8 ms·

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus. It takes a special kind of scum to slander an open source project in order to push malware. [1]: https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi...

Avamander 6y ago
I reported a bunch as spam, but it probably netted me some negative reputation by their AI though.
- kevingadd 6y ago
  Yeah, be careful doing anything like that on the Play Store. You can get your account randomly locked out with no explanation (I haven't been able to review apps, leave comments or contact the developer for like 3 years, and I never got an email or notice about this)
  - consp 6y ago
    If you have a gsuite account, that might be the reason. This started somewhere in 2018.
    - kevingadd 6y ago
      Oh, that explains it! Mystery solved, thanks :-)
    - mmahemoff 6y ago
      I have the same problem - paying Google customer, so I'm not allowed to leave ratings or reviews on Google's app store. Support's ignored my requests on this.
    - jtbayly 6y ago
      Wait... why?! I can't think of a single reason Google would do this.
- kobalsky 6y ago
  Do you really want to do anything that looks like abuse with your Google account though? When people don't know why Google banned their 15 year accounts I wonder if it's not from innocent stuff like this.
- mrweasel 6y ago
  It’s doubtful that any AI is involved, but I wouldn’t be surprised if Google have an algorithm that decides thay X number of negative reviews must be spam, without considering the quality and correctness of the review.
deleted 6y ago
[deleted]
swiley 6y ago
These app stores are a terrible software distribution model. Every day we hear about another reason they harm users far more than community maintained repositories and only protect the interests of the OS vendor.
- _jal 6y ago
  It really is pathetic. Looks more mafia-like every day - they grab control of a choke point, ensuring they get their vig, but otherwise show no interest in providing real security. It is just 'protection'.
  - lrossi 6y ago
    What you describe is actually worse than the mafia. They would offer protection to some extent against third party rip-off.
    - jimmaswell 6y ago
      Yeah, people from areas that used to be run by the mob often say they ran things better than the government did. Mobs require some form of community support to operate from what I understand. The "real" government is really just another mob anyway. Pay your [protection money/taxes] or get your shop [busted up/shut down] and have other bad things happen to you.
- notatoad 6y ago
  App stores are no more terrible than the previous software distribution model where you Google the name of the software you want to install, find some site that "mirrors" the download, realize they've repackaged the original app with extra ads and toolbars, keep searching, find the official download link, scroll past all the misleading ads containing download buttons, download the package, and then hope the download runs on your machine. Anybody complaining about app stores has forgotten how bad the alternatives are. And community-maintained repositories aren't a solution, that's just the app store model but on a smaller scale so it's less of a Target for bad actors. If ubuntu's universe repo had to suffer the same amount of abuse as the play store does, it would crumble in a day.
curtis3389 6y ago
I knew nothing of ZXing Barcode Scanner other than it was super simple and "just works." Nice to know that it's open source! I've been happily using on all my android phones since I started with the HTC Dream so many years ago.
- Fej 6y ago
  Not only that, there's a "plus" version that's both better and is now free, as it can't be updated anymore via Google Play. https://play.google.com/store/apps/details?id=com.srowen.bs.android https://play.google.com/store/apps/details?id=com.srowen.bs....
TheRealDunkirk 6y ago
"Apps" and "algorithms" seem to be driving literally everything about society now. I don't think this is a good thing, nor do I see the trend reversing. These giant black boxes now control the levers of modern society, and the companies that own them get to hide behind their "terms of service" to avoid any responsibility for the damage being done. Every significant review system is being gamed to the point of being unusable, and yet stories about not being able to trust them keep being reported as if this were somehow noteworthy. For every one of these stories that rises to a thread on HN, how many other small time vendors are getting screwed by someone who is willing to pay a room full of people in some 3rd-world country to debase their competitor's online presence?
- Gravityloss 6y ago
  The platforms these companies provide have been so useful and successful that they have both become oligopolies and are a big part of how society operates nowadays. Think like electrical grid or roads. But it's still not stabilized, society has not yet found out how to deal with all this. It's like when there were no speed limits for cars or standard signage. There was more freedom but it was way more dangerous and unpredictable and also as a result, not yet as useful as it could be. It's not necessarily anybody's fault. A company like Google maybe sees itself as a company but it's way past that. It really provides quite essential platforms for people, families, cities, you name it. And also the platform for content creators and developers and businesses. Many of these don't have a proper contract with the platform. It doesn't scale to have lawyers to be involved in every point to point dealing either. My assumption is that there is going to be maturation of these platforms, common rules and terms. Governments and WTO could be involved.
