I am generally in favor of security improvements, but I do not really see much of a benefit here. This attack vector requires both that the user enabled developer settings and that they have remote adb enabled. So, this does not seem to be a realistic attack vector for 99.9% of the users and most of the other 0.1% probably know what they are doing.

The other proposed change (to restrict access to certain interfaces or IP addresses) seems good, but why not allow developers to restrict access localhost?

It reeks of trying to block Shizuku, Canta, etc. using a way that only makes it look like a side-effect.

Amazon crippled the ADB functionality on FireTV Sticks a while ago. Making it an absolute pain to build and debug TV apps on. Currently, the only way to test is to install a release build every time.

Limiting ADB is the obvious next step. Even if this one specific feature request does not come to pass, Google has cornered everyone into relying on a developer interface for any normal personal computing tasks, whether running on-device or through USB/wireless. It's quite clear at some point in the future you will either be required to surrender your identity to them and pay a yearly fee or be severely limited to continue using it in any meaningful capacity, because Google does not want you to develop applications on Android outside their controlled channels -- and it's a developer bridge, the battle was already lost when they did not back down from the changes forbidding normal, legitimate ̶s̶i̶d̶e̶l̶o̶a̶d̶i̶n̶g̶ installation.

>Don’t even get me started on OEMs that force an audio warning such as “This call is being recorded,” when it’s in places where it’s not legally required.

This is also Google's fault. Their dialer--that OEMs increasingly pick over their own, despite their always being much better, see old MIUI one for example--just blanket applies the rule almost everywhere. Especially annoying on all MediaTek SoCs that do not support the feature on an hardware level at all through proper, reliable third-party applications. As if you didn't need any more proof you don't own "your" devices. But maybe in a couple years Gemini will be able to listen to the calls and summarize them for you, just need to go through the approved surveillance channel.

> Spamming the thread will only cause Google developers to lock the issue, ignore valuable community feedback, or stop sharing public updates about this change entirely.

So nothing would change (they can also lock away your "valuable community feedback" because what bothers them is the criticism itself), thus feel free to express your approval

When Google first announced sideloading restrictions, somebody told “but we have ADB”, and who disagreed with them was criticized harshly.

Now, I’m waiting for a workaround to enable ADB, so sideloading can be handled now, too.

Android is not more open that iOS for a very long time now. The trend will continue.

Again, this is not a technical problem (the mindset of Google), so technological solutions won’t help.

Of course this was bound to happen, next you're telling me people will be surprised that the 24 hour limit for side loading will turn into some indefinite time period.

This is huge, Android getting locked down to such levels should be sounding alarm bells. They are slowly removing everything that makes Android good.

I am worried that this might happen to websites soon.

If you want your website to be openable on Apple devices, you would have to pay Apple a fee each month. If you want your website to be openable on Android devices, you would have to pay Google a fee ecah month, etc.

We need Linux on phones. Bank apps not needed as long as I can use browser. But do need some things like wireless cards, popular apps like Sonos and Spotify working.

There's only one reason for anyone, or for me, at least, to choose Android, and it's the only reason I've consistently chosen Android from the very first Google Developer Phone: It's more open.

So, they don't want me to even have that one reason to keep choosing Android, I guess.

Every time I want to connect ADB to a device, it takes me far more time than it should. Having different ports for pairing and connecting is already a pain. I wonder what new hurdles will come up once they restrict adb to wlan0, even though atm I can't see any problems for my use cases (like pushing APKs, reading logs or connecting dev tools).

Not being able to use VPNs might be a problem in corporate setups (e.g. debugging an issue in production environments).

finally my children will be secure and my bank account impenetrable!

Looking what's this is about - Shizuku

https://github.com/thedjchi/Shizuku/wiki/setup

So it requires

* Enable Developer Options if not already enabled (Generally, this is done by going to Settings > About device and tapping Build number 7 times).

* Enable both USB debugging and Wireless debugging. Tap "Allow" if prompted to allow wireless debugging on the current network.

* Tap Pair device with pairing code.

* Downloadd other apps like ShizuCallRecorder

Or seems to be exactly what this user described.

https://news.ycombinator.com/reply?id=49046291&goto=item%3Fi...

I was thinking a lot about how these restrictions are paved with good intentions, but every time these new security measures are implemented we see criminals adopt new strategies and continue going about their day like nothing ever happened.

I've been seeing this specifically with ID / business verification requirements where they just have some innocent (or sometimes complicit) third party grant them access to verasign 'verified' trust signing keys which actually makes them way more trusted than they were ever before often making anti-malware applications way less strict about blocking it which in turn buys them just enough time to compromise the system and disable said anti-malware applications. The problem here is that anti-malware applications try to be seemless and are effectively in a giant race condition to terminate the application, more recently microsoft anti malware service will now block program execution until it validates that it is safe. Although it is not something other companies do as making the device feel sluggish is something they avoid at all costs (looking at you bitdefender).

