Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Google agrees to pay $700M in antitrust settlement reached with states (apnews.com)
176 points by DocFeind on Dec 19, 2023 | hide | past | favorite | 185 comments


> Eligible consumers will receive at least $2, according to the settlement, and may get additional payments based on their spending on the Play store between Aug. 16, 2016 and Sept. 30, 2023.

I bet they give it as a play store credit. How else would they actually distribute $2 to so many people without costing a huge percentage of the payout?

> Like Apple does in its iPhone app store, Google collects commissions ranging from 15% to 30% on in-app purchases — fees that state attorneys general contended drove prices higher than they would have been had there been an open market for payment processing.

The real lesson here is to not let anyone get a foot in the door of your walled garden.

> Google also agreed to make other changes designed to make it even easier for consumers to download and install Android apps from other outlets besides its Play Store for the next five years. It will refrain from issuing as many security warnings, or “scare screens,” when alternative choices are being used.

The States that asked for this are idiots. The real world consequence of this won’t be improved competition. It will be grandma getting fleeced.

It’s not that it should be possible, but making it not “scary” is not a good idea for the reality we live in.


> It will be grandma getting fleeced.

Not just grandma. We need to move away from the idea that just a handful of digital illiterate seniors will get screwed.

Android has been the main target for malware for a while now.

Nokia’s Threat Intelligence Report in 2021[0] reported that Android makes up more than half of all the infected systems, in the recent 2023 report this had dipped to 49%[1]. But as they’ve done in prior reports, this year they again highlight that most Android malware is a trojanized version of legitimate apps distributed via alternative means:

> Android based devices are not inherently insecure. However, most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware. Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device.

0: https://pages.nokia.com/T006US-Threat-Intelligence-Report-20...

1: https://www.nokia.com/networks/security-portfolio/threat-int...


Uh installing from just about anywhere that's unheard of in the history of computing!!!


And nothing ever went wrong with that in the history of mankind, right?


It went so wrong that a history of computing exists!!!

Anyhow, I don't argue that the security of most current computers is poor, but turning them into appsfromonestore-downloading devices is not the answer.

(there are plenty of systems safer than Android)


Android is also the most popular OS in the world right now. There billions of people who developing countries who use a cheap Android phone as their only computing device. I'm sure a lot of them come bundled with rather questionable apps and app stores.

https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...


>Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device.

F-Droid is a much better option for consumers. If I download an app that runs on my hardware and uses my mobile data, then it would be dame good idea that NOT ONLY the source is available, but there is build-able from the available source.


I love going through source code and make my own build as much as the next geek here on HN, but let’s be honest here, to the average consumer both your comment and mine reads as gibberish.

The threat report is written with the average consumer in mind, not a consumer who can read source code well enough to understand if there’s funny business going on.


That's why using F-Droid, which distributes apps *already built* by them, is such a good idea (albeit with a few risks of its own).


Whether those numbers are true, malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations).


A lot of very sensitive data is on phones, often including password managers and VPNs that might give quite a bit of access to said servers and workstations.


A lot of very sensitive data is on other computers, but they remain useful and safe enough despite allowing software not signed by Google.

Meanwhile, for a lot of people around the world the only affordable computers are smartphones; and if they are so dumbed down, those people are enormously more limited than they'd need to in their capabilities.


They are not “safe enough” - ransomware, viruses, etc


If they're used they're safe enough..!

Of course they -often- should be a lot safer, but not by turning them into Android or an iPhone


> Whether those numbers are true

Wow, hold on cowboy. If you’re going to insinuate stuff, you better come packing with some sources.

> malware on Android can generally do a lot less damage than on other systems (first of all because Android is not used for servers and workstations).

I suppose that depends on your definition of damage.

Considering most of the trojanized apps consist of banking apps that subsequently drain their victims’ accounts, I’d say that’s pretty damaging.


Cheking that report requires reading all Nokia's terms, so forgive me for not having done so yet

Unless you're the author of the report, though, I wasn't insinuating anything about you.

--

Online banking is usually accessible through browsers on any system


> Online banking is usually accessible through browsers on any system

While that's true, you said mobile Android "can do less damage".

That doesn't really seem to be the case though, due to people (commonly) installing their banking apps on their mobile phones with full access. (yeah, ugh!)


I said «malware on Android can generally do a lot less damage than on other systems» !

Since online banking is available on all systems, however bad a compromise of it might be it would be just as bad on smartphones than on the other systems, no..?

And by the way installing a banking app is (generally) a voluntary choice.

There's no need for banking apps to exist, and for that existence to dictate that smartphones need to dumbed down so much and have all these limits.


My banking app can NFC scan my credit card to verify I'm in physical possession of it. Don't think a web app can do that. Correct me if I'm wrong


So, mobile android malware can do the same amount of damage as other systems then? ;)


I think we have different ideas about algebra ;)


True. You keep on saying "can do a lot less than" but then there are examples of that not being the case. :)


I was referring to the sum of things that can be done


Ok I just noticed that you called the play store a "secure app store".

That's ludicrous.


Comparing the play to the f-droid store, the f-droid store is not secure at all. You add your entry and have it built. After that, no one takes a look at your codebase. Only if it doesn't compile for weeks.

F-Droid does not have restrictions based upon sensitive permissions, such as background location, phone & messaging, etc.

The Play Store has seen a lot of shit and has adapted policies to get that blocked.


