Your app is not compliant with Google Play Policies: A story from hell | Hacker News Reader

Your app is not compliant with Google Play Policies: A story from hell

sylviavanos.nl

395 pointsajdude189 comments

I think you were lucky they told you anything. On Quora they just say "your answer was deleted for violating Quora policies. Click here to read our policies."

This sort of "tell them nothing" approach seems pervasive in the online world. Blame the lawyers.

Their lawyers must caution them "Don't give any details. That just opens us up to more questions & legal actions." The fact that it's completely self-serving and proves they don't give a shit about you is kinda irrelevant. Who are you, after all? There are millions just like you.

I despise the tell them nothing approach and I think it's despicable, but that said I think there is a more legitimate reason than the lawyers. If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store.

I don't think that justifies the harm it does to regular people, but it is a lot less sinister than just CYA.

I actually blame tech media who capitalize on every "malware in the Play Store!!!" story a lot more, and the Apple apologists who use any news of malware on Android (even if it only applies to people downloading pirated apps and sideloading them with root) to trumpet how insecure Android is. Personally I think that bad press is the primary driver behind the modern policies.

Could be, actually. The press sucks: a bunch of untrained people too lazy to get off their laptops and talk to people.

I don't think Quora falls into that "spammer" category, though. No one is seeking to make any serious money from it, AFAICT.

If your product/brand is an answer on every relevant question, that's probably worth a lot.

So much money they're leaving on the table, then.

(Or maybe they're secretly raking it in. Who knows?)

At that point, why not put up an option for paid tech support? It would make life costly for the spammers, and give an option for people with a critical and legitimate problem.

Because then they might be liable for the advice provided. Can't be sued if you don't provide anything. *taps head*

Spammers are in it for the money, so why do you assume that they wouldn't pay?

Japan immigration does this too - they reject applications but won't say why it was rejected, because people wanting to enter the country for illegal reasons might be able to use that information:

https://www.mofa.go.jp/j_info/visit/visa/faq.html

> If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store.

Is it? Because spammers and malware writers are the only ones that already know what they did wrong - spamming and malware! While everyone else is left guessing.

They know in general, but they don't know exactly which check they tripped and why. That makes it harder to hunt down the detected part.

But you wouldn't tell them which check exactly - you only tell them "spamming/malware".

But that's not really any more specific (imagine this same article where "is not compliant with Google Play Policies" is replaced with "was flagged as spamming/malware," not much changes) plus for any false positive it's likely to make any developer even more angry ("you thought my app was malware?!").

Why would anything have to change about this article? The developer wasn't accused of spamming or malware. You seem to be saying that if an app fails any Google policy, then that is the same as if it was spamming or malware?

My point is that if the developer is given an answer of "spamming/malware" it's not much more useful than "not compliant with Google Play policies" ("spamming" alone is useful, you can check whether messages are being sent, "malware" is just far too broad). To check whether "spamming/malware" is more informative than "not compliant with Google Play policies" you can just plug it into the OP and see if any of the behavior would be different, but I can't see anything that would look different, which suggests "spamming/malware" is not really any more specific than "not compliant with Google Play policies" from the viewpoint of a developer saddled with that message.

And because it's so vague, even if a developer were not to get that message (e.g. as in this case) it still doesn't narrow down much in the negative direction either.

You misunderstand me. I'm trying to say that not every Google Play policy is something malware or spam is interested in violating.

Let me give a hypothetical example: Suppose there are color contrast requirements, to make buttons easy to distinguish. If your app is too desaturated, and buttons are hard to make out, the reviewer can tell you that you must make your app more colorful, and that information won't help malware or spammers one bit.

Or for a non-hypothetical example: How does it help spammers or malware to know that their app mustn't contain "free" in the title?

Or suppose they institute a policy where you're not allowed to re-implement functionality provided by the Google Play store (Google worked hard for that lock-in!), or make apps that are substitutes for ones provided by Android itself, or apps that break DRM.. how would being told you've violated one of these policies, help malware writers and spammers?

Ah I see what you mean. Yes that makes sense.

This kind of incompetence makes me seriously doubt that Google is doing anything to more substantially review apps for deeper security issues, either statically or at runtime.

The asymmetry of effort in this situation is profound: consider that you spend all your time and effort writing a, long, complex, thoughtful message by hand (the app), taking hundreds or thousands of hours, but then they respond with machine generated message that cost them 10ms of computer time.

The solution, I think, is obvious: Google needs a "zone defense" with the play store, a much larger (and expensive) staff, to do in-depth app reviews and be a stable, stateful relationship with the developer over time. This person would, in fact, become a 3rd party "expert" on a small set of apks and their contents, with a "feel" for what is changing over time, with the core mission of protecting users from malice, but working with devs, as a human being.

That sounds awesome to me, but if they were going to do that the cost of submitting an Android app (or the % take by Google on sale) would have to sky rocket to make it worth it. As someone who rejoices in small developers, I would hate to see that.

I think it's ok to do automated review for round 1, but I would like to see a human field appeals. Over time I would also think that will help find edge cases and cracks in the automation so that it can be further improved.

Edit: Based on other comments here, it sounds like that may be what Google is starting to do

> This kind of incompetence makes me seriously doubt that Google is doing anything to more substantially review apps for deeper security issues, either statically or at runtime.

I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vulns and ensure that you don't inundate users with false positives, forcing them down the admittedly limited support channels.

> The solution, I think, is obvious: Google needs a "zone defense" with the play store, a much larger (and expensive) staff, to do in-depth app reviews and be a stable, stateful relationship with the developer over time. This person would, in fact, become a 3rd party "expert" on a small set of apks and their contents, with a "feel" for what is changing over time, with the core mission of protecting users from malice, but working with devs, as a human being.

This sort of exists. Google pays external hackers who find vulns in popular apps via a rewards program. These don't need to be Google's apps. There may be other systems for top partners or specific kinds of apps (the org is big) but I'm not aware of anything personally.

Expanding beyond a small subset of apps is challenging. Not only are there millions of apps, each app contains tens, hundreds, or even thousands of individual apks. The staff needed to have a concierge for each app would be absolutely freaking enormous, perhaps even larger than the number of people on the planet who actually have deep security expertise on the Android platform.

Sounds to me like what you're saying is that the walled-garden approach of needing to approve every app that ever gets developed as a whole is what's infeasible without creating kafkaesque conditions dealing with their automation, and I fail to see how you've made a case for this automation being all that good in the first place, given that your main argument for it is that it's found "millions of vulns in apps over the years" but then later cite "millions of apps" as a reason you can't expand the support team.

I would suggest that it might be worthwhile to use OS-level features to stop apps from behaving maliciously in more general ways, but a lot of what I would consider malicious behavior (e.g. sending user analytics to third parties, feeding them misleading ads, messing with other processes, etc) is part of google's business model or claims of added value in many cases, so that seems unlikely to happen.

You are nonetheless astute to point out that we can't really blame the individual or even group-wise incompetence of their support teams here. What it is worthwhile to blame is the entire business model of trying to own and control a platform that supports so many users in the first place without giving them the autonomy to self-govern. No company can possibly be so many things to so many people and not screw them over. In a way, it's the same problem planned economies have. Even making the very generous assumption that this is never out of malice or greed, we can still view the major problems millions of people face due to this scale and inflexibility as practically inevitable.

> Sounds to me like what you're saying is that the walled-garden approach of needing to approve every app that ever gets developed as a whole is what's infeasible without creating kafkaesque conditions dealing with their automation, and I fail to see how you've made a case for this automation being all that good in the first place, given that your main argument for it is that it's found "millions of vulns in apps over the years" but then later cite "millions of apps" as a reason you can't expand the support team.