jorvi 6y ago
Gotta love that those bogus 1-star reviews stay up, but Google instantly came to the rescue of Robinhood when it was getting flooded by 1-star reviews that had an actual legitimate basis.
- josh11b 6y ago
  Robinhood's app has a 1.2 star rating at the moment. https://play.google.com/store/apps/details?id=com.robinhood.android&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.robinhood....
  - mynameisvlad 6y ago
    Google was well known to have removed about 100k low rating reviews during the peak: https://www.theverge.com/2021/2/1/22261178/robinhood-google-play-store-app-rating-one-star-reviews-stocks-gamestop-reddit https://www.theverge.com/2021/2/1/22261178/robinhood-google-...
tetromino_ 6y ago
See https://github.com/zxing/zxing/issues/1345 https://github.com/zxing/zxing/issues/1345 and https://android.stackexchange.com/questions/233322/finding-and-removing-android-adware-that-opens-chrome-tabs-when-unlocking-the-lo https://android.stackexchange.com/questions/233322/finding-a... TL;DR someone apparently cloned ZXing Barcode Scanner, added annoying ads, uploaded it to the Play Store with the same name. Soon enough the malicious clone got taken down. Legitimately pissed off people who installed the malicious clone are leaving angry reviews for the non-malicious original (presumably because the malicious clone is gone from the Play Store).
AdrianB1 6y ago
Don't assume malice when it can be explained by stupidity; it is probably a confusion as there are many apps with very similar names and in the phone the publisher is usually not listed (I checked mine), so people with the malware app gave reviews to other apps.
trevor-e 6y ago
FWIW the updated date doesn't necessarily mean anything, the app could be loading code remotely via some endpoint which the article does mention as a possibility in general.
tcldr 6y ago
This review fraud has got way out of hand. Right now, it would be better to remove reviews entirely and for consumers to make a decision based on the product page alone. The consumer trust in reviews is at such a low that it’s adding friction to purchase decisions and starving honest businesses from being able to invest in quality products. One solution might be to only publish reviews/ratings from accounts with a minimum spend threshold and unique active payment details. This would effectively price out the scammers.
- hammock 6y ago
  Fake reviews are not that hard to spot. Why don't we focus on educating people on how to evaluate what they read, and making informed decisions, rather than taking information (even if misinformation) away from them? It would help with fake news as well.
  - khamba 6y ago
    > Fake reviews are not that hard to spot. This statement seems very suspect to confirmation bias. How would you get to know if what you think is genuine was actually fake? This part of feedback loop is completely missing, and hence I find your above statement hard to believe.
    - hammock 6y ago
      I disagree. Still you didn't answer the question
  - tcldr 6y ago
    Most people don’t read many reviews though. Just the ‘most helpful’ and the review tally. Worse, the store search results pages use the review scores to rank apps too.
- duxup 6y ago
  Even non fake reviews suck. The sheer scale of situations where the top review is negative describes something that ... is not a bug, is actually supposed to be that way, is how the dang app works by design for good reason ... is bonkers. It seems like reviews are driven by people who don't know, and respond reviews by to people who don't know who describe what sounds like fundamentally broken things... so they give it a thumbs up and they're both completely ignorant. The volume of people who do know the app and would see / write a review seems like it is MUCH smaller. I had a game app update recently. I went to update it (one of the few times I go directly to the play store app). There at the top is a review that described how they saw opposing players "just disappear" during the game and raged about that 'bug'. But it's not a bug the game has some fog of war and view distance type mechanic. It's entirely expected / appropriate.... but there it is the top review.
bityard 6y ago
The ZXing Barcode Scanner (which is the "official barcode/QR code scanner for Android, as far as _I_ am concerned) is also available on f-droid.org. There's no absolute guarantee that F-Droid apps are malware-free but they have at least been looked at by a competent team of humans, something that is not true of the Play Store. https://f-droid.org/en/packages/com.google.zxing.client.android/ https://f-droid.org/en/packages/com.google.zxing.client.andr...
- dyingkneepad 6y ago
  Does F-Droid compile the binaries themselves? Or do they just take a look at my github and then trust the .apk I build myself and send them? I mean, I could very well make an open source app and then load some malware in the apk in addition to the well behaved thing... Are they immune from this attack?
  - ashneo76 6y ago
    F-droid mostly compiles from source. https://f-droid.org/en/docs/FAQ_-_General/#whats-the-difference-between-source-and-binary-builds https://f-droid.org/en/docs/FAQ_-_General/#whats-the-differe...