I find F-Droid more trustworthy than the Google Play Store because the F-Droid maintainers are much more transparent and communicative than Google is. The Play Store review process doesn't do a thorough job of checking apps for privacy or security issues and doesn't require apps to disclose anything other than their permissions. F-Droid reviews every app before accepting it into the main repository, and labels apps with tracking or other potential issues with "Anti-Features" labels.[1]

Any user can inspect the source code of any app in F-Droid, while that's not even an option for proprietary apps in the Play Store. When someone notices an issue and reports it to F-Droid, the maintainers listen and either change or remove the app listing, with these removals being logged in their weekly updates.[2] For Google Play apps with issues that you happen to notice despite most of the apps being closed source, unless they get media coverage, you'd be lucky to get anything other than canned responses from Google when you report them.

F-Droid also has some great apps that depend on sensitive permissions that are forbidden by Google Play, such as the AdAway[3] ad blocker which uses either the Android VPN interface or system hosts file. AdAway enhances user privacy and security by blocking trackers and malware hosts, so Google did not improve Android by removing AdAway from the Play Store.

[1] Anti-Features on F-Droid: https://f-droid.org/docs/Anti-Features/

[2] F-Droid weekly updates: https://f-droid.org/en/news/

[3] AdAway: https://f-droid.org/packages/org.adaway/


I know of all this - I uploaded one app to F-Droid some years ago. It took about a year to get it fixed and 2 to get a false positive anti-feature removed. Not a problem, I like the service and it's free/libre so I don't expect stuff to be fixed fast.

> The Play Store review process doesn't do a thorough job of checking apps for privacy or security issues and doesn't require apps to disclose anything other than their permissions.

This is wrong. Depending on what you use, more scrutiny is applied, eg an Android Auto extension has to be compliant with road safety guidelines as well, in order not to disctract the driver. The process is not 100% thorough, no, but nothing can be. App devs have to disclose quite a lot on the Play Store actually, it's only getting more: URL where to delete account, URL where to delete data, information on how data is used, tracked and shared.

My main point was security: - No restrictions on permissions is definitely libre in a way, but not secure. - Afaik no codebase or runtime checks to make sure it's not malware etc.


Yep, what the Play Store likes to block is apps which help privacy too much.

You'll find that several apps had to curtail their protection features a lot for their Play Store versions (e.g. NetGuard).


I'm dismayed that Google wasn't forced to revert the decision to block new apps from using their own signing keys[1]. That's far more problematic than the so-called "scare screens".

1: https://www.xda-developers.com/google-play-apk-replacement-p...


How would this effect normal users? For 99.9% of android users I don't think matters.


The impediment is that if your application is distributed via the Play Store, and is removed for some reason, another installer/store (FDroid, etc.) can't update the existing package.

This means that the user can't seamlessly transition between the old and new distribution methods without fully uninstalling the app and wiping the data contained theirin.


No, you can still provide Google your own key.

The enormous problem with that change is instead that indeed you're required to provide the keys to Google, which can thus replace your app with anything else (especially, something that a court orders them to use).

Anyway to switch to F-Droid you always had to reinstall the app, because they use their own signing keys (and indeed could be ordered to do the same thing as above, but it's less likely).

Although, I think there actually is a mechanism to switch signatures; but if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.


> if I remember well it entails signing with the new signature a version signed with the old one, so it's complex.

Wait no of course it's the opposite, specifically you sign the new certificate with the old key, if I understood it right (https://source.android.com/docs/security/features/apksigning...)


This has changed[0]

>All the years before, F-Droid created a dedicated key for each app to sign the published APKs, but now with reproducible builds F-Droid ships APKs that are signed by the upstream developer

[0] https://f-droid.org/en/2023/09/03/reproducible-builds-signin...


Only for reproducible builds, a lot of work has been done to encourage and facilitate them in the last years, but they're still a minority of the apps.

By the way, these reproducible builds apps run a high risk of being signed with the same key that Google has


>these reproducible builds apps run a high risk of being signed with the same key that Google has

That's a great point. Someone should submit a request to add language to their docs[0] letting developers know about that if it doesn't exist already. I breifly looked through that page just now and didn't see it pointed out explicitly. There should also be a way to let users know.

[0] https://f-droid.org/en/docs/Reproducible_Builds/


About the fact that Google could have the signing key, you mean?

Yeah I haven't followed much F-Droid lately, I wonder if they ever realized that...

I think that the project never settled on a specific security model, to be honest, and the current one is mostly the result of happenstance.

And I don't know what will happen to F-Droid now that some of the most important people left.


It's essentially a mandatory backdoor. It means that Google has the capability to modify application code, and there's no longer a mitigation for this attack vector available to developers.

Hypothetically, Google might be compelled by a government to deploy a malicious update to an app for surveillance purposes. It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys for new apps, making new non-Google apps inherently less secure.


> It means that Google has the capability to modify application code

The Play Store has system signature, so it could already do that. The mitigation is on the user's side to disable the Play Store, which is where it has always been.

> It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys

Only if they distribute through the Play Store. The whole point of the recent lawsuit is to make it easier for anybody else to distribute apps under their own control.


Google having the keys of all the apps on the store make all of them subvertible.

So you can reach even people without the Play Store and with degoogled systems, unless they only use apps from other sources.

That's both a serious problem for not so few people, and a very useful attack avenue for law enforcement.


> So you can reach even people without the Play Store and with degoogled systems

How would Google install the apps on the devices without the Play Store? Even if it somehow tricked the user into installing the app, it would require the user to approve any additional permissions that the subverted app requests.


You seem to have completely misunderstood what I said

It's the app updates that become an easy attack avenue if Google has their signing keys.

It's actually always been possible for Google to replace the initial installation packages (and if did, then also their future updates).

For this initial installation it might be a little easier for the user to verify that he has an untampered package. But most of all, in most cases, someone becomes the object of an investigation at a moment when he already has an app you'd like to subvert installed.

