Oh boy, that's gonna be a lot of people enabling the installation of APKs from untrusted sources. I can't see this working well from a security perspective.
In order to play Fortnite, you're going to need an up to date phone with modern graphics hardware, and that means it will probably be running Android 8. On Android 8, "install unknown sources" is a per-app permission which means only the Epic Launcher will be able to install other apps.
I think there is close to zero security risk to this strategy assuming the above.
Are users capable of playing the game the only users who will attempt to install it? "Fortnite for Android 7" sounds like something users will jump through hoops to install given they've already read something about hoops and Android 8.
Most modern phones are not on 8. The Oreo install base is only 12.1%, most phones are still running Nougat (7.0 dominates with 21.2%, then 7.1) or Marshmellow (23.5%). Seeing as PUBG Mobile's lowest supported version is 5.0, it wouldn't be a stretch to assume Fornite could do the same.
A lot of Android devices are about to have a real security flaw introduced (and normalized considering the median age of the Fortnite audience) which Epic is handwaving away.
No it doesn't. The requirements are Android 5.0, and can support something as weak as the Motorola E4 Plus[0]. And as someone who maintains a decently popular app on that platform, you'd be surprised how many former flagships (the Google Pixel in particular) still remain on Android 7.x (my wild guess is so that they can keep the old Google Now launcher) which does not have the selective permissions that come with Oreo.
You're much more likely to find a fake Fortnite app by searching for "fortnite" on Google Play than going to fortnite.com where the only downloads are legitimate.
"Untrusted sources" has always been a bit of a scare tactic to get people not to use Google's competitors, like Amazon.
Having only one app store allowed on a device is anti-competitive and is an area where I would approve regulators forcing changes. The fact that Apple has exclusive right to approve what I can install, and then extracts monopoly rent on top of depriving me of software, should be banned.
Android allows as many app stores on device as you'd like. Popular ones include f-droid and Amazon store. Both can be easily installed without rooting by simply downloading them from the web. Both provide app signing, updates, and authentication.
You are allowed to install other app stores on a android device.You can even install apps from unknown sources.But you need to be responsible for your own security.
However, you can't install other app stores from the Play Store itself. That seems pretty anti-competitive. Google also bans ad-blockers from its Play Store. Why? Because they interfere with its business model. Again, anti-competitive. No different than Verizon banning Skype from its network.
It's a shame the EC didn't hit Google over these, too.
It's kinda a chain of trust. One of the value of the Play Store is that you trust it not to include malware (if you do). If they allowed other app stores to be installed through it, google can't be confident in saying if you use our store, you won't get malware.
Based on total malware installs, where Apple has everybody beat by even just Xcodeghost alone.
Google doesn't pretend that manually reviewing apps prevents malware because it obviously (to any software engineer) doesn't. It does, however do both static and dynamic analysis of the apps in its store, unlike Apple and the Chinese app stores.
There is no "Chinese app store" for iDevices. Anybody who downloaded WeChat anywhere in the world was affected.
Trying to bring uo unpatched devices is changing the subject (security-conscious people use Android devices that get regular security updates) — we were talking about app stores. It remains a fact that far more people have been infected with malware from the Apple App Store than from all other app stores combined.
People who care about security use devices that get updates - that’s true. They buy iOS devices.
Which Android devices get regular updates for over 2 years? 3 years? 5 years?
Android is insecure by design - since most devices can’t be updated. Unlike iOS devices that get updated regularly worldwide without waiting on the carrier.
And I posted links showing that Android is not as secure. Do you have any links to back up your claims?
The subject was whether the Play Store was secure. I showed that it is far more secure than the Apple App Store, and you conceded that argument.
Now you want to change to another argument. I am happy to oblige.
> Which Android devices get regular updates for over 2 years? 3 years?
Pixel, Android One, Nokia, and Blackberry devices. People who have enough money to buy an iOS device have enough money to buy an Android One device every year to get an even more secure device.
> Android is insecure by design - since most devices can’t be updated.
There are far more Android device models that can be updated than iOS device models. Those who care about security choose those devices.
