Google has news on what you will need to do for still being able to sideload apps:

[argv_minus_one@mastodon.sdf.org]

@nazokiyoubinbou

Apparently this is how you unlock the boot loader on a phone in order to install a different OS:

https://www.ifixit.com/Guide/How+to+unlock+the+bootloader+of+an+Android+Phone/152629

And I thought having to turn off UEFI Secure Boot was offensive. Yikes! That's an awful lot of hoops to jump through, can't be done without first agreeing to the stock OS terms and conditions (my inner Stallman is very upset with that), and it requires a whole separate computer to do it with!

@FifiSch @grote

[epic_null@infosec.exchange]

@nazokiyoubinbou @FifiSch @grote Consider the failure state. If a user fails to set up installing outside programs, they can still use their phone and make calls. If a user fails to install a new OS, they have no phone until they succeed.

[31113@kolektiva.social]

@terminaltilt for the average person it's probably much more likely that someone's going to try to look over your shoulder or that one of the infinite surveillance cameras captures you entering your pin than it is that the cops force their finger on the fingerprint scanner. In that way biometrics are more secure and people should use them. Biometrics should just also be very easy to disable in moments where that threat is present

[lexinova@cyberplace.social]

@nazokiyoubinbou @FifiSch @grote sadly we don't have any other credible alternative.

bank and country already have great difficulty accepting the very hardened graphene os.

so don't expect linux phone or lineage to be allowed anytime soon :/

[snejpro@digitalcourage.social]

@woosh @grote

Yeah, the only problem i have with this approach: when I get a new phone I have to wait 24h until I can install my apps.

[harisont@mstdn.social]

@grote "sideloading", "power user"... all expressions that deliberately make it sound like installing a program of your choice on your computing device is this strange thing that hackers do

[nazokiyoubinbou@urusai.social]

@argv_minus_one @FifiSch @grote Well, they made it more complicated than it seems. Running adb reboot bootloader is the fastest, most universal way to get to the bootloader, but every phone has a button combo you can use while turning it on. LineageOS instructions usually just tell you to do that I think.

The instructions do also make it sound more complicated than it actually is. When you get down to it, it really is "tap a few things, then copy and paste a couple of commands."

[roughnecks@mastodon.social]

@grote

https://www.youtube.com/watch?v=guZbgOu-qqI

[nazokiyoubinbou@urusai.social]

@Epic_Null @FifiSch @grote That's the assumption, yes.

Two things.

First, you can just flash again if you for some reason did something stupid like yanking out the cord while it was transferring.

Second, modern Android devices usually use two separate partitions. When you flash it goes to whichever it's not currently using. So if you render it broken and for some reason can't flash again, you can still just boot the first.

Again, people have let themselves be convinced to be scared of things rather than trying them.

[nazokiyoubinbou@urusai.social]

@lexinova @FifiSch @grote I mean, when I said "we need something open" I didn't mean I expected it to happen. I only mean that it's what we need.

I need about three medical operations. Not going to happen. Because this is the kind of society we live in. Money rules all.

[lexinova@cyberplace.social]

@nazokiyoubinbou @FifiSch @grote just hope EU DSA wake up and make a stop to that in EU at minimum, could like GDPR trigger other block to do the same.

[pelle@mastodon.ie]

I wonder if by doing this you set out a flag that could trigger security alarms or block access to bank apps and DRM apps as Netflix, the same way as having the phone rooted or with a custom ROM

[nazokiyoubinbou@urusai.social]

@lexinova @FifiSch @grote Yes, that sort of thing would be great.

But... seeing age gate stuff still happening despite being a violation of the GDPR, I wonder even for stuff like that these days. *Sigh*

[elrohir@mastodon.gal]

@grote It would be very important to find out if banks and other critical apps will have the liberty to block users who have changed this setting, too.

It would be one thing to go through this whole ordeal once forever. And it would be another thing to do all of this, install my desired app, and then disable it again to get my bank app working on the daily, and then rinse and repeat for every new install I want to make a few weeks later.

[kdude@mastodon.social]

@grote @thornbill …for now, until they dictate some new hoops to jump through

[calcprogrammer1@mastodon.social]

@grote 24 hours of not owning my phone is evil. This is stupid. I'm fine with everything but the pointless 24 hour wait and the biometric requirement. Give us your personally identifiable information and wait in phone purgatory for 24 hours to actually be able to own your device? Ridiculous.

[tedmielczarek@mastodon.social]

@tehstu @grote bold of you to assume that multibillion-dollar companies play by the same rules as average developers. If Apple locked down macOS installation to the App Store Google would just call them up and negotiate an exception (if Apple didn't just build one in from the outset).

[lumi@snug.moe]

@ryanprior @grote no, it is not good at all. this is not a solution to anything here

a real solution is to harden the sandbox and vet the permissions. give more and more fine-grained control and inform the user about this. for even better security, have android distributions controlled by different communities, and let distro application packagers vet the permissions for the users, etc. there is a reason the distribution model for linux is so secure

not "you can't install what we don't approve of unless you go through this procedure"

google (and apple, or any other corporation) should have effectively zero control over what i can do nor make it harder for me to gain this control. they should not be able to make me wait or do anything. even bootloader unlocking should not require any verification or other bullshit

the solution is empowering the user and educating them. not making them go through stupid hurdles

[razemix@mamutovo.cz]

@nazokiyoubinbou @FifiSch @grote First problem: The user needs to know what an OS even is and that they're using one.
Second problem: The user needs to realize that they can use a different OS.
Third problem: The user needs to know the exact model/codename of their phone, find a suitable OS, unlock bootloader, probably install adb and/or other tools (if there is no WebUSB option), etc.

Should I continue?

[windofchange@mastodon.online]

@grote burn Google, burn Android. They are no longer useful to a human race.