If they do that, people will put those lines in guides on "how to get [pirated app name] working 2019 confirmed working" and people will disable their security regardless.
There's a trick to bypass any certificate warning errors in Chrome: it involved typing "badidea" into the error screen. Google had to update the code word because large vendors started putting the phrase into their documentation instead of fixing their buggy applications. It's only a matter of time until the code phrase changes again. This proves to me that secret phrases and magic developer toggles will just be made invalid by guides aimed at less technical folk which tell people to ignore warnings.
For it to work it needs to be something dynamic the user has to do involving multiple steps, like reading into a file and using the content somewhere else, all in a terminal with unix commands. Or something else dynamic and difficult if you're not used to terminals.
And I don't think a few users getting abused with this trick is sufficient enough to remove the feature altogether, that's their device after all. The alternative of removing everything seems much worse.
That could work for security if it's only possible to do so from an authenticated environment (such as ADB) and if the OS will flag the danger any time an app is opened that uses this feature. However, I think such a system is a complete maintenance horror for a problem very few people have.
There are 2.5 billion Android devices out there and only 5 million people have ever installed Termux, let alone compiled and run their own binaries. Would you, as a developer, implement a workaround for disabling an OS security mechanism for _at most_ 0.2% of your user base, most of which will probably work around it themselves by flashing an Magisk module anyway? What about the need to validate and maintain the workaround so that malicious apps can't find a vulnerability to disable the feature themselves? It doesn't make business sense to me. Android is already full of backwards compatibility hacks to make sure apps don't break too quickly, especially when they're doing stuff that you wouldn't expect.
App developers can still provide modules to the Play Store (grouped packages can access each other's data as far as I know) so the most valid use case I can think of aside from compiling your own code (optional video codecs) would already be covered. Python interpreters and Java runtimes would work just fine as well, so programmers whipping up a quick program on their tablets are still able to do so.
The only victim are people who compile their own binaries on their phones. I don't think their use case is worth risking disabling a very valid security mechanism.
> Would you, as a developer, implement a workaround for disabling an OS security mechanism for _at most_ 0.2% of your user base, most of which will probably work around it themselves by flashing an Magisk module anyway?
I wouldn't write the code to disable the functionality of the device.
Obviously, that means I wouldn't end up on the team to begin with. So it goes.
> only 5 million people have ever installed Termux
Only?
Granted, it's Google, who makes that kind of evaluation (see also: killing products that could be a whole company because they "Google scale"), but it still seems like throwing away that many users is eventually going to come back to bite them.
Keep in mind that download numbers are severely inflated. I have downloaded termux at least 5 to 10 times over the years and I've only really used it once or twice.
Just because someone installs an app doesn't mean they use it every day. Reading the reviews, most people seem to just use it as a basic terminal emulator, like there are so many on the play store.
Those people aren't going to notice anything about no longer being able to compile executables.
If you package the compiler with termux and output the APK to a shared location, nothing about this article will change after Google's future modification.
There's a trick to bypass any certificate warning errors in Chrome: it involved typing "badidea" into the error screen. Google had to update the code word because large vendors started putting the phrase into their documentation instead of fixing their buggy applications. It's only a matter of time until the code phrase changes again. This proves to me that secret phrases and magic developer toggles will just be made invalid by guides aimed at less technical folk which tell people to ignore warnings.