Google's shocking developer decree struggles to justify the urgent threat to F-Droid
Google's new developer mandate is hitting alternative app stores hard. F-Droid says forced registration, fees, and ID checks could end the open-source project.
Have we ever lived in a more stallmanwasright.jpg time?
I never wanted him to be wrong more than right now. Except for tomorrow, it's probably going to bé worse, tomorrow
Stallman has never been and never will be wrong.
I sometimes like to read his political posts:
https://www.stallman.org/archives/2025-jul-oct.html
And honestly? I mostly agree with them? Like this:
ABC ordered to pay Antoinette Lattouf another $150,000 for unlawful termination over Gaza Instagram post.
But a company faced with enormous threats wielded by fascist officials who demand that certain views be suppressed will treat such penalties as the normal cost of sucking up.
The [Israeli] army says that HAMAS is using apartment buildings for "surveillance", and has bombed some of those buildings to destroy them. Based on this logic, the army might bomb every tall building in Gaza City with the large bombs that the US is providing
He has some questionable beliefs as well, though for unusual reasons. He accepts non-binary people but refuses to use they/them pronouns because he doesn't like the ambiguity of singular/plural pronouns. So he has invented the neopronouns per/pers to refer to singular non-binary persons. I genuinely think no other person on this planet could hold this opinion.
Unless he's championing paedophilia and bestiality, which he has done on a number of occasions. Or being an absolute creep with women, which he's also done.
Technically illegal where I live.
In Brazil you can't sell a device with a given feature and then remove said feature in a software update. Even Apple, known for never allowing downgrades, was forced to downgrade and pay a fine to a customer after his iPad 3 updated to iOS 7 and lost an iOS 6 feature.
In other words... every single Android device sold until today in Brazil allows sideloading. Even if a single customer uses a sideloaded app, removing the ability to sideload freely would be illegal, and because the original feature didn't require a developer signature it can't be enforced now.
The issue is, as always, if this went to court somebody would have to manage to explain to a tech illiterate judge what a "developer signature" is, how this relates to "sideloading" and so on.
thank god for brazil
.. Brazil is one of the first countries this'll go into effect and I also remember something about how that first batch of countries was chosen because their governmemts support this change.
because their governmemts support this change.
I can see how Google's PR team might use this argument, but it's certainly illegal in Brazil so our government most definitely isn't supporting this decision. Also, it needs to be way more specific than "government" - who exactly is endorsing this? Procon? Anatel? Polícia Federal?
Either way, the actual reason for targeting Brazil as one of the first is because we do love our piracy, which naturally translates into sideloading being frequent.
The problem might be that Google will argue this isn't a downgrade at all, but an upgrade (for "security" reasons). I don't want to be a pessimist, but the tech illiterate judges could eat that up.
technically you will still be able to install apps from outside the play store, but the developer will need to verify their identity with google.
Of course, most developers will refuse to do so (myself included), and so most apps will not be able to be installed. From a technical perspective, installing apps from other sources will still be allowed. So i can see judges ruling that this is not a feature removal.
You and I both know this is google killing non play store apps, but I don't think the tech illiterate judges will see it that way.
Starting next year, Android will require all apps to be registered by verified developers in order to be installed by users on certified Android devices.
Are they actually proposing to make any previously sold devices “certified” through a software update, though? Your points are right on if this edict applied to all devices.
A "certified Android device" is a device running Google Play Services, Play Protect, Google's WideVine DRM scheme and a few other requirements. If you purchase a device from a known manufacturer, like Samsung, you're falling into this category.
Also, let's stop calling it "sideloading". Sideloading has a bad vibe. We just want to INSTALL software on our own devices.
"Google stands for free and open internet"
https://blog.google/outreach-initiatives/public-policy/keep-internet-free-and-open/
Aged like milk.
Don't be evil
Be evil when it makes money.
And of course the motto should have been, "Don't do evil." That would have been a respectable goal. But it wasn't, because even back then they only wanted to be slightly better than Microsoft.
aged like a corpse in a bathtub more like it.
Mmmm head cheese
Don't be something or other, hey check out this week's doodle!
I am really glad to see these articles popping up now. Since the news broke a week back or so it was suspiciously quiet about this, despite lots of negative comments here.
