Your app is not compliant with Google Play Policies: A story from hell

Post by marcus_holmes » Tue, Jan 18, 2022, 12:32 PM UTC

onion2k wrote: post #35

marcus_holmes wrote: post #31

Earlier quoted context omitted.

I see this and think of all the millions of apps that the code controls. I don't know how many do fail validation, but it's clearly not a vast number, definitely under 1%. Given that they're also clearly training a model for this, based on a large number of inputs and rules, then this is pretty good. Their end goal is clearly to be able to remove humans from this process completely. Which is good - it's shitty work.…

I don't see apps that fail validation, and there are too many (shitty) apps anyway - more validation is good. You've failed to understand your own problem. You're seeing lots of shitty apps. That means the validation isn't working because part of the validation process is supposed to make sure apps are of sufficient quality. So no, you don't see apps that fail validation, you see apps that should have failed validati…

Post by viraptor » Tue, Jan 18, 2022, 12:40 PM UTC

jevoten wrote: post #171

freedomben wrote: post #120

Earlier quoted context omitted.

I despise the tell them nothing approach and I think it's despicable, but that said I think there is a more legitimate reason than the lawyers. If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store. I don't think that justifies the harm it does to regular people, but it…

> If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store. Is it? Because spammers and malware writers are the only ones that already know what they did wrong - spamming and malware! While everyone else is left guessing.

Post by UncleMeat » Tue, Jan 18, 2022, 1:07 PM UTC

RNCTX wrote: post #176

UncleMeat wrote: post #134

Earlier quoted context omitted.

> This kind of incompetence makes me seriously doubt that Google is doing anything to more substantially review apps for deeper security issues, either statically or at runtime. I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vu…

> I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vulns and ensure that you don't inundate users with false positives, forcing them down the admittedly limited support channels. Pay people to do tiered support. "but that costs m…

Post by phreack » Tue, Jan 18, 2022, 2:48 PM UTC

plorkyeran wrote: post #124

phreack wrote: post #113

Earlier quoted context omitted.

But the question is why you shouldn't be able to sideload an app at all. Having a curated store is pretty cool, and you can have that while also letting users install their own apps manually (even with barriers, making it as hard as they like).

Developers only put up with the curated app store because it's the only option. If there was an alternative, major companies would mostly choose to bypass the app store, leaving it a barren wasteland like the Mac app store. If Apple allowed sideloading but went out of their way to make it obnoxious enough that everything which could be would still go through the app store, you'd just have all of the exact same compla…

Post by jevoten » Tue, Jan 18, 2022, 5:04 PM UTC

viraptor wrote: post #183

jevoten wrote: post #171

Earlier quoted context omitted.

> If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store. Is it? Because spammers and malware writers are the only ones that already know what they did wrong - spamming and malware! While everyone else is left guessing.

They know in general, but they don't know exactly which check they tripped and why. That makes it harder to hunt down the detected part.