Anyhow, when Google wasn't provided the keys, if you initially received the real package, all successive updates were guaranteed to come from the developer (unless the developer itself got compromised).

For many apps it's already extremely interesting for law enforcement to provide a slightly modified version, with not even a need for additional permissions: for all E2EE apps, for example, it might well be that all you want is to exfiltrate their encryption keys.

By the way, at least if the Play Store is installed, Google is able to install updates surreptitiously:

"If it is determined, however, that the Update will fix a critical security vulnerability or critical operability issue related to the Content, or will prevent abuse, the Update may be completed irrespective of your Update settings in Google Play or your Device."


Right, I think the solution to this, which already exists, is other preinstalled stores, like Samsung or Amazon stores, by OEMs. What should probably be illegal is making deals forcing OEMs to have exclusive app store deals?

That being said, that's also a shitty situation for consumers, as having many or different app stores is confusing and just leads to the very fragmentation people have complain about on Android for a decade.

This is the real duality of the situation. On the one hand, people criticize Android for not being as cohesive an experience as iOS, but on the other hand, anything Google does to make it more cohesive will be seen as anti-competitive. Same with security.


> That being said, that's also a shitty situation for consumers, as having many or different app stores is confusing and just leads to the very fragmentation people have complain about on Android for a decade.

Are people confused because they can choose whether to buy things at Walmart, Target, Amazon or the local convenience store? Is this "fragmentation"? Should we get rid of these others and have only Amazon, so people aren't confused?

It's not really that confusing. You can go to any shady website on the internet and give them your credit card number and find out what happens, but people mostly just buy things from stores they trust -- even though there are many of them. Why is this different?

(Actual reason: Because the incumbents suppress the other stores so none of them gets popular enough to establish a reputation with the public at large.)


Because it might not end up being a choice of which store to get things from like your physical goods example. For the larger apps/those from specific publishers it may likely be a choice of: Meta apps only from the Meta Store, Epic Games apps only from the Epic Games store, etc.

And regarding the security aspect: once people expect to download a random app store for every company, they'll be less hesitant to download one that's just malware.


> For the larger apps/those from specific publishers it may likely be a choice of: Meta apps only from the Meta Store, Epic Games apps only from the Epic Games store, etc.

That's not really different than anything else. You can only get Great Value brand products from Walmart. But when this happens it's typically because the store and the maker of the product are the same company. Then you don't have to worry about the store having a monopoly because either the product has competitors, and then you can use those, or it doesn't, in which case you're dealing with a monopolist regardless of how many stores you can get it from.

But it's not even clear this would happen if there actually was competition between stores, because why does every random company need its own store if there was enough competition between stores that they could just put their app in existing popular stores without having to pay excessive margins or being subject to abusive monopoly practices?

> And regarding the security aspect: once people expect to download a random app store for every company, they'll be less hesitant to download one that's just malware.

An app store which is just malware would be illegal, and then get removed by court order for being illegal (or cease to exist because the proprietors are in prison). You can allow legitimate competitors without allowing overt criminal activity. The obvious distinction is that who decides what's prohibited is an elected government subject to constitutional restrictions rather than a competitor with a conflict of interest.


> anything Google does to make it more cohesive will be seen as anti-competitive..

Sure, anything Google does to make it more cohesive...

https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

https://www.theverge.com/2011/05/12/google-android-skyhook-l...


> Right, I think the solution to this, which already exists, is other preinstalled stores, like Samsung or Amazon stores, by OEMs. What should probably be illegal is making deals forcing OEMs to have exclusive app store deals?

I have another store on my phone called "Mi Picks", which was preinstalled. I've never used it. Why would I?

The only reason people would ever use another store is if they were forced to, to install a specific app, this is of course the situation on PC where you need to install another store for every game, and this is the only thing that Google made deals to prevent.


> The only reason people would ever use another store is if they were forced to, to install a specific app

Obvious counterexample: The other store charges 4% instead of 15% or 30% and correspondingly the exact same app is cheaper there.


Steam charges 30% and is completely dominant on PC, and there's competitor that tries to compete by charging 4%.


It's common to install PC games without an app store at all.

Does the store charging 4% have the same games but for lower prices? Which one would you use if that were the case?


I'm mostly agreeing with you.

Steam definitely has a monopoly of PC gaming, but it's also true that having a single place with all your games and friends is far more convenient. I'm not sure where the right balance is. Are we paying more due to the lack of competition to Valve's 30%? Would more competition be worth the fragmentation? Look at streaming services and the mess that has become. I'm not sure what the answer is.


Steam is a bit of a very special case and I think very different from either Apple or Google stores.

Steam is never part of a platform, except for maybe the steam deck, and even there it lets you very easily replace it.

Steam will install other stores automatically for you. Does the game need EA's origin or what ever the epic store is called? It will install it as part of playing that game. Users will have multiple stores installed and will continue to choose Steam.

In the case of Apple or Google, I'm given a store forcefully. Google let's you jump through hoops to get another store but it isn't easy.

To even get Steam, you as a user have to make a very conscious choice to install it.

Steam is very much the choice of users and even many developers.

Steam is a private company and doesn't seem in the business of ever attempting to screw with or limit users.

Hell, Steams development of wine/pronton is the explicit choice to give users more choice.

Steam maybe an app store, but IMHO it is definitely not ever forcing anyone to do anything, unlike Apple or Google.


> In the case of Apple or Google, I'm given a store forcefully. Google let's you jump through hoops to get another store but it isn't easy.

Every Samsung and Xiami phone comes with another store.


I think you missed my point. Even if that is the case, it is still another store that the hardware vendor installed. Most likely uninstallable without rooting the device.

