I have seen few cases where UEFI was not actually usable on non-OEM configurations.
In fact, my current ASUS laptop did not allow me to install Windows until I have performed a sophisticated dance to update/flash some sort of low-level disk-related Intel bloatware. The laptop was sold without OS and was accompanied by a small paper referencing a website with instruction how to flash the firmware to actually make the laptop usable.
I am currently in process of "verifying" my identity with Android Developer console.
In addition to proof of identity (e.g. passport/driver license) Google is demanding a proof of address, government registration, this month's rental agreement, foreign passport... The process is stuck in limbo because months-old documents are deemed "outdated", and I am constantly threatened that my verification request (!) will be denied because of "exceeding allowed number of attempts" (!!)
It shares the same principle as silent Discord account bans and other "verification" harassment schemes, such as Upwork account verification. The excess developers — Google's potential competitors — need to be banished from platform as quickly and cheaply as possible, so that Google can peddle their own spyware unimpeded.
Hardware can have issues, but firmware and drivers usually work around those issues. When firmware and drivers crash, you get "masterpieces" like the one above.
> You'll need to prove you own your apps by providing your app package name and app signing keys
Needless to say, Google will throw out NewPipe, ad-blockers and anything else that might endanger their profits. For example, Google does not allow F-Droid to be published in Google Play (distributing competing app stores is against their ToS). This policy was in action as long as Google Play/Android Market existed.
Android used to have lighting-fast builds even when accounting for Google's quirky tooling, R.java generation and binary XML processing. After introduction of Gradle build system and Kotlin Android build times have become laughingstock of entire programming world.
This however has nothing to do with Java — Kotlin compiler is written Kotlin, and Gradle is written in unholy mix of Kotlin, Java and Groovy (with later being especially notorious for being slow).
I might be mistaken, but the brief look at code shows that the speed up appears to come from combination of async architecture (the selling point of Mold) and intelligent usage of PUNCH_HOLE/INSERT_RANGE fallocate() operations.
Surprisingly enough PUNCH_HOLE and friends have already matured to be production ready, with viable support from ext4 and xfs filesystem. The possibilities!
You already can not install applications from Google Play without Google account. Google accounts are registered with personal phone number (the one you obtained from your carrier, presumably using your ID). All Google Play users are already "verified" one way or another.
This change means that people who do not use Google Play or other sources, fully controlled by Google, will no longer be able to install applications on Android.
While this did funnel countless FOSS and commercial developers to pay MS for certificates, it didn't close even 50% of loopholes. You can still execute third party software from your own (e.g. Steam launching games you install with it). You can also use interpreters, JVM and other ways to disregard the requirement.
If fact, the reason why MS can charge for "nearly mandatory" executable signing is because it is not mandatory at all. If they really were forced to close loopholes, they would have made it free for everyone, — just like Let's Encrypt was made free of charge to establish mandatory encryption across the Web.
> most normal people... don't even understand what sideloading is
Actually, they understand it just fine. The concept is very simple too.
Before this change you could install Android apps without registering your passport/driving license with Google.
After this change you will have to tell Google your real name and home address to install anything on your Android device. This is all. It can take a convoluted form of registering Google account or a more direct form of sending Google your identity documents to confirm "developer privileges". But you will no longer be able to use non-hacked Android devices to install anything without doing those steps.
P.S. I recall that some people still believe that they can create Google account without giving Google your personal details, phone etc. This is simply a self-delusion. If Google does not immediately demand you to cough up a phone numbers under pretense of "suspicious activity", that's because they already know who you are (you probably told them yourself by registering another account elsewhere).
No, "burner SIM cards" aren't real. This is just another form of self-delusion, — this time architected by US security agencies. You don't become anonymous by using those, you become watched.
Note that TCP Keep-Alive might not play well with mobile devices.
Mobile operating systems can use application-level keep-alive packets, because those can be easily attributed to individual applications: an applications receives a TCP/UDP packet during low-power CPU sleep mode, asks system to wake up (by e.g. taking a wake-lock), and the system takes note who caused the wake-up. TCP Keep-Alive happens below application level, so it may be disabled, even when application can still be reached.
This might be somewhat less threatening then it sounds, because it requires caller to fully control animations used for entering the targeted Activity.
In particular, this vulnerability might not overcome root permission prompts on rooted devices, because their windows are launched and controlled by the installed su app, not by attacker.
You have to update an application every year, even if it is just meaningless version bump. Otherwise it will be removed after 2 years. Despite saying that this policy is required to ensure user security, several recent Android releases didn't have any corresponding major security changes.
First they ousted 8chan because of something-something-terrorism something-pedophilia. Then they have banned RT, because Russia and US are clearly at war (nope). Now they are banning TikTok for "spreading propaganda".
The "wide range of national and international media" you can access is shrinking rather quickly.
In fact, my current ASUS laptop did not allow me to install Windows until I have performed a sophisticated dance to update/flash some sort of low-level disk-related Intel bloatware. The laptop was sold without OS and was accompanied by a small paper referencing a website with instruction how to flash the firmware to actually make the laptop usable.