People definitely make that claim. I don't think I fully agree. From the reviews of this particular system I've seen, they are able to actually hit virtually zero false positives. The challenge is that this comes at a high cost of missed issues, which also generates complaints.

> I would suggest that it might be worthwhile to use OS-level features to stop apps from behaving maliciously in more general ways, but a lot of what I would consider malicious behavior (e.g. sending user analytics to third parties, feeding them misleading ads, messing with other processes, etc) is part of google's business model or claims of added value in many cases, so that seems unlikely to happen.

Unfortunately, people also get pissed when platform behaviors are locked down to prevent abuse. Heck, people demand to have access to rootkits despite also wanting it to be impossible for a malicious app to harm them.

They can’t really have their cake and eat it too.

Either they have a system with zero false positives and they should have a review team for all the complaints of things that slipped through. Or they should aim for zero false negatives and have a review team for anything which gets stuck.

A false positive is "rejecting an app because of a behavior that isn't actually present." You've got them backwards.

>Google pays external hackers who find vulns in popular apps via a rewards program.

How does that work? Is the submission farmed out to a 3rd party as part of the verification process, and proactively checked? Or is it reactive, similar to a bug bounty? Are there people out there making their living running apks in desktop simulators looking for issues?

I always wondered about the economics of checking huge quantities of arbitrary code (well, bytecode) for vulnerabilities, even for a 30% cut (which is probably 0 for 99% of apps, right? I would expect a power law distro). Kinda sounds like Google solved this by running the apks through something like a CI/CD gauntlet and then...hoping for the best.

And of course you can't be too transparent or bad actors will game the system. It's almost as if, as a sibling commentor mentions, it's just not possible to adequately run a walled garden that adequately detects malice at scale.

Here's an idea: instead of charging 30%, you should waive that if the dev team agrees to vet 5 other apps for you, over time, especially the open source ones.

> How does that work? Is the submission farmed out to a 3rd party as part of the verification process, and proactively checked? Or is it reactive, similar to a bug bounty?

Bug Bounty. Person finds vuln in popular app. Person submits vuln to Google. Vuln gets reported to developer. Person gets paid.

> Are there people out there making their living running apks in desktop simulators looking for issues?

Most of them use tools, I think. I don't know stats on any individual who is making bank off this but given four figure payouts per issue I could definitely believe somebody living in eastern europe or whatever is making bank on this.

> I always wondered about the economics of checking huge quantities of arbitrary code (well, bytecode) for vulnerabilities, even for a 30% cut (which is probably 0 for 99% of apps, right? I would expect a power law distro). Kinda sounds like Google solved this by running the apks through something like a CI/CD gauntlet and then...hoping for the best.

I'm not sure it is just hope. I don't know how that team works specifically, but I know that they aren't just saying "hey we hope it works" in their reviews with leadership.

> Here's an idea: instead of charging 30%, you should waive that if the dev team agrees to vet 5 other apps for you, over time, especially the open source ones.

If you think that Google's policy enforcement and support is a kafkaesque nightmare now, could you imagine if your app was booted off Play because some other devs working at some company you've never heard of decided your app was bad? How would Google evaluate the quality of these investigations? With only five apps you don't have enough volume to develop a reputation so Google would either be forced to repeat all of the investigations or simply have zero oversight over the process.

>could you imagine if your app was booted off Play because some other devs working at some company you've never heard of decided your app was bad?

I would assume they'd give a reason for booting the app, which could be verified by Google and the author. I would imagine the more likely error mode would be simply clicking "okay" without actually looking at the code at all. You know, like some devs do with code reviews!

> I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vulns and ensure that you don't inundate users with false positives, forcing them down the admittedly limited support channels.

Pay people to do tiered support.

"but that costs money"

Make less. Or don't have an app store.

> Pay people to do tiered support.

This exists. You can sign up for a contract that will grant you various tiers of support.

Some Google engineer probably thought they were very clever when they applied "the algorithm" to translated titles.

Pretty fucking draconian some of those rules, if you ask me. In games and works of art it's not uncommon to have a title longer than 30 characters. Nevermind when you have different editions or things that are related to the main title.

So how does this actually work? Why is 'Life is Strange: Before the Storm' (33 characters) on Google Play? https://play.google.com/store/apps/details?id=com.squareenix...

Until recently the limit was 35, and 50 earlier still.

Google enforces new limits on app updates, so this game was not updated recently.

The rules can be and are waived for big-time publishers.

ugh, that's annoying.. At least you made it onto HackerNews, so your problem might get silently resolved in the shadows

It really sucks that Google can't be bothered to provide 5 minutes of human support despite taking such an enormous cut of all revenue from these apps

1. It wouldn’t be 5 minutes. This could easily take hours to resolve.

2. Even with human support, companies like this would continue to be incentivised not to share what exactly triggered the ban in order to protect their systems from spam and abuse. You can’t provide services to billions of people without automation.

3. Human reviews would be performed by humans. Have you ever met humans? You’re replacing an imperfect system with another imperfect system except now things are slower and cost more.

> in order to protect their systems from spam and abuse

Spam and abuse would fall afoul of the CFAA in the US and similar laws in the EU.

Outside of the US? Well maybe those apps shouldn't even be available in the US or EU.

Spam and abuse only happens because the criminals perpetuating it do it without real consequence.

On number 2, why?

If your program is abusive, have the abuser remove the function until it's no longer abusive. The entire we cant tell you does seem like crap.

> not to share what exactly triggered the ban in order to protect their systems from spam and abuse

That's kind of true but I think that a company the size of Google could afford to assign someone to look into providing more information in a scenario like, "you are using geo-location without asking permission". Since the need for permission is not a secret, telling the vendor this causes less friction and makes people hate you a bit less.

Sure, you might also have a "secret" system that does something like "if failed 5 times in a row, blacklist them" but that is just security by obscurity and doesn't seem to stop that many people. Also, in the case where the vendor is an easily verifiable company selling, presumably, something that is fairly easy to view/check, it doesn't seem to be asking for much to either get a human or to get some automated messages.

Apparently they employ 140K people! That is a lot of people to not provide any human support.

Right, my history of suffering went on for 11 months.

Unfortunately, I don't know anyone at Google and I didn't made it to HN.

That's what I was hoping about my similar problem with facebook, but alas ... no kind HN denizens have offerred any help yet :)

Post is still here if anyone's interested or can help: https://news.ycombinator.com/item?id=29876423

I once got a warning for sexual content. The offensive phrase was "Virgin Mary".

So the right hand built machine translation and the left hand falls for naive Scunthorp problems like it's an intern writing a PHP app? (Or worse, a human with zero critical thinking)

Why am I not surprised...

Once I had my app rejected from Google Play, because they decided it was plagiarizing another application... which was actually the very same application posted by me somewhere else. Took some effort to convince them that I'm me, even despite of my Google account being registered on a domain that's prominently displayed as the first thing after launching the app.

Another time, they suddenly decided that "No information is gathered from users whatsoever." is not a valid privacy policy for a Free Software application that does not gather any information (it was a simple game that couldn't even store highscores locally).

> The reason Catima isn’t on alternative app stores isn’t because there is something wrong with them, it’s because there is something wrong with Google Play.

I don't understand. Why are erroneous policy violations in google play preventing them from launching it on Huawei or Samsung?