Steam does not come preinstalled (except for the steam deck), users choose to install it on platforms they own.

Steam is removable from all platforms with minimum fuss.

Steam can and will install competing app stores.

None of these facts are true on Apple, Google, or other preinstalled mobile app stores.


> Most likely uninstallable without rooting the device.

You can disable them without rooting your device. I just verified.


> The only reason people would ever use another store is if they were forced to

...or if the default store had terms you'd rather do without...


...or when this shitty play store decides that something is not available for my device and/or region for some idiotic reason again


Agreed. We have the entire history of personal computing to know the consequences of these changes.

Industry experts still state, ad nauseam, that side loading and 3rd party app stores are the overwhelming source of Android malware. (Source: Nokia Threat Intelligence report: literally every single year it is issued.)

There are better solutions available, such as directly addressing developer's complaints, rather than hoping a competitor will materialise:

- Requiring google spin off the approval process into an independent, audited entity.

- Legislate a maximum price for transaction fees (like how some markets do with bank fees)

- Legislate a maximum price for listing/admin fees (like how some markets do with staple goods)

What isn't the solution is removing all guard rails from the number 1 source of malware.

Also I don't care much for deemphasising the role of a trusted app store. This is mainly harmful to startups and small developers, since the likes of Spotify can fly solo and undercut smaller developers which rely on Google’s store for visibility and user trust in transactions. Few will hand over their banking details to these smaller developers, especially if they’re overseas or using a different currency.

An entire generation of people were scared of, or did not meaningfully use computers because of malware. Yet this same generation is not scared of smartphones and tablet computers and contributes significant spend to the app ecosystem. I fear that once legislators and court rooms bring back the risks of computing in the '90s, it will take us back to square 1.


> An entire generation of people were scared of, or did not meaningfully use computers because of malware

Sorry but that's just a ridiculous and entirely false claim


A single monopolistic store gives raise to all kinds of problems anyhow, at least unless it's _entirely_ controlled by a trustworthy entity devoting enough resources to its management.

Check how happy developers are with it.

And you're enormously overestimating the security checks that are performed on apps.


> An entire generation of people were scared of, or did not meaningfully use computers because of malware.

Which entire generation was this?


I personally will install any crap on my iPhone mostly with assurances that it can’t do any damage to my phone.

On the other hand supposedly reputable companies like Zoom have been found to install secret backdoor on Mac’s - a full web server - causing a massive vulnerability.

I’m much more cautious about installing something on my Mac or work PC.


It's interesting to me what someone on HN wouldn't be aware of computer aversion behaviours and malware related technophobia. Since it's not only extensively studied but reported upon frequently. It is also trivial to observe directly, often within our own network of family/friends, and forms the foundation of the marketing behind so many anti-virus products.

The generation in my remark is the segment of people who did not meaningfully engage computers due to fears of malware and hacking, the same people who now have no issue carrying a smartphone with them everywhere they go.

Do you legitimately think these people didn't exist? Even though post iPhone, digital device usage has significantly out paced population growth, and become a societal necessity.


> It's interesting to me what someone on HN wouldn't be aware of computer aversion behaviours and malware related technophobia.

I'm aware of them, and I've seen them across numerous generations with lots of members of the same generations being active computer users.

What I am not aware of and no one has provided any support for is the claim that an entire generations refused computer use for the particular reasons stated upthread, the people that avoided computer use mostly did it for ither reasons, and the people with hacking concerns were mostly computer users, though they often had atypical usage patterns (sometimes reasonably related to avoiding hacking, sometimes heavily cargo culted.)


The payout I just got from the last Google class action was PayPal or check. I chose PayPal and they mailed me a check.


> I bet they give it as a play store credit. How else would they actually distribute $2 to so many people without costing a huge percentage of the payout?

I got a $0.13 cent check from some iTunes class action settlement.

edit: Think it was this one. https://www.nola.com/louisiana_inspired/we-received-a-16-cen...


I just don't see many supposed grandma's (or prey people) make tweaks or go out and seek software outside of the playstore. The only reason my dad uses Newpipe is because of me. Someone knowledgeable has to introduce it to them. The most adventurous thing these people will do on their own is download apps on the playstore by themselves and sign in their app.


Until grandma gets a call from a nice gentleman at “Google tech support” who walks her through the process.


Or a nice popup informing her that her phone is infected with 1 billion viruses and she needs AV software right this minute.


If they take the bait, them warning signs are useless. You're giving a novice a choice between removing the viruses on their phone and the dangers of installing third party software. Do you think the prey will be like: wait a minute, I see what this malware is doing? Ha! lmao


iOS also has the ability to trick users into downloading virus protectors. But they really can’t do much harm


that's because you are downloading from the apple app store ... try jailbreaking your iPhone and keep installing random things from cydia. Pwnage awaits


Doesn’t that kind of make the point why app stores and a good sandbox are fair trade offs?


If the mark/prey believes they are talking to a legitimate tech support person, their mostly screwed. The warning sign isn't there to stop a con artist or social engineering.


How would this type of attack work on an android that is locked to play store?

I guess you could use a web phishing page, but you couldn’t remote access their device. Maybe you could get a malicious data capture app into the play store that simply collects data, but it would eventually get banned


If the aim is to have grandma download a malicious app, you direct her to download one of the countless malicious apps that find their way to the play store.


And my mom who is 80 and is somewhat computer literate - she is a retired school teacher who used our Apple //e with AppleWorks back in the 80s and has had multiple fairly up to date computers since then.

She went to download a printer driver and she went on a website that had crapware. It’s not just the shady websites. CNET (download.com) and whatever company use to own Slashdot use to bundle Firefox with crapware.


