I'm partly to blame. I accidentally ran an illegal unregulated money transference service over Google Play.
It let users cash out their Google Play Credits for real cash, which I automatically wired them.
Someone then hacked in to a major bookstore chain, stole piles of Google Play Gift cards, activated them using their access, and used my app to get cash for them.
Luckily, the whole thing blew up on me before I got in serious trouble, rightfully so, and the app was removed by Google, then an investigation followed. A ton of copycat apps popped up immediately after, then a few months months later Google announced their app review process.
A domain is only ~$12/year if you don't buy it through a scammy site like godaddy that adds fake fees or quadruples the cost after a year. WordPress is easy for blogs, or you can just vibe code something in an afternoon if you don't care to have comments. Even embedding forms or an emailing tool can be done statically. Heck, there's probably a free option out there for simple posting that I don't know about.
The biggest costs are not the money, but the work and cognitive load of the thousand cuts it takes to not only bring all of this up, but keep it running, not to mention migrating the content.
However/also, "only" $12 to some is a considerable amount of money to others.
If its a static or client-side website, GitHub Pages is free and allows you to use whatever domain you have already own. Almost all of the websites I run are hosted on GitHub Pages. No maintenance required, and updates are as easy as `git push`.
Having done this for multiple sites, there's still a lot of friction and gotchas in the setup process, and it's also not guaranteed to not break/rot (e.g. have to renew the domain.)
You didn't use the word "just", but I still want to link this article:
When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).
It was risky because I didn't actually receive any money from Google until about a month later.
What you did was money laundering. And big chance for getting in trouble if let’s say ton of credits come from fraud/stolen and then google pays out to you and then crawl back once they realize is fraud.
I’m curious how you didn’t get into money laundering problems.
Technically it was an unregulated money transference service without KYC. The user that stole the cards from the bookstore was the one doing the money laundering part. I just enabled it (which is probably worse, legally).
I was investigated and cooperated fully.
Edit: I just remembered, the bank I used for the transference did do KYC for all users who were sent funds. This makes it more like "money dirtying", since the account is tied directly to a real identity.
This is not laundering, it is in fact exactly as the service was meant to be used. As long as you save where the money comes from and where it goes you are at worst operating a discount pseudo-bank. But that's what google is also doing, so we can infer that this is okay.
I didn't know what a "money transference service" was, and certainly didn't know this service that I didn't know about was highly regulated.
I only created it because I had Google Play Credits that were gifted to me. I built an app to "convert" them to cash for myself. I had never built an app before. I was proud of it and tried to make it pretty and professional and useful for others, and used it as a learning experience. The listing on the Play Store was clear about what it was.
I had to answer questions about what the API was being used for when I signed up for Dwolla (an actual regulated money transference service). I answered honestly. They approved it.
The app sat unused with no downloads for years before someone on Reddit's `r/churning/` posted about it.
Right but... You've used gift cards before right? The whole point is that you can't convert them to cash. Not only that but Google/Apple gift cards are notorious for being used in fraud.
It wasn't a gift card that personally motivated me to make this. It was credits from an online referral program I was gifted. I guarantee I did not read the fine print at that time.
Most people dont read the fine print on the back of gift cards. So I can easily see someone never running into a situation where it’s actually explained that is not allowed face to face.
> You've used gift cards before right? The whole point is that you can't convert them to cash.
This is very untrue - there's a ton of services that do this and while it is against the ToS sometimes, there's plenty of place where ToS of this type are not legal and so you are perfectly within your rights to resell a gift card for money.
Hm, maybe that loophole was closed recently? Definitely used to be a thing, people with benefits would buy something nonperishable and marketable. Tide detergent was the example. That could then be sold for cash, or traded for cigarettes or booze or something that the benefits program would not allow, and resold to people who needed laundry detergent. Everyone taking a cut along the way of course, but hey it's free to start with so who cares?
I went ahead and did a web search on this, and found that I misremembered it. It wasn't that the laundry detergent was initially purchased with a public benefit program, it was outright stolen.
> It let users cash out their Google Play Credits for real cash, which I automatically wired them.
I really want to know what the intended design or use case was for this? This is why people usually only let you turn credits into in app balances right
With Signal, the biggest issue we have is that review times are extremely inconsistent. Sometimes it's 4 hours, sometimes it's 5 days, and there's no visibility as to why. Our working theory is that there's automated and manual queues, and occasionally, for whatever reason, we fall into the manual queue. But when you work on an app that has weekly updates, randomly getting hit with a review time of several days really throws off your groove. And it can obviously be terrible for moments where you're fixing a critical issue.
As someone who also has to deal with the review process on the Playstore, I feel your pain. Reviews timelines have been all over the place for the past year.
I greatly appreciate that I can now get Signal via Obtainium directly from your VCS. It feels like I am sometimes even getting multiple weekly updates.
Has it ever happened where your submission goes to review and then just sits in the "In Review" state for many days? I am talking 4-5 days? or sometimes longer than a week? And then it gets approved?
In the last month, I had to go through the review process twice, and twice I needed to contact them personally after waiting for 1 week of waiting. It did however helped, after every human contact I was reviewed within a few hours.
I got this explanation from them...
> We are currently experiencing a higher-than-normal amount of inquiries and have been unable to respond in the time frame that we would prefer. During these periods of high volume, the app review time will take longer than average, and we cannot currently provide a concrete timeline for when your specific app(s) will be finished with the process
I've had same experience. Brand new iOS apps are taking weeks. My latest all took 3 weeks to get reviewed and approved. Updates to existing apps are fast though (1-2 days).
Also, sometimes, apps will go in review and then just stay in that state for 3-4 days before approval. No idea why.
Well, same as my lack of sympathy for github and their "inability" to deal with "unprecedented AI generated traffic", I dont buy it. Seems really simple to setup an algorithm of "existing app from pre-AI is submitting another update gets put in the priority queue while everyone else gets the shared queue".
I've had Apple approve app submissions within 24 hours. It certainly hasn't been the norm (on average for me it takes more than 1 day, but less than 2), but I've had it happen occasionally over the past couple of years.
This is the reason I never made a mobile version and all mobile users use it in a browser.
The biggest problem (bug) with this approach is that iOS limits the RAM usage to 2 GB per website. I have to tell many of my users to ditch their $1000 iPads and get a used $150 Macbook for better experience.
> This issue is considered resolved. Per the above discussion, there are multiple restrictions at multiple levels that affect different scenarios, so it is not surprising that you are still seeing similar issues.
> Please file a new bug with your use case. Providing a deeper explanation for the need than a synthetic test case would help us prioritize it higher.
This is just shameful. 2 and a half years later, just resolving it like it's been 2 days.
I created a much more basic version of photopea (https://egeozcan.github.io/ketchup/) because I didn't even know it existed. This is very cool and fast!
When I run my website in Chrome on Android (with 8 GB of RAM), my website can get 6.5 GB of RAM.
When I run my website in any browser on iOS (iPad with 16 GB of RAM), my website can get 1.88 GB of RAM.
This much RAM might be needed only for a few seconds (computing a visual effect). A user is "focused" at just one app at a time. If a user uses my tool for hours, I think it makes sense to give them all the resources (CPU, GPU, RAM, ...)
Seems like the solution to the DoS concern is to just limit the site to whatever amount of RAM is currently available on the device - that's what every other browser/OS combination other than iOS seems to do without issue.
Team effort, but thank you!! I've just taken the next month and a half off to work on things full time. I'm excited!
The next update won't be huge, (Google required us to make all screens 'edge to edge'[0], which took up most of my time last month). I'm hoping for some solid improvements now that's out the way, once the release pipeline has returned to normal.
Feel free to get in touch if you fancy contributing.
If you can get your agent of choice to run up the app in an emulator and navigate the whole thing taking screenshots then tasks like edge-to-edge can be pretty hands off.
The way I did it was to firstly get accessibility identifiers on everything. Then have it record everything I do on an emulator to navigate the entire app. Then left it for a while to work out how to actually use the app via the emulator. Once you have this sort of baseline. A lot of changes are really quite pleasant. I often ask for an HTML gallery of screenshots covering a few device sizes as the step before I bother running it on a device myself.
We use Roborazzi[0], which is an excellent screenshot library, but:
* We target minSdk 24
* We're still using XML views
* We target a large variety of form factors
* We have a lot of screens, and these have a lot of configuration options.
I really wish it was "point an agent at it, and walk away", but many screens ended up being hours of iteration with Fable driving my phone/an emulator to produce an acceptable outcome.
Given that my Pixel 9 Pro has system screens which are still broken under edge to edge, it's not an easy change, and takes up time which could have been going towards feature development.
A tangent, but a big thank you (to you, and all other developers) for supporting older API levels from someone with devices ranging from Android 8.1 (BlackBerry Key2LE, at minSdk 27) to Android 16 (BlackBerry "Q25", at minSdk 36.1) <3
E-waste is awful, as is cutting off old devices. We still backport security fixes to minSdk 21.
To Google's credit, post-21 is a much more pleasant experience and requires very little developer time. API desugaring[0] has worked perfectly, their compatibility classes[1] handle most of the common cases, and there's often very little to actually code[2].
I just released a game [1] on both iOS and Android.
The Google Play process is more thorough. There are a lot of steps and you need to clear them one by one. This means waiting several days between each step. The Play Console dashboard is quite well documented to be honest but can be overwhelming. The main obstacle is that you need to find at least 12 testers to play your game for 2 weeks straight. I ended up paying a service to test my app.
On iOS, the process is a bit more obscure. It's fairly easy to submit an app, but then you don't really know what's happening. You can only see a status like "Pending review". And then one day, you are approved.
Overall, the iOS process felt easier for me. As long as your build succeeds and you provide the correct information, your game can be live within a week. The Android process took more than a month in total.
Finding 12 testers was a struggle for my app [1]. Had to use a mix of LinkedIn begging, work colleagues, friends, and people from random Whatsapp groups I was in.
Once you get over that hurdle for your first release, at least you don't have to do it for every update.
The Play Console is a bit fiddly and I'm always getting random warnings that I need to comply with some new rule by an arbitrary date or my app will get delisted.
Released my game a few months back. I generally agree with you, however Apple process was more painful / took longer when you start adding in-app-purchases and providing all the financial info required for that to be approved.
And, as I'm doing weekly updates, I found both stores approving builds typically within 12-14 hours which was a nice surprise
Some reviews are clearly automated, some get a light human review, and some involve a human really looking hard. New apps seem to get a more rigorous human review for their first 2-4 submissions. Or at least humans looking over automated test screenshots etc. One reviewer apparently only looked at screenshots because they missed something that would be blindingly obvious on the prior screen if they did it themselves.
The explosion in LLM app development has clearly created a bottleneck at the human review steps. Not only delays but much more “dumb” rejections from likely over-stressed humans.
Yeap latest CoMaps update took ~16 days to review (the longest wait for us so far) and two support tickets (submitted first after ~9 days and got "we have expedited it", 5 days later still in review, so submitted one more ticket).
Before that we had a hotfix update (a very small change) and still it took longer than a week and a support ticket (after which it had been approved in a day)...
Maybe I'm just incredibly lucky, but my reviews on Google Play take roughly an hour and appear to be entirely automated. My initial review was about a week, but everything after that has been 1hr. My Apple reviews are still around a day and my initial review was one month. The Google process is painless and is almost as easy as a web deploy, the Apple process feels much less certain that it will go smoothly and Apple actually regularly opens the app even months after release. This is presumably to check for problematic UGC, but feels rather unnerving.
Google just seems to fly through and fill out a bunch of forms (we had to include a condition where if the google tester credentials logs in, we switch the app to the staging API). And then it's live within the hour.
MAYBE operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all. Apple and Google are WELL past due for regulation in this space. The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
And before someone says "well akshully you can technically do it on Android," Google has been working tirelessly to make it as onerous as possible for both developers and customers. For example, users need to separately authorise each app (browser, files manager, alternative store, etc) to install an APK from outside the Play Store. Google also does background scans using "Play Protect" which will periodically delete apps Google doesn't approve of. This happened to me with SmartTubeNext. I have a dozen other ways Google ensures users are discouraged from stepping outside the Play Store.
And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
I'm not saying we have the perfect system but anything that slants the system towards "easier downloads" or "less gatekeeping" brings large, obvious risks. I don't see how regulation would address them.
We already had enough proof of vulnerabilities in the OS code and Manufacturers (eg. Samsung/Lenovo/etc privileged apps), there were enough reviewed apps that were used for fraud or access as bad actors.
My banking works in my 'unprotected' computer browser. So I'd expect giving anyone equivalent freedom. I don't mind if there's a default for gate-keepers as long as they allow competition. but I would expect to have same freedom on my mobile devices as on my laptop.
Just because there are known vulnerabilities don't mean we should drop other security features, this is the opposite in fact. Defense in depth, an OS-level vulnerability cannot be exploited if the attacker cannot access that part of the OS.
And like it or not, the Play Store approval process is a security feature. It limits the ability of bad actors to run code on your phone and access data or exploit vulnerabilities they wouldn't be able to otherwise. Some get through, but it makes their life harder, again, defense in depth. Something can be both an anticompetitive practice and a security feature.
As for banking in the browser, you can, but your bank probably doesn't like it. That's why they are pushing for browser attestation, or to force you to use the app. The banks would rather take that freedom away from everyone rather than giving it to everyone. And I suspect they do it for good (as in profitable) reasons, fraud costs them, it costs them more than what they would gain by being more open.
If we want security features and freedom (which is the harder option), we need competition. If Google and Apple are the only players besides an insignificant minority, it is easy to lock software to these platforms, screw that weird guy with his Linux distro. Legislation is another option if the first one fails.
We should have web installs by now. The only reason we don't is because Google and Apple like cash and their little monopolies are easy money.
Big tech loves to "protect us". See Anthropic and OpenAI worried about intelligence.
Google doesn't care that its AdSense ads marketplace is flooded with malware. Or that YouTube is rife with scams. Wonder why not. The blatant policy contradiction couldn't be because money, right?
I believe people in HN also remember the days before we had MMUs.
And I'm sure everyone remembers ransomware.
No one is saying OS shouldn't have security measures, permissions/entitlements and app sandboxing, user land, etc.
I still don't understand why my desktop/laptop is allowed to be 'owned' by me. but my iPhone is a closed-gardened where I'm just a guest in a device I own. and that's nearly what Google is now doing.