It's this stuff thats caused me to start degoogling as much as I can. I've started using nongmail emails and removing photos.

I Don't know what else I can do though, next up is switching to grapheneOS but I'm a ways off from that for now.

Android Wireless debugging is already a major pita to work with. Requires a wifi connection to even work, so I need to carry a mobile wifi router with me, instead of having it bound to my secure WireGuard connection. Next it assigns a random port number every time the wifi connection is interrupted, or when it considers now is a good time to reset the port number. It should be possible to set a stable port and and have it available, perhaps behind a few awkward UI/adb toggles.

Guess it's time to contact support for the few necessary apps that still don't work on GrapheneOS.

Call me crazy but that actually makes sense. ADB is clearly meant for one device to control another, otherwise it's just a hack to bypass sandboxes.

https://archive.ph/gla4i

In case it is made private.

Dies this affect GrapheneOS or CalyxOS?

I assume Sailfish and Ubuntu Touch are completely unimpacted?

Google is going the Apple route. When will we get the year of the Linux Phone?

Thank you for telling me about Shizuku! Android world is so vast and full of resources

I switched to a MacBook b/c I couldn't find a comparable PC laptop

I feel like an iPhone will be next. Good Android phones are already pricey

This assumes user is the only person with physical access to unlocked phone.

All sorts of goverment agencies, airport security, even teachers now have access. And such attacks can be trivially automated, so even low paid worker can do it.

What I find most annoying aspect of all software from 2010s onwards is this stupid discourse and associated results:

- some people want A, or A might even be already in use

- A is problematic for $MODERATE_OR_MILD_REASON

- B is introduced and made default

- a config switch between A and B is never considered

So, so tiring. If I want to bind ADB to localhost, _let me_. It's my device and my problem, ffs.

Step back to the other issue (referenced in the page*), that Google would pushing on devices something that blocks applications that do not come from play.google.com . Was it not established that Google can only push that update on devices with a google account?

* https://keepandroidopen.org/

Android had a tradeoff - less vertical integration and more annoyances, a bit worse software quality, for a more open, customisable and utility-like experience. I loved that.

Now, the tradeoff is - less vertical integration, double the integration layer trash (Google & OEM) and a much more locked down experience. But the quality of it hasn't improved, it just got worse.

Doesn't make sense anymore. They can now do 99% of the same things, but iOS has a better quality OS, better apps and better vertical integration.

Not even vertical integration, actually just any kind. FFS it's 2026 and the recommended android way to send a photo to your mac/PC is "upload to google photos and hope it decides to sync".

Locked down hardware vendor's proprietary ROMs maybe, true open source Android not so much. Unfortunately one of these matters more then the other.

I just installed CachyOS on one of my laptops. I like Open Suse a bit more, but my vpn and a few other applications work better on Arch.

Android is turning into the iOS/OSX/Win11 model. It’s not your device, you’re just renting it.

You need permission to install applications, or do anything else outside of consuming subscription services.

Where are the Linux phones ?

So glad we're becoming as locked down as iOS

LEA, Customs and intelligence agencies regularly use GDB to hack and extract information from an Android phone. So in that sense it may be a valid concern and reason to restrict this.

However, I'm pretty sure these entities will already have negotiated exemptions from the restrictions so in that sense they don't add much security.

I'm sick of having my shit be locked down because of "security".

Do these people even know tech illiterate people? They couldn't enable ADB even with instructions.

Looks like some developer just suggested an idea. Doesn’t seem concrete.

IIRC Google never originally intended for Wireless ADB to be used by the very same device, as it skirts the intended app permission model even if it takes many steps to opt in.

This is about control, not security. As in, Google's control over your device, your experience, your features and choices. This and Google just isn't interested in supporting an open OS anymore. Maybe they think it makes them liable.

Either way the writing is on the wall, and has been for a while.

Can they ruin it faster i am sick of it already. Need to root the phone to get basic functionality, i need like 6-7 magisk modules to do basic things. I can't access file system on device i paid 250$. I have to use adb to change basic things, i rather use symbian.

Would rooted phones still be game? I am fearful as this ruins all of my home built AI apps

i am not running stock ROMs and neither should you

Does anyone have any doubt left that we're headed for a future where you need a government ID to use any computing device, and only allowed to do government-approved tasks and view government-approved content?

Not a rhetorical tinfoil question: Does anyone still believe there's some hope for personal freedoms?

I'm so done with Android and iOS. I already carry around 2 phones because neither will give me exactly what I want, maybe it's time for a 3rd running Linux..?

Increasing constraints will turn people into marionettes.

If they stop sideloading and adb why should I even stay with Android?

Do you want your smart TV to become a persistent access point to your home network? If not, you should prefer to have an explicit unbypassable confirmation before another device is allowed to install arbitrary apps on it and pregrant them arbitrary permissions.

