101–110 of 259 posts
Earlier quoted context omitted.
I’m with you, let us install programs like on a PC.
It wouldn't even be hard to achieve security: (1) sandboxing, (2) permissions system, (3) database of bad app signatures, (4) heuristics based monitoring. Most of this is already in place. There's no excuse except money and power.
Earlier quoted context omitted.
If that's the thing Google is trying to address, they can easily incentivize it - Java apps are usually quite easy to decompile and check. Search for library versions in use, force upgrades on security vulnerabilities. But they're not doing that. So clearly their goal is something else.
"Force" upgrades? What do you mean?
I'm more an infra guy, and such scans are actually absolutely awesome. I see everything in my k8s clusters, all java/python dependencies that need attention.
I'm more surprised how anyone can run an app for more than 2 weeks with no high severity vulnerabilities. I guess mobile doesn't have the same attack vectors, but still
Our company just got a warning that we have sixty days to release something on Play or have our developer console account closed. The email made it pretty clear that Google wants developers to continuously push new versions to customers. We have no new features nor bug fixes in backlog. There is nothing to update. The only purpose of our software is to control hardware that our company makes. Nobody uses it for fun,…
[flagged]
I noticed this banner on one of my own apps while installing it for my mom on a new phone. The banner said "This app has fewer users than others...", almost as if they are discouraging users from installing it without even informing me. I looked it up online and it seems like many people have begun seeing this. I am linking a thread. If anyone from Google is reading this, such opaque policies are not appreciated!
It does seem like an Anti-Pattern. Presumably (some faction inside) Google wants to warn users about scam apps. However this seems like blatant shaming and ostracization of smaller developers who did not spend $$$$$ on Marketing through Google's Ad Network. Seems Monopolistic of Google to me.
If I uninstall it, do I still count or not?
Our company just got a warning that we have sixty days to release something on Play or have our developer console account closed. The email made it pretty clear that Google wants developers to continuously push new versions to customers. We have no new features nor bug fixes in backlog. There is nothing to update. The only purpose of our software is to control hardware that our company makes. Nobody uses it for fun,…
You can update the version number and re-release. I think this may grant also adding the update note "Updated version number. Nothing else. Thank you Google".
Earlier quoted context omitted.
"Force" upgrades? What do you mean?
Check for vulnerabilities in dependencies and do the same thing they described in this post, just with... meaningful feedback. I'm more an infra guy, and such scans are actually absolutely awesome. I see everything in my k8s clusters, all java/python dependencies that need attention. I'm more surprised how anyone can run an app for more than 2 weeks with no high severity vulnerabilities. I guess mobile doesn't have t…
Sure, you can bend your scope to make them relevant... but if you've got someone who can control your system in ways you didn't build by bypassing the OS protections, they already have control of the device and can do darn near anything. If you haven't protected from that, and it's frequently not possible, many other protections are meaningless.
Your backend though has to handle this kind of malicious-modified-client scenario, as well as random connections from code you don't control at all.
(This is not true for all apps of course, but for B2B stuff? Most small companies? Frequently valid)
Earlier quoted context omitted.
Not OP, but depending on the industry, this could be enormous amounts of backend work. I have projects that needs to be validated, which effectively means a huge amount of human testing for any change. The Process is confirmed to work on version X.Y.Z and nothing else.
Ah interesting. Even so for like a small styling change?
Earlier quoted context omitted.
I’m with you, let us install programs like on a PC.
It wouldn't even be hard to achieve security: (1) sandboxing, (2) permissions system, (3) database of bad app signatures, (4) heuristics based monitoring. Most of this is already in place. There's no excuse except money and power.
No, it's in 10 different places.