Google's shocking developer decree struggles to justify the urgent threat to F-Droid
Google's shocking developer decree struggles to justify the urgent threat to F-Droid
Newpipe, now signed by Norman Reedus, verification picture and everything!
we need linux phones ASAP
They exist. People just don't buy them. But there is a Ubuntu phone port you can install on your phone as an alternative to android.
But yeah it can get complicated like any Linux community project and isn't at all mainstream.
We had a few good Linux phones back in the day but Nokia / Microsoft killed them trying to compete with iPhone OS and Android: Maemo / Meego were great but did not get a proper chance.
Jolla continued the legacy and Sailfish OS is still something worth checking out if you can find suitable hardware, or idk how complex it is to port it.
Seems to be new Jolla phone coming up at some point too: https://forum.sailfishos.org/t/next-gen-jolla-phone/23882
The Jolla was probably my favorite phone, but it broke so easily. I really hope they make something more sturdy this time around.
I think Linux phones will gain some real traction within five years. Last I heard, KDE is putting great effort into making apps for Plasma Mobile
Does anyone know if existing linux phones can run 2FA apps such as Duo or Google authenticator?
Or better apps like Aegis?
What is it with you people trying your best to get away from google but still using the most exchangeable app they have.
They can run Keeppass, which does TOTP. It doesn't do push notifs, like Duo does, though.
Why do you need the google Authenticator? Proton has it too. Which (from searching) looks like it’s compatible for the Ubuntu systems. But that’s just from the search. I ‘m personally just using it with a android right now. I am currently eyeing up the fairphone Ubuntu as my next phone
Contact your representative. And here's F-droid's article about it (including how to find your representative at the end of the article): https://f-droid.org/en/2025/09/29/google-developer-registration-decree.html
I'm starting to think these for-profit companies only care about making money.
gulp You might be right
Let's hope that the rest of the world, specifically Europe smash this ridiculous proposal apart for what it is. Europe has already sorted out USB-C etc. Its not perfect and they don't get everything right, but certainly big enough to make stuff right.
They're too busy forcing chat control and age gates through our collective throats.
Yep. The E.U. has allowed itself to be dominated for too long by the US megacorps. It has the talent, ideas, and manufacturing to tell US firms to bugger off ... and the sooner, the better for us all.
they are also going hard on surveillance, private info too, backed by RU of course.i think russell vought is behind the anti-porn verifications in the EU
Unless you want hillbilly outrage slop destabilising your continent, you better get control away from American tech companies.
What pisses me off it that they say they do this for security. It changes absolutely anything.
They really think that malware developers will say "oh no! I need to submit a picture of an id card to sign my malware! It's literally impossible to submit a jpg of a stolen id card, I'm ruined and out of a job!"
What does it change? Waste 20 minutes of some malware developer while they register under a stolen id? They already have a system that scans for known malware and automatically remove it.
Thing is, Play Store is already filled with malware or near-malware from seemingly verified developers. I ran into several scam clone apps just today. It's even snuck in through OEM apps.
Same on iOS, which supposedly verifies devs.
If 'verification' and curation is their idea of security, well... It appears their system is already overloaded, yet they want to expand it?
Both things can be true. It definitely is better for security. It’s pretty much indisputably better for security.
But you know what would be even better for security? Not allowing any third-party code at all (i.e., no apps).
Obviously that’s too shitty and everyone would move off of that platform. There’s a balance that must be struck between user freedom and the general security of a worldwide network of sensitive devices.
Users should be allowed to do insecure things with their devices as long as they are (1) informed of the risks, (2) prevented from doing those things by accident if they are not informed, and (3) as long as their actions do not threaten the rest of the network.
Side-loading is perfectly reasonable under those conditions.
It’s pretty much indisputably better for security.
I dispute this. While adding extra layers of security looks good on paper, flawed security can be worse than no security at all.
Android packages already have to be signed to be valid and those keys already are very effective in practice. In effect these new measures are reinventing the wheel as to what a layperson would think this new system does.