All this is happening in a country where it's legal and OK to make unsubscribing from a paid service nearly impossible.

I mean it's OK for the crowd here, because amongst us are people who created the technical backends to let these rackets going.

goodbye shizuku i guess, and maybe termux

And I might soon restrict use of Android and iOS in my life. Because of this nonsense, how will I get around the app issue is something I am still trying to figure out but I won't pay money to companies that make my products(I own them after I bought them) worse bit by bit anymore.

RIP phones

I'm sorry but F* Google.

They started with "we love open" and when became virtual monopoly they extort the position :/

Another day of AI another day of AI not being able to maintain useful features people used to take for granted

...why? Android is the holy grail of freedom, since iOS never was. It's gotten worse since ~2024, despite the lawsuit.

Or maybe Google is genuinely about thinking this in good faith. I can't see how, though.

> Scenario 3: A Developer Using ADB over TCP/IP

- You install a malicious application.

- You enable USB debugging, starting ADBD.

- You connect via USB ADB to enable TCP/IP, then disconnect the USB cable.

- ADBD continues running and listens on all network interfaces.

- The application initiates a connection, causing an authorization prompt to appear on the screen. If the user selects No, the connection is rejected. No silent exploitation attempts are possible.

I understand the author's rationale and think the reasons why that whole ecosystem is accessing ADB are legitimate - but I have some questions here.

The above flow is basically what apps that use Shizuku have to do as well, right? Only that in that case, the user would deliberately install the app and have the knowledge it uses ADB features and therefore would also confirm the permission prompt.

However, ADBD in this situation only sees a connection attempt, not which app made the attempt, right?

So it also cannot remember that a particular app was already authorized by the user and has to display the prompt again on each connection attempt?

Does that mean that a Shizuku-enabled app would prompt the user again for ADB access any time it's started?

This seems honestly like Shizuku itself would increase the risk of a user granting ADB access to a bad actor (i.e. a second app or external connection that is different from the app the user wanted to authorize).

Thinking of "scenario 3" if a Shizuku-enabled app is already running on the device and something else wants to connect to ADB:

- I'm assuming a malicious app was already installed (without privileges) or something tries to connect to port 5555 from outside or via proxyware.

- ADBD is already running and listening for TCP to serve the Shizuku app, so those steps can be taken for granted.

- The malicious app or connection triggers a permission prompt from ADBD. However, by that time, the user has grown used to those prompts, because the Shizuku triggers them frequently, so they are more likely to select "yes".

If ADBD has no information about who is connecting, it also can't show any meaningful information in the prompt. So it cannot really help the user distinguish prompts from the legitimate Shizuku app from malicious prompts. A user still has the timing and context to distinguish prompts, i.e. prompts that appear out of the blue when they aren't using the app are suspicious.

It's frankly amazing how many Google developers will associate their real identities and contact info with such hostility, believing they're invincible.

Perhaps they should be subjected to the full force of the First Amendment.

To quote Scott McNealy, then CEO of Sun microsystems, circa 1999:

"You have zero privacy anyway. Get over it".

It has become truer every year that has passed since then.

The 2026 version : "If you believe you will be allowed to keep any kind of control over the devices you "own", you are deluding yourself".

adb connecting a device to itself is just bad design and a hack. Either the capabilities should just be granted directly to the app or it should all be blocked.

bullish on google stock

revenue must go up

These are not accidents. Google declared total war against open source. You only need to remember how it declared war against ublock origin. In the long run this will also fail, but until then Google causes a lot of damage. Legislation needs to control this tyrant but unfortunately the oligarchs run the country of the mad orange king right now.

Louis Rossman will have a field day with Google here. I think it is time to end Evil - that is, to end Google. This company serves no more useful purpose on this planet anymore.

The article overlooks security implications from spyware, which is a huge problem not only for financial applications, but personal safety, too [0].

Per FTC, a stalkerware will: geo locate, read call list & record calls, read notifications, texts, & possibly emails, access gallery, camera, & files, and monitor network activity. [1]

You could do all of those with "on-device adb" (in some cases, with just the appropriate permissions), without root access. Stalkerware & financial fraud enabled merely due to the scale & reach of Android (half of humanity uses it!) and lack of basic security literacy warrants such protective measures, as (Thaler & Sunstein would like to remind us) defaults matter.

With conspiracies abound, we must not lose sight of tech safety and related issues, which almost exclusively affect the most vulnerable & the most disadvantaged.

[0] https://www.techsafety.org/spyware-and-stalkerware-phone-sur...

[1] https://consumer.ftc.gov/articles/stalkerware-what-know

"AI ... please create a very efficient emulator which will take an Android app, and convert it to any other operating system"

Anyone up for the challenge? Or a better solution.

Fuck this bullshit. It's only going to get worse.

that seems pretty reasonable actually