> They were a massive issue before, and now they're barely a thought for most people.
Even on desktops... where there are no such review processes. Apparently we've found other mechanisms to reduce those issues, without app stores everywhere.
They're still very much a thing on desktop. You're not wrong that Windows got better at protecting itself, but I suspect the reason you don't hear about them is just that few people use desktops anymore (other than developers who, for obvious reasons, are typically less prone to be infected).
Anecdotally, at least once a month for the past several years, I notice a youtube channel in my feed get hacked. Their usual content gets replaced with crypto, Roblox, or Elon/SpaceX spam. Big channels, small channels, it happens to them all.
There's usually a post-mortem when they manage to regain control. Every time the infection happened through a virus attached to an email or by following a link on their discord.
This kind of attack simply cannot happen on mobile (unless your phone is rooted and you have disabled all warnings).
I didn’t write the previous comment, but I think the point here is that there is a long-running trend aiming to protect users both from malicious intent and to a certain extent from themselves.
In the past, viruses had it easy to infect and spread computers because of both inattentive users clicking on mails claiming someone loved them, and the default access mode for any user granting them admin access.
Even though review processeses generally do not exist for computers, they are part of that same trend.
And outside stores we have Windows’ UAC and Mac’s annoying-but-understandable “this dmg is sus” dialogues. Granted they are review processes but they’re often what keeps common users from wrecking their devices.
2. still review apps uploaded to Google Play, but don't force users to use Google Play
If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
But the motivation here isn't just security, it's control. Google doesn't want anyone to have an Android device that is independent of Google services.
> If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
So this doesn't solve the issue pointed in the OP.
> don't force auto-updates
I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
>So this doesn't solve the issue pointed in the OP.
Yes it does. This is their point:
> The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
It should be as easy for me to use an alternate storefront - or download directly from a site - straight to my phone. The googleplay store, which is (somewhat) curated and (generally) "safer" can also exist. I, as a user, get to decide which path I want to take. This is literally no different from my desktop and laptop, we already live this life. MacOS allows me to download .dmg files and install (though they are admittedly getting increasingly annoying/friction-y about it) at my own risk. Why should my phone be any different? It’s a small computer. That’s it.
It’s about user choice. It’s my hardware, so I can do with it what I want so long as I’m not using it to inflict harm on others.
I mean, probably not technically due to some EULA you were forced to sign which says the hardware is actually Google/samsung/etc and not yours. Giving them the right to brick your phone the moment you step out of the bounds they define.
We really need some sort of open firmware legislation that mandates manufacturers of computer components need to opensource their drivers and firmware. There's no "special sauce" in that software that warrants a company being able to keep it secret. It's literally just so they can force you to purchase new devices when they get bored of supporting their old devices.
Agree, what I'm saying is "it is mine and we should treat it as mine, same as my laptop/desktop." We both agree the current status quo is not that, I'm saying what it should be.
> I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
this is identifying the tension yeah, but if a review process regularly takes weeks or months, then the security patches are still missing
If libraries didn't exist could not be created today. People tend to say that "it is impossible" when it actually only needs to be well organized.
Splitting git tech-monopolies it is a survival need. Or we do it, or we will end up with a collapsed society. Entities that spy on all citizens and gatekeep access to news and services are contrary to basic human rights and democracy.
MacOS has been moving to a more locked down model over the years - increasingly difficult to install unsigned applications, SIP, etc.
> Windows
I think Windows is incredibly impressive for its ability to run binaries from many years ago, but I don't think there's much people would point to as a positive regarding Windows’ approach to app security.
How about treating people like adults for a start? How about starting public awareness campaigns about proper digital hygiene. Not everything has to be nanny state garbage.
I don't know. Literally every single person I help with tech support makes me doubt this is possible. People do not care in the slightest and treat suggestions to learn basic digital hygiene as if you've asked them to a computer science degree in its entirety.
Even super basic stuff like remembering a single secure password instead of reusing the same 2 or 3 basic initials-dob-symbol permutations that were probably pwned 10 years ago seems insurmountable.
IMO in that case its their own fault. After all they have free will and can use it against their own good if they so choose. Let them get pwned a few times and see if they learn.
that's so dumb on so many levels... should we strip cars from active safety measures and let drivers who are not super good at driving just kill themselves on the road?
I agree, but what I disagree with is the idea that everyone must be prevented from freely installing software on their own devices to make sure unskilled people cannot be tricked into doing it.
I don't really understand why a well designed sandbox and permissions system doesn't solve the problem.
Well cars kill people, granny using the password “password” does not. We can’t prevent all levels of stupidity and carelessness.
If people want to have dumb passwords and download malware, then so be it. You think they can’t do that today with the google play store? Of course they can. Most malware on android comes from the Google play store.
maybe there should be alternatives to using the smartphone for everything, personal finances included. my bank stopped offering a home banking service for example (yes, of course the mobile app still sucks), and it's a trend.
I've worked with dozens of businesses over the years and you can't even get businesses with real money and consequences on the line to follow basic security practices. My current project is updating dozens of windows domain controllers that are still on 2012 R2. Aka critical infrastructure that hasn't been getting updates for years.
At some point computers need to stop being treated as magical boxes that no reasonable person can learn how to use safely. We expect people who use cars to learn how to use them safely, we expect people who use lawnmowers to not stick their fingers in them. Computers have been a part of daily life for normies for decades at this point, it's infantilizing to suggest that average, non-tech savvy people can't learn to use (not necessarily build, repair, etc.) them properly and need to be protected from them.
People have to successfully get through a state exam in order to drive cars in first place, can be jailed, get fined when not driving them safely, or forbidden for life to ever drive again.
People that accidentality cut their fingers in lawnmowers due to lack of safety features are allowed to sue the lawnmower company.
What I would agree is that it is about time computing gets the same liability laws that the rest of the world already has in place and no EULAs that work around local laws should be considered valid in any form or shape.
Do you hate open source and want only projects where their authors can afford liability insurance and are willing to put themselves in the firing line of a legal system that can be both arbitrary and capricious? Because that’s what you seem to want.
And that’s how you prevent bake sales, lemonade stands, and more. You create a barrier to entry that gets raised little by little until only the biggest players can afford the game. Software liability would end all small open source projects.
Bake sales and lemonade stands are perfectly fine as long as people don't land on hospital urgency, due to careless work on preparing them with spoiled ingredients or lack of hygiene.
Now do that again without careless work or spoiled ingredients. Do you still want them punished or facing so much regulation they can't exist? Because you'll definitely get that with software; even really good development will have flaws, and single flaws can lead to a thousand or million hacks.
I dunno, people seem to accept most kinds of tool being fussy or flaky.
But the special thing about security flaws is that they turn a one in a billion error into a guaranteed attack. It's moderately hard to make something that doesn't feel buggy, but ridiculously hard to be secure. If you hold to the standards of a bake sale it's the former. If you want full security then nobody releases anything outside very strict contracts.
The problem is it's literally speech. Selling something isn't speech, you do not have the right to do charity work or run a business. It goes even beyond speech, it's closer to pure math/logic and I feel very uncomfortable about regulating that. I also think it's literally impossible.
On power tools, appliances, etc. the safety features are at the user's latitude to bypass. They are usually a hint (don't microwave your dog), not a hard barrier ("I'm sorry, Dave. I'm afraid I can't do that"). A spinning blade is covered by a grill you can trivially remove without permission from anyone.
I agree that the defaults should be secure, but you can't force security on people without creating parallel issues which are maybe worse. Centralizing this power in a single point can have orders of magnitude bigger blast radius than a security failure on an app.
At some point users have to take responsibility and be accountable for their actions. We can't just infantilize them forever as if a magical hand will always be over them protecting and having their best interest in mind. And we certainly shouldn't punish every user for the sake of some of them.
The worst part is that Google gets the benefit of putting itself as the central point of control over the ecosystem based on a promise to keep users safe, but without any of the liability from failing to keep that promise. When the app store is chock full of malware I'm really starting to suspect that their goal is actually only the control. And all those people defending it with "but people don't know better, they need a hand to guide them" were equally misled. What do you think?
The amount of "Do not put hands here" labels I've seen on lawnmowers would suggest that, yes, someone did sue and win (or at the least got a settlement) and thus the lawyers forced the companies to put disclaimers and warnings on the lawnmower, directly on the top of the deck in plain sight.
The computer itself won't really do anything. But I'm sure suicides go up when people lose all their money, or get personal private details leaked, and so on.
> "One [software fault] was when the operator incorrectly selected X-ray mode then in 8 seconds quickly changing to electron mode, which allowed the electron beam to be set for X-ray mode without the X-ray target being in place"
Therac-25 is an important software-development case study but a torturous stretch of "Using a computer wrong"
The endpoint safety problem obviously applies to me and every person connected to the World Wide Web, but the grandparent was talking about The Olds who install the AskJeeves and the Yahoo! toolbars and Bonzi Buddy and...
If computers aren't safe enough that a reasonably competent user, who doesn't open random files they found online and obvious spear-phishing emails, can't use one without losing their 401k, then maybe we need to just reevaluate modern life and go back to bank tellers.
And e.g. browsers cracked down on it, removed toolbar support and powerful add-on support AND enforced signing meaning everything goes through their gatekept extension store and these problems still persist (e.g. addons changing the search provider, new tab page or homepage). Locking everything down does not help.
Is that true - do you not see significantly fewer of those installs on random PCs now than you did years ago? And that's even with the current situation not being what I'd call fully locked down.
A problem that can't be solved, you can't check every single program out there much like you can't check every single human ever even with cameras installed everywhere.
20 years of being tech support for countless family members and acquaintances says that nothing can possibly make people care about "digital hygiene". An iPad, Chromebook, or similar inflexible device is perfect for most people, and marketing more flexible devices to them has been a mistake since the beginning.
You expect people to treat devices with respect and responsibility? The VAST majority of people use their phones to stream an infinite sequence of clickbait, ai slop, and conspiracies for 6 to 8 hours a day.
I wonder if people would be happy replacing the "Google approves developers" system with a "government requires your ID and address on file so you can be held liable for your apps" system. I suspect not.
If you don't agree with a decision made by your government, you can vote for someone else next time.
If you don't agree with a decision made by Google, what do you do?
The people I vote for never win. Am I really any more empowered with the government than I am with Google? At least with Google I can de-google my life (with some significant losses of convenience, but it is doable)
Personally, I find it easier to live with a decision I don't support if I was simply out-numbered in a fair vote, rather than out-powered by some random company on some random continent.
As for doing without Google, I'm kinda doing that myself (using a Linux phone even). But tbh, I think that nowadays moving to another country to escape a government you fundamentally disagree with is easier than moving away from Google.
The only part that would really be novel is the liability.
I would be shocked if you could publish an iOS app without Apple being able to tell the government who you are. Less because Apple cares and more because Apple requires you to pay, which is very hard to do anonymously for something like this (I’d bet the options they offer are effectively “credit card only”).
The app stores are neither necessary nor sufficient to curb malicious software. Conflating the centralized app stores with safety is a mistake that only serves the gatekeepers.
Just because something is not perfect that does not mean it's worthless. Most things security things operate this way where it's impossible to stop all malware or attacks.
When analyzing whether something is a net good for society, I look not only at the value it brings, but the cost that it brings. The mobile ecosystem normalizing the idea that the vendor that sold you your everyday computing device is the sole arbiter of what can run on that device is of enormous cost to society, but anytime anyone brings that up, there's an immediate retort bringing fear, uncertainty, and doubt about software obtained outside of those centralized silos.
As I've said countless times before, the answer is clear. Operating systems can install software from repositories. The vendor of the operating system can provide a default set of repositories. Third parties can also provide their own repositories. Device owners can choose what repositories to install software from.
Saying that there can only be one true repository is carrying water for trillion dollar companies to further extract money from their customers.
We could force Google to operate its app review service independently. Users could use it and pay for it, or alternatives. Currently Google forces everyone to use their own mediocre service and pay for it without knowing exactly where and how much you pay.
> And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes.
Clearly we need to regulate the kitchen knife industry more. There should be a central authority that sells authorized kitchen knives with at max 6cm length and all other knives should only be available to certified chefs.
Once we have outlawed the longer knives and strong restrictions on ordinary kitchen tools become normal we should just outlaw knives altogether. You can still hurt yourself with a short knife. Only chefs should ever be allowed to own such a dangerous tool. Just buy or order readily prepared food. Why would you do this weird nerd thing called cooking anyway? Just choose from the official list of allowed foods.
The idea that we have to prevent people from being in control of their own computers — that's what a smartphone is — is deeply dystopian and authoritarian.
> People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes
People are rightfully nervous when they see someone walking down the street swinging a knife i.e openly misusing it or treating it casually
People don't realize how much software is being misused or treated too casually. They might be similarly bothered by lax security on databases and data leaks if they realized that it represented a threat to them
Yes, hold people accountable for their actions. Don't take away their freedom. We may prohibit individual actions that involve a general tool when they harm others. That is compatible with a free society. We may not prohibit fundamental tools¹ That is fundamentally incompatible with a free society. Especially when that tool forms the infrastructure for the flow of information and free speech.
How about the same thing we do when companies leak half-the-nation's personal data twice a month. Nothing.
When companies get hacked and millions lose their personal data, nobody cares. When individuals get hacked, it's a major issue that justifies locking down consumer's hardware to protect them from the burden of controlling their own devices. See how that works?
> "Apple and Google are WELL past due for regulation in this space."
There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores and external payment methods. It also prevents Apple from playing anti-competitive games with App Store rules, like banning hyperlinks within apps that could be used to allow the user to make a payment elsewhere.
The current US government won't do anything to follow suit, but hopefully a future one might.
> There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores
So does that mean:
1. People in the EU can continue to use F-Droid etc. exactly as they have in the past, permanently? No Google verification of developers needed?
2. People are free to install apps from any APK they choose?
The EU is not interested in liberating phone operating systems because it goes against their digital wallet push which forces everyone to use an attested, Google/Apple sanctioned device and operating system.
The US government acts here in favour of a monopoly market. Trump violates free market principles; quite interesting how Trump works against core capitalistic means, in favour of personal corruption.
A weather app could be asking for your location to give you more convenient local forecasts.
It could also be asking for it to help advertisers build a robust behavioral profile about you.