Meanwhile, your links were for unpatched Android devices that security-conscious users don't use. You might as well post links about unpatched vulnerabilities for the Apple Newton.
That doesn't sound anticompetitive in the least. Alternative stores are allowed on Android; Google just isn't going to bend over backwards to do everything for you.
I am not aware that anyone has ever made this work. Full VMs are escapable, iOS jails have been broken and even permissions technically allowed can be abused, etc. There is room to improve, but "just make it impossible to escape the sandbox" is massively oversimplifying. It also makes it harder to make useful apps if you reduce API surface.
This only matters if they're the only platform available. But, they're not. You can use Android, its forks, or otherwise. While one can be philosophically opposed to their walled-garden, there is zero legal ground to stand on to regulate Apple in this regard when they are not a monopoly as defined by law.
They have the right to control what is available in their own app store, whether we like it or not.
Calling their control "monopoly" and "censorship" really dilutes the actual meaning of both terms
That wasn't very clear from the original posts, as they discussed anti-competitive behavior and regulators, not new legislation to be written. To me this implied a desire for them to be regulated under current law, which may have been my mistake in reading it.
It makes more sense read with new legislation being the intent, so you have a point.
That said, that type of regulation seems overly heavy-handed IMHO, and I'm typically not an anti-regulation type of person.
You gave them your blessing to do all this and more when you bought the phone and didn't reject it when you read their terms and conditions for its usage.
iOS has always been a walled garden. Apple is proud of that fact.
I'm sure nobody could stop you putting your own OS on top, or hacking it wide open... But I don't think you have any right to force Apple to alter their software to allow you to do anything.
If you have 2-3 platforms that all have the same restrictions you may not have a monopoly, but you have a cartel in control of the market. Thats pretty anticompetitive IMO.
Apple has monopoly on their store and they have ability to play kingmakers on other platforms with app developers in every niche. Without presence on all relevant platforms your product or service will die off.
Is there not a FOSS store on Android that provides app signing and doesn't charge anything? This is an opportunity for Fortnite's creators to create their own store which then installs their app.
Such a store would either require that the developer pay for payment processing and hosting themselves, or would have to charge in order to cover those costs.
This probably will rub Google the wrong way.. I wonder how many millions they will lose out on because of this.
Maybe they should introduce some special reduced fee teirs for the ultra high volume customers, as a precaution against this becoming a trend.
On the other hand fortnight is probably the only app where it's users want it so bad they will be willing to do just about any procedure to get it on the phones. Everything else has competitors on the Play store.
A precaution against this becoming a trend? There is no trend, there has been a massively huge tsunami wave and it's already passed through, and now the "Play Store" is a barren wasteland of utter crap loaded with ads and sending as much data as they managed to cajole you into agreeing for to a bunch of third parties. But every app is free!
30% was a lazy choice to begin with, and look at what it got them. It's not even the huge tax, the fact that your app will show up alongside a bunch of Fordnite and Fnortnite scams would be enough to scare me away.
In an interview [1], Tim Sweeney, Epic Games CEO, addressed why they opted to bypass Google Play:
GamesBeat: Do you see a reason not to put it on Google Play right now? Is that something that would happen in the future?
Sweeney: There are two reasons for what we’re doing. First, we want to have a direct relationship with our customers wherever we can. On open platforms like PC and Android, it’s possible for them to get the software direct from us. We can be in contact with them and not have a third-party distributor in between.
The second motivation is the economics of the store ecosystem as it exists right now. There’s typically a 30/70 split, and from the 70 percent, the developer pays all the costs of developing the game, operating it, marketing it, acquiring users and everything else. For most developers that eats up the majority of their revenue. We’re trying to make our software available to users in as economically efficient a way as possible. That means distributing the software directly to them, taking payment through Mastercard, Visa, Paypal, and other options, and not having a store take 30 percent.
If you look at it, the stores on the smartphone platforms actually do very little. They’ll put ads up in front of your game. When you search for Fortnite on iOS you’ll often get PUBG or Minecraft ads. Whoever bought that ad in front of us is the top result when searching for Fortnite. It’s just a bad experience. Why not just make the game available direct to users, instead of having the store get between us and our customers and inject all kinds of cruft like that? It’s a general criticism I have of the smartphone platforms right now.
