6 ms·

I imagine the comments will be either: its your fault, dont trust google and have a strategy that totally relies on a party out of your control, & in this day a

by wand3r 8y ago

I imagine the comments will be either: its your fault, dont trust google and have a strategy that totally relies on a party out of your control, & in this day and age you have to do this and this happened to me with google/apple/paypal/microsoft etc. While i think relying on google (or a single platform) is dangerous, these platforms really need to address these issues. While their isn’t much competition, they are really eroding developer trust. Developers may decide to build for an entirely different platform or work on a different idea that is outside mobile. This ultimately hurts app stores and this these platforms. Short term a small amount of discontent doesnt matter, but it could reach a tipping point.

bad_user 8y ago
> “This ultimately hurts app stores” Good, app stores need to die.
- ben_w 8y ago
  App stores are the least-unreliable mechanism I have to trust executable code. I don’t even enable JavaScript by default. Do you have an alternative trust mechanism that can’t be subverted via, for example, algorithmic voting?
  - grawprog 8y ago
    >App stores are the least-unreliable mechanism I have to trust executable code. And yet almost weekly I read a new story about malicious apps being found in app stores. Like this one posted today: https://arstechnica.com/information-technology/2019/02/google-play-caught-hosting-an-app-that-steals-users-cryptocurrency/ https://arstechnica.com/information-technology/2019/02/googl... Personally I trust things from app stores about as much as I trust random things from the web.
    - ben_w 8y ago
      Which is why I phrased it “least unreliable” rather than “best”.
      - grawprog 8y ago
        Considering there aren't many totally reliable ways to avoid shady software save going through the source of a program line by line and verifying it yourself, least-unrealiable sort of comes across as best.
  - SamReidHughes 8y ago
    I think you should be crediting sandboxing for that.
  - dvfjsdhgfv 8y ago
    A generalization is not necessary here, for me there is a huge difference between Apple's App Store and Google Play. The former actually has real people behind it that you can talk to, also on the phone, and who are really friendly and will reach out to help you fix problems. Also, they do really review the app, obviously using automated tools, but still there's some human involvement. Google tries to be smarter than everyone else but they're not. Many people have this love-hate relationship with them, but recently there's less and less love in it.
    - deleted 8y ago
      [deleted]
  - 43920 8y ago
    I think there's a couple solutions to this. First, "trust" should depend on your own evaluation of the developer, based on metrics like how long their app has existed, customer reviews, what protections they have around handling data, etc. You have the ability to do a much better job evaluating trust than Apple or Google are likely to. But even beyond that, sandboxing needs to be made effective enough that even if you do install a malicious app, it doesn't matter. iOS actually does a really good job of this - apps are contained in their own sandbox, and have to get your permission to access any sensitive data, which you can easily choose to accept or deny. There are also limits on resources, and apps can't do much to your system unless you actively open them, which makes it really easy to escape from a bad app. I know you mentioned disabling javascript, but browsers are also a really good example of this. Browsers run your code in a sandbox, and the rendering engine itself is sandboxed in case of bugs. As a result, you can pretty much visit any random website and know that it won't compromise your system - as far as I know, there haven't been any widespread attacks using browser vulnerabilities since sandoxing was introduced (except maybe Internet Explorer, which doesn't really count). The worst that can happen is that a browser tab starts using too many resources or doing something annoying (like autoplaying a video), and you can just close the tab and make it go away.
    - sonnyblarney 8y ago
      ""trust" should depend on your own evaluation of the developer, based on metrics like how long their app has existed, customer reviews, what protections they have around handling data, etc. You have the ability to do a much better job evaluating trust than Apple or Google are likely to." Wow - no, we do not have the ability to ascertain the overall trustworthiness of a dev, certainly not better than Google or Apple. Reviews can be faked, and 'how long their app has existed' is not a very good measure of anything. Their T&C's on 'protections' don't mean anything if they are not already trustworthy. So unfortunately, this is one of the valuable things that AppStores can provide.
      - 43920 8y ago
