Hacker News Reader

Comment by tgsovlerkhgsel | Hacker News Reader

Is this actually true?

"If you write an app for either platform, you have to publish it through the respective walled garden, and you can do so for free—but then it must contain built-in advertisements that provide Apple and Google with surveillance data of your users. If you want to protect your users from that, you must sell the app for money and hand over a cut to compensate Apple and Google for the missing advertisement and surveillance revenue."

I remember back in the early days uploading a free app with no ad frameworks to the play store, and I believe there are plenty of third party ad networks (that I'd assume don't share data with Apple/Google)

View on HN

Anything you get from Google play store is wrapped with Google's trackers. This ensures that Google knows what you are using at a minimum. Then the promiscuous Google Play Services provides even greater visibility as it processes all your notifications. You can check the trackers here. https://reports.exodus-privacy.eu.org/en/

Apple's store and OS is more opaque. Others may be better able to explain their mechanisms.

A small minority of us don't have Google Play Services on our phones and get all apps from F-droid. So he is not referring to us.

As a developer and system administrator I would have added to this piece how costly it is to actually delete data. It is usually far cheaper to store everything even well after it has legitimate use because developing archiving routines and strategies that don't break other things is work that few IT organizations bother with among all their other priorities.

> It is usually far cheaper to store everything even well after it has legitimate use

This is true and one of the key reasons for GDPR. The cost for keeping data beyond the legitimate use needs to be increased.

There is a bit of a conundrum with this issue.

Just last week I went over user accounts for one of my apps and deleted those that had expired for longer than 6 months on the live server.

So, their data is off the live server but still on weekly backups that are rotated out and deleted after 4 weeks. But I also have snapshots of that server that go back years and it would be some work to delete a user's data on those. And other users might need to recover data, so I can't just delete the snapshots.

Wait till you get a deletion request for a specific user... we've had to mount snapshots as DBs just to have an automated query purge their record from the snapshot, delete the snapshot and retake the snapshot.

As a software developer, I feel your pain. But as a citizen, I'm very thankful for the GDPR and similar privacy laws.

Thank you for putting in the effort and deleting properly.

It's not a pain. Regulations are there to be followed and I don't think GDPR is wrong. I honestly would rather set up these systems so that it can be done easily and being compliant with the law and user expectations.

> Anything you get from Google play store is wrapped with Google's trackers.

App bundles are terrible, but if the developer uses apk, the signature makes sure no one, including Google, can tamper with its contents.

"Google Play will start requiring new apps to be published with the Android App Bundle starting August 2021. This will replace the APK as the standard publishing format."

https://android-developers.googleblog.com/2021/06/the-future...

No, it is not true. You must pay to release any app on either store. Google charges a one-time $25 fee, Apple charges $100 per year.

You may release a free app with no advertisements. In fact, that is the easiest configuration, since charging for the app means setting up payment information. And including ads means payment information and integrating ad serving code into your app. It is not "built in" on either platform.

Yet it seems the vast majority of apps include ads.

It’s almost like the majority of developers write code to make money.

But now you successfully filtered most of the people that don't. And there is tons of quality software without a business incentive aside from the fun to create said software. Happens, since part of software development is a creative (non commercial) enterprise. I would write more free software too if I didn't need to pay rent. Of course free software cannot be the only model, but as I said, you won't find much of that in app stores.

they sure do. kinda sad that they mostly use functionality from the foss ecosystem created by the minority that doesn't.

With all due respect to phk, that he has gotten such a basic fact so howlingly wrong makes me wonder what else in the article needs attention.

It's perhaps worth steelmanning the argument here - though technically one can release an app for free, it is generally the case that any app with significant investment (warranting monetization) will take one of the two paths he described, and this describes the majority of popular apps.

This sentence:

  > but then it must contain built-in advertisements

Could just as easily have been:

  > but then it most likely contains built-in advertisements

In a technical article there may be many reasons for simplifying an explanation, but there is no excuse for lying.

I've lost battles with an editor (of a popular publication) that ultimately led to inaccuracies like this creeping in. They just cared about readability far more than truth.

I think the larger context is that you need to pay a fee to upload an app and have it reviewed. If you don't want to shoulder the cost you need to reimburse yourself through advertising income if you want to have it available for free for yourself and your customers.

So I don't believe this is a harrowing mistake...

Also this one:

"There is objectively no reason why Apple or Google should know every single time you make a phone call or send a message, but since their profits are built on them knowing, you will not find it easy to configure your mobile phone to not tell them"

I could see it being true about Google, but Apple?

I recall a recent HN post that showed that in terms of bytes of data, iphones send more to Apple than android phones to Google.

I would also like to see some citations on this. He mentions experiences with Android, but nothing for iOS. It makes me wonder if the author is speaking from a place of knowledge, or just speculation.

In either case it is requiring the users to make an account with the violators, which is a problem in itself.

Any process with enough friction to prevent spammers/scammers also has enough friction to allow government censorship.

Even if governments do end up allowing alternative app stores, I imagine the laws will include some sort of liability clause that means the store owner is responsible for censoring any apps that the government blacklists.

This may not be relevant now, but when Western nations start banning E2EE chat apps and VPNs, I think people will become more aware of what a choke-point the app store model is.

They’ve already bannned truly effective E2EE. Lavabit, TrueCrypt, Skype all RIP. I suspect the new E2EE protocols like signal may secure past communications to some degree but further forward communications can be wiretapped via federal order.

No one seems to care.

Can you explain how a Signal conversation with a verified correspondent can be wiretapped? My understanding was that their safety code would change and you would have to revalidate if anything untoward happened, but perhaps I’m wrong…

I figured an NSL could require Google Play to issue an “update” for that user which was just a backdoored client. Or similarly, require Signal to do something like that. As lavabit was pressured to do.

Truecrypt lives on as Veracrypt

Reply on news.ycombinator.com