I wish more organisations just put an APK up on their website. Whatsapp does and it's a dawdle to set-up a relative's phone without having to bother with a Google account and Play Store etc
> They’ll put ads up in front of your game. When you search for Fortnite on iOS you’ll often get PUBG or Minecraft ads. Whoever bought that ad in front of us is the top result when searching for Fortnite. It’s just a bad experience.
This is my biggest complaint about Apple too. I paid you good money so my non-tech-savvy relatives can have one of your phones. When I ask them to install an app, please don't put ads in front of it and confuse them. You are not and ad company, please don't betray my trust in you and your products.
I feel like part of the 30% tax that app stores extract is based on how easy it is for users to simply buy what they want with money that's probably already in their account. Most of the money that I've spent on apple and google apps comes from gift cards. If I had fortnite on my android phone, and considered making an impulse buy, and was required to put in credit card info, I might reconsider the purchase.
Monopolized software distribution platform is bad for so many reasons.
And for anyone claiming that this is bad for security, blame Google and Apple who don't support the other way of secure software distribution and try to lock-in to their proprietary locked-in platform for the greed.
Also, Don't use Android or iPhone in the first place because it's so restricted, unsecure, and cannot be trusted one bit.
I've had to disinfect so many of my friends computers because they downloaded VLC media player from a website that looks darn close to something "official" but wasn't. Even with the one-time perms to allow this specific app to be installed from outside the GPS I can definitely see this being a headache for not only Google because of the high profile and popularity of this game but also Epic. Good luck to everyone involved.
Google punished again for having a more open platform. With this and EU's lawsuit attacking Google for allowing other OEMs to sell Android with conditions, Google's incentive is to copy Apple and lock everything down and make it all proprietary.
That’s not what happened. Google was punished for not allowing manufacturers to sell separate products that were Android forks if they sold official Google versions of Android.
Anticompetitive behavior in forcing OEMs to bundle other Google Apps if they wanted access to the Play Store and Play Services, which has nothing to do with the other two things you mentioned.
They weren't forcing anyone to sign the contracts, see Fire devices and the Chinese mobile market for google free Android examples. Also you're making sound like they were "bundling" trash, the apps are useful and of higher quality than most apps on the platform, not mention that they make Android phones comparable to iPhones.
"They weren't forcing anyone to sign the contracts"
This is very, very disingenuous. If the only way to have a successful product in the American and European markets is to have the Play Store, then yes, there is some level of force there.
"see Fire devices and the Chinese mobile market for google free Android examples."
Google wasn't allowed in China to begin with, so that's a very poor comparison. And the Fire Android devices flopped pretty badly.
"Also you're making sound like they were "bundling" trash, the apps are useful and of higher quality than most apps on the platform"
Completely irrelevant; they're still forcing the bundling.
I am not a lawyer, but I believe anti-trust lawsuits often revolve around what the average consumer can do/is aware of.
In Europe, Android dominates the smartphone OS market with ~75% market share and most come pre-bundled with Google software. With names like "messages", "photos", or "calendar" it's not really clear that these are Google products or that they can be changed. You basically end up with most of that market share using Google software without even understanding that they have a choice.
To put it in perspective though, the fine Google received was less than 2 weeks worth of revenue and will probably be lowered if they appeal. It's not really as big a deal as the media made it out to be.
I'm not saying I agree with the fine, but I do understand how, in a certain light, the EU see Google's practice as a bit monopolistic.
It's closer to a 50/50 split than you make it sound, and the difference between this the microsoft case is that Windows had >95% of the market and not to mention that OEMs don't need google's permission to roll out their own OS (see the Chinese mobile market) also consumers would need those fundamental apps to make the phone usable similar to the apps that come with iOS which contrary to Android's are the defaults forever and can't be replaced.
> It's closer to a 50/50 split than you make it sound
No, Android OS is at 74.2% of the EU market.
It's closer to 50/50 in the US, but in the EU and worldwide Android dominates the market and will probably continue to rise as Huawei continues to expand.