        Assuming the developer has been in business for a significant amount of time, there are a lot of signals that help tell you whether an app is legit or not. As a random example, if I look for information aout Overcast (a fairly successful app from an independent developer), I get: * A bunch of reviews from users, very few of which sound fake: https://itunes.apple.com/us/app/overcast/id888422857 https://itunes.apple.com/us/app/overcast/id888422857 * Articles about the app from well-known websites: https://9to5mac.com/2018/04/29/overcast-versus-apple-podcasts-app/ https://9to5mac.com/2018/04/29/overcast-versus-apple-podcast... * A wikipedia article: https://en.wikipedia.org/wiki/Overcast_(app) https://en.wikipedia.org/wiki/Overcast_(app) * Information about the developer: https://marco.org/about https://marco.org/about You could fake all of this, but it would be really difficult and expensive, and probably wouldn't work in the long-term. It's true that for a brand-new app from an unknown developer, it's difficult to say what their intentions are, but Google and Apple don't really have any more information to go off of than you do regarding that - at best, they likely have the developer's contact information, but you can probably find that yourself as well. Additionally, the nice thing about sandboxing and permissions is that you don't really have to trust the developer in order to run an app. For example, the other day I was looking for a protractor app that would give me measurements in tenths of a degree, and I found this app [1]. Aside from a few reviews (which, as you said, could easily be fake), I know absolutely nothing about this developer - for all I know, they could be trying to steal all my data. But because iOS sandboxes everthing, they won't actually be able to access any of my data or do anything bad unless I approve it, and if I don't like the app, I can press one button and get rid of it. As a result, I can feel comfortable installing the app anyway, even if I don't trust the developer. [1] https://itunes.apple.com/us/app/angle-pro/id750327028 https://itunes.apple.com/us/app/angle-pro/id750327028
  - AnaniasAnanas 8y ago
    > App stores are the least-unreliable mechanism I have to trust executable code More so than the repositories that various linux distros use? I honestly think that something like apt for android would be a much better solution - too bad, it will never happen because it would mess with google's monopoly.
    - GordonS 8y ago
      There are Play Store alternatives, such as F-Droid, Aptoide and ApkMirror. But it still comes down to discoverability and trust - you need to know about and trust these alternatives, and you need to change a setting on your device to "allow untrusted sources".
    - yoz-y 8y ago
      Distro repositories are great but they are several orders of magnitudes smaller than the app stores. Ubuntu has ~50k packages available, app stores host millions of apps. Package maintainers to a great job but I don't think this model can scale up.
  - drcharris 8y ago
    The trust you have in an app store is because you believe in their processes for auditing apps. But the two do not need to be linked. Google Play Protect, for instance, works just fine on sideloaded apps or apps downloaded from other stores. The distribution and marketing channel don't need to be the same as the trust mechanism. There's a whole anti-malware industry out there that can do the latter, and could easily do as good a job as Google currently do.
  - lazyjones 8y ago
    > App stores are the least-unreliable mechanism I have to trust executable code. I don’t even enable JavaScript by default. How did the rest of us ever live through the 80s and 90s when we had to purchase software from physical stores based on reviews in magazines and word-of-mouth... More seriously, the PC software industry works well without app stores, download sites usually check for malware to some extent and successful publishers earn trust by not screwing over their users.
Wowfunhappy 8y ago
> Dont trust google and [don't] have a strategy that totally relies on a party out of your control Last week, much of Google and Facebook were brought to a halt after Apple revoked their enterprise certificates. While the circumstances justified Apple's actions in this case, the fact remains that even Google and Facebook are largely reliant on another large company. If Apple completely banned all Facebook apps from the app store tomorrow... well, Facebook would probably survive, but it would be a serious blow. I don't see how you can not be reliant on Apple/Google.
- coliveira 8y ago
  > I don't see how you can not be reliant on Apple/Google. This is the very definition of a monopoly, isn't it? If the government was working properly, it would be ready to break up these companies, as well in other areas of oligopoly such as oil and banking.
  - deleted 8y ago
    [deleted]
  - j88439h84 8y ago
    Well, there's two of them.
    - sundvor 8y ago
      Duopoly, then ogliopoly after that.
  - usaphp 8y ago
    > MONOpoly > thESE companIES
    - ashelmire 8y ago
      Antitrust covers market manipulation and coercion though, which you could easily argue these companies have (monopoly over certain platforms such as the iPhone; magically identical pricing).
m-p-3 8y ago
> have a strategy that totally relies on a party out of your control If it's possible to implement the app as a PWA sure, but then discoverability becomes an issue. Sadly, App Stores are a natural monopoly and everyone expect them to be fair but they clearly can't.
- sverhagen 8y ago
  Are they a natural monopoly by choice or by necessity? Not sure what "natural" means, here. I could imagine some sort of federation that would make them less of a monopoly, understandably not Google's choice, though.
  - pas 8y ago
    Natural probably means that for a given mobile platform it's natural - due to network effects and other market forces (e.g. the platform owner heavily subsidizing/supporting their choice of store) - for one store to emerge as a monopoly.

