all these measures by Google in the name of "security" as described in Digital Markets Act Art. 6 (4) fourth paragraph.

https://www.eu-digital-markets-act.com/Digital_Markets_Act_A...

Indeed. I wonder if it falls foul of labour law. Blacklisting is illegal and whitelisting (certification) is normally done with multiple competing third party certifiers.

They'd have had to start with Apple which is more locked down and has comparable market power. Apple fans (iirc like 30% of the voter population) already scream bloody murder when compatibility increases due to legislation and Apple pushes some marketing about how terrible this is

We've accepted that OS vendors can do this for decades. I think that was our mistake: relying on Google as the only available vendor. We can't make a law that punishes Google for having been open all these years. Yes, of course I (like any 'HN' hacker, I'd think) would be in favor of forcing Apple to be open as well, but then it seems that the powers that currently run the EU (and a lot of voters) kinda likes their remote DRM attestation for this digital identification project that you'll soon need for anything not suitable for toddlers and not reachable via a darkweb

this is something the EU would love, it's part of the whole Transparency thing where you dox yourself to everyone

HNers (especially Americans) are super naive and think the EU is some bastion of freedom. no. it just wants to be a huge nanny state but in a wholesome way, where you can do whatever you want as long as it's approved

I have an old $70 test device with stock Android/Google that hasn't seen security updates in half a decade yet all banking apps, electric car charging, Google services, you name it, work absolutely fine.

Meanwhile the daily driver phones of my privacy-aware family members running up-to-date Lineage or Graphene OS with recent kernels and frequent updates constantly run into apps refusing to work for "security" reasons. It's a complete joke.

Does Huawei not use android or Google play services?

It depends of the operating system you install. Fairphone by default comes with a pretty standard Android version with Google Play serices, so it will be impacted.

If you either buy a Fairphone from Murena (with /e/ OS) or from Iode (with Iode OS) or if you buy a standard one and install a version of Android without Google Play Services (like /e/ os or Iode), then you can still use FDroid.

Checked my Pixel 7 XL Pro and the app is installed and running (Version 1.0.866414232 com.google.android.verifier). I was able to force stop it, and disable it. Will check later to see if reenables itself.

Ex means "example" here right? Or do you mean ex as in the dictionary meaning of ex, as in, "formerly"?

In the PS3 case the feature was removed fully where in this case you just have to go through a new flow with warnings to reenable sideloading unverified developer's app.

I already contacted the DMA authorities and complained how this has an effect on German diabetes communities and they replied that I am not the first one who approaches them on this and they are already investigating it.

Google is just trying how far they can push this.

https://www.eu-digital-markets-act.com/Digital_Markets_Act_A... Art 6 (4). Read it to the end. That's how.

I guess it becomes a part of Play Services.

If the companies would keep their own word and never overreach maybe nobody would overreact. How many times did we hear in the past "It's just for..."

There is no spin here. Google is pulling up the ladder.

There won't be an open web, there won't be user installs, there won't be anonymity.

Everything will be identified, attested, and allowed only when Google permits it.

Nevermind them choking startups and small biz out of the oxygen they need to survive.

We already have the OS, what we need is a company that is willing to take a bet on it, support it and convince hardware vendors to provide upstreamed drivers for their stuff.

PostmarketOS may not be perfect as of now, but it would advance and progress so much if people were hired to work on it and if people could buy a smartphone with it preinstalled. Bug reports and corrections would come much quicker as well as supported apps. Right now it is just a confidencial toy OS because of the lack of hardware support really, only a small number of smartphones are supported, only 2 of them are still sold and available as new (pinephone and pinephone pro), their specs are nowhere close to what you would expect for the price and they are only sold through a rather confidential online store.

The only time I've actually seen Android malware in the wild, it was because my mother installed a homescreen flashlight toggle widget from the Play Store that also displayed ads on the lockscreen. That was forbidden under Play Store rules, but there it was. I replaced it with something from F-Droid.

The Play Store still has a problem with shady apps years later. If Google wants to be more like Apple, they should start with better curation in their own store.

They can lock down the Play store completely, that's what 99% of people and the people most vulnerable to malware are using. The problem is extending that to F-Droid and other alternative services.

> In almost every case, the feared "bottom" of the slope was never reached because humans constantly built ramps or bridges along the way.

Perhaps it happens because the slope is called out...

I alternate my thoughts frequently (which I believe is healthy), and sometimes I think we should let things take their course a bit more before reacting. It's certainly tiresome and can be pointless (some people claim 'hysterical') to fight lots of changes, not necessarily this one but some like it.

But I've come to realize there are serious downsides to letting things run their course too. Some changes are very hard to roll back (famous 'cat's out of the bag') just taking a lot of time to reverse if ever. For example, once there is a long term contractual agreement, if one parties decides to roll back they may just not be able to until the contract expires (like renting land; or worse, selling). A change in software systems for example that need backward compatibility can be quite difficult in technical and nontechnical ways.

I think people need to also keep some sympathy for the protests and let people protest more. I'm leaning more toward: if in doubt, provide visibility to a cause (even if not full support). It's okay to save yourself some energy (in particular for the most important causes). Some things might have to run their course for people to understand they were valuable, and we will probably have to eat some frogs as a consequence. Don't lose you sanity ;) (As the saying goes, "Don't you dare go hollow.")

"or the culture shifts to reinterpret the thing"

Yes. You see it already.

"Actually it is good that I can't run programs that haven't been approved by Google on my own device."

There is precedent of Google making changes in light of "security" that break ad blocking Chrome extensions. See chome extension manifest 3.

So this concern cannot be dismissed with just "slippery slope falacy", it's a new vector of the same power grab strategy.

This is a useless argument since there is no way to measure what case is this and what is not.

You can say "Classic slippery slope fallacy." to whatever seems like that to you.

This is an antipattern to scientific thinking as you can frame something x and then say all x are like this, look I created this framework to think about x. But in reality there is no empirical basis for this thought. And it serves no purpose other than doing more argument or winning arguments.

In the end what you wrote equates to "I don't think all of this will happen".

Chaning many possibilities makes the outcome less and less likely obviously.

Also the same principle applies to most religions I know of, for example:

- Assume there is God

- Assume it did create universe.

- Assume x

...

Then this also fits the same pattern and be called the "x fallacy" but it is useless to create an argument like this. This is useless mainly because this thinking pattern is ubiquitous in any world view.

More productive discussion might be to pick some steps in the theory they chained together and argue on that imo.

Just look at the world around you, the slippery slope "fallacy" stopped being a fallacy long ago.

Is it a fallacy if you've said before that Google is aiming to create a walled garden, Google itself has already started saying it wants a walled garden and they've already implemented several such steps?

It all depends on how you define malware. If malware is software doing something that is contrary to the user's interests, then for many users it is indeed malware.

it is malware when everyone is explicitly asking to not have it.

The point is that it is said to tamper with your installations. If it does, it is malware.

Those are not mutually exclusive.

Which is malware.