I’m frustrated that the article didn’t link to the “decree.” Do you know where it is?
EDIT: nvm think I found it
https://android-developers.googleblog.com/2025/08/elevating-android-security.html
Isn't this illegal in Europe? Was that the whole point of forcing apple to allow alternative app stores?
Technically, third party app stores are allowed. Developers "only" register with google to receive a developer certificate. Isn't apple doing the same thing in response to the EU regulations and that has been allowed?
Seems like a weasel around the requirement to get rid of the actual benefit of 3rd party stores.
I can't believe how useless the EU regulations are.
If you have a Mac, have you ever tried installing an app and have it refuse because it's not signed by Apple, and then you had to go into settings and click "allow anyway?"
This is that, except without the allow anyway feature, like iOS. It doesn't matter if it comes from the play store or elsewhere, as this story originally had us believe.
No, Google is following Apple's exmaple.
There's never been a more urgent time to switch to Linux on pretty much every device.
The mobile options for Linux are years out from being ready and the hardware vendors are locking them out as fast as possible.
There's generally been positive reviews for FuriLab's FLX1 model:
Their new one, the FLX1s has 2GiB more RAM (for 8GiB, in total). I've heard battery gets 2 days without charge even with Android emulation.
So it would seem.
The stepping-stone would be de-googled Android like LineageOS or GrapheneOS. I think Linux is the end-game though.
wish it would have support
For those in Europe, write your representatives.
Fro me f-droid's post: https://f-droid.org/2025/09/29/google-developer-registration-decree.html
What do we propose?
Regulatory and competition authorities should look carefully at Google’s proposed activities, and ensure that policies designed to improve security are not abused to consolidate monopoly control. We urge regulators to safeguard the ability of alternative app stores and open-source projects to operate freely, and to protect developers who cannot or will not comply with exclusionary registration schemes and demands for personal information.
If you are a developer or user who values digital freedom, you can help. Write to your Member of Parliament, Congressperson or other representative, sign petitions in defense of sideloading, and contact the European Commission’s Digital Markets Act (DMA) team to express why preserving open distribution matters. By making your voice heard, you help defend not only F-Droid, but the principle that software should remain a commons, accessible and free from unnecessary corporate gatekeeping.
https://f-droid.org/2025/09/04/twif.html antifeatures]: F-Droid Anti-Features overview: [https://f-droid.org/docs/Anti-Features/](https://f-droid.org/en/docs/Anti-Features/) \[howmanyusers]: How many F-Droid users are there, exactly? We don’t know, because we don’t track users or have any registration. “No user accounts, by design”: https://f-droid.org/2022/02/28/no-user-accounts-by-design.html sideloading]: ‘“Sideload” is a weird euphemism that the mobile duopoly came up with; it means “installing software without our permission,” which we used to just call “installing software” (because you don’t need a manufacturer’s permission to install software on your computer).’ — Pluralistic: *Darth Android*: <https://pluralistic.net/2025/09/01/fulu/> \[playprotect]: “Google Play Protect checks your apps and devices for harmful behavior”: https://support.google.com/googleplay/answer/2812853
do we have a contact tool like for chat control?
Ah, you mean https://fightchatcontrol.eu/.
I am not aware of anything yet, apart from what the article suggests. https://digital-markets-act.ec.europa.eu/contact-dma-team_en
I will literally go without a smartphone if Google does this, this is insane I would have bought an iphone if I wanted a junk device I don't actually own.
If this effects de-googled android, I will probably start investing in Linux phones.
I would rather have a limited phone than has full freedom than one that makes everyone go through Google.
It won't. This is for 99% of users with their Google enabled devices. It's still shit and it will effect the 1% indirectly by the reduction of available software outside the play store.
The crazy part is this may make iOS the better alternative when considering the emergence of third-party app stores and Apple's loosening grip on their ecosystem.
LineageOS is still a good option too, for anyone who would prefer to keep the phone they have
LineageOS is not really an alternative though, as it will still be hit by this. Please see the comment here: https://lemmy.world/post/36621884/19652276
iOS would be the better alternative, if it wasn't for the hardware they run on. After all, Apple is infamous for their blatant planned obsolescence on their iPhones since the iPhone 6. Unfortunately, Google seems to be following Apple in this way as well since they launched an update that made the Pixel 6a's battery so much worse than before. Therefore, we must all have a dumb phone + Linux phone set up...or something
Not really. They are converging onto the exact same thing. 3rd party stores are allowed, but needs [Google/Apple]'s approval.
