12 ms·
Google Warns Developers That All New Android Apps Require 3 Days for Approval
- writepub 7y agoAfter dealing with Apple's process, no one EVER said we need more of that! Among other things, the ease of approval is waht makes Android more loved by many devs, please don't spoil that
- edf13 7y agoAnd also makes it so loved by spam, fake App and other malicious devs
- writepub 7y agoOh what a beautiful lie. "If only Google blocked devs more, we'd all live in security Utopia". And that's why folks, what the world really needs is not the open web, or open anything, but an Apple/Google/UltraMegaCorp approved whitelist of domains, for your own safety. Because Apple cares, unless it's a nation state like China, then Apple folds, because hard spun tales of user safety and empathy be damned when bottom lines are in play
- lostmyoldone 7y agoYes, malicious actors tend to use the same infrastructure as everyone else, especially if it is good. Figuratively tearing up the paving is a terrible solution to a speeding problem, which most countries seem to agree with. Usually speeding instead is a fineable offense, which I'm okay with. Reserve the right to apply a fee if you release more than X apps per Y time, or update more often than Z times in Y time. Increase the allowed fee/fine geometrically (or lower, but still exponentially) for each offending update/app, but allow keeping a few "credits" if you have a reasonable update rate. This would make it costly to be a bad actor, but still affordable the odd time you mess up and need to push out an unplanned change.
- sokoloff 7y agoI had heard/read horror stories of Apple's approval process, so I was expecting a terrible experience. I had exactly the opposite; it was very smooth and much faster than I expected. (I don't recall the exact latency, but I seem to recall it was the next day.)
- alex_c 7y agoiOS review process used to be much much worse years ago - up to two weeks at worst. It’s much better now.
- greycol 7y agoYes it sucks for developers. Especially as others have pointed out because of the lack of an ability to submit the app early to have it reviewed and release at a later time. Really though Google gets a huge pass on the Android app front for the simple reason that you and your users can sideload. Yes it requires a trusted reputation, or stupid users, but google doesn't stop you from supplying your clients/customers with critical apps(or updates) as soon as they're ready.
- ajross 7y agoObviously the article is a complaint from an app developer, but... sorry, I'm on Google's side here. Rushed, rapidly-updating, poorly-reviewed games with unvetted malfeatures are a plague. The last thing the smartphone community needs is "more apps faster". I think a soft 3-day review period is very reasonable, even if it comes at the cost of making launch marketing harder for developers.
- dfabulich 7y agoOP here. We're happy to endure a three-day review process, but if it's going to take that long, then there needs to be a way to schedule an app release. Today, Google has a "timed publishing" system for app updates, allowing you to submit an app update today and schedule it to go live on a future date (after successful review). We need the same system for new app releases. Apple, which also has a multi-day review process for new apps, allows you to submit an app for approval and then hold it for manual release. After approval, you push the button on release day, and the app goes live immediately. Also: surprising us with this on release day is really unprofessional of them. The "we'll take more time" warning banner doesn't show up until after you submit the app. There was no way to know we had to submit early until it was already too late to act.
- squiggy22 7y agoStarted dipping my feet in app development recently. To get an app onto an Internal track for testing purposes..you still need to get 'reviewed'. literally a hello world app needs human review that takes 3 days. That blows my brain. Not open to the web. just testers. 3 days. painful. and imo. broken.
- dfabulich 7y agoLuckily, you only need to get internal track approval the first time. After that, you can deploy changes to your own team with fast, automated review. But, as my conversation with support showed, even after getting internal track approval, you'll need to wait another three days when you want to go live for production approval. ("It should be slightly quicker, but again we recommend three days just to be safe")
- ejefz 7y agoLittle by little Google seems to be adopting all the policies for Android that made the iPhone simply a higher quality experience. (Enforcing using Google services to deliver notifications, aggressively killing background apps, limiting access to external storage, making it impossible to record calls, now this... and many other things I can't remember) On one hand I'm happy because iPhones are too expensive and having more options is good, but on the other, this is still Google :P
- iainmerrick 7y agoThe flip side of the same coin is that they’re dropping things that made life easier for developers -- Play Store reviews now take much longer, debugging gets harder with every OS update, etc. I’m not saying the improvements in security are bad, just complaining about the extra hassle it causes developers! There’s probably no way to make everyone happy at once.
- ejefz 7y agoWhat problems are you having debugging?
- iainmerrick 7y agoInspecting network activity is more fiddly now -- HTTP is blocked and installing certificates for a proxy to intercept HTTPS is difficult. File system access is locked down. I’ve also been finding that the debugger just runs very slowly on an Android 9 test device; seems to be something to do with code verification. Nothing insurmountable, just slower and more awkward than it used to be.
- listic 7y agoHow does making it impossible to record calls make phone a higher quality experience?
- edoceo 7y ago"security"
- mikedilger 7y agoThere is no three day approval process needed for me to install software on my desktop. By going this way, Google is taking Android further and further from a general purpose pocket computer. I expect this move will quiet some squeaky wheels, but it also further opens up the market place for general purpose pocket computers like the forthcoming librem 5.
