Google Play declares educational coding app is malware and accused us of fraud | Hacker News Reader

Google Play declares educational coding app is malware and accused us of fraud

david-hurren.medium.com

54 pointsmrgoldenbrown31 comments

For anyone who missed the original discussion:

https://news.ycombinator.com/item?id=26956077

It's very unfortunate, and I don't know what I can do.

I love mobile app development, and I recently switched from web to mobile, and I must say that I prefer the apps I build natively.

The two most popular platforms are both, for all intents and purposes, closed. If I join as a developer, I could be subject to unfair treatment, and lose something I worked on for years.

These platforms are so powerful, the only way this will change is if either the EU or the USA decides to regulate this. A single country would be just deplatformed.

I'm not even sure if EU alone would be enough: if the USA treats it as attack on an American company, the EU won't get away with it. Also, when regulations go wrong, you get the cookie alerts, I don't know how they could mess this up, but maybe I'm just not imaginitive enough.

The EU has already regulated on this, and it's in force - EU regulation 2019/1150.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...

Article 4 in particular is relevant here.

Regards cookie prompts, I am must admit I think these are an example of "malicious compliance" - there's no requirement to show them unless placing non-functional, non-essential cookies. You can legally deliver your web page, store items in a shopping basket, and store logged in state - nothing prevents that.

The issue is that (right now) there isn't enough enforcement of breach of these rules - most cookie walls don't actually prevent the cookies being placed, and therefore are ineffective and illegal. The use of dark patterns to attempt to coerce consent is illegal (as consent must be to GDPR standards).

Once people stop placing third party cookies and cookies for purposes like tracking and analytics, they won't need a cookie consent prompt. In a sense the EU is raising awareness of something people had no visibility or ability to see. Perhaps the new iOS prompt will become similar. This helps people to differentiate private services, as now they will be more convenient, and hopefully succed.

Are there no humans at Google? Does noone give a sh*t? Too busy counting money?

I sympathize a lot with them. It really shows how relying on Google Play, App Store, etc is not a reliable way of making a living.

Though expect now that the story blew up some fake sympathy and the restoration of the app.

Otherwise I'd propose pivoting the coding app to a website (like Replit, maybe)

I wonder when someone will fire off a class-action suit against Google (or Apple) about these sorts of things. I am, of course, assuming an individual suit is out of the question.

The Department of Justice is building their master plan for their case against tech monopolies.

Call your representatives and tell them to end "app stores" by device/OS manufacturers. They do far more harm than good.

This is an asymmetric power relationship that is exploitative and allows platforms undue control over the entire industry.

I think the lobbies are too strong and washington is too greedy for anything to happen

This is main reason I do not develop for mobile. I just can't stand someone else being in control of my products.

However for many applications it is possible to have browser as a deployment platform. So I am thinking of porting a couple. In this case Google / Apple can not do much.

Unless you're running on your own servers residing in your own data centers and your servers in turn are running an open OS such as Linux or BSD then you're not in control of your own products. Lots of corporations run their internally-built applications in such an application hosting environment, almost no commercial software entity does.

In any event, there's a HUGE market comprised of people not running software in these kinds of environments. If you want to provide products and services to them then there's a devil you're going to be forced to dance with, unless you want to build and operate your own cloud.

>"Unless you're running on your own servers residing in your own data centers and your servers in turn are running an open OS such as Linux"

You are teaching fish how to swim.

I host my own servers and also standby dedicated servers on Hetzner. Sure In theory ISP and Hetzner (two completely different companies on different continents) can conspire and temporarily cut my oxygen but probability of it messing with my business vs Google / Apple is incomparable.

>"If you want to provide products and services to them then there's a devil you're going to be forced to dance with, unless you want to build and operate your own cloud."

I am sorry but I can't see any "devil". even though I was running my own servers since 2000. I do not need cloud as my backend are my own high performance servers written in C++. Over the years I kept changing hardware every once in a while and have never needed more than one box to serve my production. My current production box is 24 core CPU with 512GB RAM and handles load just fine without breaking much sweat.

So yes I am in as much control of my own business as reasonably possible and no I do not spend much time maintaining it. I can recreate complete server on new hardware from the scratch by running single shell script written by yours truly.

Consumer facing end is Windows Desktop Application that does not need any figgin store.

It's quite a story but it's unclear to me what the author wants Google to do, exactly.

- Should Google just let everything through?

- Should Google never cancel people's accounts?

The third option is hiring enough people that when you are kicked off, there's an actual human visibly in the loop making the decision when you appeal.

It's not just that people get kicked out, it's that people get kicked out with no warning, no explanation, no way to contest, and no guidance to fix whatever the issue is.

It should be easy for Google at a minimum to explain why it thinks DroidScript is malware. If it just tripped an automatic system, then "computer says so" is not sufficient, an actual human should review it, make a decision, and explain how they came to that decision.

(for totally new apps, summary denial of obvious malware is probably more reasonable, but if an app has been around for years, Google owes them something)

> Google owes them something

Google doesn't owe anyone anything. If people stopped acting like this, then we'd create things that don't require Google/Apple devices and we wouldn't be in this situation to begin with.

In any case, even if they hired more people - they could just deny any appeal. Then what?

I'm not saying developers have a legal claim against Google, but that Google still owes them something, in the moral sense.

Google could still deny appeals. They certainly would deny appeals. But having a real process with humans involved would be a healthy change compared to tripping an automated alarm and being locked out forever with no explanation. It's not about a human pressing the button, it's about a human actually being required to make a judgement and explain it, with reference to actual facts. The result of this process will be a yes/no decision attached to, I don't know, a paragraph or two of human-generated text referencing actual aspects of the app in question.

