13 ms·

> We don't allow apps with any code that could put a user, a user’s data, or a device at risk. If Google thinks the ability to execute arbitrary code puts use

> We don't allow apps with any code that could put a user, a user’s data, or a device at risk. If Google thinks the ability to execute arbitrary code puts users' data at risk why don't they go the full iOS route and ban everything, from scripting apps to other JS engines beside Chromium? I am so sick of their behaviour, the only reason I am still on Android because things like F-Droid still exists and iOS is even more closely guarded.

yjftsjthsd-h 5y ago
Given the issues that termux has hit, they're certainly moving that way. https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...
- nromiun 5y ago
  Yep, Termux is the most used app on my phone and I don't know what I will do when they have to migrate to SDK 29. I will probably buy another phone and install LineageOS.
  - diogenesjunior 5y ago
    >I don't know what I will do >I will probably buy another phone and install LineageOS
    - nromiun 5y ago
      It was just a figure of speech and if you know how Termux works even a rooted phone is no alternative. (Termux exposes Android APIs, like camera and GPS.)
  - femiagbabiaka 5y ago
    Curious, is the Librem 5 an alternative you would consider?
    - nromiun 5y ago
      Sure, it is a good alternative. But I still need a phone to do some work, like Whatsapp and banking apps (which I don't think Librem supports). So I am waiting for it to become stable and a little mature.
      - femiagbabiaka 5y ago
        Makes sense!
  - edrxty 5y ago
    Does LineageOS provide a workaround for this?
    - nromiun 5y ago
      Unfortunately there is no good alternative to Termux (its Android API). But with a rooted phone you can use chroot to install a Linux distribution. LineageOS is just a popular ROM for rooted phones.
      - edrxty 5y ago
        I run lineage but I don't typically use my terminal on my phone unless I'm using it for SSH. I hadn't though of the chroot angle though. That's rather interesting...
  - negativegate 5y ago
    This is the first I've heard of Termux and now I'm curious what you use it for. Like are you SSHing into other environments?
    - nromiun 5y ago
      https://www.passwordstore.org https://www.passwordstore.org Here is a popular CLI app to manage passwords. I use it on my desktop, laptop and phone.
      - terseus 5y ago
        You don't need Termux for that, there are native clients for Android, I use this one: https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis....
        nromiun 5y ago
        There are native clients, but can you use git to sync the encrypted passwords with your other devices? And that was just one example. You can also use python as a much better calculator, share files over wifi with a web server etc.
    - dheera 5y ago
      SSH, and also when you're on the road and want to write a simple Python script to process something, or do something with your sensor data logging. Termux has a Python API to access sensor data, it has numpy, it has requests, so you can do a lot.
    - donio 5y ago
      For me ssh to access my main Emacs session is a big part of it but I also run some shell scripts and CLI tools and services written in Go. ssh-ing back into the phone for file transfer is another important use.
- donio 5y ago
  Once there is no way to run Termux that will be the end of the line for me and I've been on the Android train since the G1 days. I am ok with installing it from F-Droid or adb as long as it remains runnable. (I guess I am in the bargaining phase) I don't think that I am ok with not being able to easily run my own executables since I rely on running a few Go utilities in the Termux CLI.
  - yjftsjthsd-h 5y ago
    I'm personally planning to replace termux with a full chroot; my phone is rooted, so all I need is an app to give me the actual terminal emulator and I'm good. This would be fine for running the odd Go utility, but is likely to be insufficient if you're doing anything with the actual Android API (which termux has been great at). And of course, in the long term this is just another reason for me to hope the pinephone gets to prod-ready ASAP:)
    - suifbwish 5y ago
      I am curious what root kit you use for rooting your droid? I’ve always been hesitant to trust 3rd party kits like that.
      - yjftsjthsd-h 5y ago
        I use magisk; it's open source and reputable.
- pjmlp 5y ago
  Only because Termux developers refuse to use Java APIs and don't accept Android isn't a POSIX clone.
  - higerordermap 5y ago
    Chill dude. How do I run gcc in java beanshell?
    - pjmlp 5y ago
      https://play.google.com/store/apps/details?id=com.aide.ui https://play.google.com/store/apps/details?id=com.aide.ui
      - nulld3v 5y ago
        Can you elaborate on how this link is relevant?
        pjmlp 5y ago
        Read it and learn how to use a C compiler on Android without termux.
  - yjftsjthsd-h 5y ago
    Android certainly has an acceptable POSIX component when it's not artificially broken.
    - pjmlp 5y ago
