Web downloads work fine on Android
It's technically "there" but not good enough to be a reliable form of distribution.
Yes, there are warnings, but what is the alternative? You download an app once, it installs without warning and keeps updating in the background? That'd make it way too easy for malware authors.
How I see it personally is you download the apk, tap "install", then the same permission prompt as the Play Store opens. The app is updated later the exact same way as the Play Store update (either automatically by pulling from an url or manually, depending of what the users have set as a rule for the Play Store)
This should be as seamless as using web apps, and permissions dialogues should come up when the app attempts to use certain device features. (No different than App Store downloads today.)
All of this to say that web-downloaded native apps are not first class on Android. They should be.
I'm also of the belief that we don't have to be a nanny state. We trust people to pour gasoline, drive death chariots at 70 miles per hour, open lines of credit as teenagers, buy and shoot guns, etc.
Why all the ceremony here? I think it serves the owners of the platform more than us.
Well, web base installs are the norm. That's how malware and ransomware spreads. The problem with security is that is usually anti features. That't why webbrowsers use the path of least resistance and declare that they are secure, they have containers and isolation etc. And Google with project Zero is playing the good guy.
It is all security theater. Security is expensive and no one wants to invest in it because it does not have a clear ROI.
> I'm also of the belief that we don't have to be a nanny state. We trust people to pour gasoline, drive death chariots at 70 miles per hour, open lines of credit as teenagers, buy and shoot guns, etc.
We do not trust people to buy and shoot guns.
> Why all the ceremony here? I think it serves the owners of the platform more than us.
Of course it serves only them. Security in android stops when you give apps access to SD card or camera or microfone or phone or contacts. And the fact that Google apps have all this access by default says a lot about how much google is interested in security.
besides that, permission dialogs are better than nothing. the worst would be apps being installed without me even noticing. just because people tend to ignore them that's no reason to abandon them. what would the alternative be?
Web app sandbox is better than native AFAIK, which is a good reason to add friction (because otherwise you're asking for worms).