Adding this extra layer in fact has no actual security benefit beyond posturing/"deterrence". Catching a perpetrator is not the same thing as preventing a crime. Worse - catching a thief in meatspace has the potential to recover stolen goods, but not so in digital spaces - either the crime is damage or destruction of data for which no punishment undoes the damage or the crime is sharing private data which in practice would almost certainly have been immediately fenced to multiple data brokers.
And were only getting started with this security theater:
But you know what would be even better for security?
While we're at it we could add the tropes of removing network connectivity, or switch to using clay tablets kept in a wooden box guarded by a vengeful god. Both of those would be more secure, too.
Users should be allowed to do insecure things with their devices
100% agree with you here - it's fundamentally the principle of "Your liberty to swing your fist ends just where my nose begins". Users should be given the tools and freedom to do as they want with their property - up until it affects another person or their property in an unwanted way.
Of course they know that. It's about power and money. After all, they already have a security program that filters out malware. If we believe their stated reasoning (which we don't), they're tacitly admitting that their current security program is a complete failure, and also that they will not try to fix it.
"Google stands for free and open internet"
https://blog.google/outreach-initiatives/public-policy/keep-internet-free-and-open/
Aged like milk.
Don't be evil
Be evil when it makes money.
And of course the motto should have been, "Don't do evil." That would have been a respectable goal. But it wasn't, because even back then they only wanted to be slightly better than Microsoft.
Don't be something or other, hey check out this week's doodle!
Google’s developer verification will only run on mainstream Android with play services. It’s not supposed won’t be running in standard AOSP so the easiest solution would be to switch to a custom ROM like GrapheneOS.
They are also working to similarly kill custom ROMs. Just recently the GrapheneOS team mentioned that Google is no longer making their hardware drivers Open Source, and so compatibility with new phones means reverse engineering their own drivers - which is a big reason that custom ROMs support such narrow hardware options already and very often come with limitations and/or features that just don't work. At best, they figure out how to make it work, but it takes time and updates can lag significantly behind.
We have a lot of options on the software side for avoiding google (or android), but very limited options on hardware. We need open source mobile hardware support ASAP.
But remember, unlocking bootloader is harder and harder for many devices. And Google's Play Integrity and API changes makes removing trace of unlocked bootloader harder. Many apps not just banking, ChatGPT, games, some of social media is completely unusable in that scenario.
I am perfectly ok with android apps being required to be signed by not just a certificate (they always were just it could be self signed and just needed to match to upgrade without removing data) but a list of trusted entities.
As long as:
Without this it feels too much extending the monopoly despite being forced to allow 3rd party stores.
European devs: Our laws will protect us!
Meanwhile, our laws:
Article 30
Traceability of traders
- Providers of online platforms allowing consumers to conclude distance contracts with traders shall ensure that traders can only use those online platforms to promote messages on or to offer products or services to consumers located in the Union if, prior to the use of their services for those purposes, they have obtained the following information, where applicable to the trader:
(a) the name, address, telephone number and email address of the trader;
(b) a copy of the identification document of the trader or any other electronic identification as defined by Article 3 of Regulation (EU) No 910/2014 of the European Parliament and of the Council (40);
How is trader defined? Is it a developer that's selling apps or also one that's just providing it for free?
Bear in mind that an open source license is a contract and it usually involves some form of reciprocity, like crediting the dev by name. That's in principle not different from a sponsorship deal, where some sports stadium gets the name of a corporation.
The actual definition is even wider, though. I don't see who you get out of that.
If F-droid ever has more than 50 employees, annual turnover over EUR 10 million, or over EUR 10 million on the balance sheet, then they will have to collect the same information.
Technically illegal where I live.
In Brazil you can't sell a device with a given feature and then remove said feature in a software update. Even Apple, known for never allowing downgrades, was forced to downgrade and pay a fine to a customer after his iPad 3 updated to iOS 7 and lost an iOS 6 feature.
In other words... every single Android device sold until today in Brazil allows sideloading. Even if a single customer uses a sideloaded app, removing the ability to sideload freely would be illegal, and because the original feature didn't require a developer signature it can't be enforced now.