      Where is POSIX listed here? https://developer.android.com/ndk/guides/stable_apis https://developer.android.com/ndk/guides/stable_apis > Starting in Android 7.0, the system prevents apps from dynamically linking against non-NDK libraries, which may cause your app to crash. This change in behavior aims to create a consistent app experience across platform updates and different devices. Even though your code might not be linking against private libraries, it's possible that a third-party static library in your app could be doing so. Therefore, all developers should check to make sure that their apps do not crash on devices running Android 7.0. If your app uses native code, you should only be using public NDK APIs. Taken from https://developer.android.com/about/versions/nougat/android-7.0-changes#ndk https://developer.android.com/about/versions/nougat/android-...
pdkl95 5y ago
>> "Can't you just make us a general-purpose computer that runs all the programs, except the ones that scare and anger us? Can't you just make us an Internet that transmits any message over any protocol between any two points, unless it upsets us?"[1] The War On General Purpose Computing continues. Far too many business models depend on selling general purpose computers as "appliances". They presume it is possible to sell a computer that isn't Turing complete. [1] https://boingboing.net/2012/01/10/lockdown.html https://boingboing.net/2012/01/10/lockdown.html
- Aperocky 5y ago
  It's inevitable, given the scale that has to happen before ASIC become remotely profitable and how cheap general purpose computers are today. Just buy some cheap SOC from the market and load the software, close it in a blackbox and call it a day. It's going to be the future now. God forbid they also talk to internet and runs an OS version from 2014 and never gets patched. It's a botnet paradise.
- ballenf 5y ago
  The battle really parallels the larger right to repair debate. (Especially if we realize the latter is probably is better called the right to exercise control over purchased goods.)
  - oneplane 5y ago
    Does it? Everyone is quick to judge but coming up with an alternative is hard enough that nobody has done it so far. With scale comes scaling issues; general purpose computing and repairability need a different commercial model that doesn't match with the currently used models. This leaves two avenues: - Make it worse for everyone but keep it going - Make it worse for everyone in a different way and keep it going I don't know of a good solution here, but I do know that it's a sucky situation and the many "good ideas" to fix it aren't actually making it that much better. Current scenario: - Manufacturer on the hook for most things but also controls most things - End-users that fall within the 90% bell-curve are fine - End-users that fall outside of that are royally screwed and they don't even know it - Users that are not end-users are screwed, but they know they are So far all I have seen is: - Manufacturers still on the hook for everything but they get to control less - Everyone gets a little better but also a little screwed now - The 10% outside of the curve don't get as screwed as they did but they still don't really know that they are screwed - The non-users don't get screwed the way they used to but still get screwed To clarify: If I were to manufacture something, express what user experience comes with my 'thing' and warrant that experience to a certain degree, I don't want to be on the hook for any service or cost outside of that. The more I get to control, the smaller I can make the risk. That means I can also plan ahead better and reserve resources, but not so much that I don't have resources for something else left over. This also means that if someone wants a different experience (i.e. they are not my targeted audience) or if someone wants to do something I cannot verify, I really do not want to be on the hook for that. In total that means: - If what I want and what my customer wants is similar enough, we're both happy - If a small percentage wants something else, I cut my losses and simply don't serve their needs as soon as the cost of maintaining that deviation is bigger than what I would make off of it (short term and long term) - If someone does something I don't have control over, but they do come to me to fix their problem, I don't want to be responsible for that, and I don't want to do any research on the possibility that something I made happened to break at the same time the customer broke something else; I just want a blanket "I am the captain of my UX" rule and be done with it Now, I'm not saying this is ideal, or that I am an actual manufacturer, or that this is specifically what Google is doing (or Apple is doing for that matter), but I am saying that you can't have it both ways. Want something cheap and abundant? Gotta have scale. Can't have scale if you make a bunch of risk, add a lot of differences and support more than your middle-of-the-bell-curve. This sucks, but it's also not easy as saying "let me do what I want", because what happens to you and your device has side-effects, and I really don't want to get affected by something someone on the mobile network (or wifi network) I'm on did to their 'personal' and 'owned' and 'freedom' and 'muh righz' device. Or in a high contrast (black-and-white/good-or-evil) line: If you want to be on a shared service, play by the rules or get out. (reality isn't that high of a contrast obviously, but it drives the point of externalities home a lot quicker)