I agree, it's not clear. Maybe it's because the developer has sunk so much time into dealing with Google Play that she hasn't been able to release it on other platforms, or she's discouraged from trying to do so and getting hit with another round of insanity.

My experience of Google Play is that it is 100% corrupted. I worked with companies that tried to get their apps back onto Google Play for YEARS without success. How do you solve something like “this app is not compliant with program X” when the app was never registered for that program for just that reason?

…and the "support".

Google is specifically anti-support from their beginnings because they have this belief that everything can be solved algorithmically.

When you work for companies that make Google a lot of money. Google does all the work for you, so you do not even need to care about support in the first place.

Getting boned because of the inability of the English language to distinguish between free and free, that's a new ring of machine learning hell.

But... Spanish does have a difference between "libre" and "gratis", and the translated title is using the correct one. I guess they are also trying to catch synonyms and doing a terrible job at it.

It's not a machine learning issue. A human would make the same translation. The issue is that the match should be run in the original language, not translated to English at all.

Clearly this was a fuck-up with machine learning, and while it is worrying, what's more worrying is the consequences when this goes beyond just developer app reviews.

I'm worried we will have another British Post Office Scandal[1] but on a much worse scale. Bad technology coupled with everyone in charge thinking the technology is infallible.

[1]: https://en.wikipedia.org/wiki/British_Post_Office_scandal

I have a similar story about the App Store. I wanted to move my app to another owner, but Apple has detected it's a plagiarism of my original app. Now I have neither the original app on the App Store, and the new owners app is stuck. It seems to be automated rejection without a human taking an actual look at the problem.

My app is open source https://github.com/triangledraw/TriangleDraw-iOS

It just amazes me that developers try to cram editorializing into the title of the app, when you're already given a search word field and a description field in which to tell the world about your app. IRL nobody searches for "Cheerios - Toasted Whole Grain Oat Cereal for the Whole Family".

Why even have names then? Might as well just be a serial number that isn't displayed, and a bag of keyword fields that also aren't displayed but can be searched.

A name has to convey some sort of meaning, otherwise everything will be a billion versions of Verizon. A toothbrush would be indistiguishable from a tax prep software by their names.

And of course people search for every one of those words in that long cheerios name. You can't search for a thing by it's short unique meaningless name until after you find it by searching for what you want, like toasted oat cereal or wallet of freedom.

It's sad but if you search for 'cereal', you're going to see the one with the awful title higher up in rankings.

I feel this just shows lack of imagination in the search algorithm. It seems pretty trivial to discourage this kind of thing - to start with, how about penalizing longer titles or longer lists of keywords?

Let the publisher decide whether to rank low for lots of words, or high for a few.

This is something Google does themselves. Their listing for Chrome is "Google Chrome: Fast & Secure", Keep is "Google Keep - Notes and Lists"

Meanwhile, lots of other apps with 'Free' in the title, description, etc.

https://play.google.com/store/search?q=free&c=apps

Including some Google owned ones like YouTubeTV.

Yeah they only review when you make a new release, so maybe these apps just haven't been updated in a while

Nah. Probably exclude app already in store.

Nah. Probably exclude any app under X downloads, and even then just pick a random sample every once in a while, and even then maybe the reviewer had better stuff to do that Monday and just waved everything through.

"Text Free - Call and Text Now" Updated January 10, 2022

"Free Now" - Update January 11, 2022

Many other examples have recent updates too.

I was always wondering how Free Now can stay in the Play Store with their name. Maybe it is a trademark thing (as this is a trademark).

But yeah - the rules seem quite arbitrarily enforced.

As said in other discussions about Google - I decided to untangle my life from Google further. Quite hard actually as I am a paying GSuite customer and a lot of stuff actually is tied to this account. :-(

we have an isp in france called Free - so yeah, at least somewhere it's a trademark. though this is not the real reason they ban it. people are cheapo so they all want free stuff, so they tend to search for "<app> free", and google tries to reduce the squatting on this keyword.

it always baffled me how people always feel this need to explicitly search for free stuff, without looking first if it is always free (esp. in the case of opensource software). I once had to cleanup of viruses the computer of a classmate that got all the viruses because he searched for "python free" and fell for a crappy, virus-loaded, fake version...

Not quite, it is only reviewed when you make an update to the play store description, not when you publish a new version.

Maybe we shouldn't be relying on Google and Apple to decide what we can run on our phones and tablets. Maybe we shouldn't let Apple and Microsoft decide what we can run on our computers, either.

I agree with the sentiment, however you are not forced to run Google's Android on your phone if you don't want to. It is just the most convenient OS to run (as it comes preloaded).

For the PC's (yes, an Apple laptop/desktop is a personal computer) you can always install Linux.

Try it, it's great!

Software freedom is not just about being able to run Linux. Being able to run Linux doesn't help the billions of people who will never use anything other than the stock OS that ships on their phones, tablets or computers.

I bought a model of a phone that doesn't have LineageOS support because apparently it's a weird carrier model. The base model has AOSP support, though. Didn't realize that until a few months into ownership, and by then it was too late to return. I'm stuck with Google's Android.

I've been running Linux for like 19 years now.

Ofcourse it doesn't serve the vast majority of users any good. If it would then Linux wouldn't be in minority use on desktops/laptops.

However there is a clear difference between there being the possibility to run alternative OS's on a device vs there being a convenient method to switch to something else.

Most Android devices do not force the user to use the stock OS. PC's do not care what OS they run. This runs contrary to your initial comment on users being dictated on what can and can not be run on the hardware.

Since, for the mobile industry at least, the business model doesn't revolve around simply selling hardware (Apple as well as Google makes most of their mobile earnings through the stores and ads after all) I can fully understand that that flashing with other OS's isn't supplied as an easy one click selection by the manufacturer. Why should it?

The fact that your new phone is only supported by some of the alternative software but not the one you want to use is no judgement on the manufacturer.

Not every piece of hardware should be supported by every piece of software.

Let it also be known I have run Linux for 18 years, along with various AOSP devices and other funky Linux mobiles over the last 10.

I've been making Android applications professionally for a decade now, and I'm of the opinion that who ever manages the Play store, it's policies and developer relations should be fired on the spot along with at least the next two levels of management below.

It is frankly a burning dumpster fire.

I still don't see why the app is not on any of the other app stores that the author mentions though (only rages about Play and thus the app is only there?)

To be fair, he would be fired if people didn't develop against this environment. People have warned repeatedly that developers make themselves dependent. Money is good of course...

which one is more incompetent as a service company - Amazon, Google, Facebook, or Apple?

I think my ranking would be Google, Apple, Facebook, Amazon, but that is not so much decided via any sort of logical evaluation but only due to my feeling on the matter.

For all the problems Amazon has and causes I will say I've always found their support to be pretty excellent. From what I understand Amazon's foundibg philosophy is focused on just serving the customer at the cost of any other externality and that's where most of the conterversy surrounding them comes from is placing whatever is needed to please the customer above every other concern. But that means when working with them they are pretty great.

Whereas it seems like Google and Facebook view you as a resource simply to have value extracted from and moved on.

As for Apple, well there are no problems you're just holding the phone wrong.

I've personally never contacted Facebook or Google support, seems like a futile effort. I do agree out of all the companies, Amazon seems to have support figured out the most, at least they make it easy for the customer. I had a package that was not delivered, actually pretty sure it was delivered but then stolen (apartment had a package locker so it was the delivery drivers fault).

When I contacted Amazon I was expecting them to talk for a while to determine what happened but no, immediate no questions asked refund. Amazon I'm sure has issues around delivery, but as a customer I could care less if a package gets lost once in a while if the company is immediately going to correct the issue.