Lots of administrative law works like this. Yes, your appeal may be denied. In fact, the people you're appealing to may even be part of the same bureaucracy that is causing you harm in the first place. But creating an actual process whereby claims are adjudicated (even if it's all totally internal) has some value!

Again, in the article:

https://groups.google.com/g/androidscript/c/Mbh5TZ6YYnA/m/Gf...

the person already speaks to a real person with an appeal and is still rejected.

What else do you want Google to do? People need to stop making themselves so dependent on Google and Apple to begin with.

"You can read through the Malware policy page for more details and examples of common violations." is not an explanation. It's not even specifying which part of the malware policy the app violated, just that it violated it. That's the sort of thing I'm talking about- that's not an explanation, it's a simulacrum. You can see that the replies from "Cindy" are canned. I'm saying that Google owes developers some sort of explanation that is not canned and actually at least references some sort of behavior or code contained the actual app in question.

"Your app is bad and we don't like it, look at our bad things policy for examples of bad things we don't like" is not an explanation, "Your app is going this bad thing so we don't like it" is.

It's like being fired for violating company policy without at least an explanation of what happened or what policy it was. Sure, maybe that's totally legal and above board, but companies don't have to behave that way- they can choose to write a good-faith paragraph about 1) what the bad thing was and 2) which policy it violated and 3) why it was a violation. I don't see any of that in their correspondence.

I'm not saying this needs to go to an independent arbiter[0]. Google can choose what apps to allow. I'm saying that Google really does owe long-time developers explanations when they nuke their apps from orbit.

[0] though, you know, the more they behave like this, the more politics may force it on them

It’s not really unusual for things to be vague. I don’t know of any organization that gives the level of specificity around decisions that you’re looking for.

The platform is nothing without developers so they certainly owe something to third party developers in general.

Let’s just assume for the sake of argument that this is a mistake and they didn’t do anything fraudulent. Why in that situation would Google want to deny the appeal? It should be very easily sorted.

If they hired people to pretend to be manual approve/deny people then I think Google is acting in entirely bad faith and should be criticized for it.

That's basically what it comes down to, for me: if you have an actual process that generates documentation, it will make it fairly clear whether Google is operating in good or bad faith. When all decisions are completely opaque, it's impossible to tell from outside.

I missed the part where Google created 1 trillion webpages of content, which is where the actual value of the internet lies.

Android relies on a ton of open source and free software--even just the kernel! If Google created their platform from scratch, then you'd have a point. They didn't.

And in most cases, Google did not even design or build the devices, and users have no choice but to buy a device with their software platform already installed on it. That platform actively prevents users from installing their own software and steers people towards a store where they take a massive cut. Android is like the Windows of the 21st century. Actually, it's worse. Sure there are alternatives, much like Linux and Apple were alternative desktops in the 90s and 2000s. Non-android OSes have even less share than those desktop alternatives did back in the day.

In normal business practices (ignoring anomalous ones where coercive practices are used, like in app stores and platforms), B2B disputes end up in court and are settled according to law and contract.

Part of the problem seems to be the "at-will" nature of distribution contracts, allowing platforms to remove content for any reason, including none.

It is probably for legislators and courts to take a bold step and say that isn't acceptable, and such terms are null and void.

In Europe that seems to be the direction things are heading in with the forthcoming Digital Services Act and Digital Markets Act.

It is not black/white

Google's problem lies they rarely respond to appeals unless it became something no less of a public outcry.

What is hard to believe to me is that they could still get away with even with piling scandals.

> unless it became something no less of a public outcry.

This is the problem with massive, powerful, unaccountable organizations. They can only be influenced by mass outrage, and mass outrage is so exhausting for everyone and ineffective except in a very limited number of cases. Getting an equitable deal shouldn't have to involve the whole of humanity every single time.

Maybe a single corporate entity with lots of conflicts of interests shouldn't be deciding what people are allowed to run on their computers.

But they're not though, couldn't they just have a website?

Why bother having apps at all if everything needs to be done with a website?

That's a great question. Clearly this article is one answer.

Make yourself dependent on Google, or not. Tough decision.

Why did you kick the ball to the author, Google is on the monopoly side being too powerful and not caring. The author just voiced his concern but not a solution, what Google needs to do is to listen and come up a plan.

In law there is a concept of due process, a burden of proof, an independent adjudicator, and an ability for both sides to present presence, and (generally) a presumption against the accuser, who is required to prove their case. All of this is absent.

A government cannot shut your company down without proving (to the extent necessary to satisfy the appropriate legal burden of proof) you have done something irreparably wrong.

Google and Apple have removed the due process, removed the burden of proof, and decided to appoint themselves as sole arbiters of any allegation. Allegations are by default upheld without evidence or even accuracy.

Maybe we need a middle ground, bringing in due process and independent oversight, with an independent adjudicator? Arbitration already allows for this, helps keep costs low, and ensures a burden of proof is met by the accuser.

It strikes me there's many many more shades of grey here around the extent to which being blocked from a service should prevent being able to read or access existing content, or download purchased content, as opposed to uploading new content (after being banned).

When the accuser is at Apple or Google's scale, the EU talks of them as gatekeepers, and that seems an apt term - these are economic gatekeepers, and ought to be accountable to others. As it stands, their unaccountability is helping the antitrust cases against their stores and platforms. I don't think they can have it both ways.

Reply on news.ycombinator.com