This is not a systems permission, nor is it something that billions of users can judge the ramifications of each potential privacy impacting decision. Privacy is a systems property, not a technical property enforced with ACLs. ACLs can only keep the door from being wide open, they can't prevent access which has been granted from being abused or help the user understand ramifications of granting access.
We need privacy to be a regulatory concern with actual enforcement via an international framework. Until then, it is a business concern of Apple/Google - because they are in the business of having consumers feel confident that a weather app isn't reporting their behavior to anyone willing to pay for it.
> operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all
This is exactly why I use a GNU/Linux phone that runs a desktop operating system with no artificial restrictions. Debian repositories are good enough to save me from malware, aren't they?
I am on an Android 10 system... gate keeping wasn't this bad during the Android 10 times...so i fairly use software stores like f-droid... simpmusic is one app I use frequently from f droid....no application so far has been deleted automatically.
I guess Google has been upping the gatekeeping with newer systems as they come out
Back in early 2000s, pretty much all Windows machines were infested with malware.
Do you want to bring back those glorious days?
Back in the day users didn't really have much valuable and sensitive stuff on their machines and malware was rather benign - just sending spam, not trying to fuck up that specific user. Could be a bit different when it's a smartphone user depends on.
The reason that modern computers are no longer filled with malware has nothing to do with completely irrelevant locked garden app stores on phones.
The reason is because Bill Gates put out a memo because it was fucking embarrassing that you could trivially smash the stack on default open API endpoints for services that consumers never used and shouldn't have been trivially routable from the open web in the first place.
Meanwhile in app stores, you don't have to hack anything, because consumers just download your botnet software willingly and directly.
42% of all apps on LG smart TVs turned your TV into a "residential proxy" botnet participant. 30% on Samsung TVs. There is no "hacking" in the world of apps because it's completely normalized for whatever app you build to also for some reason include remote control functionality from like 6 different companies. All of those apps pass review no problem.
People still can install/run whatever they like on their PCs, so why further restrictions needed or am I missing something? Also, further restrictions doesn't seem to work on the mobile/TV market where actual malware still infects iOS/Android/TV devices despite all the "hops" that it has too go through.
Code signing with warnings about non-signed apps is enough
I remember in Bitcoin community ~10 years ago, standard recommendation was than an iOS wallet was secure enough (I don't recall even a single case where wallet was stolen via malware), but any private keys on Windows were strongly discouraged, as most cases of stolen wallets were on Windows.
I'd say popularity of iPhone shows which way people prefer, but you do you - what prevents you from voting with your wallet and buying a Linux phone?..
Your complaint about Android .apk install is... similar to unsigned software installs on Windows in some cases (not a great argument, I know, but the same as the vast majority of users would be used to).
As for SmartTube, their keys were compromised. Inconvenient, but it wasn't about hostility to self-installed applications.
Key compromise sucks and is hard to protect against. That said the Apple/Google app stores are also full of scams where people lose a lot of real money:
This is the first time I've seen a complaint about giving permission to an app to install another app. The SmartTubeNext issue was due to the developer's keys being stolen. If you want to keep an app signed with stolen keys, you can disable Play Protect. If Play Protect uninstalled apps that Google disliked instead of apps with known vulnerabilities, people would mass disable Play Protect, which would defeat its purpose.
Web apps can't fully replace native apps. This would be a bandaid fix, we need a fully open ecosystem for apps, like what is available on PCs. Native apps can run offline, they can be much more deeply integrated into the OS (you can't have a web app Android launcher, for instance), and they have a performance overhead due to having more layers between them and the hardware, which is important for games or anything complex.
Web apps can run offline. Google could figure out web app android launchers if they wanted to. The performance overhead exists but is slight. It doesn't matter to 90+% of applications, including many games.
I have high hopes for the Rust UI ecosystem in this regard. It's implementing pretty much everything from scratch, which means that it should be able to support a standalone GUI ecosystem that doesn't depend on a system GUI toolkit being available (while also being able to target existing OS's).
Anyone can put up a PWA. The only org that hates this is Apple.
The complaint is about a shared resource, which would require governments to adopt open source policies and _pay_ for it just like they do the post office.
How are iOS users not able to use a PWA? Because it takes a few taps to add it to the homescreen? I have several PWAs on my iPhone and I can use them quite well.
it is significantly more complicated - especially for the average user - to install them than on other browsers. other browsers also let developers ask the browser to prompt the user to install the app.
This is all documented in great detail in the links i shared
Open Web Advocacy's goal is Chrome on all platforms, which just means the Play Store problem gets even worse. The moment OWA wins, the open web dies. These are people with a truly bad astroturfy goal, clothed in charitable nonprofit status.
Paradoxically, as long as WebKit is mandatory on iOS, the open web is safe: Websites have to build for a lowest common denominator standard instead of building for Chrome proprietary APIs.
Security at its core comes down to trusting the supply chain that provides the software that runs on your hardware. There are many alternative secure supply chain models, but ultimately users often are incapable of making great choices on what is trustworthy. It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.
Comparing phones to PCs isn't a great comparison because PCs don't have a great track record and the amount of personal data and ease of installing lots of apps is quite different. Of course the current arrangement is far from perfect, but acknowledging the problems it's trying to solve is an important step towards trying to find a solution that is better.
The Google Play review process has been slower and more painful than the App Store review process for 5+ years at this point. At least you get to communicate with real people at Apple; it’s all bot-driven with Google.
Strong argument in favor of web vs native apps. If you need bluetooth on iOS checkout the web bluetooth iOS safari extension i've been working on recently: https://beacio.com
Yes, a truly Open Web is the solution that we need. It already works everywhere with a single codebase, and is more secure and private than native apps.
But Apple prevents that by forcing all browsers to use terrible WebKit on iOS.
Note that Alex Russell is a Blink partisan, currently supporting Blink at Microsoft and formerly having done so at Google. Folks like that don't take kindly to the idea that a Blink monoculture might not be a great thing, and definitely do not share the opinion that it's critical to the open web that Apple not cede the open web to Blink.
Remember, Blink began as Google's 2013 fork of WebKit. They've embraced and extended it, but thankfully the "extinguish" step is taking longer than they thought. This makes the "open web, as long as it's my engine" people upset.
Safari's PWA support is not as complete as Chrome's today, but it's as good as Firefox's support and perfectly capable of supporting rich, standards-based apps. https://pwascore.com/
The fact that your "argument" rests upon baseless ad hominem, I'm mostly inclined to not even respond.
I'll simply say that if you bothered reading anything (let alone objectively), you'd clearly see that no one is arguing for a blink monoculture. They're arguing for allowing everyone to choose whichever browser and browser engine that you want. Safari included.
The math isnt mathing on that site... And, no, safari is NOT capable of PWAs - which is the primary point of contention (not obscure APIs, though safari generally lags in all of that as well). They deliberately hobble PWAs and make them very difficult to install.
edit: also, your site is just obviously biased/poorly done, because there exist many better comparisons of web features, which show how vastly far behind Safari is, often even of Firefox. This is unsurprising given your chosen style of rhetoric
It's not ad hominem since I'm critiquing their position, not their character. Their positions are public and well-documented, which is why it's important to point out the bias of what you linked to.
> And, no, safari is NOT capable of PWAs…
Incorrect, see my link. PWA installation on iOS is simple and idiomatic, and the same as it is for all websites: Share > Add to Home Screen.
It is rare that someone voluntarily exposes their lack of insight and integrity so thoroughly... Kudos..?
your argument amounts to "this person is incapable of being objective, let alone decent, because they work at xyz". Moreover, you literally didn't address a single thing presented in either link that i shared - which directly refute your nonsense. Pure ad hominem, and worse.
You are not a serious person if you think that PWA installation is "simple and idiomatic on iOS". It is buried multiple menus, taps, drags etc... deep. Most chromium browsers present a button right in the address bar or at least conspicuously in the main menu. Moreover, they allow developers to ask for the ability to prompt users to install the app.
> edit: also, your site is just obviously biased/poorly done
If you can offer recommendations for data-based improvements, I'd sincerely appreciate it! It was made without any concern for Safari "winning", as is probably obvious since it has the lowest score. Methodology described here: https://pwascore.com/about
The math is correct, see /about for methodology and this summary from the "How Scores Work" panel.
About PWA Scores:
• The main score shown is weighted for feature importance
• Only stable (non-experimental) features are counted
• Tap or hover any score to see:
– Raw scores (simple % of supported features)
– Experimental feature scores
background capabilities is 0 for all browsers. there were other weird inconsistencies as well. We can completely leave to the side that your weighting scheme is surely arbitrary or perhaps even biased.
Because they're experimental. Since that's confusing even with a key, it may be better to hide experimental features/categories by default.
> We can completely leave to the side that your weighting scheme is surely arbitrary or perhaps even biased.
Hover on any number to see both "raw" and "with experimental/non-standard features" scores. If you do this to the overall score, you'll see that Firefox benefits the most from this.
True that. Apple has strong economic incentives to nerf PWAs, and I don't share their privacy concerns about web bluetooth. If anything, forcing users who need bluetooth to install shady third-party browsers creates way more risk. Based on beacio's download numbers, quite a few people would rather have web bluetooth available in their default browser.
If you know how many get rich quick guru online are teaching people vibes code and submit apps and faceshift to other apps later, you won’t be surprised the App Store model is no longer sustainable.
Part of the value of F-Droid is the curated distribution model that hopefully catches the worst behaving developers that think they have a god given right to your data though.
Yep, I always expect 2-3 months to get an app onto Samsung TVs and those are just variants of a white-label base which already passed their QA multiple times. LG is even worse for the initial review but they accept redirects to hosted apps so at least there's no need to ever deal with them again after launch.
I just pulled a PWA app off the app store and I am going to keep it a pure PWA. It's installable, offline-first. I know I feel like I'm swimming against the current but I would love people to try to push for awareness of PWA installs more.
I'd love to see people distribute their apks directly.
Itch.io is an option for people who don't want to set up a site or handle payments. While they focus on games, they're cool with distributing non-games:
I personally have a TrustedWebActivity. Most update doesn't need a review because I only need to update server-side. Behave like a PWA while being an Android App. (And you can implement Android Auto, other native stuff)
It allows the users to discover my web app through the Google Play Store.
My app was also available as a PWA but I mostly push the TWA currently.
FWIW, this has not been my experience. Google Play usually approves within 24 hours for me still. Apple has been taking over a week though.
When Shopify announced their shift from React Native, this is actually what was on top of mind for me. Week+ delays for critical bugfixes is insane. Being able to patch things with OTA updates is tablestakes at this point.
Do you happen to live in a country where your government departments are known for rapid processing? (not weeks of delay like we're talking about here).
I generally see my legal system create severe delays (regardless of how much that victimises or costs everyone involved)
> I generally see my legal system create severe delays
Better a delay that getting your account closed without recourse. But you are right, years of conservative governments have starved the government and its services are slower than they should around the west world.
Not sure how it works behind the scene, but our app (present on the store since 2018) is taking a couple hours at best with Google, and usually less than 24h with Apple.
Very much likely an automated triage based on code change or complexity.
Could this be partly caused by the explosion of AI-assisted app development?
It feels like almost anyone can now build an app and get something publishable within a few days. If the number of submissions has grown significantly, it would make sense that the Play Store review queue is getting longer.
AI may have made building the app much faster, while unintentionally making the final step slower for everyone.
Personally, I think the review process should prioritize updates to apps that have already been published for a long time over completely new apps or apps that were only submitted recently. At least that would make it less painful for established apps waiting for a routine update to get through the review process.
Making Android apps was my introduction to publishing software. I remember in ~2011-2012 you could upload an APK and it would be published immediately and the Android Market had a "New" page which was just a chronological feed of recently published or updated apps. Just uploading your app update was an easy way to get ~500 free downloads which I found very exciting.
At the time I couldn't imagine paying $99 for an Apple Developer account and waiting a week to publish my app...
I started coding around 2013, picked up a book, learned Java and started building Android apps. It was fun at the time, and pretty painless to get your app in the store.
Fast forward to last year, with all the rage about coding tools, I got into building small projects again, and built a simple app. After a decade from posting my last app on Google Play I resurrected my account, and started going through the process of publishing an app today... And how awful things got!
Back then it was essentially, title, description, upload your Apk and some screenshots and you're done! Now there are reviews, privacy policy, endless amount of forms and information you need to fill out. I get why (some) things are the way they are today, but when you just want to make an app for fun, getting it out there just feels like work. I gave up on the app, made it into a website, and in the end it actually felt better (and so much easier).
This is one part where it should really just be done by AI for 99% of the cases. Just have a security focused AI model that is biased towards flagging things a bit more conservatively.
Only apps that get flagged by the AI reviewer then have to go through a separate, slower human review process.
I believe the App Store has switched to automated reviews, at least for updates. I've had my app updates approved in <1h on a regular basis starting this summer.
From what I was able to see from the outside, App Store has had semi-automated reviews for updates in basically forever (+ some random spot checks), presumably based on some introspection that only triggers a human review if a new system API was used.
I have three apps on the Play Store, they all take a couple hours to pass review and their auto-testing/review systems often catch little bugs I didn't almost immediately.
Getting a new app on the store is a bit cumbersome, but it should be.
I've published hundreds of apps over the past 6 years and Google's review times had a similar spike during covid. It took a very long time to recover but now it's back to being bad, I can confirm that.
Indeed their product is an app that is little more than a webview that only shows one website, with optional value-add features. They handle publishing for the client, hence the hundreds.
We push updates for our app pretty frequently and they've been passing review in an average time of 1 hour (around 7 updates in the last 60 days). Hope it stays that way.
Still trying to get a Play Store page with stats onto my AI Impact page, but if their numbers are anything like Apple's (and they're likely much higher), then it's a tough life for them right now:
This is a big part of why React Native (and especially EAS) is still my preferred native development platform. The ability to ship OTA updates directly without depending on platform reviews & rollout schedules is a killer feature I'm not sure I could live without.
We should write more web apps, more PWAs and have some sort of a way to distribute those without proprietary app stores. It's true not every mobile app can be a web app, but for a lot of cases web apps work great.
In fact, I'd support Google with this policies if they'd also take full accountability if my phone gets hacked. Do they? No, so it's unfair and a bad authoritarian way to create another walled garden.