Avamander 6y ago

I reported a bunch as spam, but it probably netted me some negative reputation by their AI though.

kevingadd 6y ago
Yeah, be careful doing anything like that on the Play Store. You can get your account randomly locked out with no explanation (I haven't been able to review apps, leave comments or contact the developer for like 3 years, and I never got an email or notice about this)
- consp 6y ago
  If you have a gsuite account, that might be the reason. This started somewhere in 2018.
  - kevingadd 6y ago
    Oh, that explains it! Mystery solved, thanks :-)
  - mmahemoff 6y ago
    I have the same problem - paying Google customer, so I'm not allowed to leave ratings or reviews on Google's app store. Support's ignored my requests on this.
  - jtbayly 6y ago
    Wait... why?! I can't think of a single reason Google would do this.
kobalsky 6y ago
Do you really want to do anything that looks like abuse with your Google account though? When people don't know why Google banned their 15 year accounts I wonder if it's not from innocent stuff like this.
mrweasel 6y ago
It’s doubtful that any AI is involved, but I wouldn’t be surprised if Google have an algorithm that decides thay X number of negative reviews must be spam, without considering the quality and correctness of the review.

deleted 6y ago

[deleted]

swiley 6y ago

These app stores are a terrible software distribution model. Every day we hear about another reason they harm users far more than community maintained repositories and only protect the interests of the OS vendor.

_jal 6y ago
It really is pathetic. Looks more mafia-like every day - they grab control of a choke point, ensuring they get their vig, but otherwise show no interest in providing real security. It is just 'protection'.
- lrossi 6y ago
  What you describe is actually worse than the mafia. They would offer protection to some extent against third party rip-off.
  - jimmaswell 6y ago
    Yeah, people from areas that used to be run by the mob often say they ran things better than the government did. Mobs require some form of community support to operate from what I understand. The "real" government is really just another mob anyway. Pay your [protection money/taxes] or get your shop [busted up/shut down] and have other bad things happen to you.
notatoad 6y ago
App stores are no more terrible than the previous software distribution model where you Google the name of the software you want to install, find some site that "mirrors" the download, realize they've repackaged the original app with extra ads and toolbars, keep searching, find the official download link, scroll past all the misleading ads containing download buttons, download the package, and then hope the download runs on your machine. Anybody complaining about app stores has forgotten how bad the alternatives are. And community-maintained repositories aren't a solution, that's just the app store model but on a smaller scale so it's less of a Target for bad actors. If ubuntu's universe repo had to suffer the same amount of abuse as the play store does, it would crumble in a day.

curtis3389 6y ago

I knew nothing of ZXing Barcode Scanner other than it was super simple and "just works." Nice to know that it's open source! I've been happily using on all my android phones since I started with the HTC Dream so many years ago.

Fej 6y ago
Not only that, there's a "plus" version that's both better and is now free, as it can't be updated anymore via Google Play. https://play.google.com/store/apps/details?id=com.srowen.bs.android https://play.google.com/store/apps/details?id=com.srowen.bs....

TheRealDunkirk 6y ago

"Apps" and "algorithms" seem to be driving literally everything about society now. I don't think this is a good thing, nor do I see the trend reversing. These giant black boxes now control the levers of modern society, and the companies that own them get to hide behind their "terms of service" to avoid any responsibility for the damage being done. Every significant review system is being gamed to the point of being unusable, and yet stories about not being able to trust them keep being reported as if this were somehow noteworthy. For every one of these stories that rises to a thread on HN, how many other small time vendors are getting screwed by someone who is willing to pay a room full of people in some 3rd-world country to debase their competitor's online presence?

Gravityloss 6y ago
The platforms these companies provide have been so useful and successful that they have both become oligopolies and are a big part of how society operates nowadays. Think like electrical grid or roads. But it's still not stabilized, society has not yet found out how to deal with all this. It's like when there were no speed limits for cars or standard signage. There was more freedom but it was way more dangerous and unpredictable and also as a result, not yet as useful as it could be. It's not necessarily anybody's fault. A company like Google maybe sees itself as a company but it's way past that. It really provides quite essential platforms for people, families, cities, you name it. And also the platform for content creators and developers and businesses. Many of these don't have a proper contract with the platform. It doesn't scale to have lawyers to be involved in every point to point dealing either. My assumption is that there is going to be maturation of these platforms, common rules and terms. Governments and WTO could be involved.