> How else would they actually distribute $2 to so many people without costing a huge percentage of the payout?

It’s rentseeking monopolies all the way down.


Grandma getting fleeced is a small price to pay when the alternative is totalitarianism.


If Android is perceived as a place where normal people get fleeced, then the logical recommendation for non tech literate people will be “get an iphone”


Therefore people shouldn’t be allowed to install software on computers they bought.


TLDR: Google was exploiting “openness” as a concept while actively not being open. This is a win for openness, not a loss as op asserts.

It’s neat that you make this a Google vs apple thing somehow, but the walled garden had very little to do with the lawsuit.

Google was found to be engaging in anti-competitive behaviour. This behaviour is used by at least some consumers to make decisions (being an “open platform”), but which Google was forcibly manipulating behind to scenes to not actually be as open as they were pretending to be.

You can call it just “apple keeping a walled garden” all you like, it doesn’t change that Google was attempting to shift market behaviours based on what was demonstrably a lie. For all intents and purposes, Google *was a walled garden*, and comments like yours show that their manipulation worked.


The walled garden has everything to do with the lawsuit. This lawsuit would not have happened had Android been a walled garden.


Android *is a walled garden*, and that’s why they lost.

Google asserts that they are open while actively being closed and anti-competitive.

This is a win for openness. Not a loss.


Android is open, there is competition otherwise there couldn't be "unfair competition".


No. They pretend to be open. They speak out of one side of their mouths and behave from the other.


My god you can install every app you want on an android phone. It's so absurd to deny this. It's not open because Google doesn't provide a billing service for every would-be app store competitor? Neither does Windows, Mac or Linux.


I don’t know a ton about this lawsuit but I do know that sideloading was one of the arguments Google made, and they lost.


aint nobody suing about not being open ... unless Apple would be litigating all day. Google lost wrt that argument because they actually allow side-loading but with a scary warning that the app they are side-loading shouldn't be trusted.

Epic: Waaah! we don't want to pay the app store tax. We'll take Apple and Google to court.

Apple: Ha Non-Starter. Good luck with the app. Walled garden. Closed. We don't bend for anyone on this hill, etc. your honor. Never have. Never will.

Google: Well we also take a cut if you want to be in our app store (although the rules are a bit more loose than Apples and hush-hush side deals) but we are a open and your users can install the app without going through our app store (side-loading). Although we will show a warning to protect users that what they are installing hasn't gone thru the review/quality/security process the app store provides.

Epic: Hmm See your honor Google is putting up this scary label when we tell the users to install the app in a way that bypasses the Google tax.

Judge: Yeah that does seem unfair. I'm ruling in favor of Epic against what Google is doing. Google stop putting up those scary labels!

Apple Lawyers: JAJAJAJA

Google: But but but...

In the end Android is riddled with Malware and the OS is unusable because some app installed from a website not vetted by the review process is hogging all the resources or stealing bank info.

"Android is the worst!"


Note: this lawsuit is actually different from the epic lawsuit. This lawsuit was brought by several states.



What do you think all these point-of-sale devices (eg. Clover, etc.) or Amazon Kindle run on? It's not iOS


Why was that comment downvoted??


It's shocking that it's illegal to make an OS that allows people to install apps from other sources after warning them, but not illegal to not allow that at all.


This is the problem that arises when the legislature doesn't make laws specifically around things like app stores.

The courts take existing laws and regulations and try to make them fit, and different courts come up with different answers because the laws they're using never imagined this precise scenario.

Ideally we'd have a functioning Congress that would debate these issues and write carefully thought-out laws to regulate app stores. Until then, we just get messes of seemingly contradictory rulings that seem to be decided more by chance than by any clear cohesive principle.

In other words -- blame the legislature, not the courts.


These things would be processed faster if we had sane laws and/or procedures around lawsuit discovery requests and motions. Still a problem with the legislature, but also a little with the courts.

We simply do not have enough judges to handle caseloads in a timely fashion. But also, whenever a major company is sued you end up with 8 billion motions that the court has to rule on before you even get close to a trial date.

A major problem is there's no real penalty for wasting the court's time. Companies are incentivized to make longshot motions because in the worst case, the court will just say no. For lawfirms, the more motions you make the bigger their paycheck so they not only go unpunished, they are rewarded for making as many motions as possible.


> because the laws they're using never imagined this precise scenarios

These scenarios precisely avoided the law


>Ideally we'd have a functioning Congress that would debate these issues and write carefully thought-out laws to regulate app stores.

Why is it ideal that there are more laws, more regulations...?


The system is currently very broken. Less laws wouldn’t make this situation better. Either update/adapt, or require specific amendments?


Because the world changes, so laws need to change as well. Because capitalism would devour the entire planet without regulation.


> It's shocking that it's illegal to make an OS that allows people to install apps from other sources after warning them, but not illegal to not allow that at all.

That hasn't been established yet. This wasn't a court decision, it was a settlement. Epic separately sued both Google and Apple and won against Google but lost against Apple, but both of the cases are being appealed and you don't have a national precedent until you have a Supreme Court decision.


I think it's a little more complicated than that. You can have precedent when courts follow fellow courts' decisions. The supreme court just has the final say. Also, even if SCOTUS rules one way, it can just overrule itself a few years later if it wants to (like it did in the summer).


> You can have precedent when courts follow fellow courts' decisions.

They're not required to do that and when it comes to nonsense results like trying to reconcile the different outcomes in Epic v. Apple and Epic v. Google, they're going to have a think and then make their own decision.

> Also, even if SCOTUS rules one way, it can just overrule itself a few years later if it wants to (like it did in the summer).