I think that the app targeting Android Auto should be pointed out. Google Play reviews are mostly automated and it shouldn't take more than a few hours. Android Auto is heavily curated for good reasons.
Everyone that ingests code is seeing an order of magnitude more of it thanks to LLMs, even existing apps are producing more updates. It's the same sort of thing github keeps failing to keep up with.
For all the complaining about Apple's store, the Play Store has always been worse imo. You can't even release an app without first doing a beta test with at least a dozen people.
> You can't even release an app without first doing a beta test with at least a dozen people.
Perhaps I'm misunderstanding what you are saying here but less than a month ago I released a brand new app with no beta period, direct to production (white labeled app, which is why I didn't need a beta)
I think it only applies to newer accounts and individual rather than company accounts. To make things worse, Google doesn't allow you to switch an account from individual > company. You need to create a whole new account.
Same happened to me yesterday, I published a new app and it was reviewed and published within a few hours without any beta testing. but I think this is why I see people ready to buy old playstore accounts for real money, maybe this only affects new accounts
I'm just working on my first app (thanks to AI...) and if you have a new dev account created sometime after 2023 they are making you do a 12 person, 14 day beta run before anything else occurs, apparently.
It gets worse! If Google decides the people in your test don't engage enough and/or you didn't respond to their feedback, they may not give you production access. I've got a game that's available on iOS, I released there first and did lots of testing to deal with the low-hanging bugs. After doing the 14 day test Google emailed me:
Possible reasons why your production access could not be granted include:
- Testers were not engaged with your app during your closed test
- You didn't follow testing best practices, which may include gathering and acting on user feedback through updates to your app
Anecdata: I've pushed out dozens of small code fixes to My PlayHome Plus over the past month and none of them took more than a few hours to be reviewed.
On the flip side, googles release infra provides much more functionality for apps that already has scale. I wish apple were more production oriented too.
The joy of a world with a duopoly reigning over a strategic core market
We're really into the South Park cliché: Anal douche or Shit Sandwich.
I wish regulators across the world did something about this, but even Europe shy attempts aren't moving the market in a better direction.
It's depressing to see a company that thrived from the open internet becoming such an evil piece of cyberpunk lore. I mean... Nobody really expected Apple to care about anything else than its bottom line. But I'm not alone to have had hopes about Google.
When I die, I think not fighting Google when it was still time will be one of the regrets I'll drag into my grave.
I find it super funny that all sorts of garbage goes into the AppStore, PlayStore. They both make ridiculous amounts of money, immense profit margins, I don't remember how much, they never publish the numbers, but likely in the 60-70%.
And yet there are STILL tons of developers defending app stores.
Apple's App Review has also been slipping over the past few months. I have multiple apps that have taken days, up to a week to be approved.
What's most galling is that if you use CapacitorJS or similar you can ship app updates instantly to your users but if you write native first-class OS citizen apps you are penalized.
There is nothing quite so annoying as having a fix for a bug people are running into and have zero control over when it will get out to them.
Google's review is complete horseshit. It has been darkly funny to watch them try to compete with Apple by adding strict review (way stricter than Apple's) and still terrible applications make it in while legitimate ones have trouble.
Just go back to the way it was before, and scan the apps with static analysis tools. This security theater is stupid and always was (for Apple and Google).
> AI is becoming part of how people experience the web every day. We want to make sure that doesn’t mean people are chained to one company’s self-serving pipeline.
Ah yes, the extremely diverse offering of OpenAI, Google, Anthropic, Microsoft, and Mistral (a fake "euro" chatbot). Mozilla is truly a "people's" company.
I hope someone will sue the ever-loving shit out of Apple when their foot dragging prevents a critical update from going out in time to prevent a 0-day from being widely exploited.
Interesting. And all the history of Kafkaesque review interactions that various developers have had could be subpoenaed, as evidence of a pattern: that delays aren't necessarily due to excellence and good faith.
Given the sibling reply, I can imagine them claiming national security prevents them from releasing those records. But that’s okay; I am fairly certain we can find enough developers willing to tell their tales.
Apple has some “trust” for vetting things, and with the wave of slop-apps it fine with a slight delay so the App Store doesn’t become riddled with slop like the android store.
Definitely not exclusive, though I believe they are related enough to not tank one for the other. If a review is 2 seconds and done, then the circle for figuring out the mvp slop app is pretty slim.
You can imagine with the AI models we have now, many of the stuff reviewers do could be automated to a large extent. They can also determine through binary diffing that functionality changes may be limited etc. Many things can be done to eliminate majority of the queue for example.
Some stuff the reviewers do could easily be automated. I’m off the mindset everything the reviewers do shouldn’t be automated however, as llms do hallucinate and are still susceptible to ghost prompts.
At the infinite app review scale (some apps malicious, illegal, rip-offs), extra time is inevitable.
You shouldn't have shipped that bug in the first place, I would say. If the bug comes from an Android update, I assume that developers have had access to betas long before the system update is rolled out.
For new accounts yes, for older accounts it's much faster in my experience.
Apple has it's own issues, they often just answer with a random question so they can kick the review down the line. "Are you sure this is your pricing?" "Can you confifrm you have not selected that country" and then you have to wait another 2 days.
TFA is a post from an established developer and showing a screenshot for the submission of an update to a longstanding app (Conversations XMPP chat client).
I'm partly to blame. I accidentally ran an illegal unregulated money transference service over Google Play.
It let users cash out their Google Play Credits for real cash, which I automatically wired them.
Someone then hacked in to a major bookstore chain, stole piles of Google Play Gift cards, activated them using their access, and used my app to get cash for them.
Luckily, the whole thing blew up on me before I got in serious trouble, rightfully so, and the app was removed by Google, then an investigation followed. A ton of copycat apps popped up immediately after, then a few months months later Google announced their app review process.
I love how casually you're dropping this incredible piece of internet lore as if somebody asked you how's the weather.
Haha. I used to have some blog posts detailing things a bit more, but I let it die when Heroku cancelled their original free tier years ago.
A domain is only ~$12/year if you don't buy it through a scammy site like godaddy that adds fake fees or quadruples the cost after a year. WordPress is easy for blogs, or you can just vibe code something in an afternoon if you don't care to have comments. Even embedding forms or an emailing tool can be done statically. Heck, there's probably a free option out there for simple posting that I don't know about.
The biggest costs are not the money, but the work and cognitive load of the thousand cuts it takes to not only bring all of this up, but keep it running, not to mention migrating the content.
However/also, "only" $12 to some is a considerable amount of money to others.
If its a static or client-side website, GitHub Pages is free and allows you to use whatever domain you have already own. Almost all of the websites I run are hosted on GitHub Pages. No maintenance required, and updates are as easy as `git push`.
Having done this for multiple sites, there's still a lot of friction and gotchas in the setup process, and it's also not guaranteed to not break/rot (e.g. have to renew the domain.)
You didn't use the word "just", but I still want to link this article:
https://alistapart.com/blog/post/the-most-dangerous-word-in-...
what was the url? asking for a wayback friend
https://web.archive.org/web/20220119132757/https://davidmurd...
Wow! You managed to break almost every financial law and regulation in one go. That's amazing!
Reminded me of Arrested Development's George Bluth's "Light Treason".
If you're inspired to rehash it here or another blog you'll have at least this additional reader.
https://web.archive.org/web/20220119132757/https://davidmurd...
What did you do with all the Google Play Credits?
When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).
It was risky because I didn't actually receive any money from Google until about a month later.
What you did was money laundering. And big chance for getting in trouble if let’s say ton of credits come from fraud/stolen and then google pays out to you and then crawl back once they realize is fraud.
I’m curious how you didn’t get into money laundering problems.
Technically it was an unregulated money transference service without KYC. The user that stole the cards from the bookstore was the one doing the money laundering part. I just enabled it (which is probably worse, legally).
I was investigated and cooperated fully.
Edit: I just remembered, the bank I used for the transference did do KYC for all users who were sent funds. This makes it more like "money dirtying", since the account is tied directly to a real identity.
Thanks for your detailed answer. Could you tell me what other things you had to deal with? Any prison, bad credit, fees, lawyer fees ?
This is not laundering, it is in fact exactly as the service was meant to be used. As long as you save where the money comes from and where it goes you are at worst operating a discount pseudo-bank. But that's what google is also doing, so we can infer that this is okay.
How did you "accidentally" do something that was so obviously not allowed?
I didn't know what a "money transference service" was, and certainly didn't know this service that I didn't know about was highly regulated.
I only created it because I had Google Play Credits that were gifted to me. I built an app to "convert" them to cash for myself. I had never built an app before. I was proud of it and tried to make it pretty and professional and useful for others, and used it as a learning experience. The listing on the Play Store was clear about what it was.
I had to answer questions about what the API was being used for when I signed up for Dwolla (an actual regulated money transference service). I answered honestly. They approved it.
The app sat unused with no downloads for years before someone on Reddit's `r/churning/` posted about it.
Right but... You've used gift cards before right? The whole point is that you can't convert them to cash. Not only that but Google/Apple gift cards are notorious for being used in fraud.
I guess if you're young...
Sure.
I created it back in 2011 or 2012.
It wasn't a gift card that personally motivated me to make this. It was credits from an online referral program I was gifted. I guarantee I did not read the fine print at that time.
Most people dont read the fine print on the back of gift cards. So I can easily see someone never running into a situation where it’s actually explained that is not allowed face to face.
> You've used gift cards before right? The whole point is that you can't convert them to cash.
This is very untrue - there's a ton of services that do this and while it is against the ToS sometimes, there's plenty of place where ToS of this type are not legal and so you are perfectly within your rights to resell a gift card for money.
There are multiple companies dedicated to turning gift cards into cash.
It isn't some new idea, he just didn't follow all the rules doing it!
It's obvious that you can convert them to cash, because merchants accept cash and do not want to pay their employees in gift cards.
The process is just not obvious and usually not accessible to everyone.
I mean people in poor neighborhoods do the same thing with laundry detergent or anything else you can buy with SNAP benefits.
You can’t buy laundry detergent with SNAP benefits, since it isn’t food.
Hm, maybe that loophole was closed recently? Definitely used to be a thing, people with benefits would buy something nonperishable and marketable. Tide detergent was the example. That could then be sold for cash, or traded for cigarettes or booze or something that the benefits program would not allow, and resold to people who needed laundry detergent. Everyone taking a cut along the way of course, but hey it's free to start with so who cares?
I went ahead and did a web search on this, and found that I misremembered it. It wasn't that the laundry detergent was initially purchased with a public benefit program, it was outright stolen.
https://reason.org/commentary/sound-money-tide-as-gold-stand...
Still, variations on the scam with benefit programs are still run.
I’m really wondering how you confused “things that thieves steal” with “things people buy with food stamps”. Food is rarely shoplifted in America.
He accidentally got caught.
I responded to others with more details if you're interested
I’ll never understand people so desperate to find villains in the world.
Anyone interested in this topic should check out https://www.bitsaboutmoney.com/archive/gift-card-marketplace...
> It let users cash out their Google Play Credits for real cash, which I automatically wired them.
I really want to know what the intended design or use case was for this? This is why people usually only let you turn credits into in app balances right
Cashing out unwanted gift cards
With Signal, the biggest issue we have is that review times are extremely inconsistent. Sometimes it's 4 hours, sometimes it's 5 days, and there's no visibility as to why. Our working theory is that there's automated and manual queues, and occasionally, for whatever reason, we fall into the manual queue. But when you work on an app that has weekly updates, randomly getting hit with a review time of several days really throws off your groove. And it can obviously be terrible for moments where you're fixing a critical issue.
Thank you for Signal <3
I can imagine Apple probably has an automated review of a diff, and probably makes a manual review anytime a system API call changes
As someone who also has to deal with the review process on the Playstore, I feel your pain. Reviews timelines have been all over the place for the past year.
I greatly appreciate that I can now get Signal via Obtainium directly from your VCS. It feels like I am sometimes even getting multiple weekly updates.
Has it ever happened where your submission goes to review and then just sits in the "In Review" state for many days? I am talking 4-5 days? or sometimes longer than a week? And then it gets approved?
That's been happening randomly to me.
I agree with this. I had a production Play Store submission approved within 4 hours last week. It feels so random.
By the way, the same is happening for the Apple Store.
Their review process is advocated as usually within 24 hours (and heavily advertised by Apple as such, see https://developer.apple.com/distribute/app-review/) and it is taking now much longer.
In the last month, I had to go through the review process twice, and twice I needed to contact them personally after waiting for 1 week of waiting. It did however helped, after every human contact I was reviewed within a few hours.
I got this explanation from them...
> We are currently experiencing a higher-than-normal amount of inquiries and have been unable to respond in the time frame that we would prefer. During these periods of high volume, the app review time will take longer than average, and we cannot currently provide a concrete timeline for when your specific app(s) will be finished with the process
I'm guessing, AI slots invading the store.
I'm sure submissions have absolutely skyrocketed with model advancements since the beginning of the year. I'd be curious to see the numbers.
I know Github's commit numbers have been pretty staggering YoY.
Yup, my bets are on this. It’s not only github that gets ~order of magnitude more PRs and commits, but probably app stores too.
Wonder how it will change app stores for the future.
I've had same experience. Brand new iOS apps are taking weeks. My latest all took 3 weeks to get reviewed and approved. Updates to existing apps are fast though (1-2 days).
Also, sometimes, apps will go in review and then just stay in that state for 3-4 days before approval. No idea why.
theres's hordes of sloppycats in every vertical. Check out how many birding apps have come out in the last 12 months for example
> I'm guessing, AI slots invading the store.
Well, same as my lack of sympathy for github and their "inability" to deal with "unprecedented AI generated traffic", I dont buy it. Seems really simple to setup an algorithm of "existing app from pre-AI is submitting another update gets put in the priority queue while everyone else gets the shared queue".
> usually within 24 hours
I have never seen Apple approving within 24 hours
I've had Apple approve app submissions within 24 hours. It certainly hasn't been the norm (on average for me it takes more than 1 day, but less than 2), but I've had it happen occasionally over the past couple of years.
Or just developer/mansgement slop? I don't understand why every app needs to be updated every second day (at least it feels like that).
The easiest way to count how many apps you have is to turn off automated updates and wait a week. The number of updates equals the number of apps.
My tool is used by 1 million people a day https://www.photopea.com
This is the reason I never made a mobile version and all mobile users use it in a browser.