- xtirpation 7y agoIf you're talking about installing software on your own device, you can still do so with an apk, can't you?
- paxys 7y agoYou can install software on your Android phone instantly as well. It just has to be from outside the Play Store.
- Wowfunhappy 7y agoYeah. I'm significantly less sympathetic to these arguments on Android than on iOS.
- jnbiche 7y agoYou can't install iPhone apps from outside the App Store on an iPhone (unless it's rooted, which most people prefer not to do for reasons of complexity and security). I'd say the Android app store is a nice balance. Also, if you want to install some other, less-well maintained app store on your Android, that's also possible (on non-rooted phones, too). Indeed, I've got F-Droid enabled on my Android. That said, if Google ever pulls the ability to sideload apps on non-rooted phones, I'll not be happy at all.
- CannisterFlux 7y agoI'm surprised Google didn't pull the ability to download an APK and install it from Android Q. They modified the permissions slightly so now you have to click "allow" again every time an app wants to install an APK it has downloaded. Up until Q, once you used an app to e.g. update itself, it maintained the ability to download and install updates forever. When Fortnite was distributed outside the Play store I thought that would be the catalyst for removing side-loading permissions, only retaining them over ADB so developers would not be totally screwed. Maybe the news of that arrived too late in the Q cycle for it to be implemented. I'm sure that one day on-the-fly side-loading is going away. Maybe not in Android Q, but in R or S definitely. It's too consumer-friendly and useful! Removing it will "help user's security" while at the same time removing the ability to install 3rd party VPN-faking ad-removers or games like Fortnite that don't have to pay Google 30%.
- _nickwhite 7y agoIf Google are _really_ reviewing the apps, creating a 3-day backlog to get approved, then I say "Bravo! The world could absolutely use less crapware on the Google Play store." But, the cynic in me tells me this is just a ploy by them to put on a masquerade of actually caring.
- bogwog 7y agoYeah this seems strange. How could they go from no reviews whatsoever to being so efficient they can review all app submissions in just 3 days. The Play Store gets more app submissions per day today than the App Store did back when it took Apple weeks to review each submission. Google doesn't even provide human customer service for most of their products, so how are they suddenly so efficient at this?
- jolmg 7y agoThey could start by automatically accepting apps they haven't gotten around to after 3 days of being in-queue. After some period of practice and improvements, if the team they prepared still can't handle the workload without the automatic acceptance fallback, then they can increase the team size. I'm just guessing a plan like that is doable. They could also have been practicing with a simulation of the review process using real-world app submissions for a while before this, and gotten the experience from that.
- londons_explore 7y agoThe real reason behind this will be automated generation of spammy apps. Imagine you write a script which creates a spammy app (eg. no content, 100% ads). You launch on the play store, and instantly insert a few 5* fake reviews, and then for the next 10 minutes you do a heavy ad blitz all over the internet and other mobile apps to get a decent installed base. All those users now see what 'appears' to be a brand new app, already getting decent reveiws! They install it, only to find it's junk. Many won't bother to uninstall, so the app maker gets to keep popping up modal ads and running a background service for years... Repeat the whole process 20 minutes later with another procedurally generated app on a new account...
- gok 7y agoA waiting period is good. A $10,000 bond which gets surrendered if the submission contains malware would be better.
- ocdtrekkie 7y agoNot really, this would kill most independent/hobbyist app developers' ability to submit entirely.
- deleted 7y ago[deleted]
- hanniabu 7y agoCould be a nice either-or option. Deal with the waiting period or post collateral.
- SteveSmith16384 7y agoMy guess is that this is what Google really wants. Now that all the hobbysists have helped get Android/Play Store where it is today, they don't need us any more.
- HillaryBriss 7y agoOr, what if it worked in the other direction? What if a developer could buy an insurance policy from Google for a reasonable premium? e.g.: "The Google Play Store will carry out a security review on your app and list it in the store on April 17. If that doesn't happen, this policy will pay XYZ developer $1,000,000"
- deleted 7y ago[deleted]
- pie420 7y agothis is like a kid waiting until 11:59 Pm to submit his homeowrk, and then blaming the professor when the upload process takes 5 mins and his submission is late. If your app needs to launch on a specific day (it doesnt), it should have been uploaded and field tested at least a couple of weeks in advance.
- dfabulich 7y agoOP here. Google offers no way to submit an app for approval in advance. You can upload a build as early as you like, but they won't start reviewing it until you try to go live. Then the app will go live immediately after approval. In the past, we've handled this by submitting the app for review 24 hours in advance; luckily, that turned out to be just enough time to make our app go live this afternoon. Google offers a “timed publishing” feature, but it only works for app updates, not for new apps. If Google is going to put apps through a multi-day review process, we need timed publishing for new apps as well.
- cameronbrown 7y agoI know it's definitely a hotfix solution until Google fixes things, but would a soft-launch followed by a properly timed launch a few weeks later be better?