The issue is, as always, if this went to court somebody would have to manage to explain to a tech illiterate judge what a "developer signature" is, how this relates to "sideloading" and so on.
Also, let's stop calling it "sideloading". Sideloading has a bad vibe. We just want to INSTALL software on our own devices.
thank god for brazil
.. Brazil is one of the first countries this'll go into effect and I also remember something about how that first batch of countries was chosen because their governmemts support this change.
because their governmemts support this change.
I can see how Google's PR team might use this argument, but it's certainly illegal in Brazil so our government most definitely isn't supporting this decision. Also, it needs to be way more specific than "government" - who exactly is endorsing this? Procon? Anatel? Polícia Federal?
Either way, the actual reason for targeting Brazil as one of the first is because we do love our piracy, which naturally translates into sideloading being frequent.
The problem might be that Google will argue this isn't a downgrade at all, but an upgrade (for "security" reasons). I don't want to be a pessimist, but the tech illiterate judges could eat that up.
That's exactly what they're hoping for, and why we need to keep pouring out our outcry to reach them and hope they become more tech-literate.
technically you will still be able to install apps from outside the play store, but the developer will need to verify their identity with google.
Of course, most developers will refuse to do so (myself included), and so most apps will not be able to be installed. From a technical perspective, installing apps from other sources will still be allowed. So i can see judges ruling that this is not a feature removal.
You and I both know this is google killing non play store apps, but I don't think the tech illiterate judges will see it that way.
but the developer will need to verify their identity with google.
If I purchase a device today, it's got the ability to install apps that are not verified. This is a feature. If now it's restricted, it violates our code.
Starting next year, Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices.
Are they actually proposing to make any previously sold devices “certified” through a software update, though? Your points are right on if this edict applied to all devices.
A "certified Android device" is a device running Google Play Services, Play Protect, Google's WideVine DRM scheme and a few other requirements. If you purchase a device from a known manufacturer, like Samsung, you're falling into this category.
It seems to me that part of the problem is overreliance on phones as computing devices. A lot of things, like banking, are best done on an actual computer. We have become too dependent on phones.
Maybe we have this view because when we refer to computers we see a more open ecosystem that's not found in the mobile phone era. I want that same liberty with my phone. When the word "sideloading" has disappeared, I think then we have known something has changed.
no it's not. takes me 2 seconds to log in into my banking up in my phone. anything basic will take a few taps to do (eg transfer money).
Your phone has likely much better security for your banking apps than your computer, unless you run really niche setup like QubesOS.
There are no banking apps on my computer.
We as a society should be rethinking the term "security", if it's come to mean submitting to being jerked around however best suits some private company's interests instead of our own. If there's a central platform for its security benefit it should be democratically controlled instead of controlled by what are effectively feudal lords, or perhaps even an occupying force
You say "security" I say "a bug that won't let me log in". Which is it?
I'm not sure how it works the way where you live but where I live, the way the banking apps are implemented completely violate MFA. They rely on SMS verification which is absurd since if you're phone is already compromised, no doubt your SMSes are too. There's no true multi-device authentication in place and this has led to a huge number of victims being scammed after their devices get compromised by a phishing attack.
The desktop and phone are both insecure, proper security should not have all your eggs in one basket.
Yeah but it's "we" as in everyone not "we" as in "Lemmy commenters".
So the network effect will keep the average person on a locked-down phone that can't run anything anti-regime
Yep I absolutely refuse to put any banking apps on my phone. The only thing that has access to my bank is me physically going there or logging into their website via my own computer. Fuck any app that asks for access to my bank account including autopay services thorugh third parties.
The only third party serive I use for payments is paypal and that only goes to my credit card.
Yeah guess what happens when access starts to be app-only?
Have we ever lived in a more stallmanwasright.jpg time?
I never wanted him to be wrong more than right now. Except for tomorrow, it's probably going to bé worse, tomorrow
Stallman has never been and never will be wrong.