Amazon's FBA support on the other hand is horrendous, possibly betraying their more adversarial relationship with their sellers. I was so annoyed by repeated incompetence that not only did I stop doing FBA side projects, but I (mostly) cut out my Amazon shopping and am unlikely to recommend AWS as a first option to a client in future.

Not everyone has the same experiences with Amazon. I guess I've had pretty good experiences with Amazon as a retail customer per se, in terms of delivery and returns, but beyond that it's an entirely different story.

I had an experience very similar to the one in this article, for example:

https://consumerist.com/2013/06/18/amazon-cancels-my-6000-or...

> From what I understand Amazon's foundibg philosophy is focused on just serving the customer at the cost of any other externality and that's where most of the conterversy surrounding them comes from is placing whatever is needed to please the customer above every other concern. But that means when working with them they are pretty great.

I have tried for years to report counterfeits on Amazon to their customer support to no avail. They don't want to collect that data, it seems, despite the severe effects their products can have on customers.

Google is awful. I worked at a company in a now-legal business with a YouTube channel from the not-as-legal days… it has incredibly unprofessional and embarrassing branded footage and there was nothing we were able to do to pull the channel down. (No one currently working there has the login)

I think AWS is the best, but only because you can have a paid support plan, and real humans will reply to your support requests.

I've used Amazon support proper for Fire TV stick issues and a human (via chat) was able to resolve my problem relatively quickly and painlessly.

Agreed - I don't think AWS Support is cheap (but my company pays) but it is good.

Never interacted with facebook in any position, the rest is completely correct.

Google is absolutely trash at support, Apple is quite bad (in store support used to be rather good, services was always shit), Amazon is competent at least.

For the record I had a simple oauth problem flagged by Facebook and emailed with a number of humans there successfully. I'm a non enterprise/paying dev. It felt reasonably okay and quick, as if they read and listened to my responses.

Amazon is also in the easiest position to offer support, since for the bulk of support queries, if all else fails, they can just absorb the cost and refund the customer. The customer is usually not any worse than when they started if they do this.

The money spent on a purchase is fungible. There is no obvious monetary refund to give to someone who can't update their app, got their YouTube channel taken down or got their Instagram handle stolen.

I have the same experience with the Google Play Store. For all the complaints people have about the Apple App Store, at least their reviewers are human and you can discuss things with them. And they block updates but don't remove the app without warning!

My experience with the Google Play store: I get an email on a friday night after working hours stating that the app of my company was removed after a routine check and that I have to follow an appeal process to get it back. (The reason being that we had 2 apps in the store, one for production use and one for training). Only after pinging people I knew working at Google was I able to get my support case prioritized and the app unblocked.

A second time we had our app deleted from the store because we used background geolocation and failed to comply in time with the new reporting requirements. Once again, no warning and no grace period except a generic "Google Play policy update" email 6 months earlier...

I guess we're just lucky to have a B2B app that we can install via APK to our customers' phones if needed.

The number of times I've heard of people only getting support from Google because they know someone on the inside is quite astonishing.

If I were an Google employee looking to make a few extra bucks I'd definitely start offering to help "nudge" account issues for a few extra bucks under the table.

What is astonishing is that despite the scale at which they operate we rarely hear about the problems. False positives seem to be ridiculously low.

Is it really rarely? I feel like I'm hearing about it all the time. The comments in this thread reenforce this feeling. Having to make it to HN frontpage to get support from Google seems also a much too common occurrence.

My assessment would be false positives are way too high and customer support is close to non-existent. And we're hearing only about a tiny fraction of the problems with the majority being stuck in customer support hell.

HM is a bubble with bias against Google. People here seem to believe that bashing this company publicly will somehow change how they operate.

Interestingly enough, back in the day Google used to be a darling of HN community. I suspect folks might be disappointed to see how things turned out at the end.

Well, yeah. I too am in the bubble of realistic experience of having apps repeatedly pulled out from underneath me.

Excuse me for being in that bubble.

It's almost as if over a decade or more if time that people can see the result of behavior they didn't see as problematic initially.

Or that google might have changed how they operate in small ways as they are steered differently.

Expecting any one person to still have the same opinion of any one other person a decade later might be asking a lot. It's nothing strange that a community of people would have differing thoughts on a whole company of people and product and policies.

Google was a hedge against Microsoft which was a hedge against IBM.

The tech world is always running from one monopoly to another.

People should think differently about Google because it is different and now has become the monopoly.

> HM is a bubble with bias against Google.

It seems that way to you because the front pages of Reddit, HN and Twitter are Google's only support channels.

> Interestingly enough, back in the day Google used to be a darling of HN community.

For example, back in the day Google search was useful. Things change, darlings go to the most hated list.

We hear about problems on here all the time... and that's probably about 0.01 percent of the problems that actually happen.

Given the diversity and sheer boneheaded stupidity of the problems we do hear about, there's no chance that they don't have a ton of false positives... especially among apps developed by people who haven't yet learned how to work around whatever stupidity currently obtains. But you can't learn definitively, because they keep changing the stupidity.

After my app got some traction due to a reddit post i made, admob instantly disabled earning for 2 weeks due to "suspicious activity" or something like that.

I tried to reach someone to at least get a clarification...am I not allowed to have a surge of ~100 real users? but there really was no way to present my issue to anyone. It really is bad, there was nothing I could do. If this wasnt a hobby project I would have been really frustrated instead of being just disillusioned.

Its a remake of an old 90s game that is also offline so there is not much risk in it.

I suspect there are a lot of these stories never shared.

It seems to me what people are complaining about isn't the false positives, its the fact that there aren't proper channels to address the issues - and your basically a hostage till someone at Google decides to take pity and talk to you.

This. Reality is going to cause false positives. While you can try to minimize them you'll never get rid of them.

The measure of a system is how they are dealt with. Note that this is not limited to Google by any means. I'm thinking of the police throwing some people in jail as terrorists because they pinged on a geiger counter. Cancer patients, not terrorists. Compare that to what happened when my wife tripped a detector in China. The officials knew it was almost certainly a false positive and were looking for why rather than playing gotcha. (However, I think they went too far in the other direction--it was due to a nuclear heart test, but they didn't even doing the simple test of seeing what the distribution of the radioactivity was.)

Dont worry, google is working hard to make sure that even employees are unable to do anything of that sort. Gather the world's information and make it uniformally unsupported.

This is good. It will tie the fates of small time customers/users to the elites, so the situation gets fixed or the business collapses.

I agree. A process that's broken for everyone gets fixed. A process that can be worked around by everyone who has the power to get it changed can stay broken indefinitely.

Google has many processes that are broken for everyone and don't get fixed. That's why monopolies are bad.

> A process that's broken for everyone gets fixed. A process that can be worked around by everyone who has the power to get it changed can stay broken indefinitely.

OK, but the only processes that are broken for everyone are processes that are mandatory for everyone. Using a different process is a perfectly workable way to get around a broken process.

Agreed. The current state is the most awful for the powerless. At least this change evens the playing field a bit so that when $HUGE_CORP gets burned they will raise enough hell to (hopefully) fix the process.

Occasionally this happens, see Epic Games, and then the $HUGER_CORP has their security teams look for spurious "vulnerabilities" and then uses their PR team to have them dragged through the mud, etc.

Just speculating, but another possibility may be a new kind of business popping up: Google App Store experts who can somehow prevent these problems and/or make them go away.