The biggest problem (bug) with this approach is that iOS limits the RAM usage to 2 GB per website. I have to tell many of my users to ditch their $1000 iPads and get a used $150 Macbook for better experience.
I think Apple does it on purpose https://bugs.webkit.org/show_bug.cgi?id=268816
If you are the photopea developer, you are a true hero. Thank you for your work!
Thank you! :)
https://bugs.webkit.org/show_bug.cgi?id=268816#c19
> This issue is considered resolved. Per the above discussion, there are multiple restrictions at multiple levels that affect different scenarios, so it is not surprising that you are still seeing similar issues.
> Please file a new bug with your use case. Providing a deeper explanation for the need than a synthetic test case would help us prioritize it higher.
This is just shameful. 2 and a half years later, just resolving it like it's been 2 days.
I created a much more basic version of photopea (https://egeozcan.github.io/ketchup/) because I didn't even know it existed. This is very cool and fast!
Nice! :)
It's nothing more than a "hello world" project in comparison to what you shipped. Photopea is crazy good! Anyway, thanks!
In fairness is that really a bug? All apps are deliberately limited to a couple of GB on Android (depending on how much total RAM you have).
It would be pretty annoying if a random website can just DoS your phone by using all your RAM.
When I run my website in Chrome on Android (with 8 GB of RAM), my website can get 6.5 GB of RAM.
When I run my website in any browser on iOS (iPad with 16 GB of RAM), my website can get 1.88 GB of RAM.
This much RAM might be needed only for a few seconds (computing a visual effect). A user is "focused" at just one app at a time. If a user uses my tool for hours, I think it makes sense to give them all the resources (CPU, GPU, RAM, ...)
Seems like the solution to the DoS concern is to just limit the site to whatever amount of RAM is currently available on the device - that's what every other browser/OS combination other than iOS seems to do without issue.
[dead]
AnkiDroid (~17 years old) submitted our latest alpha on Sept 03, 2026, 4:40 am. Still pending review.
We have about a 16 year old app, and our Google Play app review consistently takes between 30 minutes to 1 hour.
Apple consistently takes about 36 hours for us.
thanks for your app! using it for learning danish and finding it very useful.
Team effort, but thank you!! I've just taken the next month and a half off to work on things full time. I'm excited!
The next update won't be huge, (Google required us to make all screens 'edge to edge'[0], which took up most of my time last month). I'm hoping for some solid improvements now that's out the way, once the release pipeline has returned to normal.
Feel free to get in touch if you fancy contributing.
[0] https://developer.android.com/develop/ui/views/layout/edge-t...
If you can get your agent of choice to run up the app in an emulator and navigate the whole thing taking screenshots then tasks like edge-to-edge can be pretty hands off.
The way I did it was to firstly get accessibility identifiers on everything. Then have it record everything I do on an emulator to navigate the entire app. Then left it for a while to work out how to actually use the app via the emulator. Once you have this sort of baseline. A lot of changes are really quite pleasant. I often ask for an HTML gallery of screenshots covering a few device sizes as the step before I bother running it on a device myself.
We use Roborazzi[0], which is an excellent screenshot library, but:
* We target minSdk 24
* We're still using XML views
* We target a large variety of form factors
* We have a lot of screens, and these have a lot of configuration options.
I really wish it was "point an agent at it, and walk away", but many screens ended up being hours of iteration with Fable driving my phone/an emulator to produce an acceptable outcome.
Given that my Pixel 9 Pro has system screens which are still broken under edge to edge, it's not an easy change, and takes up time which could have been going towards feature development.
[0] https://github.com/takahirom/roborazzi/
A tangent, but a big thank you (to you, and all other developers) for supporting older API levels from someone with devices ranging from Android 8.1 (BlackBerry Key2LE, at minSdk 27) to Android 16 (BlackBerry "Q25", at minSdk 36.1) <3
Thank you!!
E-waste is awful, as is cutting off old devices. We still backport security fixes to minSdk 21.
To Google's credit, post-21 is a much more pleasant experience and requires very little developer time. API desugaring[0] has worked perfectly, their compatibility classes[1] handle most of the common cases, and there's often very little to actually code[2].
[0] https://developer.android.com/studio/write/java8-support-tab...
[1] https://developer.android.com/jetpack/androidx/releases/appc...
[2] https://github.com/ankidroid/Anki-Android/blob/main/compat/s...
Gotta love that Google enforces rules on developers that it won’t even enforce on itself. Such a great look.
Yeah you'd think they could use some kind of exponential back-off type algorithm for apps that have been successfully reviewed many times... :-D
Is that 2.24.1 which was successfully published on F-Droid on Sept 2? If so that's... Interesting. And useful.
Google Play rejected our 2.24.1 release (Aug 31). F-Droid is typically slower, but we don't have to worry about distribution issues.
This is regarding 2.25.0alpha4.
Thanks for clarifying. Yeah, I expected F-Droid to be slower... Though I feel like outright rejection is worse.
Thank you for Ankidroid!
You guys are awesome, thank you.
I just released a game [1] on both iOS and Android.
The Google Play process is more thorough. There are a lot of steps and you need to clear them one by one. This means waiting several days between each step. The Play Console dashboard is quite well documented to be honest but can be overwhelming. The main obstacle is that you need to find at least 12 testers to play your game for 2 weeks straight. I ended up paying a service to test my app.
On iOS, the process is a bit more obscure. It's fairly easy to submit an app, but then you don't really know what's happening. You can only see a status like "Pending review". And then one day, you are approved.
Overall, the iOS process felt easier for me. As long as your build succeeds and you provide the correct information, your game can be live within a week. The Android process took more than a month in total.
[1] https://jgthms.com/hopera/
Finding 12 testers was a struggle for my app [1]. Had to use a mix of LinkedIn begging, work colleagues, friends, and people from random Whatsapp groups I was in.
Once you get over that hurdle for your first release, at least you don't have to do it for every update.
The Play Console is a bit fiddly and I'm always getting random warnings that I need to comply with some new rule by an arbitrary date or my app will get delisted.
[1] https://play.google.com/store/apps/details?id=com.gads.hamil...
Released my game a few months back. I generally agree with you, however Apple process was more painful / took longer when you start adding in-app-purchases and providing all the financial info required for that to be approved.
And, as I'm doing weekly updates, I found both stores approving builds typically within 12-14 hours which was a nice surprise
> but can be overwhelming
That's an understatement and a half. It's massively over engineered and complicated, especially when compared with (say) the dashboard on Itch.
Some reviews are clearly automated, some get a light human review, and some involve a human really looking hard. New apps seem to get a more rigorous human review for their first 2-4 submissions. Or at least humans looking over automated test screenshots etc. One reviewer apparently only looked at screenshots because they missed something that would be blindingly obvious on the prior screen if they did it themselves.
The explosion in LLM app development has clearly created a bottleneck at the human review steps. Not only delays but much more “dumb” rejections from likely over-stressed humans.
Yeap latest CoMaps update took ~16 days to review (the longest wait for us so far) and two support tickets (submitted first after ~9 days and got "we have expedited it", 5 days later still in review, so submitted one more ticket).
Before that we had a hotfix update (a very small change) and still it took longer than a week and a support ticket (after which it had been approved in a day)...
Our app includes Android Auto, which I think is what causes it for us. Submitted 4 Sept, still in review.
Was only 48-72 hours until this year, where it randomly jumped to 2 weeks or longer like it still is.
It's really frustrating, and makes it very difficult to develop with, let alone reliably release features across platforms.
I suspect the same issue; I added Android Auto to my application on the latest release and the version I pushed on Sept 3th is still under review.
Maybe I'm just incredibly lucky, but my reviews on Google Play take roughly an hour and appear to be entirely automated. My initial review was about a week, but everything after that has been 1hr. My Apple reviews are still around a day and my initial review was one month. The Google process is painless and is almost as easy as a web deploy, the Apple process feels much less certain that it will go smoothly and Apple actually regularly opens the app even months after release. This is presumably to check for problematic UGC, but feels rather unnerving.
Exact same situation for us.
Google just seems to fly through and fill out a bunch of forms (we had to include a condition where if the google tester credentials logs in, we switch the app to the staging API). And then it's live within the hour.
MAYBE operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all. Apple and Google are WELL past due for regulation in this space. The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
And before someone says "well akshully you can technically do it on Android," Google has been working tirelessly to make it as onerous as possible for both developers and customers. For example, users need to separately authorise each app (browser, files manager, alternative store, etc) to install an APK from outside the Play Store. Google also does background scans using "Play Protect" which will periodically delete apps Google doesn't approve of. This happened to me with SmartTubeNext. I have a dozen other ways Google ensures users are discouraged from stepping outside the Play Store.
And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
I'm not saying we have the perfect system but anything that slants the system towards "easier downloads" or "less gatekeeping" brings large, obvious risks. I don't see how regulation would address them.
We already had enough proof of vulnerabilities in the OS code and Manufacturers (eg. Samsung/Lenovo/etc privileged apps), there were enough reviewed apps that were used for fraud or access as bad actors.
My banking works in my 'unprotected' computer browser. So I'd expect giving anyone equivalent freedom. I don't mind if there's a default for gate-keepers as long as they allow competition. but I would expect to have same freedom on my mobile devices as on my laptop.
Just because there are known vulnerabilities don't mean we should drop other security features, this is the opposite in fact. Defense in depth, an OS-level vulnerability cannot be exploited if the attacker cannot access that part of the OS.
And like it or not, the Play Store approval process is a security feature. It limits the ability of bad actors to run code on your phone and access data or exploit vulnerabilities they wouldn't be able to otherwise. Some get through, but it makes their life harder, again, defense in depth. Something can be both an anticompetitive practice and a security feature.
As for banking in the browser, you can, but your bank probably doesn't like it. That's why they are pushing for browser attestation, or to force you to use the app. The banks would rather take that freedom away from everyone rather than giving it to everyone. And I suspect they do it for good (as in profitable) reasons, fraud costs them, it costs them more than what they would gain by being more open.
If we want security features and freedom (which is the harder option), we need competition. If Google and Apple are the only players besides an insignificant minority, it is easy to lock software to these platforms, screw that weird guy with his Linux distro. Legislation is another option if the first one fails.
Sandbox, ACL, scan, sign, revoke bad actors.
We should have web installs by now. The only reason we don't is because Google and Apple like cash and their little monopolies are easy money.
Big tech loves to "protect us". See Anthropic and OpenAI worried about intelligence.
Google doesn't care that its AdSense ads marketplace is flooded with malware. Or that YouTube is rife with scams. Wonder why not. The blatant policy contradiction couldn't be because money, right?
Do people not remember the days of viruses destroying computers?
They were a massive issue before, and now they're barely a thought for most people.
These review processes have been good for the general population.
I believe people in HN also remember the days before we had MMUs.
And I'm sure everyone remembers ransomware.
No one is saying OS shouldn't have security measures, permissions/entitlements and app sandboxing, user land, etc.
I still don't understand why my desktop/laptop is allowed to be 'owned' by me. but my iPhone is a closed-gardened where I'm just a guest in a device I own. and that's nearly what Google is now doing.
> They were a massive issue before, and now they're barely a thought for most people.
Even on desktops... where there are no such review processes. Apparently we've found other mechanisms to reduce those issues, without app stores everywhere.
They're still very much a thing on desktop. You're not wrong that Windows got better at protecting itself, but I suspect the reason you don't hear about them is just that few people use desktops anymore (other than developers who, for obvious reasons, are typically less prone to be infected).
Anecdotally, at least once a month for the past several years, I notice a youtube channel in my feed get hacked. Their usual content gets replaced with crypto, Roblox, or Elon/SpaceX spam. Big channels, small channels, it happens to them all.
There's usually a post-mortem when they manage to regain control. Every time the infection happened through a virus attached to an email or by following a link on their discord.
This kind of attack simply cannot happen on mobile (unless your phone is rooted and you have disabled all warnings).
What review processes on computers?
I didn’t write the previous comment, but I think the point here is that there is a long-running trend aiming to protect users both from malicious intent and to a certain extent from themselves. In the past, viruses had it easy to infect and spread computers because of both inattentive users clicking on mails claiming someone loved them, and the default access mode for any user granting them admin access.
Even though review processeses generally do not exist for computers, they are part of that same trend.
mac app store / windows app store
And outside stores we have Windows’ UAC and Mac’s annoying-but-understandable “this dmg is sus” dialogues. Granted they are review processes but they’re often what keeps common users from wrecking their devices.
> We already had enough proof of vulnerabilities in the OS code and Manufacturers (eg. Samsung/Lenovo/etc privileged apps)
Vulnerabilities aren't intentional.
> reviewed apps that were used for fraud or access as bad actors
The App Developer Verification program, Android Advanced Protection Mode, and Play Protect are all systems put in place in response to "bad actors".
That's a tangential issue.
1. don't force auto-updates
2. still review apps uploaded to Google Play, but don't force users to use Google Play
If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
But the motivation here isn't just security, it's control. Google doesn't want anyone to have an Android device that is independent of Google services.
> If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
So this doesn't solve the issue pointed in the OP.
> don't force auto-updates
I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
>So this doesn't solve the issue pointed in the OP.
Yes it does. This is their point:
> The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
It should be as easy for me to use an alternate storefront - or download directly from a site - straight to my phone. The googleplay store, which is (somewhat) curated and (generally) "safer" can also exist. I, as a user, get to decide which path I want to take. This is literally no different from my desktop and laptop, we already live this life. MacOS allows me to download .dmg files and install (though they are admittedly getting increasingly annoying/friction-y about it) at my own risk. Why should my phone be any different? It’s a small computer. That’s it.
It’s about user choice. It’s my hardware, so I can do with it what I want so long as I’m not using it to inflict harm on others.
> It’s my hardware
I mean, probably not technically due to some EULA you were forced to sign which says the hardware is actually Google/samsung/etc and not yours. Giving them the right to brick your phone the moment you step out of the bounds they define.
We really need some sort of open firmware legislation that mandates manufacturers of computer components need to opensource their drivers and firmware. There's no "special sauce" in that software that warrants a company being able to keep it secret. It's literally just so they can force you to purchase new devices when they get bored of supporting their old devices.
Agree, what I'm saying is "it is mine and we should treat it as mine, same as my laptop/desktop." We both agree the current status quo is not that, I'm saying what it should be.
