"Sideloading" is the rentseeker word for "being able to run software of your choosing on a computing device you purchased". There is no reasonable case for an operating system developer having a say over what programs you run on your hardware.

#Android #Google

@Gargron the review process at Google can be a PITA, but for a good reason. Permissions to access more than an app really needs can be exploited for harvesting private information on a seemless update that most won't even notice. Side loaded apps downloaded from say APK mirror can have been tampered with using smali edits and you won't know. What Google should do is certified dev signing keys to trace and confirm if an APK is legit or not and coming from the actual dev, regardless of being side loaded.
@denzilferreira @Gargron so why dont we do this on windows or linux then, both oses by default dont even have a permissions system and give applications near full access to the device
@Chickerino @Gargron that's not true, you do need to raise admin rights to install something not digitally signed on Windows, and admin credentials to install on Linux. On Linux you have Flatpaks that do have permissions in place, and the software runs on a sandbox with only access to what you allow. Windows does not do any of that - hence I'm not gonna even recommend it.
@denzilferreira @Gargron thats why i said "near" everything, for example on android you need to give permission for the app to be able to access your files outside of the app container, windows by default lets every app access every file that your user has access to, i think thats a bit stinky
@Chickerino @Gargron yes 😅 btw Google is doing exactly what I said: verification of dev certificate on the .APK allowing you to side load authentic apps. Only unverified .APK are blocked https://arstechnica.com/gadgets/2025/08/google-will-block-sideloading-of-unverified-android-apps-starting-next-year/
Google will block sideloading of unverified Android apps starting next year

Google says it's no different than checking IDs at the airport.

Ars Technica

@denzilferreira

Denzil, nope. G****e demands you give them your private app signing keys, breaking any thrust chain this way.

@Billie we are talking about Google Certified devices here. Google is the root trust CA, and as a developer that wants to publish on the Play Store, you want people not to be able to side load malicious versions of your app. That's what this is about. If you put your own ROM, without GMS, nothing stops you from side loaded apks. It is the same for iPhones. This will affect and prevent the spread of malicious and randonsomware that scammers use.

@denzilferreira

Giving away your private signing keys breaks any thrust chain. It is just the opposite.

@Billie I guess Google only needs the pub key to verify your identity, true.

@Billie @denzilferreira except #Google.has no right to demand that control to begin with!

  • They have forfeilt their control the moment a person ticks the "allow unverified app installations" setting in Android.

Remember: "Know Your Developer" IS the ilkicit activity!