Hacker News Reader

Comment by MathMonkeyMan | Hacker News Reader

Hot take: The word is "installing." There's no such thing as "sideloading."

It's a really important point, because it clarifies what this change really means: developers are now being given the final say about how their application is installed (i.e. through what intermediary, if any) on the end user's device. In short: it's DRM in different clothes. Luckily, it appears the developers have to opt-in (at least for now).

I mean, it is the developer’s intellectual property, so they should have a say in how it’s used, right?

Yes, they should have a say. This is "the final word". There's a large gap of rationality in between them.

Copyright is often bound up with the moral rights of authors, one of which is final control of whether and how their work is exhibited, because the author's reputation is bound up with the exhibition of the work. This is more explicit in jurisdictions like European countries, where authors rights are more encoded into IP law.

In the USA, you have things like the first sale doctrine, which applies to things like books and audio recordings, but DOES NOT apply to software, especially not software that makes use of services provided by the author (as most mobile apps do). Do not expect, in general, to have a right to use a piece of software, especially a mobile app, in ways not explicitly authorized by the app's vendor. Yes, this also means video games as things you can play forever are going away. Get used to it.

> so they should have a say in how it’s used

users should, that's why feedback forms exist

With traditional property, the vendor never had this right. I could buy a hammer and use it hammer in nails or use it to break windows and the hammer manufacturer couldn't stop me. It was one thing when intellectual property was entertainment and media but now that it's come to encompass tools needed to interact with the world users need to have something more akin to traditional consumer rights for apps they "own".

But intellectual property has traditionally been property for a long time. Copyright isn’t a recent invention.

You're applying copyright to something functional like a computer program versus a piece of art.

And what these companies are doing is making the (hardware or external) functionality dependent on that copy-written computer program. So now it's impossible to modify your device without modifying software and thus breaking copyright.

Take a look at the US constitution copyright clause:

[the United States Congress shall have power] To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries.

How does this use case of copyright promote the progress of science and useful arts? Copyright was clearly intended to make it temporarily difficult to publish information, not to make it impossible to modify machines.

Property is a bundle of rights, not a single unified monolith.

But regardless of whether they should have that say, they empirically do seem to have it.

Which is why the solution is free software, and why the FSF has always understood the threat of hardware and encryption being used against the user rather than for them.

Not at all. I reject any and all notions of "intellectual property". Especially when their implementation requires the sacrifice of free computing as we know it, the destruction of everything the word "hacker" ever stood for. I'd very much prefer that creators have zero say over anything, if that is the cost of computers remaining free.

No.

I wonder to what extent the supposed user benefits of central control of apps are true.

Maybe arbitrary programs on a phone is akin to a random .exe on Windows 95, but instead of Windows 95 it's a computing platform that a majority of human beings have in their pocket and that can provide direct or indirect access to almost all personal and financial information. I mean, you have to grant the privileges, but of course you will.

Maybe having a locked down library of programs is good, I'm just too much of a cynic to see it as anything but a power grab. On the other hand, maybe the support and legal headaches of customers "screwing themselves up" also plays a part, especially when there's a whole dark industry to trick people into screwing themselves up.

If locking the user's data was the goal, Google would many a non-negative amount of effort locking the user's data from malicious apps.

Instead, they work on mixing the data so much users can't tell what is being accessed, blocking data-redacting apps, and making sure term changes are invisible.

>Maybe arbitrary programs on a phone is akin to a random .exe on Windows 95

No, it isn't because there is already sandboxing.

>that can provide direct or indirect access to almost all personal and financial information.

Windows 95 computers also used to have web browsers and bank information. The risk has not progressed

There is no reason whatsoever for a developer looking to publish apps on a proprietary app store to ever opt out of this.