rhinoceraptor 5y ago
Arbitrary code isn't banned on iOS, there isn't anything (yet) that can create fully fledged apps like Droidscript, but a few cool apps are: - iSH: an Alpine Linux shell environment, powered by an x86 to ARM JIT emulator - Scriptable: an iOS automation tool using Javascript, it can even integrate with native iOS APIs like photos and calendars, create native UIs, etc. - Pythonista: a Python IDE, you can create 2D games, use it as a REPL, integrate with native APIs, and much more And of course, there are the 1st party apps, Playgrounds and Shortcuts.
- glsdfgkjsklfj 5y ago
  > Arbitrary code isn't banned on iOS It is. Even mozilla firefox is banned on the premise that it can run arbitrary code and yes, that is the official apple instance. The fact that they apply it when they see fit and allow other times, and that it is totally arbitrary and opaque based on their own private interests, is exactly what everyone with common sense tried to explain when criticizing the walled garden.
  - mrtranscendence 5y ago
    My understanding is that what's banned on iOS is not arbitrary code per se, it's arbitrary code downloaded from the internet. Code you enter yourself, like in Pythonista, is just fine.
    - caleb-allen 5y ago
      I believe Pythonista is interpreted, not compiled, and outside of Apple's Swift app you are not able to run compiled code
    - tomp 5y ago
      Isn't the problem JITing? Mozilla could ship Firefox, even with the JS engine, it would simply be unusable (compared to Safari) because they wouldn't be allowed to run JIT (only interpreter).
    - lurkerasdfh8 5y ago
cookiengineer 5y ago
Technically, f-droid is a walled garden of sorts, too. The difference is that fdroid is actually helping users through being transparent about it. The other stores and their policies usually are not transparent, and therefore nobody knows whether there were financial motivations involved in the decisions. What I don't like is google claiming droidscript harms Android through a malicious AdMob ID. Even if that were the case, what happens to the 100.000+ installs that are rolled out already? And the Apps built with DroidScript? If there's no support you can contact (at Google) and no changelog on what happened, the policies get intransparent and look more like a financial motivation rather than a decision that seemed to be beneficial for the end-users.
- CivBase 5y ago
  I can add third-party repositories to F-Droid. The default F-Droid repository may be a walled garden but as far as I can tell the app and protocol are definitely not.
  - cookiengineer 5y ago
    A walled garden doesn't necessarily exist solely of proprietary protocols and code. In the case of fdroid, apps that violate open source licenses are not allowed. So, technically, from the perspective of a company like Facebook, fdroid is a walled garden they cannot enter without open sourcing their code. (I'm not saying fdroid's policies are bad. I'm just trying to make an argument for the counterside and am playing the devil's advocate here.) PS: I know about third-party repositories. That's not the point, it's differences in policies and their effects on the ecosystem I want to discuss because I think they're more important. Google advocates always make the argument that endusers "can just root their phones and install the APKs anyways" which is similar to f-droid with an external repository. Most non-technical endusers simply won't do that.
    - _ZeD_ 5y ago
      no, literally: you can add any repository you want, even with proprietary code.
austincheney 5y ago
Weak. The console tab of Chrome's developer tools allow arbitrary code execution. That example is not a security violation, ergo arbitrary code execution is potentially but not necessarily a security violation. A valid remediation requires more than just arbitrary code execution, such as privilege escalation or leaking containment.
Phylter 5y ago
You may not realize this but Apple allows scripting apps on their platform now. There are two notable Python language interpreters Pyto and Pythonista. There are some shell environments too that include Unix style command shells and different interpreters.
kmeisthax 5y ago
This is actually worse than the full iOS route, because Apple is likely to at least listen to appeals and implement bright-line rules between "things the app does" and "things users do". They ultimately do want to have developer tools on the App Store and are willing to accommodate them to a point. Even the "no competing browser engine" thing has a technical explanation: Apple wants to be able to update that part of your app without you being involved. Google just doesn't care about what your app does until they start seeing click fraud, upon which they ban your app, delete your Gmail, and ghost you. They've even done this to paying GSuite customers, game studios they were working on, and their own employees' spouses. As far as I can tell, antispam is at the top of the org chart and can overrule all other layers of management. I would never trust Google with anything I can't backup or migrate to another service.