There seems to be a myth going around on HN that having a dominating market position is some sort of necessary and sufficient condition to an anti-trust violation. That is not the case.
Tim Sweeney has always been a very outspoken critic of app stores. He's famously rattled his saber about the Windows Store every chance he gets, despite the fact that outside Store installations will never realistically, ever go away.
So an opposition to the Play Store on moral grounds is pretty much what I'd expect here from him. I'm guessing the 30% cut is just the cash incentive he needed to convince the rest of his team that this was the right way to go.
86 comments
[ 3.3 ms ] story [ 147 ms ] threadIn order to play Fortnite, you're going to need an up to date phone with modern graphics hardware, and that means it will probably be running Android 8. On Android 8, "install unknown sources" is a per-app permission which means only the Epic Launcher will be able to install other apps.
I think there is close to zero security risk to this strategy assuming the above.
A lot of Android devices are about to have a real security flaw introduced (and normalized considering the median age of the Fortnite audience) which Epic is handwaving away.
[0]https://www.androidauthority.com/fortnite-mobile-compatible-...
"Untrusted sources" has always been a bit of a scare tactic to get people not to use Google's competitors, like Amazon.
It's a shame the EC didn't hit Google over these, too.
Google doesn't pretend that manually reviewing apps prevents malware because it obviously (to any software engineer) doesn't. It does, however do both static and dynamic analysis of the apps in its store, unlike Apple and the Chinese app stores.
https://us.norton.com/internetsecurity-mobile-android-vs-ios...
https://www.sophos.com/en-us/security-news-trends/security-t...
That doesn’t even consider all of the unpatched Android security holes.
https://www.esecurityplanet.com/mobile-security/how-secure-i...
Or the fact that most Android phones are running older versions that will never get patched.
https://developer.android.com/about/dashboards/
Compared to iPhones running the latest versions....
https://www.digitaltrends.com/mobile/ios-distribution-news/
Trying to bring uo unpatched devices is changing the subject (security-conscious people use Android devices that get regular security updates) — we were talking about app stores. It remains a fact that far more people have been infected with malware from the Apple App Store than from all other app stores combined.
Which Android devices get regular updates for over 2 years? 3 years? 5 years?
Android is insecure by design - since most devices can’t be updated. Unlike iOS devices that get updated regularly worldwide without waiting on the carrier.
And I posted links showing that Android is not as secure. Do you have any links to back up your claims?
Now you want to change to another argument. I am happy to oblige.
> Which Android devices get regular updates for over 2 years? 3 years?
Pixel, Android One, Nokia, and Blackberry devices. People who have enough money to buy an iOS device have enough money to buy an Android One device every year to get an even more secure device.
> Android is insecure by design - since most devices can’t be updated.
There are far more Android device models that can be updated than iOS device models. Those who care about security choose those devices.
> Do you have any links to back up your claims?
http://lmgtfy.com/?q=xcodeghost
Meanwhile, your links were for unpatched Android devices that security-conscious users don't use. You might as well post links about unpatched vulnerabilities for the Apple Newton.
Or they could make sandboxing actually work.
They have the right to control what is available in their own app store, whether we like it or not.
Calling their control "monopoly" and "censorship" really dilutes the actual meaning of both terms
It makes more sense read with new legislation being the intent, so you have a point.
That said, that type of regulation seems overly heavy-handed IMHO, and I'm typically not an anti-regulation type of person.
You gave them your blessing to do all this and more when you bought the phone and didn't reject it when you read their terms and conditions for its usage.
iOS has always been a walled garden. Apple is proud of that fact.
I'm sure nobody could stop you putting your own OS on top, or hacking it wide open... But I don't think you have any right to force Apple to alter their software to allow you to do anything.
Do you feel that Nintendo, Sony, and Microsoft should also be forced to open up their platforms?
And yes, they also approve physical game sales and you can’t run a physical disk on either platform without it being cryptographically signed.
https://f-droid.org
Maybe they should introduce some special reduced fee teirs for the ultra high volume customers, as a precaution against this becoming a trend.
On the other hand fortnight is probably the only app where it's users want it so bad they will be willing to do just about any procedure to get it on the phones. Everything else has competitors on the Play store.
