How Android Oreo Changed Sideloading, and Why It’s a Good Thing

In versions of Android as far back as the mind can remember, apps not found in the Play Store could be universally “sideloaded” by ticking one box in the device’s Security menu. With Oreo, that changes.

How Sideloading Worked Before

In previous versions of Android, if you wanted to install an application not found in the Play Store—an act called “sideloading”—you had to jump into the Settings > Security menu and enable a feature called “Unknown Sources.” This essentially told the phone to ignore security protocols set in place for apps outside of the official channels and go ahead and allow them to be installed.

This is an excellent feature for a number of reasons. It allows developers to release their apps for testing outside of the Play Store. It gives users the control to manually update applications before the update is officially available on their handsets. For the most part, it’s a good thing.

But like with most things that are inherently good, there’s a dark side. Enabling this feature opens the door for viruses and other forms of malicious software to make their way onto phones. For example, some of the biggest threats to Android have been with applications that could self-install directly from SMS messages with little to no interaction from the user. That’s scary.

How Sideloading Has Changed in Oreo

With Oreo, Google decided to change how the Unknown Sources feature works. Instead of being a simple toggle that allows any application to download and install third-party applications, this feature is now enabled on a per-app basis. It’s incredibly smart.

For example, I personally sideload apps often that I’ve downloaded from APKMirror. Since these are all downloaded through my default browser—Chrome Beta—I can simply allow just that application to install non-Play Store software. That means any APK (Android Package Kit) that I download using Chrome Beta is allowed to bypass Android’s (and by extension, Google Play Protect’s) security settings, but if I tried the same thing using any other browser—even other versions of Chrome—this installation would be blocked. I’m sure you can already see how this is beneficial.

Another great example is Amazon Underground. This is Amazon’s unofficially official way of getting its applications, like Prime Video, onto Android devices. It doesn’t allow this software to be installed through Google Play, and Google doesn’t allow app stores to be installed through the Play Store. These two seriously need to kiss and make up already.

So Amazon’s solution is the Underground app, which is essentially a version of the Amazon app that bundles the Amazon Appstore, and can be downloaded directly from Amazon’s website. WIth the Underground app, users are then able to install Prime Video (or anything else available in the Appstore). Since the Underground application itself has to be sideloaded, it essentially circumvents Google’s “no app stores in the Play Store” policy.

So, all that said, this is where the new sideloading policy is really beneficial. Historically, users who use Prime Video have left the “Unknown Sources” option enabled all the time so the application could automatically update. In Oreo, however, installation of unknown sources can simply be enabled for the Amazon Underground app. This will allow the Prime Video app to be updated as needed, but also keep the rest of the system secure. It’s a brilliant compromise.