5 ms·
Right now, Google Play is the wild west. The app store admins are far too lenient when it comes to things like this. No vetting of apps. No inspection of source
by kosasbest 5y ago
Right now, Google Play is the wild west. The app store admins are far too lenient when it comes to things like this. No vetting of apps. No inspection of source code for red flags. And the sketchy apps can be rated five stars by a bunch of bots artificially inflating its popularity. Clown show.
- sebzim4500 5y agoAre there any app stores where the developer needs to submit the source code for inspection?
- dane-pgp 5y agoWould it be unreasonable to answer that with "F-Droid"? I guess the implicit (and reasonable) assumptions of your question are that the source code is fully reviewed by the people running the app store, and it is a "store" in the sense that people routinely pay money for the apps available there.
- myko 5y ago> No vetting of apps. This is not true, apps are reviewed now. IMO this is theater and useless, though. > No inspection of source code for red flags. This is also untrue, Google scans apps for known malware. Not sure how this was missed, though. > And the sketchy apps can be rated five stars by a bunch of bots artificially inflating its popularity. This is true. It's also a problem on the App Store and similar sites. The App Store is not immune to these issues, either: https://twitter.com/jonathandata1/status/1486458526767661060 https://twitter.com/jonathandata1/status/1486458526767661060
- joshstrange 5y agoI know the App Store isn't immune but I'm having a hard time remembering a time when an app on iOS was reaching into other app's data or doing something like a keylogger system-wide. Often it's things like "It's listening to you, grabbing your clipboard, etc". While far from "good" or "ok", it's a far cry from some random app being able to steal my banking session.
- realusername 5y agohttps://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/ https://www.macrumors.com/2020/08/24/xcode-malware-infiltrat... It usually starts with xcode injecting malware, since the building process is so opaque and undocumented, they get away with it.
- joshstrange 5y ago> It usually starts with xcode injecting malware That happened once, it's not like every few months or year where hear of a new instance of something like that and it's still not reaching outside itself into other apps as far as I know. So yeah, it could steal the banking login info of the banking app it managed to get injected into but it's not like "iFart" can reach in and grab your bank creds.
- realusername 5y agoThat issue is worse than some "iFart" app since you are getting a regular app, from a regular vendor.
- joshstrange 5y agoNo doubt, I'm not downplaying the severity of the xcode inject issue. I'm just saying it has only happened once before that we know of and it still isn't a "breakout"/"escape"-type exploit that we see so often in Android-land.
- realusername 5y agoI can't recall a sandbox breakout happening on Android for a very long time and this malware isn't breaking out either.
- duskwuff 5y ago> https://twitter.com/jonathandata1/status/1486458526767661060 https://twitter.com/jonathandata1/status/1486458526767661060 Relevant subtweet: https://twitter.com/0xabad1dea/status/1487093037352333317 https://twitter.com/0xabad1dea/status/1487093037352333317
- edm0nd 5y agoIt's almost as if malicious actors have learned how to obfuscate malicious code to bypass Google Play reviews...
- ziml77 5y agoPeople who constantly say that [large company] does nothing to block malicious/spam content are underestimating how motivated the bad actors are and how many there. And when it comes to measures to prevent this stuff, there's a balancing act to be done. Because things that make it harder for malicious actors also makes it harder for everyone else and will increase the false positive rate.
- kubik369 5y agoI would love to encounter these lenient admins/moderators. We just seem to be getting our app at work suspended all the time for the most random things. One time, the whole app was suspended and we needed to create a new app identifier in the play store, because no one was replying to our case :/ I agree that it is a true clown show.
- admax88qqq 5y agoYou should ship malware instead, those appear to pass "inspection" more often :/.
- sschueller 5y agoMy App was rejected because a word was repeated twice in the description by mistake.
- tata71 5y agoFair enough, honestly.
- tata71 5y agoWhich Google product are you competing with?
- paulpauper 5y agoNot just google play. Big tech companies are the greatest gift for scammers ever. People have made so much money scamming users of these sites, whether twitter ,Facebook, YouTube, apps... anything. The reason has to do with how content is moderated. If you spam Reddit, the admins will handle it almost as soon as it is reported and will come down really hard, but the lag time between when Google is aware of of a threat and then acts and when the threat goes live, is long enough for scammers to make a lot of money. Paying for moderation is expansive. Apple is willing to make the large investment in quality control to protect its users, but most companies either outsource or automate as much as possible, so a lot of garbage gets through.
- dathinab 5y agoIt's not lenient admins but failing autonomous screening/getting. People have all the time problems publishing for all the stupid reasons. At the same time people publishing malware or spyware are not cought.