That wasn't a few years, it was half a century, and in general they try to avoid that. The case you're referring to was quite possibly the most controversial case in living memory.


Law is so weird. Apple stopped watch sales today for using decades old technology[1]. And Google for this. Out of ALL the bad things they have done.

[1]: https://www.forbes.com/sites/katiejennings/2023/10/31/some-a...


Am I misunderstanding or are you suggesting it should be illegal to make an OS that doesn't permit certain functionality?


It’s because the acts in a vacuum aren’t illegal. It’s about leveraging power derived from market dominance.

(Although in this case the legality hasn’t been adjudicated because a settlement was reached).

If you create a platform and app market with strict rules, that’s not illegal. The logic here is that you’re new in the market and if the terms aren’t commensurate with market conditions, you will never grow. If you do grow, then the market has decided that the gains outweigh the limitations you imposed.

There comes a point where you have gained enough dominance where your actions can be scrutinized. But in general as long as you don’t actively tighten the reigns, you’re in the clear. So if you had strict rules when you started and despite those strict rules you grew and since then you haven’t made the rules stricter, then you’re in the clear because you haven’t abused your market dominance.

The flip side of this coin is that if you created a platform and app market that didn’t have strict rules and was very open, but once you’ve gained market dominance you put up hurdles or you impose stricter rules, then there could be a problem because now it can be explained as you abusing your market dominance after everyone got in.

Personally I don’t think the so called “scare screens” fall under dominance abuse because they serve a legitimate purpose. If anything I think they’re not enough.

Nokia’s Threat Intelligence Report in 2021[0] reported that Android makes up more than half of all the infected systems in the recent 2023 report this had dipped to 49%[1]. But as they’ve done in prior reports, this year they again highlight that most Android malware is a trojanized version of legitimate apps distributed via alternative means:

> Android based devices are not inherently insecure. However, most smartphone malware is distributed as trojanized applications and since Android users can load application from just about anywhere, it’s much easier to trick them into installing applications that are infected with malware. Android users can protect themselves by only installing applications from secure app stores like Google Play and installing a mobile anti-virus product on their device.

In any case, whether something is legal or illegal in this case depends on whether it was or wasn’t done while having market dominance.

0: https://pages.nokia.com/T006US-Threat-Intelligence-Report-20...

1: https://www.nokia.com/networks/security-portfolio/threat-int...


Government of the people, by the people and for the people.[1]

1. Corporations have been determined to be people.


Blah, this generic sentiment is so tired. What specific rights should we take away from groups of people but are present as individuals?


They should go to prison like individuals. Instead of the endless settlements suspend their business for a while. They would pay way more attention.


Write the Attorney General, corporations don't shield individuals from criminal liability just financial.

If we are making a wishlist; government bailouts to corporations should trigger a termination clause for the the whole c-suite.


Corporations are systems generally set up to earn as much as possible disregarding everything else, definitely not "groups of people"....


Corporations are what their shareholders want them to be. Since a lot of the shareholders came to be shareholders by buying in, they generally want to see a return on investment.

It doesn't have to be that way if you can convince the shareholders differently. You are free to bring up a vote to Disney shareholders to change their mission into finding every mouse in the world and naming it Mickey.


That's why I said generally

By the way, there's a very widespread view that companies are legally required to maximize their shareholders' monetary profit.

Can you name many corporations that in the long term were shown to not having behaved so?


Corporations aren't democratic organizations though so every individual in the group doesn't really have an equal access to these rights.


What’s not clear to me is why a corporation’s specific governance would matter. When a company “speaks”, it’s still an individual ultimately expressing themselves, just with the benefit of compensation.


And a nearly impregnable shield from criminal liability.


Sure, expressing themselves...


You may not like their motives or incentives, but I don't see a compelling argument that makes their expression less legitimate than mine.


The compelling argument is that it should be quite obvious that companies do not speak for all of their employees, cause most of them are - to what degree can be argued until the end of time - basically coerced to express the "opinion" of the company. At most it's the opinion of the owners, artificially amplified.

And to the question why the owners should not be able to express themselves: They can express themselves individually all they want, but if they want to use a company to do it they should also be personally responsible for everything the company does. And since one of the primary reasons to have a company is to isolate the owners from being sued personally ... there's a bit of a problem here.


But that’s not the claim. A “company” doesn’t speak, individuals do. Just because the individuals do as a result of compensation, doesn’t mean they lose their right to free expression.

You’re focusing on the “group” aspect of this, but that’s irrelevant to the argument. A PR spokesperson has individual rights, even if they choose to use that voice to advance a company’s goals.


"Corporations free speech" usually refers to the freedom of giving money to politicians, not the freedom of a PR to speech


Yes, and the reasoning holds; an individual decides to do that. There’s a name on that check, a specific person who authorizes the transfer of funds. How could you ethically stop a person from authorizing that check?


Disregarding the fact that I see many ways to ethically stop corruption, when an individual *acts* in the name of a corporation, the action is a result of the corporation's functioning, not of the individual's will (were it not so, the individual would have misappropriated the funds, to my understanding).


That’s what we’re discussing; I’m saying that an individual is protected in their speech while operating on behalf of a corporation, and that it’s not corruption. You declaring it so doesn’t make it so.

And yes, the individual risks acting in ways their company doesn’t like, but they can do things to lower that risk, such as asking other individuals within that corporation what their desired action is.

But it’s still individuals acting, so they’re afforded all of the protections the Constitution provides.


No, it's simply not so


A better comment would attempt to explain why is my point. Thus far, you've been insistent on refusing to explain yourself or being open to alternative views.