It's a useful word, descriptive and much shorter than "installing from outside the official app store using a third-party APK".

and yet, when you do it on a PC, it's just called "installing".

the point is that the word railroads you into the assumption that having an official app store is the default behaviour and installing software from elsewhere is somewhat underhanded and sneaky, which is convenient for Apple, Google and Microsoft's profit margins

It's not just an assumption, it actually is the default on iOS, Android, iPadOS, and macOS, and the user has to jump through hoops to get around it. I'm not saying this is a good thing, but having a name for it makes it easier to describe, search for, lobby for, and ultimately use. It's like rooting or jailbreaking or even something as innocent as a plug-in or forking: different techniques of modifying software functionality away from the default, but each with its own costs and benefits.

If you tell someone to install Adguard, for example, then on iOS they're installing an app that gives them a Safari extension through the official mechanisms. It can block ads in Safari. But on Android they don't install it from the official store, they sideload an APK by disabling some built in system protections against unsanctioned apps. It's more hoops on Android because of the sideloading, but they get way more power (it acts as a VPN and also a HTTPS MITM cert and filters all your traffic). It can filter ads in all apps, even through HTTPS. The downside is that now all your data goes to this small ad blocking company and circumvents the billions of dollars Google's spent trying to keep your device safe. It's a meaningful difference and users should know both the risks and benefits of being able to sideload apps, just like they should understand the risks and benefits of fully rooting your phone.

I see what you're trying to say, but the fact that it is already the default for many operating systems is all the more reason that you should stop tacitly accepting it, not the other way around

the term sideload gives implicit primacy to monopolistic app stores. install does not.

we should be fighting for third party installation to be the default, not to have the scraps of some workaround that developers are less likely to work with.

for 20 years computers managed just fine with third party downloads as the default. developers favoured broad compatibility and users had more power

there are times and places for locked-down devices: children. old people. corporate devices. display models. etc.

however, this should be opt-in. with an optional app store if the OS manufacturer cares to provide one.

using the term "install" favours a world where developers make apps that you can install on your own terms. using the term "sideload" favours a world where developers make apps for an official app store.

I'm not saying stop using the word sideload, I'm just saying stop fighting for sideloading, and fight for (mobile) install rights.

I don't entirely agree or disagree with what you're saying... depends on the target audience, I think? There doesn't have to be a one-size-fits-all balance between power & protection.

For myself, as a dev, I like Android for this very reason. I don't root it anymore, but I do sideload apps. But for friends and family, I have the exact opposite advice: Not only do I tell them not to sideload anything, they also shouldn't download any no-name apps from the official app store either (especially on Android) because the chance of malware and scams is so incredibly high.

This was always a risky thing to do, even back in the Tucows/CNET Downloads days, and why Windows malware was always a problem. Normal users don't really have the technical ability to audit all the random crap that's available on the internet. Hell, most devs don't either (how many npm or apt-get packages have I audited recently...? zero).

I'm the kind of person who turns off UAC for every fresh Windows install, and if they ever lock down macOS like iOS, I'm gone. But people like us also are not typical users. I think it's actually nice that the market offers this sort of choice. Power users and devs can always choose Framework machines and build their own Linuxes. Boring ol' web devs can use standard Macs. Kids and grandmas get iPads (and honestly most adults would be fine with them) in its default locked-down state. People who really want some customizability on their phones can still use Android and either sideload or put some de-Googled distro on there.

Really, the average person doesn't need this much power and customizability either for their PC, phone, TV, car, washing machine... they're just commodity appliances to watch Game of Thrones and browse TikTok on. I think it's actually a good thing they're locked down. They don't have to worry as much about all the malware and broken configurations that were so common in the Windows 95 days.

But it's also nice, of course, that there are still niche options in the market that you can get if you really want that full bare-metal experience. Most people just don't need or care about that, and it actively hurts them by making them less safe.

"Load" as in "load the CD-ROM" (am I showing my relic-ness?).

"Side" as in "go in through the side door".

A term precipitated by the operating system locking down installation paths to The One Approved Way(tm).

Reply on news.ycombinator.com