181 – Breaking News & Latest Updates 2026
Skip to main content

Sean Hollister

Sean Hollister

Senior Editor

Senior Editor

    More From Sean Hollister

    Sean Hollister
    Sean Hollister
    “There never was Cyberpunk for Android, but unfortunately users don’t know better.”

    Google’s security expert Dr. Qian is describing various types of annoying and scary malware that have hit Android devices, including adware, ransomware, and spyware. One example was a fake Cyberpunk 2077 game that wasn’t a game at all.

    Like his Epic counterpart, Qian has three basic arguments that we’re now seeing on-screen:

    Android devices face a significant threat of malware that can harm users

    Android sideloading screens are prudent and consistent with best practices

    Prof. Mickens’ proposals are less flexible, would introduce new security risks, and impose significant burdens on Google.

    Sean Hollister
    Sean Hollister
    We’re now hearing from Google’s expert witness: Dr. Zhiyun Qian.

    He’s a professor at UC Riverside who spent two years working on Android anti-malware solutions, and Google is taking care of a question about his financial conflict of interests right away: his lab received a grant from Google for a couple hundred thousand dollars, but he says it was less than 5 percent of the lab’s funding and received none personally.

    He didn’t say if Google paid him to consult on this case though, yet.

    Sean Hollister
    Sean Hollister
    Epic explains why game consoles don’t have sideloading.

    Mickens, prompted by Epic’s attorney, says the Switch, PlayStation and Xbox gaming devices — not general purpose computers like an Android phone — and that game consoles are often sold at a loss, making their money back on software, so there’s an economic reason to lock them down.

    Sean Hollister
    Sean Hollister
    “There’s no requirement that all app developers register with Google.”

    Mickens says his notarization proposals would keep that optional.

    In other words, Epic Games could make Fortnite a trusted, non-scare-screen app by getting it notarized, but other developers wouldn’t have to if they’re fine with more warnings.

    Sean Hollister
    Sean Hollister
    Google points out Epic makes Fortnite available on consoles, which don’t offer sideloading.

    Google also tried to draw him into some questions to promote its “we compete with the iPhone” narrative, asking if Android was much less restrictive than iOS (he agreed) and if Apple hammers Android on security in its marketing.

    Google asked if Apple would have a field day if it dropped its sideloading warnings — setting up a straw man, since Mickens doesn’t propose dropping them entirely.

    I think I got one word wrong in this quote, but this is almost entirely what he said:

    “I think if Google did not replace those sideloading warnings with something that protects users, then Apple would make some hay out of that.”

    He’s Epic’s witness again, just to go over some fine points of what he told Google.

    Sean Hollister
    Sean Hollister
    Google is suggesting the existing sideload flow on Android isn’t incredibly far from what Mickens is asking for.

    We’re seeing that after we eliminate steps in the modern install flow that are out of the Android operating system’s direct control, there are few that Mickens takes issue with — mostly just the scare screens.

    “You agree with the concept of asking users for consent before you allow one app to be an installer on the phone, right?” Yes.

    In a March video deposition, Mickens suggested that the discriminatory nature of the scare screens (that is to say, they don’t pop up when you install via Google Play, only third-party stores and sideloaded apps) was his primary remaining concern with them.

    Sean Hollister
    Sean Hollister
    Google introduces us to “Nitflix,” a supposed Netflix app from a site called APKFab.

    “All APK/XAPK files on APKFab.com are original and 100% safe with fast download,” reads the listing at APKFab, which also has a fancy “Trusted App” badge with a green checkmark.

    Professor Mickens admits he doesn’t know if APKFab reviewed this app at all, and that the “com.tveemobilee.nitflix” file hosted there is likely not a legitimate app.

    The point, I assume, is that decentralized notarization would lead to confusion about which websites have legitimate apps? We didn’t quite get to that.

    Sean Hollister
    Sean Hollister
    Epic’s security expert says Epic has paid him roughly $150,000 for his testimony.

    He makes $750 an hour, he tells Google’s lawyer.

    Wonder if a jury will take that into account. Surely, Epic will ask the same question of Google’s expert now.

    Speaking of Google’s expert, a Professor Qian — Google says Qian warned Epic’s expert that agencies like CISA recommend against one of his suggestions (I missed which, sorry), and he admits he didn’t incorporate those warnings into his report.

    Correction: We’re now learning it’s Professor Qian, not Chen. Dr. Zhiyun Qian. I apologize for the error.

    Sean Hollister
    Sean Hollister
    Google is trying to suggest that Mickens is asking the company to enter a “new domain” of security.

    Mickens admits that no popular operating system has ever implemented decentralized notarization but waffles on “new domain,” saying he believes it’s possible for Google to do this relatively easily.

    Sean Hollister
    Sean Hollister
    “Cost to Google: ???”

    “You don’t say how much it would cost Google to scale up its human review teams,” says Google.

    “You don’t say how much Google should charge for a centralized app review process, right?”

    The phrases “Cost to Google: ???” and “Cost to developers: ???” appear on Google’s slide, which is clearly designed to suggest Mickens hasn’t thought his proposal through.