If you are big and have teeth (like Epic Games), you will (probably) be allowed, if you are small like a single open source developer, the can shut you down city dubious "security"/"ToS" issue, and you probably don't have the money to sue.
They both go for the least open option. If asking for all devs registration and validation from google is viable and legally sound, apple will do the same if that's not already in the pipe.
Both "stores" are targeted for the same issues.
Where are the third party app stores on iOS. Apple is delaying and fighting every inch in the EU.
Hopefully they go to court to get an injunction. Hopefully, they also go to the powers that be in the EU, those same powers have been so focused on the Apple App Store they failed to take into account Google can do something like this with the Play Store. It would be a shame for the F-Droid project to end but it is completely avoidable.
To be fair, up until recently, there was no clear indication that Google would do this. Google made it so that installing non-play store apps was slightly more difficult, Apple made it pretty much impossible. So Apple was a pretty logical target at that point (and honestly, up until then, they had pretty much gotten a free ride - think of the default browser issue in Windows, no one every bothered with Apple).
Open source community keeps trusting Google and they keep using the Embrace, Extend, Extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish
Linux mobile
Yea... I'm really disappointed with the timing of FuriLabs new phone which is mostly a downgrade over the previous one. I've been window shopping phones for a couple of months and am at a loss for what to do. Even spent some time considering a dumb flip phone that can work as a wifi-hotspot and use a small linux tablet or something for the more involved stuff, but couldn't find a good tablet option that wasn't huge (would still want it to fit in my pocket) or come with the same problems.
I'm starting to think these for-profit companies only care about making money.
gulp You might be right
Let's hope that the rest of the world, specifically Europe smash this ridiculous proposal apart for what it is. Europe has already sorted out USB-C etc. Its not perfect and they don't get everything right, but certainly big enough to make stuff right.
They're too busy forcing chat control and age gates through our collective throats.
Yep. The E.U. has allowed itself to be dominated for too long by the US megacorps. It has the talent, ideas, and manufacturing to tell US firms to bugger off ... and the sooner, the better for us all.
Unless you want hillbilly outrage slop destabilising your continent, you better get control away from American tech companies.
What pisses me off it that they say they do this for security. It changes absolutely anything.
They really think that malware developers will say "oh no! I need to submit a picture of an id card to sign my malware! It's literally impossible to submit a jpg of a stolen id card, I'm ruined and out of a job!"
What does it change? Waste 20 minutes of some malware developer while they register under a stolen id? They already have a system that scans for known malware and automatically remove it.
Of course they know that. It's about power and money. After all, they already have a security program that filters out malware. If we believe their stated reasoning (which we don't), they're tacitly admitting that their current security program is a complete failure, and also that they will not try to fix it.
Thing is, Play Store is already filled with malware or near-malware from seemingly verified developers. I ran into several scam clone apps just today. It's even snuck in through OEM apps.
Same on iOS, which supposedly verifies devs.
If 'verification' and curation is their idea of security, well... It appears their system is already overloaded, yet they want to expand it?
Both things can be true. It definitely is better for security. It’s pretty much indisputably better for security.
But you know what would be even better for security? Not allowing any third-party code at all (i.e., no apps).
Obviously that’s too shitty and everyone would move off of that platform. There’s a balance that must be struck between user freedom and the general security of a worldwide network of sensitive devices.
Users should be allowed to do insecure things with their devices as long as they are (1) informed of the risks, (2) prevented from doing those things by accident if they are not informed, and (3) as long as their actions do not threaten the rest of the network.
Side-loading is perfectly reasonable under those conditions.
It seems to me that part of the problem is overreliance on phones as computing devices. A lot of things, like banking, are best done on an actual computer. We have become too dependent on phones.
Your phone has likely much better security for your banking apps than your computer, unless you run really niche setup like QubesOS.