Similar to Google-SEO consultants, or college-admissions consultants who help rich kids get into universities they normally couldn't.

There is already this service which works to get your Facebook account back:

https://hacked.com/

That would almost certainly violate some contract you signed when you were hired.

Most definitively, but at least people who do not have connections inside of google could stay in businesses. Which speaks to just how big of an issue all of this is.

Oh, I've no doubt that's happening in all the major tech companies.

Amazon employees got caught doing this.

https://www.justice.gov/usao-wdwa/pr/six-indicted-connection...

There could be an app for that -- a clearing house that lets you submit an issue and have it taken up by an employee, with anonymity, for a fee. It could be the Uber for access to insider support.

Stuff like this does happen at the big companies, but it's also rooted out (when you're that big, you can afford to have internal security teams that investigate this stuff) and the offenders get fucked by legal (and fired, obviously). Usually quietly because of the PR damage it would otherwise cause.

Every time I get fucked-up support dead-ends like this now I go to war against the management of that company. I pay to get hold of all the home phone/cellphones/personal email addresses of the highest position employees I can find and bug the shit out of them until one of them capitulates and gets a minion to fix the problem.

I just harassed the C-suite of a unicorn that wouldn't give me a refund for something that wasn't delivered. "We can't give you a refund because FedEx says it was delivered." IT WAS DELIVERED TO SOMEONE ELSE AND THEN FEDEX COLLECTED IT AND RETURNED IT AS YOU CAN SEE IN THE TRACKING LOGS. "Thank you for your e-mail. As the package shows that it was delivered you will need to take this up with FedEx. I cannot help you further with this enquiry." A weekend of texting and emailing the management and now suddenly I have them giving me their corporate email addresses and a promise to have it fixed after the holiday.

I swear I am not a Google plant. I JUST went through the same process the OP did (literally yesterday).

The Play reviewer took down the app because they thought they needed sign-in information to test it (like the OP). However, this was based on a misunderstanding of some menu item in the app - the app, in fact, is perfectly usable without signing in.

I replied to the original email I had received about the problem, and... A few days later, a real human replied that they agreed with my take, and had removed the objection. However, they had found other policy violations, regarding the maturity rating viz-a-viz the app contents (it's a game). They included screen shots, showing that they had not only played the game, but pretty thoroughly, too.

Again, I followed the recommendations to comply (went over the rating wizard) and requested a re-evaluation. This was done a day later and the app re-instated. Done.

I was super surprised about how well the process worked. I even went through the trouble of completing their little support survey with praise. I had been bracing myself for a Kafkaesque nightmare when the app was taken down, considering just how many app updates Google reviewers must be going through on a daily basis, and I'm pretty sure each violation is met with some sort of discussion from the developer's side. Not to mention the reputation Google has earned for support. It goes to show that people have different experiences, and not all of them are negative.

EDIT: Just wanted to add that I don't think the OP's story is particularly egregious either. So Google auto-translates your app title? I guess you opted into this somewhere, at least they don't do this for my app. And I would never assume that Google would sit and hand-translate app titles to every language. And in either case, it actually looks like OP got timely and fairly accurate advice. I must sound like some starry-eyed Google fanboy, but I'm really not, just not seeing it here.

Google did recently update its review process. I was complaining about its previous review process for 10 months at least. It's a little better now.

Previously, an app was suspended without any warning. You even couldn't comply with their requirements neither because they would deactivate access to the app in question in Google Play Console. Your only chance was an appeals request. Your app still suspended in the meantime which could be months. And you might loose all ratings, reviews, and downloads of your app.

My feedback at this time was:

> An easy but important improvement in Google Play:

1.) Don't suspend and remove the complete package id from Google Play, but instead just prevent the specific app update from publishing

2.) If the app update doesn't comply with Google's policies, then give developers the opportunity to fix that

3.) Developer submits a new app update which does comply

4.) App update gets approved by Google

5.) Google is happy and developers are happy

Which might be the case now. At least in Germany.

> So Google auto-translates your app title? I guess you opted into this somewhere, at least they don't do this for my app.

The way I understood it, what they are actually doing is auto-translating the localised (by the developer) title back to English for the purpose of running automated checks on it, and rejecting based on this automatic translation turning a word that implies nothing about price in the original language into the English word "free".

I understood it like you did. She--the author--even wrote that she had translators for all the languages supported by the app, hence the 50-to-30 chars kerfuffle.

>So Google auto-translates your app title?

I mean my reading is that she and her translators hand translate the title, and then Google uses Google Translate to make sure it follows particular rules, and one of the rules it should not say it is free?

>And I would never assume that Google would sit and hand-translate app titles to every language.

maybe the assumption is that they would not autotranslate app titles for the target language of a particular app store. I mean you do understand that the app stores of different languages are obviously not in English? And that there is a very long and funny tradition of translating from one language to English and back to show how things get lost in translation?

At least if they used google translate they should have some sort of tool that allowed you to see if there were some suggested texts that would be less problematic so a reviewer (or bot in this case I suppose) could ask the developer. So that it could say you used the word vrij, which is most commonly understood as free, but there are these other usages which did you intend. Get a result and then run it past a human very quick for an ok / not ok decision. But no, Google translate is good enough.

>just not seeing it here.

I have a hard time seeing how it is not crystal clear.

on edit: fixed missing words.

> And they block updates but don't remove the app without warning!

Epic would like a word.

The key is whether or not your violation impacts revenue. Almost any other issue will not get you the full wrath of Google and Apple. Cut them out of their 30% and they'll act harshly.

And I thought I was joking when I kept saying that Google uses Machine Learning!(tm) for everything...

Edit: on further thinking, the last problem about needing login info for an app that doesn't have accounts is probably due to some poor soul on minimum wage trying to make their review quota for the day.

Parsing text is not machine learning. It's the lack of machine learning thats causing the issues IMO. Because this system just flags everything with the word free in it.

What OP unfortunately missed is a post like this: "Tell HN: You can't add “no ads” in your Play Store app's title"

https://news.ycombinator.com/item?id=29497680

Sadly the feature to filter out apps that have ads or in app purchases does not exist. Probably on purpose.

There are many utility apps with thousand of similar apps, most are garbage filled with ads but then there are a few made without app upselling or ads but until you find those you send a lot of time.

Yeah, I gave up on the Play Store very quickly, and so now it's just F-Droid and the occasional play store install with Aurora. I just feel like that if I need to spend energy either way, then I'm better off spending it in the FOSS ecosystem.

So, the relevant bit from the Play Store policy documents is probably: https://support.google.com/googleplay/android-developer/answ...

That policy seems very reasonable. Is the policy being misapplied here? Hard to say, since it's describing the spirit of the rules rather than an exhaustive list of specific violations. It doesn't seem that anything in the title would be misleading. But the original title is kind of irrelevant; whether the app is libre or not has no bearing on its functionality.

Yeah, once I caught gist of what was bothering them, I would've just nuked Libre from the title and all translations.

Just call it the Card Wallet and be done with it.

This would be practical - but what about companies like "Free Now" that are (at least currently) seemingly allowed to keep operating under that name in the Play store.

Why delete something from the name that is actually transporting information for the user just because Google arbitrarily decides that for this rue the mistranslation comprises a rule break while other apps (with probably bigger marketing spend on Google) are allowed to keep "Free" in the name.

Imho is not the rules per se. It is the mistranslation and also the arbitrary enforcement that reminds me personally of stories by Kafka (the author, not the tech).

If your livelihood is tied to an app in the store being published, you gotta play ball.