Except when it comes to women and girls, he’s absolutely wrong
I sometimes like to read his political posts:
https://www.stallman.org/archives/2025-jul-oct.html
And honestly? I mostly agree with them? Like this:
ABC ordered to pay Antoinette Lattouf another $150,000 for unlawful termination over Gaza Instagram post.
But a company faced with enormous threats wielded by fascist officials who demand that certain views be suppressed will treat such penalties as the normal cost of sucking up.
The [Israeli] army says that HAMAS is using apartment buildings for "surveillance", and has bombed some of those buildings to destroy them. Based on this logic, the army might bomb every tall building in Gaza City with the large bombs that the US is providing
He has some questionable beliefs as well, though for unusual reasons. He accepts non-binary people but refuses to use they/them pronouns because he doesn't like the ambiguity of singular/plural pronouns. So he has invented the neopronouns per/pers to refer to singular non-binary persons. I genuinely think no other person on this planet could hold this opinion.
🪴
Isn't this illegal in Europe? Was that the whole point of forcing apple to allow alternative app stores?
Technically, third party app stores are allowed. Developers "only" register with google to receive a developer certificate. Isn't apple doing the same thing in response to the EU regulations and that has been allowed?
Seems like a weasel around the requirement to get rid of the actual benefit of 3rd party stores.
I can't believe how useless the EU regulations are.
If you have a Mac, have you ever tried installing an app and have it refuse because it's not signed by Apple, and then you had to go into settings and click "allow anyway?"
This is that, except without the allow anyway feature, like iOS. It doesn't matter if it comes from the play store or elsewhere, as this story originally had us believe.
No, Google is following Apple's exmaple.
Open source community keeps trusting Google and they keep using the Embrace, Extend, Extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish
I will literally go without a smartphone if Google does this, this is insane I would have bought an iphone if I wanted a junk device I don't actually own.
If this effects de-googled android, I will probably start investing in Linux phones.
I would rather have a limited phone than has full freedom than one that makes everyone go through Google.
It won't. This is for 99% of users with their Google enabled devices. It's still shit and it will effect the 1% indirectly by the reduction of available software outside the play store.
The crazy part is this may make iOS the better alternative when considering the emergence of third-party app stores and Apple's loosening grip on their ecosystem.
LineageOS is still a good option too, for anyone who would prefer to keep the phone they have
LineageOS is not really an alternative though, as it will still be hit by this. Please see the comment here: https://lemmy.world/post/36621884/19652276
Not really. They are converging onto the exact same thing. 3rd party stores are allowed, but needs [Google/Apple]'s approval.
If you are big and have teeth (like Epic Games), you will (probably) be allowed, if you are small like a single open source developer, the can shut you down city dubious "security"/"ToS" issue, and you probably don't have the money to sue.
iOS would be the better alternative, if it wasn't for the hardware they run on. After all, Apple is infamous for their blatant planned obsolescence on their iPhones since the iPhone 6. Unfortunately, Google seems to be following Apple in this way as well since they launched an update that made the Pixel 6a's battery so much worse than before. Therefore, we must all have a dumb phone + Linux phone set up...or something
They both go for the least open option. If asking for all devs registration and validation from google is viable and legally sound, apple will do the same if that's not already in the pipe.
Both "stores" are targeted for the same issues.
"Year of the Linux Phone" has a nice ring to it.
Not for me, no. I love the sandboxing and permissions of android (GrapheneOS). Honestly, desktop OSs should learn from it. Also, android is a lot easier to use, especially on small form factor devices.
Idk about GrapheneOS in particular but I find the sandboxing solutions for GNU/Linux like bubblewrap to be much more granular than standard Android.
"give us access to manage phone calls or we won't you me answer internet calls (which have nothing to do with actual SIM calls)", "give us access to all your files or we wont let you share that file via the share function (which doesn't need fs access to work)".
On GNU/Linux I can only give a program exactly the resources it needs, I can disallow dbus, I can block it from accessing potentially troublesome things like /dev/dri, can overlay filesystems and pretend that's my real home dir. Or can just mount the whole / to some other system.