by wand3r 8y ago

bad_user 8y ago

> “This ultimately hurts app stores” Good, app stores need to die.

ben_w 8y ago
App stores are the least-unreliable mechanism I have to trust executable code. I don’t even enable JavaScript by default. Do you have an alternative trust mechanism that can’t be subverted via, for example, algorithmic voting?
- grawprog 8y ago
  >App stores are the least-unreliable mechanism I have to trust executable code. And yet almost weekly I read a new story about malicious apps being found in app stores. Like this one posted today: https://arstechnica.com/information-technology/2019/02/google-play-caught-hosting-an-app-that-steals-users-cryptocurrency/ https://arstechnica.com/information-technology/2019/02/googl... Personally I trust things from app stores about as much as I trust random things from the web.
  - ben_w 8y ago
    Which is why I phrased it “least unreliable” rather than “best”.
    - grawprog 8y ago
      Considering there aren't many totally reliable ways to avoid shady software save going through the source of a program line by line and verifying it yourself, least-unrealiable sort of comes across as best.
- SamReidHughes 8y ago
  I think you should be crediting sandboxing for that.
- dvfjsdhgfv 8y ago
  A generalization is not necessary here, for me there is a huge difference between Apple's App Store and Google Play. The former actually has real people behind it that you can talk to, also on the phone, and who are really friendly and will reach out to help you fix problems. Also, they do really review the app, obviously using automated tools, but still there's some human involvement. Google tries to be smarter than everyone else but they're not. Many people have this love-hate relationship with them, but recently there's less and less love in it.
  - deleted 8y ago
    [deleted]
- 43920 8y ago
  I think there's a couple solutions to this. First, "trust" should depend on your own evaluation of the developer, based on metrics like how long their app has existed, customer reviews, what protections they have around handling data, etc. You have the ability to do a much better job evaluating trust than Apple or Google are likely to. But even beyond that, sandboxing needs to be made effective enough that even if you do install a malicious app, it doesn't matter. iOS actually does a really good job of this - apps are contained in their own sandbox, and have to get your permission to access any sensitive data, which you can easily choose to accept or deny. There are also limits on resources, and apps can't do much to your system unless you actively open them, which makes it really easy to escape from a bad app. I know you mentioned disabling javascript, but browsers are also a really good example of this. Browsers run your code in a sandbox, and the rendering engine itself is sandboxed in case of bugs. As a result, you can pretty much visit any random website and know that it won't compromise your system - as far as I know, there haven't been any widespread attacks using browser vulnerabilities since sandoxing was introduced (except maybe Internet Explorer, which doesn't really count). The worst that can happen is that a browser tab starts using too many resources or doing something annoying (like autoplaying a video), and you can just close the tab and make it go away.
  - sonnyblarney 8y ago
    ""trust" should depend on your own evaluation of the developer, based on metrics like how long their app has existed, customer reviews, what protections they have around handling data, etc. You have the ability to do a much better job evaluating trust than Apple or Google are likely to." Wow - no, we do not have the ability to ascertain the overall trustworthiness of a dev, certainly not better than Google or Apple. Reviews can be faked, and 'how long their app has existed' is not a very good measure of anything. Their T&C's on 'protections' don't mean anything if they are not already trustworthy. So unfortunately, this is one of the valuable things that AppStores can provide.
    - 43920 8y ago
      Assuming the developer has been in business for a significant amount of time, there are a lot of signals that help tell you whether an app is legit or not. As a random example, if I look for information aout Overcast (a fairly successful app from an independent developer), I get: * A bunch of reviews from users, very few of which sound fake: https://itunes.apple.com/us/app/overcast/id888422857 https://itunes.apple.com/us/app/overcast/id888422857 * Articles about the app from well-known websites: https://9to5mac.com/2018/04/29/overcast-versus-apple-podcasts-app/ https://9to5mac.com/2018/04/29/overcast-versus-apple-podcast... * A wikipedia article: https://en.wikipedia.org/wiki/Overcast_(app) https://en.wikipedia.org/wiki/Overcast_(app) * Information about the developer: https://marco.org/about https://marco.org/about You could fake all of this, but it would be really difficult and expensive, and probably wouldn't work in the long-term. It's true that for a brand-new app from an unknown developer, it's difficult to say what their intentions are, but Google and Apple don't really have any more information to go off of than you do regarding that - at best, they likely have the developer's contact information, but you can probably find that yourself as well. Additionally, the nice thing about sandboxing and permissions is that you don't really have to trust the developer in order to run an app. For example, the other day I was looking for a protractor app that would give me measurements in tenths of a degree, and I found this app [1]. Aside from a few reviews (which, as you said, could easily be fake), I know absolutely nothing about this developer - for all I know, they could be trying to steal all my data. But because iOS sandboxes everthing, they won't actually be able to access any of my data or do anything bad unless I approve it, and if I don't like the app, I can press one button and get rid of it. As a result, I can feel comfortable installing the app anyway, even if I don't trust the developer. [1] https://itunes.apple.com/us/app/angle-pro/id750327028 https://itunes.apple.com/us/app/angle-pro/id750327028
- AnaniasAnanas 8y ago
  > App stores are the least-unreliable mechanism I have to trust executable code More so than the repositories that various linux distros use? I honestly think that something like apt for android would be a much better solution - too bad, it will never happen because it would mess with google's monopoly.
  - GordonS 8y ago
    There are Play Store alternatives, such as F-Droid, Aptoide and ApkMirror. But it still comes down to discoverability and trust - you need to know about and trust these alternatives, and you need to change a setting on your device to "allow untrusted sources".
  - yoz-y 8y ago
    Distro repositories are great but they are several orders of magnitudes smaller than the app stores. Ubuntu has ~50k packages available, app stores host millions of apps. Package maintainers to a great job but I don't think this model can scale up.
- drcharris 8y ago
  The trust you have in an app store is because you believe in their processes for auditing apps. But the two do not need to be linked. Google Play Protect, for instance, works just fine on sideloaded apps or apps downloaded from other stores. The distribution and marketing channel don't need to be the same as the trust mechanism. There's a whole anti-malware industry out there that can do the latter, and could easily do as good a job as Google currently do.
- lazyjones 8y ago
  > App stores are the least-unreliable mechanism I have to trust executable code. I don’t even enable JavaScript by default. How did the rest of us ever live through the 80s and 90s when we had to purchase software from physical stores based on reviews in magazines and word-of-mouth... More seriously, the PC software industry works well without app stores, download sites usually check for malware to some extent and successful publishers earn trust by not screwing over their users.