- mfduffy 7y agoI mean, that’s sort of what we’ve been doing. (Hi, OP’s coworker here.) We’re a bit unusual in that we release games on Thursdays. In our busy season, that can be every other Thursday, with an email and social blast accompanying it. In the past we’ve submitted and been approved on Wednesdays so our customers know they can often sneak in Wednesday night and find our release before the marketing blast. In future, our soft launch will be two days or more, I guess, but we will submit according to that three day buffer. It’s totally doable. The problem is we can’t market a new game until it’s available on all platforms, which we time on each platform to the day. Ie we know how long ahead of time for iOS and Steam, and we (until now) also knew when to submit for Google. And a quick word on soft launch periods: It’s ok, it’s not the worst thing, but it’s not preferable itself. Hence the need for a timed release tool.
- slezyr 7y agoWell this might stop some malware, but what stops to push app with some kind of VM(or browser view) that load remote code and later update it to something else?
- pier25 7y agoI think both Apple and Google should make reviews optional. Sure, give preference to the reviewed apps in the store, put a nice badge on it when it's reviewed, add a setting to allow unreviewed apps to install, prevent kids from installing unreviewed apps, etc, but at least let me upload my app when and how I want to.
- swebs 7y agoYou can upload your app to Fdroid. It (unfortunately for users, fortunately for you) doesn't include a review system.
- pier25 7y agoI could even distribute the .apk myself but that's not the point.
- ptx 7y agoIt does include a different sort of review system though. Every app is built from source by the F-Droid maintainers and has a corresponding source code bundle availabile. This means that if you notice or suspect any shady behavior, you can review the code to find out the exact nature of the shadiness and alert people. Developers can't as easily claim that it was an unintentional bug that happened to accidentally siphon all private data from your device.
- Arainach 7y agoThe entire point of the App Store is to have a curated experience to keep malware out. Review is the essential component.
- pier25 7y agoThe point of the app store is to have a centralized distribution point for apps of the OS.
- Gustomaximus 7y ago
- draw_down 7y agoHuh, I guess Apple was on to something. Who would have thought!
- t0astbread 7y agoMozilla has also recently introduced a 24-hour timeout for new extension submissions to AMO without telling anyone. (I only heard about it after filing a complaint to AMO moderators after my addon has been queued for almost a day.) What's particularly annoying about the AMO case is that you can't even sideload addons on Firefox but that's a different issue.
- ChrisSD 7y agoHave they stopped allowing you to locally sign addons automatically?
- t0astbread 7y agoAs far as I know you can't install addons not signed by Mozilla in official Firefox builds. (Though I also haven't been able to get it working in my unofficial build.)
- ChrisSD 7y agoSure but I thought they signed unlisted addons using a quick automatic test? Sorry it's been awhile so I might be behind the time.
- t0astbread 7y agoOh, that might be possible. I've not looked into that.
- bradyd 7y agoFirefox Developer Edition and Nightly both support installing unsigned extensions by changing the preference xpinstall.signatures.required to false. https://support.mozilla.org/en-US/kb/add-on-signing-in-firefox https://support.mozilla.org/en-US/kb/add-on-signing-in-firef...
- samcat116 7y agoThis really shows how much Apple's review process has improved: - Usually under a couple days, sometimes same day - Doesn't immediately hit the store upon passing review, instead hits "Pending developer release" - Expedited option for critical bug and security fixes - Preorders Now if only they would stop those apps that trick people into crazy subscriptions.
- wil93 7y agoThat's what 99$ per year can do, as opposed to a one-off 25$
- codinghorror 7y agowow the Google Play fee is only $25 one time ever? That's nuts!
- megaremote 7y agoWow, Apple is down to a day for brand new apps.
- drawkbox 7y agoReviews aren't bad, but they don't necessarily stop bad apps, and they slow down good ones. The worse part of approval delays is that they are almost never given time in development schedules made by project managers, bizdevs, marketing etc. They just absorb that few days into the dev time or take from testing etc. In a way, having long app reviews, or delays to update, causes worse quality apps from having dev days or testing days taken from the app development cycle and rushed fixes just to get it back in the pipeline. This is a very common occurrence in app/game development. I wish it weren't this way but quality has to be fought for and it can harm the people pushing for it perceptually as 'slow'. Basic heuristics on release for bad actors is enough, then upon launch have random reviews that check out what people are doing past the point. The problem apps are usually getting through the review by cheating and then turning on features that are dark patterns or malware type junk. Any reviews over a day or two add to bad quality simply due to compressed timelines.
- Causality1 7y agoWhat they really need to address is hostile entities buying the rights to an app from the original developer and then using app updates to fill devices with malware.
- deleted 7y ago[deleted]
- himes19 7y agoIt’s really annoying, we have an app that fixes a really big problem in Mexico, it’s been doing great on Apple Store, and android users are breathing on our neck waiting for the release, sore but I disagree, I don’t think that Google taking more than 3 days is going to benefit anyone. Shorter review process increases availability an that raises the playing feel. From where I stand, Google is just taking more time to review the apps, not necessarily improving the way they do it. Longer review times encourage more feature pack pack updates with more bugs, and linger time for users to get bug fixes...