yjftsjthsd-h 5y ago

Given the issues that termux has hit, they're certainly moving that way. https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 https://github.com/termux/termux-packages/wiki/Termux-and-An...

nromiun 5y ago
Yep, Termux is the most used app on my phone and I don't know what I will do when they have to migrate to SDK 29. I will probably buy another phone and install LineageOS.
- diogenesjunior 5y ago
  >I don't know what I will do >I will probably buy another phone and install LineageOS
  - nromiun 5y ago
    It was just a figure of speech and if you know how Termux works even a rooted phone is no alternative. (Termux exposes Android APIs, like camera and GPS.)
- femiagbabiaka 5y ago
  Curious, is the Librem 5 an alternative you would consider?
  - nromiun 5y ago
    Sure, it is a good alternative. But I still need a phone to do some work, like Whatsapp and banking apps (which I don't think Librem supports). So I am waiting for it to become stable and a little mature.
    - femiagbabiaka 5y ago
      Makes sense!
- edrxty 5y ago
  Does LineageOS provide a workaround for this?
  - nromiun 5y ago
    Unfortunately there is no good alternative to Termux (its Android API). But with a rooted phone you can use chroot to install a Linux distribution. LineageOS is just a popular ROM for rooted phones.
    - edrxty 5y ago
      I run lineage but I don't typically use my terminal on my phone unless I'm using it for SSH. I hadn't though of the chroot angle though. That's rather interesting...
- negativegate 5y ago
  This is the first I've heard of Termux and now I'm curious what you use it for. Like are you SSHing into other environments?
  - nromiun 5y ago
    https://www.passwordstore.org https://www.passwordstore.org Here is a popular CLI app to manage passwords. I use it on my desktop, laptop and phone.
    - terseus 5y ago
      You don't need Termux for that, there are native clients for Android, I use this one: https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis....
      - nromiun 5y ago
        There are native clients, but can you use git to sync the encrypted passwords with your other devices? And that was just one example. You can also use python as a much better calculator, share files over wifi with a web server etc.
  - dheera 5y ago
    SSH, and also when you're on the road and want to write a simple Python script to process something, or do something with your sensor data logging. Termux has a Python API to access sensor data, it has numpy, it has requests, so you can do a lot.
  - donio 5y ago
    For me ssh to access my main Emacs session is a big part of it but I also run some shell scripts and CLI tools and services written in Go. ssh-ing back into the phone for file transfer is another important use.
donio 5y ago
Once there is no way to run Termux that will be the end of the line for me and I've been on the Android train since the G1 days. I am ok with installing it from F-Droid or adb as long as it remains runnable. (I guess I am in the bargaining phase) I don't think that I am ok with not being able to easily run my own executables since I rely on running a few Go utilities in the Termux CLI.
- yjftsjthsd-h 5y ago
  I'm personally planning to replace termux with a full chroot; my phone is rooted, so all I need is an app to give me the actual terminal emulator and I'm good. This would be fine for running the odd Go utility, but is likely to be insufficient if you're doing anything with the actual Android API (which termux has been great at). And of course, in the long term this is just another reason for me to hope the pinephone gets to prod-ready ASAP:)
  - suifbwish 5y ago
    I am curious what root kit you use for rooting your droid? I’ve always been hesitant to trust 3rd party kits like that.
    - yjftsjthsd-h 5y ago
      I use magisk; it's open source and reputable.
pjmlp 5y ago
Only because Termux developers refuse to use Java APIs and don't accept Android isn't a POSIX clone.
- higerordermap 5y ago
  Chill dude. How do I run gcc in java beanshell?
  - pjmlp 5y ago
    https://play.google.com/store/apps/details?id=com.aide.ui https://play.google.com/store/apps/details?id=com.aide.ui
    - nulld3v 5y ago
      Can you elaborate on how this link is relevant?
      - pjmlp 5y ago
        Read it and learn how to use a C compiler on Android without termux.
- yjftsjthsd-h 5y ago
  Android certainly has an acceptable POSIX component when it's not artificially broken.
  - pjmlp 5y ago
    Where is POSIX listed here? https://developer.android.com/ndk/guides/stable_apis https://developer.android.com/ndk/guides/stable_apis > Starting in Android 7.0, the system prevents apps from dynamically linking against non-NDK libraries, which may cause your app to crash. This change in behavior aims to create a consistent app experience across platform updates and different devices. Even though your code might not be linking against private libraries, it's possible that a third-party static library in your app could be doing so. Therefore, all developers should check to make sure that their apps do not crash on devices running Android 7.0. If your app uses native code, you should only be using public NDK APIs. Taken from https://developer.android.com/about/versions/nougat/android-7.0-changes#ndk https://developer.android.com/about/versions/nougat/android-...

