After the news cycle recently exploded with the announcement that Google would require every single Android app to be from a registered and verified developer, while killing third-party app stores …
The constraint to require a valid signing isn’t something imposed by the license on the Android code. If you want to distribute a version of Android that doesn’t check for a registered signature, that should work fine.
I mean, the Graphene guys could impose that constraint. But they don’t have to do so.
I think that there’s a larger issue of practicality, though. Stuff like F-Droid works in part because you don’t need to install an alternative firmware on your phone — it’s not hard to install an alternate app store with the stock firmware. If suddenly using a package from a developer that isn’t registered with Google requires installing an alternate firmware, that’s going to severely limit the potential userbase for that package.
Even if you can handle installing the alternate firmware, a lot of developers probably just aren’t going to bother trying to develop software without being registered.
But if Graphene chooses not to do this, they diverge from the Android project. Which will take more time to maintain the project which will ultimately lead to more developers burning out and dropping out of the project.
It doesn’t need to be affected, but most open source projects don’t have the resources to keep going against big companies when most of their users aren’t contributing.
They already diverge by having a network permission and a bunch of other differences, and not being allowed to use Google Pay because of those differences
You are of course aware that Graphene OS is affected just like any other version of Android?
Straight from the horse’s mouth. The rest of the post is a good reminder that GrapheneOS are morons.
But why would you lie about this?
I don’t see why it would need to be affected.
The constraint to require a valid signing isn’t something imposed by the license on the Android code. If you want to distribute a version of Android that doesn’t check for a registered signature, that should work fine.
I mean, the Graphene guys could impose that constraint. But they don’t have to do so.
I think that there’s a larger issue of practicality, though. Stuff like F-Droid works in part because you don’t need to install an alternative firmware on your phone — it’s not hard to install an alternate app store with the stock firmware. If suddenly using a package from a developer that isn’t registered with Google requires installing an alternate firmware, that’s going to severely limit the potential userbase for that package.
Even if you can handle installing the alternate firmware, a lot of developers probably just aren’t going to bother trying to develop software without being registered.
But if Graphene chooses not to do this, they diverge from the Android project. Which will take more time to maintain the project which will ultimately lead to more developers burning out and dropping out of the project.
It doesn’t need to be affected, but most open source projects don’t have the resources to keep going against big companies when most of their users aren’t contributing.
They already diverge by having a network permission and a bunch of other differences, and not being allowed to use Google Pay because of those differences
And more and more, apps require to be run as playstore version only with server side checks…
Graphene could sandbox the integrity check, just like they do with the Play Store.
It becomes an integrity check arms race. Graphene OS devs not keen on this idea, but they may not have a choice in the near future