jorvi 6y ago

Gotta love that those bogus 1-star reviews stay up, but Google instantly came to the rescue of Robinhood when it was getting flooded by 1-star reviews that had an actual legitimate basis.

josh11b 6y ago
Robinhood's app has a 1.2 star rating at the moment. https://play.google.com/store/apps/details?id=com.robinhood.android&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.robinhood....
- mynameisvlad 6y ago
  Google was well known to have removed about 100k low rating reviews during the peak: https://www.theverge.com/2021/2/1/22261178/robinhood-google-play-store-app-rating-one-star-reviews-stocks-gamestop-reddit https://www.theverge.com/2021/2/1/22261178/robinhood-google-...

tetromino_ 6y ago

See https://github.com/zxing/zxing/issues/1345 https://github.com/zxing/zxing/issues/1345 and https://android.stackexchange.com/questions/233322/finding-and-removing-android-adware-that-opens-chrome-tabs-when-unlocking-the-lo https://android.stackexchange.com/questions/233322/finding-a... TL;DR someone apparently cloned ZXing Barcode Scanner, added annoying ads, uploaded it to the Play Store with the same name. Soon enough the malicious clone got taken down. Legitimately pissed off people who installed the malicious clone are leaving angry reviews for the non-malicious original (presumably because the malicious clone is gone from the Play Store).

AdrianB1 6y ago

Don't assume malice when it can be explained by stupidity; it is probably a confusion as there are many apps with very similar names and in the phone the publisher is usually not listed (I checked mine), so people with the malware app gave reviews to other apps.

trevor-e 6y ago

FWIW the updated date doesn't necessarily mean anything, the app could be loading code remotely via some endpoint which the article does mention as a possibility in general.

tcldr 6y ago

This review fraud has got way out of hand. Right now, it would be better to remove reviews entirely and for consumers to make a decision based on the product page alone. The consumer trust in reviews is at such a low that it’s adding friction to purchase decisions and starving honest businesses from being able to invest in quality products. One solution might be to only publish reviews/ratings from accounts with a minimum spend threshold and unique active payment details. This would effectively price out the scammers.

hammock 6y ago
Fake reviews are not that hard to spot. Why don't we focus on educating people on how to evaluate what they read, and making informed decisions, rather than taking information (even if misinformation) away from them? It would help with fake news as well.
- khamba 6y ago
  > Fake reviews are not that hard to spot. This statement seems very suspect to confirmation bias. How would you get to know if what you think is genuine was actually fake? This part of feedback loop is completely missing, and hence I find your above statement hard to believe.
  - hammock 6y ago
    I disagree. Still you didn't answer the question
- tcldr 6y ago
  Most people don’t read many reviews though. Just the ‘most helpful’ and the review tally. Worse, the store search results pages use the review scores to rank apps too.
duxup 6y ago
Even non fake reviews suck. The sheer scale of situations where the top review is negative describes something that ... is not a bug, is actually supposed to be that way, is how the dang app works by design for good reason ... is bonkers. It seems like reviews are driven by people who don't know, and respond reviews by to people who don't know who describe what sounds like fundamentally broken things... so they give it a thumbs up and they're both completely ignorant. The volume of people who do know the app and would see / write a review seems like it is MUCH smaller. I had a game app update recently. I went to update it (one of the few times I go directly to the play store app). There at the top is a review that described how they saw opposing players "just disappear" during the game and raged about that 'bug'. But it's not a bug the game has some fog of war and view distance type mechanic. It's entirely expected / appropriate.... but there it is the top review.

bityard 6y ago

The ZXing Barcode Scanner (which is the "official barcode/QR code scanner for Android, as far as _I_ am concerned) is also available on f-droid.org. There's no absolute guarantee that F-Droid apps are malware-free but they have at least been looked at by a competent team of humans, something that is not true of the Play Store. https://f-droid.org/en/packages/com.google.zxing.client.android/ https://f-droid.org/en/packages/com.google.zxing.client.andr...

dyingkneepad 6y ago
Does F-Droid compile the binaries themselves? Or do they just take a look at my github and then trust the .apk I build myself and send them? I mean, I could very well make an open source app and then load some malware in the apk in addition to the well behaved thing... Are they immune from this attack?
- ashneo76 6y ago
  F-droid mostly compiles from source. https://f-droid.org/en/docs/FAQ_-_General/#whats-the-difference-between-source-and-binary-builds https://f-droid.org/en/docs/FAQ_-_General/#whats-the-differe...