If you can survive with or without the app being published, then I'd definitely take a crack at trying to explain to Google what their problem is.

Maybe I missed something, but I don't see how Google's conduct relates to the other app stores, as mentioned near the beginning of the article. Did she leave that part out?

I went through a similar hell getting compliance to use a certain Google API after getting algorithmically flagged. Months of back and forth, with conflicting approvals and rejections. The same automated emails over and over sprinkled with emails from humans who kind of understood.

I will never again use any Google service for business purposes if I can avoid it.

Oof. I’ve had the user account one before from Play for an app that had no user accounts. Apple isn’t much better though - currently trying to argue that asking for user location (when a user clicks ‘use my location’) for a real estate app is reasonable. They are insistent it’s not a valid feature and won’t accept it til it’s removed.

We had a similar experience to the one here: https://dev.to/codenameone/google-play-kafkaesque-experience...

Google is worse than Apple in many regards.

I went through similar hell recently. Google should just sell Google Play at this point.

https://news.ycombinator.com/item?id=29640436

I'm somehow both appalled, surprised, and unsurprised at the same time. Tech companies have a weird habit of jumping into language markets they don't actually have the staffing to properly serve. However, I never expected to see Google just outright machine-translating titles to do compliance checks on.

> After 4 full days of trying to teach Google staff how a dictionary worked

Google's moderation policy is to treat any sort of complicated business situation as some kind of DDOS attack, as if you e-mailed your appeal buried deep within a ZIP bomb. They have strict computation quotas on wetware.

>Title (en_US): "Catima - The Free Card Wallet"

>This proved my theory: Google was using Google Translate to translate the app titles instead of reviewing them with native speakers.

Why would they use Google translate on an en_US string?

It's the same with all of FAANG.

It's now been almost two months since my facebook page of 56k users was hacked, and nobody at facebook seems to give a shit: https://news.ycombinator.com/item?id=29876423

I just gave up and made a new page now. Hopefully the hacker won't manage to claim that one too.

There is a paid service to help you get these back.. O_O

https://hacked.com/

(I guess it is that common?)

$899

Holy c...!

My app has been removed from youtube oauth multiple times because we keep getting different verifiers. We've even had permission revoked after being approved. All we do is use a oauth to get their userid and read their livechat for a chatbot. They just can't get their shit together.

About the log-in requirement, happened to me too on an app with a textbox used for searching (no login required anywhere). I just filled the login form with a sample search and wrote a little explanation. They accepted it on the spot (although I doubt they will ever read it)

Regarding the update at the bottom of the article, I also just got the email about needing to provide login info so they can review my app. An offline game that has no login functionality...

I’ve also had horrible experiences with the Google Play people. Will never consider publishing on that platform again, huge waste of resources and personal time.

Fortunately PWAs are a thing.

The play store review program is there to serve the installing users, not the app authors, so even a high rate of obvious false positives is probably considered acceptable.

>The play store review program is there to serve the installing users, not the app authors, so even a high rate of obvious false positives is probably considered acceptable.

This article should provove that Google incompetence exists and it works in both ways, it blocks good apps and there is no reason why bad apps would get away. I mean code like

if(shity title translation constains an word from illegalWordsInEnglishList) proves there is no super clever AI here but at best a quick workaround , so if quick workaround or shity code is allowed why would you be convinced that the "security" scans are better? (we found that 100% Apple security scans are as bad so I won't be surprised if a Google dev also created a list of illegalAPUIs and does a naive search that clever developers can get around with a bit of clever reflection/dynaimc class or obfuscation)

TL:DR I am not convinced that badly implemented policies and shiutty implemented security scans do not affect the users.

So, how am I "served" by being denied actually useful apps, while I am still offered a vast array of malware and crap?

The implementation of the Play Stores policies for consumers is also fundamentally broken. In my country's version of the Play Store, the number two ranking app is currently rated at 2.6 with multiple complaints of users losing money to an alleged scam.

I’ve read the post, its just how it is with their policies being evaluated by automations and not humans. Nothing you can do but work around them sadly.

I’ve read the post, its just how it is with their policies being evaluated by automations and not humans.

No, it's definitely a problem with the humans. It's just that the humans in question aren't customer support humans. It's Google's engineering humans that are to blame for shipping these poor quality experiences. They might be able to invert binary trees on whiteboards pretty well, but they suck at making an HTML page that explains why their system isn't working for you.

The engineers at Google Play really have got to feel embarrassed at how bad this situation has been over the years. How could they have a conversation with an Android developer that's had to deal with the lack of support?

I see this and think of all the millions of apps that the code controls. I don't know how many do fail validation, but it's clearly not a vast number, definitely under 1%.

Given that they're also clearly training a model for this, based on a large number of inputs and rules, then this is pretty good.

Their end goal is clearly to be able to remove humans from this process completely. Which is good - it's shitty work.

From my point of view as an app customer, this is fine. I don't see apps that fail validation, and there are too many (shitty) apps anyway - more validation is good.

From my point of view as an entrepreneur, I approve. Clearly they can live with a certain level of false negatives, and that makes sense from a business point of view as they save so much in the validation process.

From my point of view as a developer, however, it's a dumpster fire and I'm not going anywhere near it.

I don't see apps that fail validation, and there are too many (shitty) apps anyway - more validation is good.

You've failed to understand your own problem. You're seeing lots of shitty apps. That means the validation isn't working because part of the validation process is supposed to make sure apps are of sufficient quality. So no, you don't see apps that fail validation, you see apps that should have failed validation. That's worse, especially when the same validation is apparently rejecting good apps.

I don't see all the apps that applied. I just see the apps that passed validation. It's totally reasonable to assume that the apps that were rejected by the validation process are worse than the apps that were accepted.

> From my point of view as an entrepreneur, I approve.

Sorry, I don't believe you here. If you were trying to get, say, a loan from the bank you've done business with for years but would only ever get vague replies and could never speak with a human, you'd be rightfully angry. There's nothing special about being an "entrepreneur" that makes this less problematic.

Devs aren't the customer here.

I work in a fintech and deal with banks all the time. We only ever get vague replies, and while we do speak to humans, they're not as helpful as you'd think. I'm rightfully angry. But there's nothing we can do because we're not the customer - we need to do business with them, we can't walk away, so we've got very little leverage.

I find it interesting that people blame the engineers when they're the bottom of the hierarchy. It's their bosses that prioritize their work, decide whether their work is good enough, and decide whether to fix something that's broken.

It's not the individual engineers who decide whether the company will have a culture of helping users and/or app developers, or treating them like resources to exploit.

It's not the individual engineers who choose to have no humans involved in the app review process.

Some engineers are incompetent, yes, but it's the bosses who keep the incompetent folks working at the company instead of finding better people.

Engineers at Google can get a job anywhere. They choose to work for Google despite building and maintaining a substandard product.

Google engineers have a lot of leverage. I refuse to pretend that they can't influence product quality.

Google and other trendy tech companies have a concept called Human Ops.

Human ops is designed to improve and keep safe the mental health of its engineers. They do this by using machines to do all the dirty stuff as possible. Classic example is evil image flagging problems causing genuine psychological trauma, but it's extended now to everything engineers hate like drudge work, customer support etc.

You'd need to convince the engineers that Human Ops is wrong first. Engineers like the shield and the corporation likes the cost cut.

They're choosing to use machines to maintain their mental health by creating a product that impacts the mental health of their customers who get to deal with their revenue streams being cut off entirely, arbitrarily, often with no know reason or recourse. This argument makes the engineers look monstrous, not just mildly shitty.