Linux mobile
Yea... I'm really disappointed with the timing of FuriLabs new phone which is mostly a downgrade over the previous one. I've been window shopping phones for a couple of months and am at a loss for what to do. Even spent some time considering a dumb flip phone that can work as a wifi-hotspot and use a small linux tablet or something for the more involved stuff, but couldn't find a good tablet option that wasn't huge (would still want it to fit in my pocket) or come with the same problems.
For those in Europe, write your representatives.
Fro me f-droid's post: https://f-droid.org/2025/09/29/google-developer-registration-decree.html
What do we propose?
Regulatory and competition authorities should look carefully at Google’s proposed activities, and ensure that policies designed to improve security are not abused to consolidate monopoly control. We urge regulators to safeguard the ability of alternative app stores and open-source projects to operate freely, and to protect developers who cannot or will not comply with exclusionary registration schemes and demands for personal information.
If you are a developer or user who values digital freedom, you can help. Write to your Member of Parliament, Congressperson or other representative, sign petitions in defense of sideloading, and contact the European Commission’s Digital Markets Act (DMA) team to express why preserving open distribution matters. By making your voice heard, you help defend not only F-Droid, but the principle that software should remain a commons, accessible and free from unnecessary corporate gatekeeping.
https://f-droid.org/2025/09/04/twif.html antifeatures]: F-Droid Anti-Features overview: [https://f-droid.org/docs/Anti-Features/](https://f-droid.org/en/docs/Anti-Features/) \[howmanyusers]: How many F-Droid users are there, exactly? We don’t know, because we don’t track users or have any registration. “No user accounts, by design”: https://f-droid.org/2022/02/28/no-user-accounts-by-design.html sideloading]: ‘“Sideload” is a weird euphemism that the mobile duopoly came up with; it means “installing software without our permission,” which we used to just call “installing software” (because you don’t need a manufacturer’s permission to install software on your computer).’ — Pluralistic: *Darth Android*: <https://pluralistic.net/2025/09/01/fulu/> \[playprotect]: “Google Play Protect checks your apps and devices for harmful behavior”: https://support.google.com/googleplay/answer/2812853
do we have a contact tool like for chat control?
Ah, you mean https://fightchatcontrol.eu/.
I am not aware of anything yet, apart from what the article suggests. https://digital-markets-act.ec.europa.eu/contact-dma-team_en
There's never been a more urgent time to switch to Linux on pretty much every device.
The mobile options for Linux are years out from being ready and the hardware vendors are locking them out as fast as possible.
There's generally been positive reviews for FuriLab's FLX1 model:
Their new one, the FLX1s has 2GiB more RAM (for 8GiB, in total). I've heard battery gets 2 days without charge even with Android emulation.
So it would seem.
The stepping-stone would be de-googled Android like LineageOS or GrapheneOS. I think Linux is the end-game though.
wish it would have support
I am really glad to see these articles popping up now. Since the news broke a week back or so it was suspiciously quiet about this, despite lots of negative comments here.
I’m frustrated that the article didn’t link to the “decree.” Do you know where it is?
EDIT: nvm think I found it
https://android-developers.googleblog.com/2025/08/elevating-android-security.html
Right now the only decently speced phone with mainline Linux support is the Oneplus 6, and the only one I can find is being sold for $2000
There's the FairPhone 6, running e/OS, Which is a deGoogled port of android, running microG
https://murena.com/america/shop/smartphones/brand-new/murena-fairphone-6/
I think that's the one I have, but please explain what mainline Linux kernel means? Would it be about installing bare Linux instead of Android?
It means you can use the regular Linux kernel instead of fucking around with a custom kernel (like Asahi) or with some sort of Android layer (like Halium). So running whatever distro you want shouldn't be too difficult.
Can't you install graphene on Pixel 6 and later?
Hopefully they go to court to get an injunction. Hopefully, they also go to the powers that be in the EU, those same powers have been so focused on the Apple App Store they failed to take into account Google can do something like this with the Play Store. It would be a shame for the F-Droid project to end but it is completely avoidable.
