5 ms·

Is this actually true? "If you write an app for either platform, you have to publish it through the respective walled garden, and you can do so for free—but th

Is this actually true? "If you write an app for either platform, you have to publish it through the respective walled garden, and you can do so for free—but then it must contain built-in advertisements that provide Apple and Google with surveillance data of your users. If you want to protect your users from that, you must sell the app for money and hand over a cut to compensate Apple and Google for the missing advertisement and surveillance revenue." I remember back in the early days uploading a free app with no ad frameworks to the play store, and I believe there are plenty of third party ad networks (that I'd assume don't share data with Apple/Google)

flax 5y ago
No, it is not true. You must pay to release any app on either store. Google charges a one-time $25 fee, Apple charges $100 per year. You may release a free app with no advertisements. In fact, that is the easiest configuration, since charging for the app means setting up payment information. And including ads means payment information and integrating ad serving code into your app. It is not "built in" on either platform.
- hackerfromthefu 5y ago
  Yet it seems the vast majority of apps include ads.
  - avianlyric 5y ago
    It’s almost like the majority of developers write code to make money.
    - raxxorrax 5y ago
      But now you successfully filtered most of the people that don't. And there is tons of quality software without a business incentive aside from the fun to create said software. Happens, since part of software development is a creative (non commercial) enterprise. I would write more free software too if I didn't need to pay rent. Of course free software cannot be the only model, but as I said, you won't find much of that in app stores.
    - hansel_der 5y ago
      they sure do. kinda sad that they mostly use functionality from the foss ecosystem created by the minority that doesn't.
btdmaster 5y ago
In either case it is requiring the users to make an account with the violators, which is a problem in itself.
- dane-pgp 5y ago
  Any process with enough friction to prevent spammers/scammers also has enough friction to allow government censorship. Even if governments do end up allowing alternative app stores, I imagine the laws will include some sort of liability clause that means the store owner is responsible for censoring any apps that the government blacklists. This may not be relevant now, but when Western nations start banning E2EE chat apps and VPNs, I think people will become more aware of what a choke-point the app store model is.
  - runnerup 5y ago
    They’ve already bannned truly effective E2EE. Lavabit, TrueCrypt, Skype all RIP. I suspect the new E2EE protocols like signal may secure past communications to some degree but further forward communications can be wiretapped via federal order. No one seems to care.
    - spzb 5y ago
      Truecrypt lives on as Veracrypt
    - bigfudge 5y ago
      Can you explain how a Signal conversation with a verified correspondent can be wiretapped? My understanding was that their safety code would change and you would have to revalidate if anything untoward happened, but perhaps I’m wrong…
      - runnerup 5y ago
        I figured an NSL could require Google Play to issue an “update” for that user which was just a backdoored client. Or similarly, require Signal to do something like that. As lavabit was pressured to do.
kornhole 5y ago
Anything you get from Google play store is wrapped with Google's trackers. This ensures that Google knows what you are using at a minimum. Then the promiscuous Google Play Services provides even greater visibility as it processes all your notifications. You can check the trackers here. https://reports.exodus-privacy.eu.org/en/ https://reports.exodus-privacy.eu.org/en/ Apple's store and OS is more opaque. Others may be better able to explain their mechanisms. A small minority of us don't have Google Play Services on our phones and get all apps from F-droid. So he is not referring to us. As a developer and system administrator I would have added to this piece how costly it is to actually delete data. It is usually far cheaper to store everything even well after it has legitimate use because developing archiving routines and strategies that don't break other things is work that few IT organizations bother with among all their other priorities.
- IanCal 5y ago
  > It is usually far cheaper to store everything even well after it has legitimate use This is true and one of the key reasons for GDPR. The cost for keeping data beyond the legitimate use needs to be increased.
  - oblib 5y ago
    There is a bit of a conundrum with this issue. Just last week I went over user accounts for one of my apps and deleted those that had expired for longer than 6 months on the live server. So, their data is off the live server but still on weekly backups that are rotated out and deleted after 4 weeks. But I also have snapshots of that server that go back years and it would be some work to delete a user's data on those. And other users might need to recover data, so I can't just delete the snapshots.
    - WrtCdEvrydy 5y ago
      Wait till you get a deletion request for a specific user... we've had to mount snapshots as DBs just to have an automated query purge their record from the snapshot, delete the snapshot and retake the snapshot.
_moof 5y ago
With all due respect to phk, that he has gotten such a basic fact so howlingly wrong makes me wonder what else in the article needs attention.
- agallant 5y ago
  It's perhaps worth steelmanning the argument here - though technically one can release an app for free, it is generally the case that any app with significant investment (warranting monetization) will take one of the two paths he described, and this describes the majority of popular apps.
  - dotancohen 5y ago
    This sentence: > but then it must contain built-in advertisements Could just as easily have been: > but then it most likely contains built-in advertisements In a technical article there may be many reasons for simplifying an explanation, but there is no excuse for lying.
    - Helloyello 5y ago
    - deleted 5y ago
      [deleted]
    - sideshowb 5y ago
      I've lost battles with an editor (of a popular publication) that ultimately led to inaccuracies like this creeping in. They just cared about readability far more than truth.
- raxxorrax 5y ago
  I think the larger context is that you need to pay a fee to upload an app and have it reviewed. If you don't want to shoulder the cost you need to reimburse yourself through advertising income if you want to have it available for free for yourself and your customers. So I don't believe this is a harrowing mistake...
woah 5y ago
Also this one: "There is objectively no reason why Apple or Google should know every single time you make a phone call or send a message, but since their profits are built on them knowing, you will not find it easy to configure your mobile phone to not tell them" I could see it being true about Google, but Apple?
- hackerfromthefu 5y ago
  I recall a recent HN post that showed that in terms of bytes of data, iphones send more to Apple than android phones to Google.
- avianlyric 5y ago
  I would also like to see some citations on this. He mentions experiences with Android, but nothing for iOS. It makes me wonder if the author is speaking from a place of knowledge, or just speculation.