> I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
this is identifying the tension yeah, but if a review process regularly takes weeks or months, then the security patches are still missing
And what do windows / linux / macos do about apps getting hacked to billions of pc's simultaneously? How is that a new problem?
If libraries didn't exist could not be created today. People tend to say that "it is impossible" when it actually only needs to be well organized.
Splitting git tech-monopolies it is a survival need. Or we do it, or we will end up with a collapsed society. Entities that spy on all citizens and gatekeep access to news and services are contrary to basic human rights and democracy.
> macos
MacOS has been moving to a more locked down model over the years - increasingly difficult to install unsigned applications, SIP, etc.
> Windows
I think Windows is incredibly impressive for its ability to run binaries from many years ago, but I don't think there's much people would point to as a positive regarding Windows’ approach to app security.
> but I don't think there's much people would point to as a positive regarding Windows’ approach to app security.
Yet life in Windows land is perfectly fine in 2026 and has been for at least 2 decades.
If Windows, which started at the bottom of the barrel security wise can make it, surely we can have more modern OSes that make freedom bearable?
How about treating people like adults for a start? How about starting public awareness campaigns about proper digital hygiene. Not everything has to be nanny state garbage.
I don't know. Literally every single person I help with tech support makes me doubt this is possible. People do not care in the slightest and treat suggestions to learn basic digital hygiene as if you've asked them to a computer science degree in its entirety.
Even super basic stuff like remembering a single secure password instead of reusing the same 2 or 3 basic initials-dob-symbol permutations that were probably pwned 10 years ago seems insurmountable.
A shocking number of people have passwords like "shovel"
When assisting friends of elderly relatives I was surprised to see that one of them had managed to set up a password of "a1".
IMO in that case its their own fault. After all they have free will and can use it against their own good if they so choose. Let them get pwned a few times and see if they learn.
that's so dumb on so many levels... should we strip cars from active safety measures and let drivers who are not super good at driving just kill themselves on the road?
I agree, but what I disagree with is the idea that everyone must be prevented from freely installing software on their own devices to make sure unskilled people cannot be tricked into doing it.
I don't really understand why a well designed sandbox and permissions system doesn't solve the problem.
Well cars kill people, granny using the password “password” does not. We can’t prevent all levels of stupidity and carelessness.
If people want to have dumb passwords and download malware, then so be it. You think they can’t do that today with the google play store? Of course they can. Most malware on android comes from the Google play store.
Maybe a drivers license should be needed to have a phone.
maybe there should be alternatives to using the smartphone for everything, personal finances included. my bank stopped offering a home banking service for example (yes, of course the mobile app still sucks), and it's a trend.
I've worked with dozens of businesses over the years and you can't even get businesses with real money and consequences on the line to follow basic security practices. My current project is updating dozens of windows domain controllers that are still on 2012 R2. Aka critical infrastructure that hasn't been getting updates for years.
Many of us have routinely cleaned computers from adults that installed several Ask Jeeves and Yahoo toolbars.
At some point computers need to stop being treated as magical boxes that no reasonable person can learn how to use safely. We expect people who use cars to learn how to use them safely, we expect people who use lawnmowers to not stick their fingers in them. Computers have been a part of daily life for normies for decades at this point, it's infantilizing to suggest that average, non-tech savvy people can't learn to use (not necessarily build, repair, etc.) them properly and need to be protected from them.
People have to successfully get through a state exam in order to drive cars in first place, can be jailed, get fined when not driving them safely, or forbidden for life to ever drive again.
People that accidentality cut their fingers in lawnmowers due to lack of safety features are allowed to sue the lawnmower company.
What I would agree is that it is about time computing gets the same liability laws that the rest of the world already has in place and no EULAs that work around local laws should be considered valid in any form or shape.
Do you hate open source and want only projects where their authors can afford liability insurance and are willing to put themselves in the firing line of a legal system that can be both arbitrary and capricious? Because that’s what you seem to want.
Even people selling on the street or doing charity work have to account for liability of their actions.
Lets stop talking about open source as special snowflakes where everything is excused.
And that’s how you prevent bake sales, lemonade stands, and more. You create a barrier to entry that gets raised little by little until only the biggest players can afford the game. Software liability would end all small open source projects.
Bake sales and lemonade stands are perfectly fine as long as people don't land on hospital urgency, due to careless work on preparing them with spoiled ingredients or lack of hygiene.
Lets strive for quality in software.
Now do that again without careless work or spoiled ingredients. Do you still want them punished or facing so much regulation they can't exist? Because you'll definitely get that with software; even really good development will have flaws, and single flaws can lead to a thousand or million hacks.
All humans face scrutiny in their interactions with others.
Software only got this bad, because we educated users broken tools are acceptable and fixable with computer reboots and anti-virus.
I dunno, people seem to accept most kinds of tool being fussy or flaky.
But the special thing about security flaws is that they turn a one in a billion error into a guaranteed attack. It's moderately hard to make something that doesn't feel buggy, but ridiculously hard to be secure. If you hold to the standards of a bake sale it's the former. If you want full security then nobody releases anything outside very strict contracts.
Thankfully industry is changing,
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...
- https://www.nsa.gov/Press-Room/News-Highlights/Article/Artic...
And I could keep listing several other world regions.
The problem is it's literally speech. Selling something isn't speech, you do not have the right to do charity work or run a business. It goes even beyond speech, it's closer to pure math/logic and I feel very uncomfortable about regulating that. I also think it's literally impossible.
Speech is subject to laws in most jurisdictions.
On power tools, appliances, etc. the safety features are at the user's latitude to bypass. They are usually a hint (don't microwave your dog), not a hard barrier ("I'm sorry, Dave. I'm afraid I can't do that"). A spinning blade is covered by a grill you can trivially remove without permission from anyone.
I agree that the defaults should be secure, but you can't force security on people without creating parallel issues which are maybe worse. Centralizing this power in a single point can have orders of magnitude bigger blast radius than a security failure on an app.
At some point users have to take responsibility and be accountable for their actions. We can't just infantilize them forever as if a magical hand will always be over them protecting and having their best interest in mind. And we certainly shouldn't punish every user for the sake of some of them.
The worst part is that Google gets the benefit of putting itself as the central point of control over the ecosystem based on a promise to keep users safe, but without any of the liability from failing to keep that promise. When the app store is chock full of malware I'm really starting to suspect that their goal is actually only the control. And all those people defending it with "but people don't know better, they need a hand to guide them" were equally misled. What do you think?
Yes, and when they fail to do so, there are laws in place for liability of third party, or when their own irresponsible actions affects others.
>People that accidentality cut their fingers in lawnmowers due to lack of safety features are allowed to sue the lawnmower company.
Anyone is allowed to sue the lawnmower company. Did they win?
The amount of "Do not put hands here" labels I've seen on lawnmowers would suggest that, yes, someone did sue and win (or at the least got a settlement) and thus the lawyers forced the companies to put disclaimers and warnings on the lawnmower, directly on the top of the deck in plain sight.
Using a computer wrong doesn't kill people.
Yes and no.
The computer itself won't really do anything. But I'm sure suicides go up when people lose all their money, or get personal private details leaked, and so on.
ehm: https://en.wikipedia.org/wiki/Therac-25
> "One [software fault] was when the operator incorrectly selected X-ray mode then in 8 seconds quickly changing to electron mode, which allowed the electron beam to be set for X-ray mode without the X-ray target being in place"
Therac-25 is an important software-development case study but a torturous stretch of "Using a computer wrong"
You are right! Computer use should be taught, tested and licensed exactly the same way of steering several tons of metal at 70mph are!
Depends on what those computers are responsible for.
I'm sure you can think of many examples where it does though.
Well, computers first stop being magical machines that no person can learn how to use safely, then.
And, honestly, if you think the endpoint safety problem doesn't apply to you, you are part of the problem.
The endpoint safety problem obviously applies to me and every person connected to the World Wide Web, but the grandparent was talking about The Olds who install the AskJeeves and the Yahoo! toolbars and Bonzi Buddy and...
If computers aren't safe enough that a reasonably competent user, who doesn't open random files they found online and obvious spear-phishing emails, can't use one without losing their 401k, then maybe we need to just reevaluate modern life and go back to bank tellers.
And e.g. browsers cracked down on it, removed toolbar support and powerful add-on support AND enforced signing meaning everything goes through their gatekept extension store and these problems still persist (e.g. addons changing the search provider, new tab page or homepage). Locking everything down does not help.
> does not help
Is that true - do you not see significantly fewer of those installs on random PCs now than you did years ago? And that's even with the current situation not being what I'd call fully locked down.
Nope.
More a problem of those stores still not being properly validated rather a dumping ground for extensions, than anything else.
A problem that can't be solved, you can't check every single program out there much like you can't check every single human ever even with cameras installed everywhere.
Just because some people still die with seatbelts, does not mean they aren't safer without them.
Yes you can check every single program out there, when digital stores are the only acquisition mechanism.
Or as alternative, signed binaries.
Coupled with liability like anything else in our societies.
20 years of being tech support for countless family members and acquaintances says that nothing can possibly make people care about "digital hygiene". An iPad, Chromebook, or similar inflexible device is perfect for most people, and marketing more flexible devices to them has been a mistake since the beginning.
You expect people to treat devices with respect and responsibility? The VAST majority of people use their phones to stream an infinite sequence of clickbait, ai slop, and conspiracies for 6 to 8 hours a day.
I wonder if people would be happy replacing the "Google approves developers" system with a "government requires your ID and address on file so you can be held liable for your apps" system. I suspect not.
That is already a requirement in any civilized country. You cannot run a business without a registered ID, address, etc. for tax purposes.
For free (like for real no microtransactions) that is different. For the rest, they already have that.
It's virtually the case, google and apple accounts require ID verification, which in turn can be requested by the gov in case of an investigation.
If you don't agree with a decision made by your government, you can vote for someone else next time. If you don't agree with a decision made by Google, what do you do?
The people I vote for never win. Am I really any more empowered with the government than I am with Google? At least with Google I can de-google my life (with some significant losses of convenience, but it is doable)
Personally, I find it easier to live with a decision I don't support if I was simply out-numbered in a fair vote, rather than out-powered by some random company on some random continent.
As for doing without Google, I'm kinda doing that myself (using a Linux phone even). But tbh, I think that nowadays moving to another country to escape a government you fundamentally disagree with is easier than moving away from Google.
You probably have some sort of legal rights and ability to challenge decisions made by your government.
If you're banned from Google? Good luck, you're fucked.
The only part that would really be novel is the liability.
I would be shocked if you could publish an iOS app without Apple being able to tell the government who you are. Less because Apple cares and more because Apple requires you to pay, which is very hard to do anonymously for something like this (I’d bet the options they offer are effectively “credit card only”).
What for? Malicious actors have no shortage of stolen identities.
The app stores are neither necessary nor sufficient to curb malicious software. Conflating the centralized app stores with safety is a mistake that only serves the gatekeepers.
Just because something is not perfect that does not mean it's worthless. Most things security things operate this way where it's impossible to stop all malware or attacks.
When analyzing whether something is a net good for society, I look not only at the value it brings, but the cost that it brings. The mobile ecosystem normalizing the idea that the vendor that sold you your everyday computing device is the sole arbiter of what can run on that device is of enormous cost to society, but anytime anyone brings that up, there's an immediate retort bringing fear, uncertainty, and doubt about software obtained outside of those centralized silos.
As I've said countless times before, the answer is clear. Operating systems can install software from repositories. The vendor of the operating system can provide a default set of repositories. Third parties can also provide their own repositories. Device owners can choose what repositories to install software from.
Saying that there can only be one true repository is carrying water for trillion dollar companies to further extract money from their customers.
We could force Google to operate its app review service independently. Users could use it and pay for it, or alternatives. Currently Google forces everyone to use their own mediocre service and pay for it without knowing exactly where and how much you pay.
> And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
https://news.ycombinator.com/item?id=49731273
People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes.
Clearly we need to regulate the kitchen knife industry more. There should be a central authority that sells authorized kitchen knives with at max 6cm length and all other knives should only be available to certified chefs.
Once we have outlawed the longer knives and strong restrictions on ordinary kitchen tools become normal we should just outlaw knives altogether. You can still hurt yourself with a short knife. Only chefs should ever be allowed to own such a dangerous tool. Just buy or order readily prepared food. Why would you do this weird nerd thing called cooking anyway? Just choose from the official list of allowed foods.
The idea that we have to prevent people from being in control of their own computers — that's what a smartphone is — is deeply dystopian and authoritarian.
> People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes
People are rightfully nervous when they see someone walking down the street swinging a knife i.e openly misusing it or treating it casually
People don't realize how much software is being misused or treated too casually. They might be similarly bothered by lax security on databases and data leaks if they realized that it represented a threat to them
Yes, hold people accountable for their actions. Don't take away their freedom. We may prohibit individual actions that involve a general tool when they harm others. That is compatible with a free society. We may not prohibit fundamental tools¹ That is fundamentally incompatible with a free society. Especially when that tool forms the infrastructure for the flow of information and free speech.
[1] General purpose computing
Regulation is already addressing that. I encourage you to read up on the Cyber Resilience Act.
How about the same thing we do when companies leak half-the-nation's personal data twice a month. Nothing.
When companies get hacked and millions lose their personal data, nobody cares. When individuals get hacked, it's a major issue that justifies locking down consumer's hardware to protect them from the burden of controlling their own devices. See how that works?
How would a reviewer catch that?
> "Apple and Google are WELL past due for regulation in this space."
There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores and external payment methods. It also prevents Apple from playing anti-competitive games with App Store rules, like banning hyperlinks within apps that could be used to allow the user to make a payment elsewhere.
The current US government won't do anything to follow suit, but hopefully a future one might.
> There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores
So does that mean:
1. People in the EU can continue to use F-Droid etc. exactly as they have in the past, permanently? No Google verification of developers needed? 2. People are free to install apps from any APK they choose?
Yes. Even beyond that, people outside the EU are free to install apps from any APK they choose.
Yea, but apple and google keep finding out loopholes and unfaithful compliance, it is time for EU to have some backbone.
The EU is not interested in liberating phone operating systems because it goes against their digital wallet push which forces everyone to use an attested, Google/Apple sanctioned device and operating system.