30% was a lazy choice to begin with, and look at what it got them. It's not even the huge tax, the fact that your app will show up alongside a bunch of Fordnite and Fnortnite scams would be enough to scare me away.
Yes.
https://www.eurogamer.net/articles/digitalfoundry-2018-fortn...
GamesBeat: Do you see a reason not to put it on Google Play right now? Is that something that would happen in the future?
Sweeney: There are two reasons for what we’re doing. First, we want to have a direct relationship with our customers wherever we can. On open platforms like PC and Android, it’s possible for them to get the software direct from us. We can be in contact with them and not have a third-party distributor in between.
The second motivation is the economics of the store ecosystem as it exists right now. There’s typically a 30/70 split, and from the 70 percent, the developer pays all the costs of developing the game, operating it, marketing it, acquiring users and everything else. For most developers that eats up the majority of their revenue. We’re trying to make our software available to users in as economically efficient a way as possible. That means distributing the software directly to them, taking payment through Mastercard, Visa, Paypal, and other options, and not having a store take 30 percent.
If you look at it, the stores on the smartphone platforms actually do very little. They’ll put ads up in front of your game. When you search for Fortnite on iOS you’ll often get PUBG or Minecraft ads. Whoever bought that ad in front of us is the top result when searching for Fortnite. It’s just a bad experience. Why not just make the game available direct to users, instead of having the store get between us and our customers and inject all kinds of cruft like that? It’s a general criticism I have of the smartphone platforms right now.
[1] https://venturebeat.com/2018/08/03/tim-sweeney-epics-ceo-on-...
This is my biggest complaint about Apple too. I paid you good money so my non-tech-savvy relatives can have one of your phones. When I ask them to install an app, please don't put ads in front of it and confuse them. You are not and ad company, please don't betray my trust in you and your products.
They don't allow brand keywords to be the target of ads on the play store. They are fine with it on desktop though.
Just to clarify, he is the CEO of Epic Games (company that created Fortnite)
Monopolized software distribution platform is bad for so many reasons.
And for anyone claiming that this is bad for security, blame Google and Apple who don't support the other way of secure software distribution and try to lock-in to their proprietary locked-in platform for the greed.
Also, Don't use Android or iPhone in the first place because it's so restricted, unsecure, and cannot be trusted one bit.
https://developer.android.com/distribute/marketing-tools/alt... https://en.m.wikipedia.org/wiki/List_of_Android_app_stores
On the scale of 1-10 of openness, that’s a -100.
This is very, very disingenuous. If the only way to have a successful product in the American and European markets is to have the Play Store, then yes, there is some level of force there.
"see Fire devices and the Chinese mobile market for google free Android examples."
Google wasn't allowed in China to begin with, so that's a very poor comparison. And the Fire Android devices flopped pretty badly.
"Also you're making sound like they were "bundling" trash, the apps are useful and of higher quality than most apps on the platform"
Completely irrelevant; they're still forcing the bundling.
In Europe, Android dominates the smartphone OS market with ~75% market share and most come pre-bundled with Google software. With names like "messages", "photos", or "calendar" it's not really clear that these are Google products or that they can be changed. You basically end up with most of that market share using Google software without even understanding that they have a choice.
I believe the logic behind the fine was very similar to the USA vs Microsoft anti trust suit (https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor...).
To put it in perspective though, the fine Google received was less than 2 weeks worth of revenue and will probably be lowered if they appeal. It's not really as big a deal as the media made it out to be.
I'm not saying I agree with the fine, but I do understand how, in a certain light, the EU see Google's practice as a bit monopolistic.
No, Android OS is at 74.2% of the EU market.
It's closer to 50/50 in the US, but in the EU and worldwide Android dominates the market and will probably continue to rise as Huawei continues to expand.
Multiple sources for the 74.2% number:
http://gs.statcounter.com/os-market-share/mobile/europe
https://www.mobileeurope.co.uk/press-wire/ios-and-android-ga...
So an opposition to the Play Store on moral grounds is pretty much what I'd expect here from him. I'm guessing the 30% cut is just the cash incentive he needed to convince the rest of his team that this was the right way to go.