Google has news on what you will need to do for still being able to sideload apps:

[aethralux@mastodon.social]

@grote
One will also need to:
*Summon Satan using only Holy Water
*Sell your first born child

"Can someone continue the list? These peasants need to kneel before the Corporation"

[jandi@mastodon.social]

@govinda_hari @faduda @grote As others have noted, it's PIN *or* biometrics (not to save Goog's face, they're being awful here, but biometrics are not required at this point, yet!)

[li@tech.lgbt]

@CalcProgrammer1 @itsFriday @grote its wrong to assume this is about stopping scams or will do anything to stop scammers-

scammers will.. simply .. just ask you to enter your details into a web application, instead of a 'native' app, and nothing changes

the purpose is control, the purpose is survailence, the purpose is to deny certain people the 'privledge' of making android apps, the purpose is to send armed forces to your house to socially/actually murder you if you make an app they dont approve of

the purpose is not to 'stop scammers'

[itsfriday@toot.community]

@CalcProgrammer1 @grote For the scamer scenario, 1 day of patience I see as a workimg precaution. But why do I need to go through hidden steps to get there? Why is there not a question at the very first startup "Would you like to add F-Droid, Aurora, ... and/or the option to install any apk on your phone? Tick the ones you like and it is installed automatically."

[lumi@snug.moe]

@ryanprior sure

[oatrapado@mastodon.social]

@Frenezul0_o @grote those chinese/european phones are just obsolete and overprized, pinephone another archeological piece at a high price.

[agowa338@chaos.social]

@Li @grote

You're absolutely right. However I think you misinterpreted my initial post. That was to be seen more of the lines of "if life gives you lemons make lemonade" (and kinda ironically).

I just wanted to make readers think about all of this and the implications

[tedmielczarek@mastodon.social]

@grote @TimWardCam Google has a whole "Managed Google Play" as part of Enterprise Android support: https://support.google.com/work/android/answer/9495634?hl=en
I don't think companies doing such things will be fussed by this at all. A company using Android devices but not using enterprise management would already be in a pretty self-inflicted state of badness.
Edit: https://developer.android.com/developer-verification/guides/faq explicitly says this doesn't affect enterprise apps.

[itsfriday@toot.community]

@Li @CalcProgrammer1 @grote Yes, that's why I think the 24h are the only reasonable steps.

[li@tech.lgbt]

@agowa338 @grote bleh ive been seeing techbros unironically supporting this because "muh scammers" .. as if they wont just switch to using a fucking web app overnight

[hidoni@meow.social]

@grote the point about requiring biometrics is incorrect. The blog post states that you need to confirm with "biometric authentication [...] or device PIN."

[clarfonthey@toot.cat]

@grote here, "sideloading" means "installing apps from developers who have not submitted a drop of blood to Google"

the drop of blood thing is an exaggeration; we don't yet know if something more, like an entire finger, will be required

[doragasu@mastodon.sdf.org]

@grote Judging by the attached image, biometrics are not mandatory, device PIN should work. Very bad, but mandatory biometrics is what would make it terrible, at least for me.

[timwardcam@c.im]

@tedmielczarek @grote I'm thinking of a small company with a dozen or so developers who have one Android app that talks to their back end, for use by a few dozen installation crews. Anything with "enterprise" in its name would be *vastly* too expensive to be of any use to a company like that.

[agowa338@chaos.social]

@Li @grote

Well I still think this approach from google is a good first draft to start a discussion.

But all of the border agent stuff was more of a "making the best out of a shitty situation".

[alvarord@framapiaf.org]

@grote

First point is:
* be evil

[karl@infosec.exchange]

@grote Google always finds new ways to give me a reason to say fuck google.

[raymaccarthy@mastodon.ie]

@CalcProgrammer1 @itsFriday @grote
And it's not even about malware. Plenty in the Playstore. It's about Google deciding they are in control of your phone. You only rented it.

[burnitdown@beige.party]

@grote

"scammers often pressure victims into disabling security measures"

gee Google, i wonder where they might find malware that would bypass those "security measures" without any pressure at all??? oh well not fucking important i guess.

[tedmielczarek@mastodon.social]

@grote buried in the FAQ, but note that they are saying that installation via ADB will not be affected by these changes: https://developer.android.com/developer-verification/guides/faq
So these sideloading changes are to cover "download an APK file from the internet and install it without using a secondary device".