Hacker News Reader

Comment by ikurei | Hacker News Reader

An app that does nothing passed review? I hope this doesn't happen often, and that the processes are reviewed. May be reviewers have too much work to do and just click OK sometimes to move on?

Also, I understand that the App store has a million apps, and they can't be super thorough with all of them.

What I don't understand is how an app that is actually getting a lot of downloads and reviews, and that charges a huge ammount of money, and that is promoted very up in search, doesn't make it to the top of the "let's really review this" priority list.

View on HN

The scammers scammed App Review, it’s not hard to do or understand. What the reviewers saw isn’t what customers see.

If the binary users download isn't the binary you sign and send to app review, what's the point of signing or reviewing anything?

The binary is never changed.

Apps can behave differently based on a flag set in the cloud, that’s only triggered after approval.

They can behave differently based on geofencing areas, such as Cupertino.

As to the point of whether review matters, can you imagine the dreck the store would be filled with without review?

> As to the point of whether review matters, can you imagine the dreck the store would be filled with without review?

Anecdotally—and this has been true for multiple years—none of the apps I use were discovered via the App Store, I always found them somewhere else. The App Store is already filled with garbage, and searching is both broken[1] and can be manipulated[2].

App review seems to be useless in every single way[3], stops developers from making quick fixes, and arbitrarily stops people from installing apps they may want.

[1]: Last time I tried searching for “pinboard” (a bookmarking service), I had scroll past twenty pinball apps before reaching the first relevant app.

[2]: Apps buying the name of their competitors as search terms for themselves.

[3]: Cant’t even stop malware: https://www.wired.com/story/apple-app-store-malware-click-fr...

I mean the app store is filled with garbage already because review, much like DRM, only solves a few surface problems while punishing good-actors more than clever bad-actors.

Geofencing seems easy enough to spoof if you're Apple and have internal tools down to the hardware. Not to mention, Apple is global business.

The issue of only working during review is solved by doing a two-pronged approach, testing pre-production and proactively testing the released applications after publication. They obviously have manual ways of revoking apps.

Not disagree that Apple should work on a solution, but what app store already does this?

We can ask that Apple do better but don’t forget it already does far more then any other store.

> The binary is never changed.

> Apps can behave differently based on a flag set in the cloud, that’s only triggered after approval.

But if this do-nothing app _did_ do something in the review phase, then why switch that functionality off afterwards? If you've already gone to the trouble of writing (or stealing) code to do _something,_ at least enough not to be refused entry into the App Store with a "does nothing at all" verdict, then your scam will only be hurt by switching even that minimal functionality off: Users will just quit using it all the faster. You'd use your remote switch to activate the scamming bits, not to de-activate the rest.

So I don't believe that's how this particular app under discussion got through. It can't have actually done anything useful in the review phase either.

If cloud-stored-flag-variable == 'n', show buffer screen, else show scam screen.

Same binary

If the scammers are going to the effort to create apps that can actually pass review, why not just sell those apps unaltered?

Because the scammed version is way more profitable? They can code up some buttons in a layout roughly resembling a keyboard that insert the character when clicked on in like 15 minutes which will probably pass review. The "keyboard" of course will be unusable for practical purpose.

If the "keyboard" wasn't usable for practical purposes then why did it pass review? A stronger review process could refuse such apps.

And if the "keyboard" was usable for practical purposes then why would the scammer waste the chance to monetize those practical, working features which they sunk their own time developing?

It’s not the reviewers job to decide if you created a “good” keyboard, just that your app generally does what it says it does.

Doing specific feature testing would not be trivial. Your description may say you have the worlds only AI keyboard driven by machine learning. No way the reviewers will be able to test that, so they will accept it at face value.

A few years ago Apple substantially decreased the App Review time, in direct response to developer complaints. It went from a week to a day. Part of the reduction was the use of more automated tools to detect violations. Some of it was adding more resources.

But that means reviewers only have minutes to review each app, not hours. And they are focused on technical rules violations. They aren’t ever going to build a test plan based on marketing claims to verify every single one.

I don't think it's necessary to do specific feature testing or verify marketing claims to solve this particular issue.

For example, whether or not the app is lying in its description about using AI techniques is irrelevant. Even if it were lying about using AI techniques, it still might be a useful and functional keyboard app. And even if it really did use AI techniques, it still might be a useless impractical app.

> It’s not the reviewers job to decide if you created a “good” keyboard

Don't the app store guidelines say that the app needs to deliver a "great" experience?

> But that means reviewers only have minutes to review each app, not hours.

To me, that eliminates a big part of the value proposition of having a "highly curated" app store.

Apple wants developers to deliver a great experience. It’s not a review requirement.

The far larger amount of scams and malware on Google Play vs the App Store clearly establishes its value proposition.

Even this garden variety scam isn’t likely to bet its makers more than a few hundred bucks before their account is banned.

> The far larger amount of scams and malware on Google Play vs the App Store clearly establishes its value proposition.

[Citation needed]

> It’s not the reviewers job to decide if you created a “good” keyboard, just that your app generally does what it says it does.

From KeyboardCleanTool’s webpage[1]:

> In 2011 Apple rejected the app for the Mac App Store because apparently it's "not useful", however I often use it to clean my Macbook Keyboard without producing annoying input.

App review does make judgements on the usefulness of apps (and in this case they are wrong, because plenty of people use that app).

[1]: https://folivora.ai/keyboardcleantool

So ten years ago they showed why it’s a bad idea?

It’s trivial to create an app to pass review and turns into a scam. Far harder to create an actually good and useful app.

On this example, it could have gone like this. They create a simple keypad on the watch, and some subscription screens. The app reviewer verified that there is a keypad on the watch, that the screens language and subscription process is reasonable and approves.

Then when the app appears on the store, now it works entirely differently and all the user sees are the scam screens.

The App Store review is about protecting Apple, not the users.

Reply on news.ycombinator.com