flax 5y ago

No, it is not true. You must pay to release any app on either store. Google charges a one-time $25 fee, Apple charges $100 per year. You may release a free app with no advertisements. In fact, that is the easiest configuration, since charging for the app means setting up payment information. And including ads means payment information and integrating ad serving code into your app. It is not "built in" on either platform.

hackerfromthefu 5y ago
Yet it seems the vast majority of apps include ads.
- avianlyric 5y ago
  It’s almost like the majority of developers write code to make money.
  - raxxorrax 5y ago
    But now you successfully filtered most of the people that don't. And there is tons of quality software without a business incentive aside from the fun to create said software. Happens, since part of software development is a creative (non commercial) enterprise. I would write more free software too if I didn't need to pay rent. Of course free software cannot be the only model, but as I said, you won't find much of that in app stores.
  - hansel_der 5y ago
    they sure do. kinda sad that they mostly use functionality from the foss ecosystem created by the minority that doesn't.

btdmaster 5y ago

In either case it is requiring the users to make an account with the violators, which is a problem in itself.

dane-pgp 5y ago
Any process with enough friction to prevent spammers/scammers also has enough friction to allow government censorship. Even if governments do end up allowing alternative app stores, I imagine the laws will include some sort of liability clause that means the store owner is responsible for censoring any apps that the government blacklists. This may not be relevant now, but when Western nations start banning E2EE chat apps and VPNs, I think people will become more aware of what a choke-point the app store model is.
- runnerup 5y ago
  They’ve already bannned truly effective E2EE. Lavabit, TrueCrypt, Skype all RIP. I suspect the new E2EE protocols like signal may secure past communications to some degree but further forward communications can be wiretapped via federal order. No one seems to care.
  - spzb 5y ago
    Truecrypt lives on as Veracrypt
  - bigfudge 5y ago
    Can you explain how a Signal conversation with a verified correspondent can be wiretapped? My understanding was that their safety code would change and you would have to revalidate if anything untoward happened, but perhaps I’m wrong…
    - runnerup 5y ago
      I figured an NSL could require Google Play to issue an “update” for that user which was just a backdoored client. Or similarly, require Signal to do something like that. As lavabit was pressured to do.

kornhole 5y ago

Anything you get from Google play store is wrapped with Google's trackers. This ensures that Google knows what you are using at a minimum. Then the promiscuous Google Play Services provides even greater visibility as it processes all your notifications. You can check the trackers here. https://reports.exodus-privacy.eu.org/en/ https://reports.exodus-privacy.eu.org/en/ Apple's store and OS is more opaque. Others may be better able to explain their mechanisms. A small minority of us don't have Google Play Services on our phones and get all apps from F-droid. So he is not referring to us. As a developer and system administrator I would have added to this piece how costly it is to actually delete data. It is usually far cheaper to store everything even well after it has legitimate use because developing archiving routines and strategies that don't break other things is work that few IT organizations bother with among all their other priorities.

IanCal 5y ago
> It is usually far cheaper to store everything even well after it has legitimate use This is true and one of the key reasons for GDPR. The cost for keeping data beyond the legitimate use needs to be increased.
- oblib 5y ago
  There is a bit of a conundrum with this issue. Just last week I went over user accounts for one of my apps and deleted those that had expired for longer than 6 months on the live server. So, their data is off the live server but still on weekly backups that are rotated out and deleted after 4 weeks. But I also have snapshots of that server that go back years and it would be some work to delete a user's data on those. And other users might need to recover data, so I can't just delete the snapshots.
  - WrtCdEvrydy 5y ago
    Wait till you get a deletion request for a specific user... we've had to mount snapshots as DBs just to have an automated query purge their record from the snapshot, delete the snapshot and retake the snapshot.

_moof 5y ago

With all due respect to phk, that he has gotten such a basic fact so howlingly wrong makes me wonder what else in the article needs attention.

agallant 5y ago
It's perhaps worth steelmanning the argument here - though technically one can release an app for free, it is generally the case that any app with significant investment (warranting monetization) will take one of the two paths he described, and this describes the majority of popular apps.
- dotancohen 5y ago
  This sentence: > but then it must contain built-in advertisements Could just as easily have been: > but then it most likely contains built-in advertisements In a technical article there may be many reasons for simplifying an explanation, but there is no excuse for lying.
  - Helloyello 5y ago
  - deleted 5y ago
    [deleted]
  - sideshowb 5y ago
    I've lost battles with an editor (of a popular publication) that ultimately led to inaccuracies like this creeping in. They just cared about readability far more than truth.
raxxorrax 5y ago
I think the larger context is that you need to pay a fee to upload an app and have it reviewed. If you don't want to shoulder the cost you need to reimburse yourself through advertising income if you want to have it available for free for yourself and your customers. So I don't believe this is a harrowing mistake...

woah 5y ago

Also this one: "There is objectively no reason why Apple or Google should know every single time you make a phone call or send a message, but since their profits are built on them knowing, you will not find it easy to configure your mobile phone to not tell them" I could see it being true about Google, but Apple?

hackerfromthefu 5y ago
I recall a recent HN post that showed that in terms of bytes of data, iphones send more to Apple than android phones to Google.
avianlyric 5y ago
I would also like to see some citations on this. He mentions experiences with Android, but nothing for iOS. It makes me wonder if the author is speaking from a place of knowledge, or just speculation.