pdkl95 5y ago

>> "Can't you just make us a general-purpose computer that runs all the programs, except the ones that scare and anger us? Can't you just make us an Internet that transmits any message over any protocol between any two points, unless it upsets us?"[1] The War On General Purpose Computing continues. Far too many business models depend on selling general purpose computers as "appliances". They presume it is possible to sell a computer that isn't Turing complete. [1] https://boingboing.net/2012/01/10/lockdown.html https://boingboing.net/2012/01/10/lockdown.html

Aperocky 5y ago
It's inevitable, given the scale that has to happen before ASIC become remotely profitable and how cheap general purpose computers are today. Just buy some cheap SOC from the market and load the software, close it in a blackbox and call it a day. It's going to be the future now. God forbid they also talk to internet and runs an OS version from 2014 and never gets patched. It's a botnet paradise.
ballenf 5y ago
The battle really parallels the larger right to repair debate. (Especially if we realize the latter is probably is better called the right to exercise control over purchased goods.)
- oneplane 5y ago
  Does it? Everyone is quick to judge but coming up with an alternative is hard enough that nobody has done it so far. With scale comes scaling issues; general purpose computing and repairability need a different commercial model that doesn't match with the currently used models. This leaves two avenues: - Make it worse for everyone but keep it going - Make it worse for everyone in a different way and keep it going I don't know of a good solution here, but I do know that it's a sucky situation and the many "good ideas" to fix it aren't actually making it that much better. Current scenario: - Manufacturer on the hook for most things but also controls most things - End-users that fall within the 90% bell-curve are fine - End-users that fall outside of that are royally screwed and they don't even know it - Users that are not end-users are screwed, but they know they are So far all I have seen is: - Manufacturers still on the hook for everything but they get to control less - Everyone gets a little better but also a little screwed now - The 10% outside of the curve don't get as screwed as they did but they still don't really know that they are screwed - The non-users don't get screwed the way they used to but still get screwed To clarify: If I were to manufacture something, express what user experience comes with my 'thing' and warrant that experience to a certain degree, I don't want to be on the hook for any service or cost outside of that. The more I get to control, the smaller I can make the risk. That means I can also plan ahead better and reserve resources, but not so much that I don't have resources for something else left over. This also means that if someone wants a different experience (i.e. they are not my targeted audience) or if someone wants to do something I cannot verify, I really do not want to be on the hook for that. In total that means: - If what I want and what my customer wants is similar enough, we're both happy - If a small percentage wants something else, I cut my losses and simply don't serve their needs as soon as the cost of maintaining that deviation is bigger than what I would make off of it (short term and long term) - If someone does something I don't have control over, but they do come to me to fix their problem, I don't want to be responsible for that, and I don't want to do any research on the possibility that something I made happened to break at the same time the customer broke something else; I just want a blanket "I am the captain of my UX" rule and be done with it Now, I'm not saying this is ideal, or that I am an actual manufacturer, or that this is specifically what Google is doing (or Apple is doing for that matter), but I am saying that you can't have it both ways. Want something cheap and abundant? Gotta have scale. Can't have scale if you make a bunch of risk, add a lot of differences and support more than your middle-of-the-bell-curve. This sucks, but it's also not easy as saying "let me do what I want", because what happens to you and your device has side-effects, and I really don't want to get affected by something someone on the mobile network (or wifi network) I'm on did to their 'personal' and 'owned' and 'freedom' and 'muh righz' device. Or in a high contrast (black-and-white/good-or-evil) line: If you want to be on a shared service, play by the rules or get out. (reality isn't that high of a contrast obviously, but it drives the point of externalities home a lot quicker)

rhinoceraptor 5y ago

Arbitrary code isn't banned on iOS, there isn't anything (yet) that can create fully fledged apps like Droidscript, but a few cool apps are: - iSH: an Alpine Linux shell environment, powered by an x86 to ARM JIT emulator - Scriptable: an iOS automation tool using Javascript, it can even integrate with native iOS APIs like photos and calendars, create native UIs, etc. - Pythonista: a Python IDE, you can create 2D games, use it as a REPL, integrate with native APIs, and much more And of course, there are the 1st party apps, Playgrounds and Shortcuts.