To be fair, up until recently, there was no clear indication that Google would do this. Google made it so that installing non-play store apps was slightly more difficult, Apple made it pretty much impossible. So Apple was a pretty logical target at that point (and honestly, up until then, they had pretty much gotten a free ride - think of the default browser issue in Windows, no one every bothered with Apple).
EU be like: Really? Didn't you learn from Apple?
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
The late stage capitalism of western oligarchies indicated that Google's rug pull of AOSP was an imminent inevitability. After already having to change my services and workflows multiple times over the last 2 decades — despite careful analysis and forethought — due to services ever changing value propositions, acquisitions, and all other forms of enshittification, I'm at the point where I won't bother wasting energy on 99% of digital products unless they're open source and I can run them indefinitely on my own Linux server.
The more dependent you grow on digital products, the more interdependent they become, and the more time and effort is required to replace or substitute them.
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
Bullshit. If you liked so much your freedom and privacy you would have many opportunities to use open source ROMs. You chose to stay on your iPhone because it was easy.
Also absolutely not believing you when you say that you anticipated the rug pull and chose to "not bother" for that reason. What a poor excuse for staying and supporting the closed ecosystem of Apple.
After already having to change my services and workflows multiple times over the last 2 decades
I can't believe someone who has been for years on an iPhone would pretend they are an ardent defender of freedom and open source.
Sure thing, buddy. Nice gate keeping high horse ya got there. FOSS is sure to attract more users with humble geniuses such as yourself antagonizing them. Do you also use Arch, btw?
"If you don't spend hundreds of hours switching from big tech corp controlled platform A — you've used for almost 20 years — to switch to big tech corp controlled platform B, you obviously don't support freedom and open source"
I actually contribute to the development of open source projects. Do you create/give value, or are you just a taker/user? ... Or are you just salty you couldn't see this highly predictable result coming a mile away?
Nice nick!
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
I'm at the point where I won't bother wasting energy on 99% of digital products unless they're open source and I can run them indefinitely on my own Linux server.
but.. this doesn't make any sense. the roms you brought up can be still used indefinitely, they will still be able to install any apps. maybe except when they have installed the official google suite, but that's always a user choice in the popular android rom world, none of these preinstall it, and microg users are not affected
What stops those open source projects having that same rugpull? AOSP was open source and for a long time could be installed on one's phone indefinitely.
You could argue ownership, but if Audacity can be bought then so can nearly anything.
How does google plan to enforce this? Will they disable side-loading for any app that isn't registered with google?
that's exactly what they are going to do. on every device released by certified partners.
https://www.android.com/certified/partners/
unless they change their mind on this, android will soon be a walled garden like the iphone is.
@AlteredEgo
Yes, pretty much. You need to sign the app with a key registered with Google.
@ardi60
My job doesn't allow me to use a jailbroken/rooted device
So if/when this goes through I'll be switching to iOS.
Given the choice between two closed platforms, I'll pick the one that ostensibly says they're privacy focused instead of the one actively enshittifying their product.
I obviously don't know your situation, but using your own phone for work is a bit of a red flag. If you're required to use a phone for work, ideally the job should provide you one that meets their requirements.
I must assume they mean no use it for their business that they own. Otherwise I'll just be sad.
You should just get a cheap phone to use for work. No reason to have their software on your own device. That will undoubtedly be used for creepy purposes.
Your job can say what phone you have? I don't get it
The moment my work says what phone I need is the moment I demand they provide a phone for me.
How about Murena Fairphone/Shiftphone with non-rooted /e/OS and locked bootloader?
Best part: the better names in the alt os and device scenes don't sell in us markets.
Unless you do the legwork of flashing your own device, most of us are out of luck.
I just love a good market stranglehold.
But they do: https://murena.com/america
Would this be possible to bypass by bulding an app from source and convincing android that you are a developer who is testing his program?
theoretically installing through ADB will still work. but that's very impractical, and f-droid cannot do that.
Droid-ify + Shizuku FTW
Theoretically, google could keep that workaround in the code, yes.
Graphene users REPRESENT