Sideloading

How it works

On Android, the user downloads an APK and allows the app doing the download to install packages. Since Android 8 in 2017 that permission is per-source rather than one global switch, so allowing a browser doesn't allow a file manager. The install itself has no signature check beyond the APK's own signing key, and no scan unless Play Protect steps in afterwards.

Apple kept the door shut much longer. In-house apps go through internal distribution with an enterprise signing certificate, and since iOS 17.4 in March 2024, alternative app marketplaces are possible in the EU under the Digital Markets Act. Both routes need real governance: enterprise certificates can be revoked, and a revoked certificate stops every app signed with it from launching.

So sideloading works. What it lacks is everything around the install: version control, assignment, forced updates, removal, inventory.

Why it matters for a fleet

An APK shared by email or a download page is unmanageable at scale. You don't know which version is on which device, you can't force an upgrade when a security fix lands, and uninstalling means asking 300 people nicely.

There's also the habit problem. Once a fleet is trained to accept installs from unknown sources, a malicious APK looks exactly like the legitimate one. That's the real risk, more than the technique itself.

Managed private distribution is the serious replacement. A private app in Managed Google Play or Apple internal distribution through an enterprise app store gives you the same freedom to ship your own build, with signing, assignment, updates and removal handled by the platform. Same app, no unknown-sources toggle.

How Appaloosa handles it

Appaloosa replaces the APK-by-email workflow with managed distribution: upload your signed APK or IPA, version it, assign it to device groups, push updates silently and remove it remotely. Public apps come through Managed Google Play and Apple VPP in the same catalogue. See the Mobile Application Management page.