I think I did explain more than enough

If you think that someone acting in the name of a company can act in his name there doesn't seem much to discuss.


"Because I believe differently than you, there isn't much to discuss." is a terrible way to convince others of your belief.

You're presupposing your conclusion and seem completely closed to the idea that you may be wrong.


No, I explained my conclusion multiple times but you don't seem to have noticed it.

I'm not a lawyer, but the fact that a representative of a company can't manage the company's funds however he wants is:

* what I've always known

* obvious on the face of it

* apparently confirmed by quick searches of terms like misappropriation and embezzlement

You seem to be just trying to win a debate competition and I have zero interest in that; especially since there isn't someone around to judge it.


That’s true, but it’s not what I said. It seems like you may need to reread what I wrote in order to respond to it, but then again it’s probably easier for you to pretend to misunderstand me than it is to actually address what I’ve written…


It's definitely you who has to read again the thread.

I did and I've gotten the nth confirmation that you're not really reading what I write, and maybe not really here for a discussion


You've said over and over again how you don't want to talk about the subject, yet you keep replying. I'm just making sure people understand this isn't the strategy of someone who knows what they're talking about, and you're cooperating magnificently.

Honestly anyhow I have a distaste for US right of speech and its enormously broad interpretation, so I'm not too interested in debating its applications.

(I support the right to express your opinions, at most)

I also think that at the base of most US problems there's the freedom to corrupt politicians ("lobbying"), so, yeah, I really don't care much how legal it is


But you seem utterly incapable of justifying those beliefs to others...

Your beliefs are worthless to everyone else if you can't explain them, and no all you've done so far is declare what you believe to be correct, and have crumpled at the slightest sign of resistance. That demonstrates the weakness of your belief.


My reply is: whatever.

If you're here to win debates for the sake of it, you can have the last word.

I only mentioned those beliefs and I'm not interested in debating them in a hacker news thread, right now.


This isn’t a debate, this is me getting you to reveal how little weight you have behind what you believe.

This is useful because if anyone else reads this, they will get a pretty standard idea of how people who think like you can’t really justify their beliefs when challenged.

I do appreciate it, but I doubt you do. Easier to dismiss me and ignore any dissent, than it is to consider that you might actually be the bad guy here.

I told you this approach weakens your advocacy. Too bad you can’t listen.


I TRIED to debate the core of the issue, and you haven't read what I said.

This branch of the thread was just about a mention of some ideas that I have no intention to discuss right now.

Not that you offered any support for your ideas, other than "I think that my constitution says so".

If you're for freedom of companies corrupting politicians and politicians lying to everyone, you're free to be, maybe you're on the side who benefits from it.

I was hoping to have closed the discussion about eight messages ago, I'm not really here for this.


[flagged]

Tyranny cloaks itself in morality. Nothing new. I hope most people know we don’t need that kind of advocacy.


Morality is what separates us from animals. The suggestion right and wrong don’t exist is the real tyranny. It's what evil people say to do evil things.


Presumably the board could stop corporate speech the majority does not agree with. It would be interesting to re-litigate this case with a company like Facebook where Zuckerberg has special voting shares. If donating to a PAC is just a group of people exercising their free speech, can you delegate your right to free speech to someone else?


The most f* up aspect is interpreting corruption as "free speech", for both individuals and corporations.


Publicly traded corporations are democratic organizations. You get one vote per share you hold. If you want something to happen, the shareholders can vote for it.


Google created a market, and then they stifled that market.

There's no "iOS app distribution" market for Apple to act anti-competitively in.



What's that?


Third party app store for jail broken iOS devices


> Google has agreed to pay $700 million and make several other concessions to settle allegations that it had been stifling competition against its Android app store

> [...] it’s a fraction of the $10.5 billion in damages that the attorneys general estimated the company could be forced to pay if they had taken the case to trial instead of settling.

> The settlement represents a “loud and clear message to Big Tech [...]", said Connecticut Attorney General William Tong.

It sure does. It's just not the message you think or claim it is.


I wonder if they can claim that as a loss and pay less taxes?


Can someone tell me why Google "loses" and Apple still gets away with the same behaviour?


My understanding is that Google's behavior was seen as strong-arming their way into signing non-competitive agreements with competitors.

For example, they'd make a deal with Samsung that if they want Google services on Samsung phones, Samsung had to agree to not let anyone else put competing app stores or payment processing other than Samsung's own and Google's own.

Where-as Apple it's more seen that they simply are not letting competitors put their alternatives on their own Phones, which isn't seen as anti-competitive, but more as how Apple itself competes.

And probably Google also internally used bad language that talked more about how to prevent competitors, etc. that might have been more incriminating.

So I think they see it more like if CocaCola told Walgreens they won't sell Coke products at Walgreens if Walgreens caries Pepsi products. Where Coke is seen as such a big player, that their leading market position forces Walgreens to agree, because not selling Coke would harm them financially so much due to the market leading position of Coke, but also it's seen as a anti-competitive agreement from Coke.


Jurors confirmed that a big part of their decision was based on Google's internal behavior, not explicitly the deals. The evidence that upper management would move sensitive conversations to chat where they knew a short 24hr retention period existed was a very influential piece, as well as some of the wording in internal emails.

I always thought the Communicating with Care courses were a reasonable amount of legal paranoia, but I see how it could also look sketchy.


My favorite part of this whole thing is getting ammo against Google apologists (aka current Googlers not using auto-sell).


autosell?


Autosell is a way for employees to automatically sell their Google shares as soon as they vest


The long and short of it is that it matters when you started doing it, or more precisely how dominant you were when you started doing it.