The US government acts here in favour of a monopoly market. Trump violates free market principles; quite interesting how Trump works against core capitalistic means, in favour of personal corruption.
A weather app could be asking for your location to give you more convenient local forecasts.
It could also be asking for it to help advertisers build a robust behavioral profile about you.
This is not a systems permission, nor is it something that billions of users can judge the ramifications of each potential privacy impacting decision. Privacy is a systems property, not a technical property enforced with ACLs. ACLs can only keep the door from being wide open, they can't prevent access which has been granted from being abused or help the user understand ramifications of granting access.
We need privacy to be a regulatory concern with actual enforcement via an international framework. Until then, it is a business concern of Apple/Google - because they are in the business of having consumers feel confident that a weather app isn't reporting their behavior to anyone willing to pay for it.
> operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all
This is exactly why I use a GNU/Linux phone that runs a desktop operating system with no artificial restrictions. Debian repositories are good enough to save me from malware, aren't they?
The push to involve the legal system and the government is ironic.
It's partly lawsuits that are pushing Google to do this in the first place - because people download shady apps and get scammed or hacked.
The more regulation we get, the more it's going to push towards central app stores that are inaccessible to small devs.
Haha, oh the poor mega tech companies?! As if. Google sees a market, it wants to capture it. Same as Apple did.
You're misreading me. Regulation helps boost Apple and Google at the expense of anyone trying to compete with them on app stores.
I am on an Android 10 system... gate keeping wasn't this bad during the Android 10 times...so i fairly use software stores like f-droid... simpmusic is one app I use frequently from f droid....no application so far has been deleted automatically. I guess Google has been upping the gatekeeping with newer systems as they come out
This case has nothing to do with "gatekeepers". It is about the Play Store, operated by Google.
> This case has nothing to do with "gatekeepers". It is about the Play Store, operated by Google.
To-may-to, to-mah-to. The AppStore is basically identical in most aspects people care about.
Back in early 2000s, pretty much all Windows machines were infested with malware.
Do you want to bring back those glorious days?
Back in the day users didn't really have much valuable and sensitive stuff on their machines and malware was rather benign - just sending spam, not trying to fuck up that specific user. Could be a bit different when it's a smartphone user depends on.
The reason that modern computers are no longer filled with malware has nothing to do with completely irrelevant locked garden app stores on phones.
The reason is because Bill Gates put out a memo because it was fucking embarrassing that you could trivially smash the stack on default open API endpoints for services that consumers never used and shouldn't have been trivially routable from the open web in the first place.
Meanwhile in app stores, you don't have to hack anything, because consumers just download your botnet software willingly and directly.
42% of all apps on LG smart TVs turned your TV into a "residential proxy" botnet participant. 30% on Samsung TVs. There is no "hacking" in the world of apps because it's completely normalized for whatever app you build to also for some reason include remote control functionality from like 6 different companies. All of those apps pass review no problem.
Interesting that you mention LG and Samsung TVs.
Does it happen on Google Pixel phones?
Obviously, the quality of the walled garden depends on the maintainer. Google's quality standards are lower than Apples, but higher than LGs.
People still can install/run whatever they like on their PCs, so why further restrictions needed or am I missing something? Also, further restrictions doesn't seem to work on the mobile/TV market where actual malware still infects iOS/Android/TV devices despite all the "hops" that it has too go through.
Code signing with warnings about non-signed apps is enough
Hmm? Malware on iOS is extremely rare.
I remember in Bitcoin community ~10 years ago, standard recommendation was than an iOS wallet was secure enough (I don't recall even a single case where wallet was stolen via malware), but any private keys on Windows were strongly discouraged, as most cases of stolen wallets were on Windows.
I'd say popularity of iPhone shows which way people prefer, but you do you - what prevents you from voting with your wallet and buying a Linux phone?..
Your complaint about Android .apk install is... similar to unsigned software installs on Windows in some cases (not a great argument, I know, but the same as the vast majority of users would be used to).
As for SmartTube, their keys were compromised. Inconvenient, but it wasn't about hostility to self-installed applications.
For the former there is: https://github.com/privacyguides/verified-apps-android
Key compromise sucks and is hard to protect against. That said the Apple/Google app stores are also full of scams where people lose a lot of real money:
https://www.macrumors.com/2026/07/27/apple-app-store-fake-bi...
The main difference is that signing a Windows binary doesn't require any third party review of the app content.
Signing an APK also doesn't require third party review of the app content.
But the context of this discussion is the difficulty of installing an APK from outside the Play Store.
This is the first time I've seen a complaint about giving permission to an app to install another app. The SmartTubeNext issue was due to the developer's keys being stolen. If you want to keep an app signed with stolen keys, you can disable Play Protect. If Play Protect uninstalled apps that Google disliked instead of apps with known vulnerabilities, people would mass disable Play Protect, which would defeat its purpose.
Nintendo, Playstation, XBox,...
… should also be open, but that’s irrelevant to the discussion.
It is quite relevant as computing systems.
And yes, they also have apps besides games on their stores, and support external keyboards and mices.
Sorry, I think I misunderstood your argument as whataboutism.
[dead]
[flagged]
Web apps can't fully replace native apps. This would be a bandaid fix, we need a fully open ecosystem for apps, like what is available on PCs. Native apps can run offline, they can be much more deeply integrated into the OS (you can't have a web app Android launcher, for instance), and they have a performance overhead due to having more layers between them and the hardware, which is important for games or anything complex.
Web apps can run offline. Google could figure out web app android launchers if they wanted to. The performance overhead exists but is slight. It doesn't matter to 90+% of applications, including many games.
I have high hopes for the Rust UI ecosystem in this regard. It's implementing pretty much everything from scratch, which means that it should be able to support a standalone GUI ecosystem that doesn't depend on a system GUI toolkit being available (while also being able to target existing OS's).
we have an open web. no ones pays for it.
Anyone can put up a PWA. The only org that hates this is Apple.
The complaint is about a shared resource, which would require governments to adopt open source policies and _pay_ for it just like they do the post office.
But ya'll hate government, so here we are.
why invest in developing a PWA if a significant portion of (particularly wealthy) users cant use it?
How are iOS users not able to use a PWA? Because it takes a few taps to add it to the homescreen? I have several PWAs on my iPhone and I can use them quite well.
it is significantly more complicated - especially for the average user - to install them than on other browsers. other browsers also let developers ask the browser to prompt the user to install the app.
This is all documented in great detail in the links i shared
Open Web Advocacy's goal is Chrome on all platforms, which just means the Play Store problem gets even worse. The moment OWA wins, the open web dies. These are people with a truly bad astroturfy goal, clothed in charitable nonprofit status.
Paradoxically, as long as WebKit is mandatory on iOS, the open web is safe: Websites have to build for a lowest common denominator standard instead of building for Chrome proprietary APIs.
[flagged]
[dead]
Security at its core comes down to trusting the supply chain that provides the software that runs on your hardware. There are many alternative secure supply chain models, but ultimately users often are incapable of making great choices on what is trustworthy. It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.
Comparing phones to PCs isn't a great comparison because PCs don't have a great track record and the amount of personal data and ease of installing lots of apps is quite different. Of course the current arrangement is far from perfect, but acknowledging the problems it's trying to solve is an important step towards trying to find a solution that is better.
I'm not sure how much manual review in these stores is for security rather than content and enforcement of business rules.
I imagine nearly all the security review is automated scans, and not the source of the delays.
> It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.
this position of privilege is what the OS vendor (google in this case) wants, because it spells profit.
I dont trust it.
The only trust i have is community trust. Piracy works on this trust, and it has worked for very long.
Hard to find better solutions when we have no agency to enact them. The “arrangement” was one-sided from the start.
The Google Play review process has been slower and more painful than the App Store review process for 5+ years at this point. At least you get to communicate with real people at Apple; it’s all bot-driven with Google.
What are bots doing for two weeks
Strong argument in favor of web vs native apps. If you need bluetooth on iOS checkout the web bluetooth iOS safari extension i've been working on recently: https://beacio.com
Yes, a truly Open Web is the solution that we need. It already works everywhere with a single codebase, and is more secure and private than native apps. But Apple prevents that by forcing all browsers to use terrible WebKit on iOS.
Endless more information on all of this at
https://infrequently.org/series/browser-choice-must-matter/
https://open-web-advocacy.org
Note that Alex Russell is a Blink partisan, currently supporting Blink at Microsoft and formerly having done so at Google. Folks like that don't take kindly to the idea that a Blink monoculture might not be a great thing, and definitely do not share the opinion that it's critical to the open web that Apple not cede the open web to Blink.
Remember, Blink began as Google's 2013 fork of WebKit. They've embraced and extended it, but thankfully the "extinguish" step is taking longer than they thought. This makes the "open web, as long as it's my engine" people upset.
Safari's PWA support is not as complete as Chrome's today, but it's as good as Firefox's support and perfectly capable of supporting rich, standards-based apps. https://pwascore.com/
The fact that your "argument" rests upon baseless ad hominem, I'm mostly inclined to not even respond.
I'll simply say that if you bothered reading anything (let alone objectively), you'd clearly see that no one is arguing for a blink monoculture. They're arguing for allowing everyone to choose whichever browser and browser engine that you want. Safari included.
The math isnt mathing on that site... And, no, safari is NOT capable of PWAs - which is the primary point of contention (not obscure APIs, though safari generally lags in all of that as well). They deliberately hobble PWAs and make them very difficult to install.
edit: also, your site is just obviously biased/poorly done, because there exist many better comparisons of web features, which show how vastly far behind Safari is, often even of Firefox. This is unsurprising given your chosen style of rhetoric
https://wpt.fyi/
https://webstatus.dev/
It's not ad hominem since I'm critiquing their position, not their character. Their positions are public and well-documented, which is why it's important to point out the bias of what you linked to.
> And, no, safari is NOT capable of PWAs…
Incorrect, see my link. PWA installation on iOS is simple and idiomatic, and the same as it is for all websites: Share > Add to Home Screen.
It is rare that someone voluntarily exposes their lack of insight and integrity so thoroughly... Kudos..?
your argument amounts to "this person is incapable of being objective, let alone decent, because they work at xyz". Moreover, you literally didn't address a single thing presented in either link that i shared - which directly refute your nonsense. Pure ad hominem, and worse.
You are not a serious person if you think that PWA installation is "simple and idiomatic on iOS". It is buried multiple menus, taps, drags etc... deep. Most chromium browsers present a button right in the address bar or at least conspicuously in the main menu. Moreover, they allow developers to ask for the ability to prompt users to install the app.
https://adactio.com/journal/18252
https://adactio.com/journal/22757
Apple forces their employees to debase themselves in order to defend this status quo. eg:
https://github.com/w3ctag/design-reviews/issues/1245
https://github.com/WebKit/standards-positions/issues/619
Take care. And keep that math not mathing!
> Incorrect, see my link. PWA installation on iOS is simple and idiomatic
> Share > Add to Home Screen.
Are you sure "share" is idiomatic here?
Also calling a 6 steps process simple is laughable. One-click prompt to install is simple and part of PWA API that safari doesn't implement.
> edit: also, your site is just obviously biased/poorly done
If you can offer recommendations for data-based improvements, I'd sincerely appreciate it! It was made without any concern for Safari "winning", as is probably obvious since it has the lowest score. Methodology described here: https://pwascore.com/about
lol, not after you behaved so disgracefully here. at the very least, fix the math as i said more than once
The math is correct, see /about for methodology and this summary from the "How Scores Work" panel.
background capabilities is 0 for all browsers. there were other weird inconsistencies as well. We can completely leave to the side that your weighting scheme is surely arbitrary or perhaps even biased.
Because they're experimental. Since that's confusing even with a key, it may be better to hide experimental features/categories by default.
> We can completely leave to the side that your weighting scheme is surely arbitrary or perhaps even biased.
Hover on any number to see both "raw" and "with experimental/non-standard features" scores. If you do this to the overall score, you'll see that Firefox benefits the most from this.
True that. Apple has strong economic incentives to nerf PWAs, and I don't share their privacy concerns about web bluetooth. If anything, forcing users who need bluetooth to install shady third-party browsers creates way more risk. Based on beacio's download numbers, quite a few people would rather have web bluetooth available in their default browser.
>safari is NOT capable of PWAs... > They deliberately hobble PWAs and make them very difficult to install.
Hit the share button, "Add to Home Screen" is very difficult to install?
If you know how many get rich quick guru online are teaching people vibes code and submit apps and faceshift to other apps later, you won’t be surprised the App Store model is no longer sustainable.
F-Droid's great but their build queue has had multi week waits too, difference is you can see exactly where your build is stuck instead of guessing.
You can also choose to host your own repositories like futo and new pipe do.
Part of the value of F-Droid is the curated distribution model that hopefully catches the worst behaving developers that think they have a god given right to your data though.
Hopefully the process is straight forward so others can easily pick it up.
Yea I noticed that as well. Even longer than Apple's.
FYI Samsung's is even worse.. 6-8 weeks. Hope you get it right the first time you submit your app.
I submitted Signage Sync (https://signagesync.app) last year, still on my third review. Fingers crossed:)
Yep, I always expect 2-3 months to get an app onto Samsung TVs and those are just variants of a white-label base which already passed their QA multiple times. LG is even worse for the initial review but they accept redirects to hosted apps so at least there's no need to ever deal with them again after launch.
I just pulled a PWA app off the app store and I am going to keep it a pure PWA. It's installable, offline-first. I know I feel like I'm swimming against the current but I would love people to try to push for awareness of PWA installs more.
I'd love to see people distribute their apks directly.
Itch.io is an option for people who don't want to set up a site or handle payments. While they focus on games, they're cool with distributing non-games:
https://itch.io/blog/32835/itchio-isnt-just-for-games-check-...
I personally have a TrustedWebActivity. Most update doesn't need a review because I only need to update server-side. Behave like a PWA while being an Android App. (And you can implement Android Auto, other native stuff)
It allows the users to discover my web app through the Google Play Store. My app was also available as a PWA but I mostly push the TWA currently.
FWIW, this has not been my experience. Google Play usually approves within 24 hours for me still. Apple has been taking over a week though.
When Shopify announced their shift from React Native, this is actually what was on top of mind for me. Week+ delays for critical bugfixes is insane. Being able to patch things with OTA updates is tablestakes at this point.