Google engineers potentially can get a job anywhere but may not want to for multiple reasons:

1) The pay, plain and simple.

2) Google-scale problems are a very specific kind of problem that may not apply to other companies. I'm sure most of the engineers would be competent at dealing with smaller companies' problems, but maybe they don't want to?

The interviewing process already selects for low-level LeetCode-style problems and I guess the ones who make it through must enjoy it. You're unlikely to have a need for those kinds of problems in smaller businesses where most of the work is CRUD and connecting APIs together.

3) At such a large company you could lay back, chill and most likely still fly under the radar while enjoying the money. This might be more difficult in smaller companies who are more demanding.

Google promotes engineers into leadership though. If you look through the board of Google, especially people who have titles like "Head of Customer Success"[1], you usually see they came up from engineering jobs. Google is not a company full of MBAs and pointy-haired bosses. These are decisions made by engineers (or at least former engineers I guess).

Also, it's decidedly unreasonable to assume the leadership at Google are clueless idiots ordering helpless engineers around. There are many layers of management and engineering, and all of them have to come together to get stuff done. At any point people at every level of the org could influence the direction of things like customer success around simple things like an error page. We're not talking about the long term strategy of the whole business that's decided at a board level here.

[1] Slightly unfair to link to someone, but here's an example: https://uk.linkedin.com/in/markpidgeon

I've run into issues with both Google and Apple that were just ridiculous.

One time, Google randomly ceased payment processing for our app. When I reached out to them, the support staff were not at all helpful and said an "account specialist" would be needed and that they would forward the case along. Afterwards, I got an email saying that they would respond in 24-48 hours. After days of waiting, they finally message me asking for passport photos. I send them over, get another "24-48 hour message", and then two days later they reply back saying they want the exact same documents again. Insane! I send it again and mention that I already sent these. They wait two days and reply back that they actually want my co-founder's passport now. I reply back with that. Then they send another "please wait 24-48 hours" message.

At this point, I tried reaching out to friends at Google to see if they could escalate internally for me. A case got created, but two days later I get an email saying that this is something that the Google Pay team manages, not the Play Store team. Apparently, Google's org chart was my problem.

After all this, a response comes back saying "Your account is currently suspended you submitted documents which cannot be used to verify your account details. Our team has responded to you with specifics about what needs to be submitted in order for them to complete our review." Except they hadn't. I responded back about how both my cofounder and I submitted every document they asked for multiple times and answered all their questions to no avail. I pleaded with them to please let me speak to a human about this. After yet another agonizing 96 hours, our case was resolved and payment processing was re-enabled. We were bleeding money at the time and had been paying thousands of dollars a month to their ridiculous 30% highway robbery tax on subscriptions.

While not quite as bad, Apple blocked an app update because the current reviewer didn't like our subscription group separation. The only problem is that the app release in question had no such changes and the subscription group setup had already been approved in a previous release. The setup made sense and used common practices for A/B testing different prices, but the Apple agent we got on the phone with wouldn't have it. They insisted we release an update that would break existing subscribers to comply with their policies. Two bugfix updates were rejected for nonsensical reasons. We went through an escalation channel to get them out. When we submitted updates again, the reviewers magically had no more issues with things they'd already approved in the past.

Forcing a 30% cut isn't even the worst offense of these app stores. There's literally no easy recourse when things go wrong.

Obligatory reminder that a backdoor was added to the Play Store last summer: https://www.xda-developers.com/google-play-apk-replacement-p...

I wouldn't be surprised in the least to find out that "Android App Bundles" were the ultimate result of a secret FISA ruling.

I'm genuinely interested in hearing from people who believe that Apple and Google should have a monopoly on deciding what apps people can run on their phones.

In case of Google's Android, one can still install third party App Stores, even they take away auto-updates and such. Apple is a much worse offender.

In either case, why does anyone think that they should have a monopoly there and why is nothing being done to fight it? Many years ago the EU forced Microsoft to release Windows versions without a default media player or a default browser. Yet, nothing has been done to Apple and Google. Why?

How would you realistically solve this problem? Part of what makes these platforms so attractive to the end user is in fact app curation. Strict control over APIs and power usage, all sorts of minimum standards and mandatory integrations are contributing enormous value to these ecosystems.

I would allow fair competition and let the user choose.

You don't need a monopoly to have curated storefronts. For example, GOG is curated and if I don't like their curation, I can look at Steam or a plethora of other stores.

F-Droid has its own kind of curation, which I prefer to Google's curation; it gives me a decent guarantee that I'm looking at free software, and antifeatures are usually hilighted. However, I don't have to use F-Droid if I don't want to.

So maybe another entity can provide better curation that Google does. And maybe another entity can offer an uncurated store; if users prefer that, it's their choice.

Users are consistently choosing locked down Apple ecosystem over more open Android. How are you going to explain this?

You also need to realise that you’re not an average user. You’re in 0.0001% of the population when it comes to use of technology and your preferences might not reflect the average Joe.

Most phones would quickly fill up with apps doing malware, phishing, spam, crypto mining and DDoS attacks.

> Users are consistently choosing locked down Apple ecosystem over more open Android. How are you going to explain this?

Not true in my part of the world. I don't know, maybe people over there see iPhone as a status symbol? Or just think it's the best phone? Or maybe they trust Apple more than they trust G. I'm glad they can make the choice!

> You also need to realise that you’re not an average user. You’re in 0.0001% of the population when it comes to use of technology and your preferences might not reflect the average Joe.

I fail to see how this is relevant to the discussion.

> Most phones would quickly fill up with apps doing malware, phishing, spam, crypto mining and DDoS attacks.

I disagree. Most users would consistently choose to stick to a locked down store they trust; in your part of the world, perhaps that'd be the Apple store if they trust locked down ecosystems as much as you think. But in a world where the platform's blessed app store isn't a monopoly, they'd have other alternatives to choose from.

A small fraction of users would be tricked into installing malware, but it's not as if they were immune to that right now.

> Users are consistently choosing locked down Apple ecosystem over more open Android. How are you going to explain this?

Anecdata, but of the couple dozen people I know well, 18 or so choose Apple, 1 does so because her husband is an iOS dev and it's the only thing she knows, and only 1 does so (at least he claims) because he likes the locked down nature of it. I usually point out that he doesn't really, because he uses his developer to account to sideload apps onto his device, but for some reason that argument gets nowhere with him. 6 or so of the others do so because that's what their company gave them (either now or in the past). Nearly all of them stay with Apple because they have a big investment now in apps and purchases that they lose if they move. And of course iOS is what they know, and most people stick with the devil you know over the devil you don't know.

But how do I explain this? I think it's a multi variable equation. No doubt Apple is known for quality and deserves this reputation (although the last few years they've been losing this on the software side). There's also no doubt a lot of people who view it as a status symbol. My son wants an iPhone so bad because he doesn't want to be a "green bubble" anymore. He's never even used one, it's purely social pressure. I doubt adults are immune to this stuff either. There's also a pool of people that truly prefer to be powerless over what they run on their device. I guess they are afraid that if sideloading is an option, they will decide to sideload apps from sketchy sources and get themselves infected with malware.

> Users are consistently choosing locked down Apple ecosystem over more open Android. How are you going to explain this?

The choice is not only based on the app ecosystem. I started with Android phones because why pay the Apple tax? They had so many problems I eventually bought an iPhone and never looked back.

As for the "ecosystem", I'm probably an outlier but I'm so disgusted by all the IAP crap available in both "ecosystems" that my phone is basically an expensive portable chat terminal. I have almost no other apps on it.