We as a society should be rethinking the term "security", if it's come to mean submitting to being jerked around however best suits some private company's interests instead of our own. If there's a central platform for its security benefit it should be democratically controlled instead of controlled by what are effectively feudal lords, or perhaps even an occupying force
I'm not sure how it works the way where you live but where I live, the way the banking apps are implemented completely violate MFA. They rely on SMS verification which is absurd since if you're phone is already compromised, no doubt your SMSes are too. There's no true multi-device authentication in place and this has led to a huge number of victims being scammed after their devices get compromised by a phishing attack.
The desktop and phone are both insecure, proper security should not have all your eggs in one basket.
You say "security" I say "a bug that won't let me log in". Which is it?
Maybe we have this view because when we refer to computers we see a more open ecosystem that's not found in the mobile phone era. I want that same liberty with my phone. When the word "sideloading" has disappeared, I think then we have known something has changed.
Yeah but it's "we" as in everyone not "we" as in "Lemmy commenters".
So the network effect will keep the average person on a locked-down phone that can't run anything anti-regime
no it's not. takes me 2 seconds to log in into my banking up in my phone. anything basic will take a few taps to do (eg transfer money).
Yep I absolutely refuse to put any banking apps on my phone. The only thing that has access to my bank is me physically going there or logging into their website via my own computer. Fuck any app that asks for access to my bank account including autopay services thorugh third parties.
The only third party serive I use for payments is paypal and that only goes to my credit card.
Yeah guess what happens when access starts to be app-only?
I am perfectly ok with android apps being required to be signed by not just a certificate (they always were just it could be self signed and just needed to match to upgrade without removing data) but a list of trusted entities.
As long as:
Without this it feels too much extending the monopoly despite being forced to allow 3rd party stores.
The justification is simple, I don't see the confusion, they want absolute power and for all alternatives to wither and die ? What is there not to understand ?
we need linux phones ASAP
I think Linux phones will gain some real traction within five years. Last I heard, KDE is putting great effort into making apps for Plasma Mobile
Does anyone know if existing linux phones can run 2FA apps such as Duo or Google authenticator?
They can run Keeppass, which does TOTP. It doesn't do push notifs, like Duo does, though.
We had a few good Linux phones back in the day but Nokia / Microsoft killed them trying to compete with iPhone OS and Android: Maemo / Meego were great but did not get a proper chance.
Jolla continued the legacy and Sailfish OS is still something worth checking out if you can find suitable hardware, or idk how complex it is to port it.
Seems to be new Jolla phone coming up at some point too: https://forum.sailfishos.org/t/next-gen-jolla-phone/23882
EU be like: Really? Didn't you learn from Apple?
Right now the only decently speced phone with mainline Linux support is the Oneplus 6, and the only one I can find is being sold for $2000
There's the FairPhone 6, running e/OS, Which is a deGoogled port of android, running microG
https://murena.com/america/shop/smartphones/brand-new/murena-fairphone-6/
I think that's the one I have, but please explain what mainline Linux kernel means? Would it be about installing bare Linux instead of Android?
It means you can use the regular Linux kernel instead of fucking around with a custom kernel (like Asahi) or with some sort of Android layer (like Halium). So running whatever distro you want shouldn't be too difficult.
Can't you install graphene on Pixel 6 and later?
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
The late stage capitalism of western oligarchies indicated that Google's rug pull of AOSP was an imminent inevitability. After already having to change my services and workflows multiple times over the last 2 decades — despite careful analysis and forethought — due to services ever changing value propositions, acquisitions, and all other forms of enshittification, I'm at the point where I won't bother wasting energy on 99% of digital products unless they're open source and I can run them indefinitely on my own Linux server.
The more dependent you grow on digital products, the more interdependent they become, and the more time and effort is required to replace or substitute them.
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
Bullshit. If you liked so much your freedom and privacy you would have many opportunities to use open source ROMs. You chose to stay on your iPhone because it was easy.
Also absolutely not believing you when you say that you anticipated the rug pull and chose to "not bother" for that reason. What a poor excuse for staying and supporting the closed ecosystem of Apple.
After already having to change my services and workflows multiple times over the last 2 decades
I can't believe someone who has been for years on an iPhone would pretend they are an ardent defender of freedom and open source.
Sure thing, buddy. Nice gate keeping high horse ya got there. FOSS is sure to attract more users with humble geniuses such as yourself antagonizing them. Do you also use Arch, btw?