I think inconsistency is really annoying. Hard to rely on it. Most of our reviews clear with a couple hours, but sometimes it gets stuck for days.
This is why goverments have appeal processes and layers of tribunals. To be judged and found guilty by a corporation takes away all your rights.
Do you happen to live in a country where your government departments are known for rapid processing? (not weeks of delay like we're talking about here).
I generally see my legal system create severe delays (regardless of how much that victimises or costs everyone involved)
> I generally see my legal system create severe delays
Better a delay that getting your account closed without recourse. But you are right, years of conservative governments have starved the government and its services are slower than they should around the west world.
Not sure how it works behind the scene, but our app (present on the store since 2018) is taking a couple hours at best with Google, and usually less than 24h with Apple.
Very much likely an automated triage based on code change or complexity.
Could this be partly caused by the explosion of AI-assisted app development?
It feels like almost anyone can now build an app and get something publishable within a few days. If the number of submissions has grown significantly, it would make sense that the Play Store review queue is getting longer.
AI may have made building the app much faster, while unintentionally making the final step slower for everyone.
Personally, I think the review process should prioritize updates to apps that have already been published for a long time over completely new apps or apps that were only submitted recently. At least that would make it less painful for established apps waiting for a routine update to get through the review process.
Making Android apps was my introduction to publishing software. I remember in ~2011-2012 you could upload an APK and it would be published immediately and the Android Market had a "New" page which was just a chronological feed of recently published or updated apps. Just uploading your app update was an easy way to get ~500 free downloads which I found very exciting.
At the time I couldn't imagine paying $99 for an Apple Developer account and waiting a week to publish my app...
Why do people still want to make Google more powerful? I don't get it. Legislation must allow for break up of monopolies such as google play.
I started coding around 2013, picked up a book, learned Java and started building Android apps. It was fun at the time, and pretty painless to get your app in the store.
Fast forward to last year, with all the rage about coding tools, I got into building small projects again, and built a simple app. After a decade from posting my last app on Google Play I resurrected my account, and started going through the process of publishing an app today... And how awful things got!
Back then it was essentially, title, description, upload your Apk and some screenshots and you're done! Now there are reviews, privacy policy, endless amount of forms and information you need to fill out. I get why (some) things are the way they are today, but when you just want to make an app for fun, getting it out there just feels like work. I gave up on the app, made it into a website, and in the end it actually felt better (and so much easier).
This is one part where it should really just be done by AI for 99% of the cases. Just have a security focused AI model that is biased towards flagging things a bit more conservatively.
Only apps that get flagged by the AI reviewer then have to go through a separate, slower human review process.
Longer than an average App Store review (which is heavily criticized for being too long)? Hilarious
I believe the App Store has switched to automated reviews, at least for updates. I've had my app updates approved in <1h on a regular basis starting this summer.
From what I was able to see from the outside, App Store has had semi-automated reviews for updates in basically forever (+ some random spot checks), presumably based on some introspection that only triggers a human review if a new system API was used.
I've noticed this
Google Play is regularly slower now than App Store Connect, which never used to be the case
The google review process is the best advertising for f-droid there could ever be.
I have three apps on the Play Store, they all take a couple hours to pass review and their auto-testing/review systems often catch little bugs I didn't almost immediately.
Getting a new app on the store is a bit cumbersome, but it should be.
I've published hundreds of apps over the past 6 years and Google's review times had a similar spike during covid. It took a very long time to recover but now it's back to being bad, I can confirm that.
I wrote about it a while ago, might be time to upsate that post. https://webtoapp.design/blog/time-to-publish-apps
Hang on. You've published hundreds of apps? As in the same thing slightly modified several times?
Indeed their product is an app that is little more than a webview that only shows one website, with optional value-add features. They handle publishing for the client, hence the hundreds.
https://webtoapp.design/
We push updates for our app pretty frequently and they've been passing review in an average time of 1 hour (around 7 updates in the last 60 days). Hope it stays that way.
Still trying to get a Play Store page with stats onto my AI Impact page, but if their numbers are anything like Apple's (and they're likely much higher), then it's a tough life for them right now:
https://vester.si/ai-impact/appstore/
Meanwhile, the Web is ever more powerful. But now Android and iOS users expect to find things in the App store only.
I just submitted an open source android passive income app [0]. It's been two weeks and I'm still waiting. It's my first app though.
[0]: https://github.com/proxybasehq/proxybase-gui
This is a big part of why React Native (and especially EAS) is still my preferred native development platform. The ability to ship OTA updates directly without depending on platform reviews & rollout schedules is a killer feature I'm not sure I could live without.
Can confirm. Took about 8 days for my last app update, and about 5 or 6 for the Play Store listing update.
As someone new to the app publishing world I am surprised at how strict the requirements are, given the absolute dross you can find published.
We should write more web apps, more PWAs and have some sort of a way to distribute those without proprietary app stores. It's true not every mobile app can be a web app, but for a lot of cases web apps work great.
In fact, I'd support Google with this policies if they'd also take full accountability if my phone gets hacked. Do they? No, so it's unfair and a bad authoritarian way to create another walled garden.
I think that the app targeting Android Auto should be pointed out. Google Play reviews are mostly automated and it shouldn't take more than a few hours. Android Auto is heavily curated for good reasons.
Everyone that ingests code is seeing an order of magnitude more of it thanks to LLMs, even existing apps are producing more updates. It's the same sort of thing github keeps failing to keep up with.
For all the complaining about Apple's store, the Play Store has always been worse imo. You can't even release an app without first doing a beta test with at least a dozen people.
> You can't even release an app without first doing a beta test with at least a dozen people.
Perhaps I'm misunderstanding what you are saying here but less than a month ago I released a brand new app with no beta period, direct to production (white labeled app, which is why I didn't need a beta)
As an individual that 'dozen people beta test' is required. It's not required if you're a business. Also depends on when your account was created.
https://support.google.com/googleplay/android-developer/answ...
I think it only applies to newer accounts and individual rather than company accounts. To make things worse, Google doesn't allow you to switch an account from individual > company. You need to create a whole new account.
Same happened to me yesterday, I published a new app and it was reviewed and published within a few hours without any beta testing. but I think this is why I see people ready to buy old playstore accounts for real money, maybe this only affects new accounts
I'm just working on my first app (thanks to AI...) and if you have a new dev account created sometime after 2023 they are making you do a 12 person, 14 day beta run before anything else occurs, apparently.
It gets worse! If Google decides the people in your test don't engage enough and/or you didn't respond to their feedback, they may not give you production access. I've got a game that's available on iOS, I released there first and did lots of testing to deal with the low-hanging bugs. After doing the 14 day test Google emailed me:
Possible reasons why your production access could not be granted include:
Anecdata: I've pushed out dozens of small code fixes to My PlayHome Plus over the past month and none of them took more than a few hours to be reviewed.
This will only change once a new player rises. We live in a world full of blind consumers that won't look out of the Google and Apple walled gardens.
Huh.
On the flip side, googles release infra provides much more functionality for apps that already has scale. I wish apple were more production oriented too.
I know this is quite the controversial idea. But I'd personally love a fee per app, just to counter spam, say 100usd/app.
The joy of a world with a duopoly reigning over a strategic core market We're really into the South Park cliché: Anal douche or Shit Sandwich.
I wish regulators across the world did something about this, but even Europe shy attempts aren't moving the market in a better direction.
It's depressing to see a company that thrived from the open internet becoming such an evil piece of cyberpunk lore. I mean... Nobody really expected Apple to care about anything else than its bottom line. But I'm not alone to have had hopes about Google.
When I die, I think not fighting Google when it was still time will be one of the regrets I'll drag into my grave.
If developers want to get the same processing speed, are we ready to pay as much as we pay for Apple App Store?
Our app rarely takes longer than a day, but it doesn't have Android Auto support so maybe that's the difference?
Interestingly, I published a completely new app yesterday, and it was reviewed and published in less than 2 hours.
In the opposite, Google Chrome extensions are now reviewed in a few hours, sometimes less than one hour.
Depends on how trusted account/apps are. I have some old apps that are reviewed in 2-3 hours every time
I just updated 2 dormant apps for the first time in 10 years; It took 2 days, and the apps were approved on a sunday.
yo, it was usually taking two hours max..now i released two ios verosions while android one still under review.. w.t.f google
You would think that with the AGI that these companies are hyping the review happens in minutes. Weird.
Guess both are excused for not having up to the par approaches available.
A public FTP server is next app store.
This isn't my experience. My updates usually get accepted within hours. Apple takes days usually.
IMO/IME (as former mobile developer) mobile app development is obliterated.
This is fight for big dogs now.
Strange. I had an app the other day approved in hours on Google 15 days on Apple.
I haven't pushed an update since June, but this has not been my recent experience...
A week-plus review queue basically kills any chance of a quick hotfix for a free app.
Stop deploying software onto closed platforms. There's no excuse.
I find it super funny that all sorts of garbage goes into the AppStore, PlayStore. They both make ridiculous amounts of money, immense profit margins, I don't remember how much, they never publish the numbers, but likely in the 60-70%.
And yet there are STILL tons of developers defending app stores.
That's quick. The Slack App review takes 10+ weeks.
yeah my 'promptly AI' alarm clock almost always spends 7 days, as soon as the binary changes, even descriptions changes take several days
Sometimes several weeks in my recent submissions.
Now, let's compare with "google friendly" apps: https://www.apkmirror.com/uploads/?appcategory=youtube :)
It took the whole year before v21 was finally approved, so seems only fair they publish minor v21 revisions multiple times a day!
21.37.42-SECONDARY is an interesting version number, don't they like final-final2 in their version numbers?
Apple's App Review has also been slipping over the past few months. I have multiple apps that have taken days, up to a week to be approved.
What's most galling is that if you use CapacitorJS or similar you can ship app updates instantly to your users but if you write native first-class OS citizen apps you are penalized.
There is nothing quite so annoying as having a fix for a bug people are running into and have zero control over when it will get out to them.
Google's review is complete horseshit. It has been darkly funny to watch them try to compete with Apple by adding strict review (way stricter than Apple's) and still terrible applications make it in while legitimate ones have trouble.
Just go back to the way it was before, and scan the apps with static analysis tools. This security theater is stupid and always was (for Apple and Google).
not my experience... I have most updates go through in <24h.
Same happened for CoMaps (which unfortunately does not have 12+ years of presence going for it)
> AI is becoming part of how people experience the web every day. We want to make sure that doesn’t mean people are chained to one company’s self-serving pipeline.
Ah yes, the extremely diverse offering of OpenAI, Google, Anthropic, Microsoft, and Mistral (a fake "euro" chatbot). Mozilla is truly a "people's" company.
Sounds like a clear "find another store" message to me.
[flagged]
[dead]
[flagged]
[dead]
[dead]
[dead]
[dead]
I'm not familiar with this space (new to Android), could someone explain why there hasn't been additional "app stores" appear that people can use?
It's coming soon. Android have been pushed to accept third-party app stores.
A new era for choice and openness : https://android-developers.googleblog.com/2026/03/a-new-era-...
There have been, but most non-technical users don't care or don't go through the hassle of using them.
Is there any that I should be looking into?
F-droid is the biggest one
Check out droidify or neo store for a better front end to f-droid
I use Foxy Droid.
It's unfortunate the official f-droid client is an unusable mess. (I stopped using it years ago, maybe they fixed it.)
There's also f-droid classic, can't remember why I use foxy droid over it.
The Huawei AppGallery is hundreds of times bigger.
I hope someone will sue the ever-loving shit out of Apple when their foot dragging prevents a critical update from going out in time to prevent a 0-day from being widely exploited.
Interesting. And all the history of Kafkaesque review interactions that various developers have had could be subpoenaed, as evidence of a pattern: that delays aren't necessarily due to excellence and good faith.
Given the sibling reply, I can imagine them claiming national security prevents them from releasing those records. But that’s okay; I am fairly certain we can find enough developers willing to tell their tales.
You can request an expedite review from Apple. We already did this, and our app was up in the next 1-2 hours.
Why can't you wait for a week? That doesn't sound like a long time.
For a critical bug fix, a week can be a very long time.
with ai agents and everything even hours can be a long time. I think google playstore should be responsible for all the damages...
For apps with a scale, it's a long time
Because? People wait far longer for much more important things in real life.
Speed is money. Yes people wait for 9 months for having a baby, doesn't mean you should wait 9 months for an app release. That is not a sound logic.
Yes, but one week to wait for your app is nothing to complain about.
Sometime there are 0 days etc.. So, maybe you should have broader view on things instead of simple assumption.
You should want higher speed and quality of service from your vendors. In this case, apple is paid wonderfully for it.
Apple has some “trust” for vetting things, and with the wave of slop-apps it fine with a slight delay so the App Store doesn’t become riddled with slop like the android store.
Review speed and slopness are related but not exclusive to each other.
Definitely not exclusive, though I believe they are related enough to not tank one for the other. If a review is 2 seconds and done, then the circle for figuring out the mvp slop app is pretty slim.
You can imagine with the AI models we have now, many of the stuff reviewers do could be automated to a large extent. They can also determine through binary diffing that functionality changes may be limited etc. Many things can be done to eliminate majority of the queue for example.
Some stuff the reviewers do could easily be automated. I’m off the mindset everything the reviewers do shouldn’t be automated however, as llms do hallucinate and are still susceptible to ghost prompts.
At the infinite app review scale (some apps malicious, illegal, rip-offs), extra time is inevitable.
let's say you have a bug that makes your app unusable. If you can't get an update our for a week - people are going to just stop using your app.
You shouldn't have shipped that bug in the first place, I would say. If the bug comes from an Android update, I assume that developers have had access to betas long before the system update is rolled out.
Why do you think apple has point releases that fix... Bugs every time? Not necessarily new features but bugs.
Lesson in there.
Do you mean that these point releases introduce bugs that break third party software?
I decided not to engage with you. Not productive.
And you know 100% all the bugs are visible at all times.
For new accounts yes, for older accounts it's much faster in my experience.
Apple has it's own issues, they often just answer with a random question so they can kick the review down the line. "Are you sure this is your pricing?" "Can you confifrm you have not selected that country" and then you have to wait another 2 days.
TFA is a post from an established developer and showing a screenshot for the submission of an update to a longstanding app (Conversations XMPP chat client).
My experience. I submit about 20-30 apps per year