What makes these platforms attractive to the end user is that they're the only things available for sale down at the phone store. And what makes the decision between the two available choices is what your friends have, or what you already have, or what's on sale, or about a trillion other things that are more likely to be "top of mind" for the average buyer.

I bet not one user in 1000 gives any thought to "app curation" before they choose a phone.

I very much appreciate how freely I can install apps from the app store. I hear about, I install it, I try it out, no worries. Whereas without curation I'd spend twenty minutes making sure it was mentioned by multiple sites or people I trust and doing a set of web searches to check for reports of malicious behavior, and I'd still worry about it, especially about updates. Putting out a good, well-behaved app and then putting out a malicious update that is required for the app to work with the latest OS update would be a common malware vector.

I'd probably uninstall half my apps every major OS update. How often do I use this app? Once a month? Is it worth doing a few quick web searches to see if the latest update is malicious? Nah, just delete it. I can do without.

Once or twice I've had to install a major OS update just a few days after it was released, which would mean no time for other people to discover malicious app updates. What would I do then? Just roll the dice? What if the initial update is fine, but then a week later it's replaced with a malicious one, to catch people who put off updating?

I completely agree with you on the value of curation.

But why not have a setting deep in the menu to allow sideloading unapproved apps? If Joe Block is able to opt in to the uncurated minefield, does that harm you or take away from you ability to enjoy curation?

What if someone else did all of that privacy research and monitoring for you, only it was a set of volunteers, and they did it for free? This is what F-droid does except they verify that apps on their store are clean at the source code level, compile the source code, and then publish it in their app store on behalf of the authors. When I'm looking for an app in the F-droid repo, I only need to wonder, "Is it any good?", because it is at least safe. They also warn you if the app does anything at all you might object to. For an example, check out the page for Firefox below, which at least gives you an idea of the kind of information available in the app.

https://f-droid.org/en/packages/org.mozilla.fennec_fdroid/

At times, Apple has removed apps capriciously out of self-interest and done things that aren't good from a privacy perspective. I trust F-droid to be a more equal an honest arbiter more than Apple since they don't have and reason to do something I wouldn't like. Basically, I'm saying that (in addition to scummy app stores) there would likely also be some app stores that do a better job than what Apple does at protecting you from the bad actors you just mentioned.

I coulda/sorta buy this argument for Apple(though I am pretty sure that is not the main reason people buy Iphones) , but for Android?? Curation??? Hahahahhahahahahaha

I would not mind my apps on iOS being curated by Microsoft for example and some people would probably prefer their apps on Android devices being curated by Apple... or Microsoft or EFF or Mozilla or Signal or say a new community of volunteers who come together just for this purpose.

It could also be that I trust a group of vendors while I don't trust some others as a user. For example, someone would maybe want their Android apps to be delivered by Apple, Samsung and Mozilla... but not by Google or Amazon for example.

The phone makers could still control their frontends and interface of their stores as they please... but to absolutely not allow certain apps from vendors altogether even if the user REALLY wants to install it on their device is a completely different thing (which is the case now as far as Apple is concerned).

Note: In the above examples when I am naming companies and organizations, I'm imagining a world where any of these companies can have hosting service for their own curated list of apps where developers would submit their apps for various platforms and users can add these as sources on their App Store. There could be a chain of trust for new app store source vendor, where a group of third party organizations decide who to give or take away these rights from.

This is exactly the point I try to make but to no avail. I don't understand why it's so hard for most people to see that you can still have a curated app store even if there's an option buried in the menu to allow power users to subscribe to additional stores, or sideload, etc.

If there's any Apple people who think that would be bad, I'd love to hear about it. So far it's been nearly impossible to get an answer on that. At that point the argument usually changes to "just get an Android if that's what you want" or "nobody but you cares about that" or "if you want to sideload just pay the annual developer fee" or "Apple's curation is a lot better than Google's" (which is an entirely different argument I would point out).

> Strict control over APIs and power usage

These are doable with technical measures. Modern OS kernels are multi-user, when implemented properly, their user isolation features are very hard to break. If an OS doesn’t want apps to have some APIs, it shouldn’t expose that API to apps. For instance, Linux doesn’t allow users to pretend they’re someone else, but that’s not enforces by curation, instead the APIs like setresuid() only work if the caller is a root.

Similarly, if the OS doesn’t like high resource usage of background services, it has technical tools to enforce various limits. An easy enforcement method is killing the offending process. For instance, in Windows Phone 7, background audio agents were limited to 15 MB RAM. If a background audio process exceeds that limit, the OS silently kills the process, audio stops playing.

When something is doable with technical measures or curation, technical measures are almost always better because the curation is fundamentally unreliable.

Legislation mandating all platforms to allow for third party app stores to exist with zero functionality/feature penalties in terms of what those apps are able to do (Apple can't gatekeep certain features as only supported by Apple app store apps). I would dovetail this with legislation limiting app store cuts to 5%.

> I'm genuinely interested in hearing from people who believe that Apple

I'm old. I like that I can generally trust installing apps on my phone because Apple vets them. It is one less thing for me to think about.

Likewise, I have young children. I also like that I can generally install an age appropriate app for them, because Apple's vetting process. Again one less thing for me to think about.

On the flip side, I banned the kids youtube app, until Google came down hard and removed ads and started moderating videos aimed at kids. Prior to that, it's algorithm was serving up highly questionable content to kids. Now, I feel more confident letting my kids watch videos on Kids Youtube (though I typically have the sound off...)

But the question is why you shouldn't be able to sideload an app at all. Having a curated store is pretty cool, and you can have that while also letting users install their own apps manually (even with barriers, making it as hard as they like).

Just refuse to buy an IPhone and buy only android phones. It is not like you don't have an option. But for me and a lot of people, apple's walled garden is a feature, not a bug. I don't see why apple should be forced to change it just because YOU don't like it, when it is not like you're forced to have an iOS device.

Apple's stance was (IIRC from my days as a mobile dev--it may have since changed) was instead of side-loading of apps, that there is the web, and people would be free to utilize webapps.

ios Safari puts in place some limitation (sandboxing, constraint device apis) to guard against malicious actors, but it is not curated the same way ios App Store is.

Developers only put up with the curated app store because it's the only option. If there was an alternative, major companies would mostly choose to bypass the app store, leaving it a barren wasteland like the Mac app store.

If Apple allowed sideloading but went out of their way to make it obnoxious enough that everything which could be would still go through the app store, you'd just have all of the exact same complaints about how Apple is deliberately making things painful for users.

But that's not the case at all with Android and has never been. I don't think any of that would happen, the vast majority seems to stick with the default app store, while the rare technical user who wants to sideload has the freedom to do so, everyone wins.

> I'm genuinely interested in hearing from people who believe that Apple and Google should have a monopoly on deciding what apps people can run on their phones.

It’s not so much that I prefer that Apple/Google can decide what I can install on my phone, it’s that I prefer that they decide for my mother and father who click on every ‘accept’ button without reading to just get it out of the way, or my aunt who forwards every facebook scam she encounters and every a-technical person in my life who I would have to bail out time and again if this were not the case.

If there was an option in the settings menu to disable this, would you be worried about your mother and father finding it and changing it from the (safe) default?

Yes.

I'm not actually so sure of that.

Despite the "review" process at Google, my grandparents still managed to infect their Android devices with all kinds of malicious apps (mostly adware).

Interestingly, neither have ever installed a virus on their Windows PCs.

Reply on news.ycombinator.com