"If you don't spend hundreds of hours switching from big tech corp controlled platform A — you've used for almost 20 years — to switch to big tech corp controlled platform B, you obviously don't support freedom and open source"
I actually contribute to the development of open source projects. Do you create/give value, or are you just a taker/user? ... Or are you just salty you couldn't see this highly predictable result coming a mile away?
Nice nick!
What stops those open source projects having that same rugpull? AOSP was open source and for a long time could be installed on one's phone indefinitely.
You could argue ownership, but if Audacity can be bought then so can nearly anything.
This is why I didn't bother switching to GOS, Lineage, Calyx etc despite being sick of Apple's anti-foss monopoly — marketed as Privacy™️ and Security™️ — for years.
I'm at the point where I won't bother wasting energy on 99% of digital products unless they're open source and I can run them indefinitely on my own Linux server.
but.. this doesn't make any sense. the roms you brought up can be still used indefinitely, they will still be able to install any apps. maybe except when they have installed the official google suite, but that's always a user choice in the popular android rom world, none of these preinstall it, and microg users are not affected
My job doesn't allow me to use a jailbroken/rooted device
So if/when this goes through I'll be switching to iOS.
Given the choice between two closed platforms, I'll pick the one that ostensibly says they're privacy focused instead of the one actively enshittifying their product.
I obviously don't know your situation, but using your own phone for work is a bit of a red flag. If you're required to use a phone for work, ideally the job should provide you one that meets their requirements.
You should just get a cheap phone to use for work. No reason to have their software on your own device. That will undoubtedly be used for creepy purposes.
Your job can say what phone you have? I don't get it
The moment my work says what phone I need is the moment I demand they provide a phone for me.
How about Murena Fairphone/Shiftphone with non-rooted /e/OS and locked bootloader?
How does google plan to enforce this? Will they disable side-loading for any app that isn't registered with google?
that's exactly what they are going to do. on every device released by certified partners.
https://www.android.com/certified/partners/
unless they change their mind on this, android will soon be a walled garden like the iphone is.
@AlteredEgo
Yes, pretty much. You need to sign the app with a key registered with Google.
@ardi60
European devs: Our laws will protect us!
Meanwhile, our laws:
Article 30
Traceability of traders
- Providers of online platforms allowing consumers to conclude distance contracts with traders shall ensure that traders can only use those online platforms to promote messages on or to offer products or services to consumers located in the Union if, prior to the use of their services for those purposes, they have obtained the following information, where applicable to the trader:
(a) the name, address, telephone number and email address of the trader;
(b) a copy of the identification document of the trader or any other electronic identification as defined by Article 3 of Regulation (EU) No 910/2014 of the European Parliament and of the Council (40);
Google’s developer verification will only run on mainstream Android with play services. It’s not supposed won’t be running in standard AOSP so the easiest solution would be to switch to a custom ROM like GrapheneOS.
They are also working to similarly kill custom ROMs. Just recently the GrapheneOS team mentioned that Google is no longer making their hardware drivers Open Source, and so compatibility with new phones means reverse engineering their own drivers - which is a big reason that custom ROMs support such narrow hardware options already and very often come with limitations and/or features that just don't work. At best, they figure out how to make it work, but it takes time and updates can lag significantly behind.
We have a lot of options on the software side for avoiding google (or android), but very limited options on hardware. We need open source mobile hardware support ASAP.
But remember, unlocking bootloader is harder and harder for many devices. And Google's Play Integrity and API changes makes removing trace of unlocked bootloader harder. Many apps not just banking, ChatGPT, games, some of social media is completely unusable in that scenario.
Contact your representative. And here's F-droid's article about it (including how to find your representative at the end of the article): https://f-droid.org/en/2025/09/29/google-developer-registration-decree.html
Best part: the better names in the alt os and device scenes don't sell in us markets.
Unless you do the legwork of flashing your own device, most of us are out of luck.
I just love a good market stranglehold.
But they do: https://murena.com/america
Would this be possible to bypass by bulding an app from source and convincing android that you are a developer who is testing his program?
theoretically installing through ADB will still work. but that's very impractical, and f-droid cannot do that.
Droid-ify + Shizuku FTW
Theoretically, google could keep that workaround in the code, yes.