glsdfgkjsklfj 5y ago
> Arbitrary code isn't banned on iOS It is. Even mozilla firefox is banned on the premise that it can run arbitrary code and yes, that is the official apple instance. The fact that they apply it when they see fit and allow other times, and that it is totally arbitrary and opaque based on their own private interests, is exactly what everyone with common sense tried to explain when criticizing the walled garden.
- mrtranscendence 5y ago
  My understanding is that what's banned on iOS is not arbitrary code per se, it's arbitrary code downloaded from the internet. Code you enter yourself, like in Pythonista, is just fine.
  - caleb-allen 5y ago
    I believe Pythonista is interpreted, not compiled, and outside of Apple's Swift app you are not able to run compiled code
  - tomp 5y ago
    Isn't the problem JITing? Mozilla could ship Firefox, even with the JS engine, it would simply be unusable (compared to Safari) because they wouldn't be allowed to run JIT (only interpreter).
  - lurkerasdfh8 5y ago

cookiengineer 5y ago

Technically, f-droid is a walled garden of sorts, too. The difference is that fdroid is actually helping users through being transparent about it. The other stores and their policies usually are not transparent, and therefore nobody knows whether there were financial motivations involved in the decisions. What I don't like is google claiming droidscript harms Android through a malicious AdMob ID. Even if that were the case, what happens to the 100.000+ installs that are rolled out already? And the Apps built with DroidScript? If there's no support you can contact (at Google) and no changelog on what happened, the policies get intransparent and look more like a financial motivation rather than a decision that seemed to be beneficial for the end-users.

CivBase 5y ago
I can add third-party repositories to F-Droid. The default F-Droid repository may be a walled garden but as far as I can tell the app and protocol are definitely not.
- cookiengineer 5y ago
  A walled garden doesn't necessarily exist solely of proprietary protocols and code. In the case of fdroid, apps that violate open source licenses are not allowed. So, technically, from the perspective of a company like Facebook, fdroid is a walled garden they cannot enter without open sourcing their code. (I'm not saying fdroid's policies are bad. I'm just trying to make an argument for the counterside and am playing the devil's advocate here.) PS: I know about third-party repositories. That's not the point, it's differences in policies and their effects on the ecosystem I want to discuss because I think they're more important. Google advocates always make the argument that endusers "can just root their phones and install the APKs anyways" which is similar to f-droid with an external repository. Most non-technical endusers simply won't do that.
  - _ZeD_ 5y ago
    no, literally: you can add any repository you want, even with proprietary code.

austincheney 5y ago

Weak. The console tab of Chrome's developer tools allow arbitrary code execution. That example is not a security violation, ergo arbitrary code execution is potentially but not necessarily a security violation. A valid remediation requires more than just arbitrary code execution, such as privilege escalation or leaking containment.

Phylter 5y ago

You may not realize this but Apple allows scripting apps on their platform now. There are two notable Python language interpreters Pyto and Pythonista. There are some shell environments too that include Unix style command shells and different interpreters.

kmeisthax 5y ago

This is actually worse than the full iOS route, because Apple is likely to at least listen to appeals and implement bright-line rules between "things the app does" and "things users do". They ultimately do want to have developer tools on the App Store and are willing to accommodate them to a point. Even the "no competing browser engine" thing has a technical explanation: Apple wants to be able to update that part of your app without you being involved. Google just doesn't care about what your app does until they start seeing click fraud, upon which they ban your app, delete your Gmail, and ghost you. They've even done this to paying GSuite customers, game studios they were working on, and their own employees' spouses. As far as I can tell, antispam is at the top of the org chart and can overrule all other layers of management. I would never trust Google with anything I can't backup or migrate to another service.