645
Android won't kill sideloading after all, but new verification rules will make it harder (www.techspot.com)
submitted 8 months ago by to c/technology@lemmy.world
120 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 19 points 8 months ago (2 children)

Weird that they want to do all the verification themselves and not just allow certificate signing using verified CAs. Oh well it's not weird because we all know Google does this to fight back against third party stores and to get developers back to their shitty one and of course to better track them.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 2 points 8 months ago (1 child)

    I'm guessing what you're suggesting is that Google's proposal is the same as requiring all packages be signed and accompanied by an Extended Validation or Oragnisation Validation X.509 certificate.

    While that would technically work, the problem with using the existing PKI is that it's still very expensive to get EV/OV certificates. And the most common of these certs (those for TLS purposes) will soon only last 47 days which is, to put it mildly, would be a pain in the ass to use for package-signing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 8 months ago

    My project uses a free one from SignPath. They offer this for opensource projects and require a verifiable GitHub build process. It's not EV certs but it's good enough and free.

  • permalink
  • fedilink
  • source
  • parent