A file without a hash is a rumour with a filename

Allowlist first

Unknown sources exist so vendors can ship outside a store. They also exist so a hostile file can look like an update. If you do not already trust the signer, do not flip the switch.

An unplugged cable next to a sleeve is the right posture: nothing incoming until the source is named.

Why latest version lives here

A separate latest-version route would be a thin twin. Until a dated build exists, this caution is the whole story.

Unknown sources are a switch, not a feature

The switch exists so a signer can ship. It also exists so a hostile file can impersonate an update. If you do not already trust the signer, leave it off.

Why a chat checksum is worthless

The person who sent the file also sent the number. That is one source, not two.

Latest version as a thin twin

A separate route would repeat this caution with a different heading. Until a dated build exists, this is the whole story.

iOS sideloads

Unverified and usually worse. This desk will not publish a how-to.

The safer refusal

Use the browser exit or do not sit. A missing APK is not a missing product. It is a missing rumour.

Sideload caution without a recipe

Unknown sources are a single switch with two uses: a vendor file and a hostile file. If you cannot name the signer, leave the switch off. A checksum sent in the same chat as the file is one source, not two. This desk has no verified hash and will not invent one.

Latest-version language is folded here so a thin twin route is not created. Until a dated build exists, there is nothing to version. A recipe for sideloading would be a push. The caution is the job. Prefer the browser exit or do not sit.

Closing field notes

Turning on unknown sources for one file and forgetting to turn it off is how the next hostile file needs no conversation. If you ever flip the switch, flip it back before you sit. Better: never flip it.

This desk will not publish command-line install steps. A reader who needs those steps is already past the caution. The caution is the product here.

Fifteen sideload refusals

1. No file is hosted here.
2. No hash is verified.
3. No version is verified.
4. Latest-version lives here so a twin route is not born.
5. Unknown sources ship vendor files and hostile files through one door.
6. A chat checksum is one source, not two.
7. Flip the switch back if you ever flip it. Better: never flip it.
8. No command-line recipe will be published.
9. iOS sideloads are unverified and worse.
10. A browser sitting is a complete alternative.
11. Walking away is a complete outcome.
12. A file claiming to come from this editorial host is hostile.
13. Trust the signer or do not sit.
14. Just-in-case sideloads keep the door open.
15. The caution is the product.

More checks, said another way

1. No hash, no file, no version, no recipe.
2. That list is complete.
3. Unknown sources are one door with two uses.
4. Chat checksums are one speaker.
5. Flip switches back.
6. Better: never flip.
7. iOS sideloads are worse and unpublished.
8. Browser sitting is enough.
9. Walking away is enough.
10. A file with this host in the name is hostile.
11. Just-in-case is how doors stay open.
12. Latest-version is folded here on purpose.
13. Trust the signer or sit elsewhere.
14. Forgotten switches install the next file in silence.
15. The caution is the whole offering.

Checks restated for tired readers

1. Four absences: hash, file, version, recipe. Complete.
2. Remember both uses of the unknown-sources door.
3. A speaker cannot verify his own number.
4. Return every switch you touch.
5. Prefer a life in which you never touch it.
6. iOS unpublished, usually worse.
7. Browser sitting complete.
8. Leaving complete.
9. Our hostname inside a filename is bait.
10. Open doors collect later gifts you did not want.
11. No version twin will be born.
12. Signer or nothing, said again.
13. Forgotten switches are silent installers.
14. Caution is the only offering, said again.
15. A week-later file needs no conversation if the switch stays on.
16. Command lines will not appear here.
17. Just-in-case is a doorstop.
18. Hostile files like helpful friends.
19. This desk will not become a mirror.
20. Walk. That is a full outcome.

Restated once more

No hash, no file, no version, no recipe, no mirror, no command line. Browser or walk. Return the switch. Remember the silent week-later file. Caution remains the product, not a preface to a download that does not exist here.

Breath line

Absence, browser, walk, returned switch. Repeat until boring. Boring keeps hostile files unemployed. There is no quieter complete outcome than a sitting you never sideloaded.