Wowfunhappy 8y ago

> Dont trust google and [don't] have a strategy that totally relies on a party out of your control Last week, much of Google and Facebook were brought to a halt after Apple revoked their enterprise certificates. While the circumstances justified Apple's actions in this case, the fact remains that even Google and Facebook are largely reliant on another large company. If Apple completely banned all Facebook apps from the app store tomorrow... well, Facebook would probably survive, but it would be a serious blow. I don't see how you can not be reliant on Apple/Google.

coliveira 8y ago
> I don't see how you can not be reliant on Apple/Google. This is the very definition of a monopoly, isn't it? If the government was working properly, it would be ready to break up these companies, as well in other areas of oligopoly such as oil and banking.
- deleted 8y ago
  [deleted]
- j88439h84 8y ago
  Well, there's two of them.
  - sundvor 8y ago
    Duopoly, then ogliopoly after that.
- usaphp 8y ago
  > MONOpoly > thESE companIES
  - ashelmire 8y ago
    Antitrust covers market manipulation and coercion though, which you could easily argue these companies have (monopoly over certain platforms such as the iPhone; magically identical pricing).

m-p-3 8y ago

> have a strategy that totally relies on a party out of your control If it's possible to implement the app as a PWA sure, but then discoverability becomes an issue. Sadly, App Stores are a natural monopoly and everyone expect them to be fair but they clearly can't.

sverhagen 8y ago
Are they a natural monopoly by choice or by necessity? Not sure what "natural" means, here. I could imagine some sort of federation that would make them less of a monopoly, understandably not Google's choice, though.
- pas 8y ago
  Natural probably means that for a given mobile platform it's natural - due to network effects and other market forces (e.g. the platform owner heavily subsidizing/supporting their choice of store) - for one store to emerge as a monopoly.