If you have strict rules form the get go while you’re a nobody in the relevant market, then you’re free to maintain those strict rules even if you all of a sudden became a big player (although you can’t become more strict). This is in part because the assumption is that if your rules would’ve been too strict, then you would’ve never been able to become a dominant market player, because nobody would’ve wanted to deal with you.

If on the other hand you were open and didn’t have strict rules in place but you start changing your tune once you’re big and powerful then it could be explained as you abusing your power (i.e. luring people in with relaxed rules, only to turn up the thumbscrews once everyone depends on you).

Apple has always had a walled garden with strict rules and a 30% commission, and despite that many were happy to join. Since then they’ve not turned up the thumbscrews, in fact they’ve done the opposite by lowering the commission for the vast majority of developers. The flip side is that they can’t go stricter and to a higher commission from here because they are too dominant now.

That’s also in part why Apple has all these hills they’re willing to die on, anything they concede now, they can never undo or return to.

They don’t have the flexibility of testing a 5% commission for example and see if that works better, because the moment they decide it didn’t work out for them and they increase it back to 15% or 30%, it can be explained as an abuse of dominance because of the people that joined in, and became dependent on them, during that test.

Smaller companies can try new pricing strategies, new monetisation strategies, etc. Sure when they announce that from now on their “free plan” is discontinued some customers might moan and complain, but they never have to worry about government intervention on the basis of antitrust.


> If you have strict rules form the get go while you’re a nobody in the relevant market, then you’re free to maintain those strict rules even if you all of a sudden became a big player (although you can’t become more strict). This is in part because the assumption is that if your rules would’ve been too strict, then you would’ve never been able to become a dominant market player, because nobody would’ve wanted to deal with you.

My head hurts.


I’ll simplify it for you:

You can act like a dick, lock everything down and impose all kinds of shit onto your product, as long as you do it from the get go before you start being successful and don’t turn into more of a dick once you’re successful.


The EU is forcing Apple to allow third party app stores by April. As for the US issue, law cases like this are unique and have to be dealt with individually.

https://9to5mac.com/2023/12/18/third-party-app-stores-apple-...


I heard on a podcast that some part of the difference in the two rulings was due to the fact that Google was cutting deals with some companies/developers to lure them to their store, meaning not everyone was equally subject to the 30% fee. Apple (to my knowledge) hasn't done any deals like this - everyone pays the same fee, no special treatment (until recently, when they reduced the fee for apps with revenue <$1m)



My understanding is that Apple's defense is that they never opted in to a free market, and therefore they aren't required to have one. Google however sold android as being a "free market" choice, and as such can't artificially skew that market.

I don't know if it really makes sense, but that's my understanding of these two verdict when held in contrast.


It’s simple case law. You can’t change the rules of the game after the product is purchased. People bought iPhones knowing they were locked to one store.

Google claimed to be open and weren’t


Just give it time. People tripping over themselves to insist they’re fundamentally different will lose out. It’ll even out and regulation will catch up


Having to settle and pay $700 million is not a loss. That is NOTHING for Google.

This is a huge win for them, because you can rest assured Google will get a ton of concessions out of the states in exchange of paying the fine. It's not even high enough to make Google feel "let's never do this again" – it wouldn't be for Google, Facebook, Apple, Amazon, any of these guys.

It should be in the order tens of billions or a hefty amount of their revenue, whichever is greater. Google must be celebrating such a low fine.


First, it wasn't a fine.

Second, the settlement wasn't just this $700M, it was a bunch of changes to how Android works. As explained in the article.

Third, where in the world are you getting this fairytale about "concessions from the states" from?


There's no point in trying to find an "explanation" or justification here. This is by no means a fair outcome.


The Verge has a pretty good explainer on how, in relation to the Google/Epic case https://www.theverge.com/24003500/epic-v-google-loss-apple-w...

The tl;dr is that the jury determined that "android app distribution" is the relevent market, and google has lots of dodgy emails where they stifled competition in it. There is no "ios app distribution" market.


One thing that always surprises me is how toothless any anti-trust settlement is. I don't think I have ever seen an anti-trust fine that was so painful that it would deter people from trying to do it in the first place. It almost always is a sum that would encourage anti-competitive behavior in the future because the fine is so much less than the spoils of the behavior.


To all the comments claiming that Android is open, managed cooperatively and in the best interest of users:

https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

https://www.theverge.com/2011/05/12/google-android-skyhook-l...


> Google also agreed to make other changes designed to make it even easier for consumers to download and install Android apps from other outlets besides its Play Store for the next five years. It will refrain from issuing as many security warnings, or “scare screens,” when alternative choices are being used.

Note that they're not agreeing to stop actively sabotaging third party android variants and app stores by encouraging app developers to take on bogus Play Service dependencies.


"Insert coin to continue"


At least they're forced to (gradually, slowly, after 15 years) make a few improvements though...


I agree, of course, but it's not enough force.

"If violence doesn't help, you're not using enough violence." (It's from a manga called 'Bleach')

The one thing these settlements are good for is to make the employees and customers of Google aware of the fact, that despite being too big to fail and having their hands in a lot of pockets (not judging here, this' the way of capitalism), _the attack surface is actually gigantic and impossible to defend_.

Corporations have more weak spots than the average skinny-fat human who's never been in a fight.


Well yeah


This settlement is a joke...


Not for the lawyers. I bet they just filled their multi-generational retirement fund.


$2 for people, millions for lawyers... US has become a slave of its own legal system...


you'll better enjoy your $2 or else


And they also have to do a few small things for 5 years. That’s it?

In other words, google won


10.5 B USD was the correct amount. Not this mere couple bucks.


How do I qualify for the money rebate from google


What would have happened if Google didn’t agree?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: