Hacker News Reader

Comment by keleftheriou | Hacker News Reader

Disclaimer: I'm the developer of FlickType and have been advocating for this change for months now, after being severely affected by scam competitors on the App Store. I have also filed a lawsuit against Apple, partly because of this.

This is a welcome change, but what’s most important is what Apple actually does with the reports - which I’m definitely going to be keeping a close eye on.

Of note, this “New” Report-a-Problem button is not actually new: it used to be there but Apple decided to remove it years ago, while App Store scams were - and still are - running rampant: https://techcrunch.com/2021/10/06/with-return-of-report-a-pr...

View on HN

I am interested in what they will do around false reports. I hear about negative review attacks from competitors on Amazon listings, so it will be interesting to see how this is weaponized and how Apple responds.

It works as sabotage on Amazon listings because Amazon uses reviews with certain keywords as lead indicators for product contamination or other issues. So if you want to sabotage a competitor's vitamin pill the day before Prime Day, you have an entire building full of people leave variations of "taking this made me feel nauseous" or "this gave me a headache" and "weird chemical odor" after purchasing the product. Either the automated systems will flag it or complaints will flag it for review.

Software can't actually poison people in a physical sense, so generally the software marketplaces care less about signals from reviews like those.

Why are those reviews included at all if they weren't "verified purchases"? I guess there's some utility in it - you already own product X and want to let people know about something (positive or negative) but... this blatant sabotage from obvious non-customers/users is crazy.

You would pay your manipulators to leave verified purchases. In the black market for manipulative reviews that comes at a premium. You can also get similar effects with unverified reviews on some product types (consumables, beauty products, etc.)

It's not non obvious if you bribe someone who uses an American shipping address to do it.

Now I know why I see the phrase “weird chemical odor” on reviews for things like facemasks masks a lot.

They're hoping that it gives it a hazmat or pesticide false flag. Pesticide false flags are extremely common even for things for which it would make no sense whatsoever. Anything that says 'filter' for example will often result in a pesticide false flag.

How about

‘This software broke my phone’

‘This software wasted my battery’

‘This software invaded my privacy’

‘This software is a scam’

I haven't worked on anything related to app stores in years so I'm not sure, but that's promising, as would "this posted without my permission," "this bricked my phone," "my phone ran so hot it burned my pocket," etc.

> Now App Store product pages on iOS 15, iPadOS 15, and macOS Monterey display a “Report a Problem“ link, so users can more easily report concerns with content they’ve purchased or downloaded.

It appears that reports are going to be attributed to actual accounts, which should enable Apple to identify abusers more easily.

> It appears that reports are going to be attributed to actual accounts, which should enable Apple to identify abusers more easily.

I don't feel X == Y in this case. Account creation is not a high enough bar to block abusers IMHO. Amazon reviews require accounts too, but that obviously doesn't stop the negative review attacks which GP mentioned.

Account creation is a very high bar when it comes to Apple services, because Apple "console bans" hardware devices associated with accounts that evidence fraudulent behavior. I expect they will only seriously consider reports from users who have an active Apple hardware device bound to their Apple account.

I also expect they'll link this system to a human review queue. If you send abusive reports for something that isn't scammy, it will probably not be considered scammy during human review, especially if you're responsive to questions asked by Apple during that review. There will, of course, be a 'first post' false positive someday when a reviewer makes the wrong call, but it's a safe bet that they have not implemented a Google/Facebook/Yelp system where your life and livelihood can be destroyed by an algorithm without human participation.

I’m sure like most models, the weight of your submission will largely be determined by multiple factors, such as the age of the account, how much money you’ve spent, whether you’ve spent money on the app being reported, how many devices are connected to the account and for how long, etc. Not all complaints are created equal and it allows them to attribute a “trust factor” across several metrics.

For a few thousand bucks and the right cause, I'll happily sell my vetted AppleID for this. I don't have anything important in there -- a ton of apps that I never use that I can't remove from my account, and years of history. It is of zero value to me, but apparently because of these checks, could be worth a lot of money to someone else.

I feel like App Store accounts require a credit card number, and they do an authorization for a few cents to check if it’s real. At least they did years ago when I tried to set up a relative’s iOS device with a fake credit card number.

you can use an Apple App Store account without credit card or other payment info.

https://support.apple.com/en-us/HT204034

Interesting, I wonder if that changed or if they were not up front about it before.

I would assume that attacks similar to these could be checked against device ownership - for example if a user has been the first registered owner of an apple device, their reports may be deemed more trustworthy. If they see a device being reused to submit similar reports, that could be a signal that reports are fake.

Maybe correlate with regular spending.

Quite easy/cheap to pass that bar - have your 100-1000 sockpuppets spend a few $$ on a subscription (which may or may not be money coming back to you in some fashion), then buy competitor apps and report them as scams.

Possibly negated with some form of (even Apple-internal) web-of-trust measurement of account validity.

And adding human review completes it. The other measures are just to reduce the amount of spam.

So if are fraudulent ripoff of your app gets uploaded by some one else, in order for you to report it, you have to purchase the fraudulent ripoff app?

If you have an Apple developer account in good standing, at WWDC they introduced a separate reporting page for you to use, that doesn't require to you have purchased the app first. There's also a pre-existing, years-old process for you to report lookalikes and such.

Cool, I'm not an Apple dev so I wasn't aware of this... sounds like for some devs though these reports havn't been taken seriously in the past.

This article gives more detail on the excellent work OP @keleftheriou has been doing to track down scam/fraud apps in the App Store. https://www.theverge.com/2021/4/21/22385859/apple-app-store-...

Thank you, I really appreciate that.

Reply on news.ycombinator.com