5 ms·

Tell HN: FairEmail terminated after Google falsely flagged as spyware

123 points by richardboegli 4y ago

I follow K9 XOAUTH2 issue [0] and saw someone post that FairMail development has been terminated. From the post [0] and the website [1]: All my projects have been terminated after Google falsely flagged FairEmail as spyware without a reasonable opportunity to appeal. There will be no further development and no more support. GitHub has the last release as of 2022-05-18 and the repository has been archived by the owner. It is now read-only. FairEmail was posted on HN just over a year ago [3]. EDIT1: Another post was done earlier [4] linking to an XDA post. Thanks @M66B EDIT2: Another post was done earlier [5] linking to another XDA post. Thanks @neogodless [0] https://github.com/k9mail/k-9/issues/655#issuecomment-1131645640 https://github.com/k9mail/k-9/issues/655#issuecomment-113164... [1] https://email.faircode.eu/ https://email.faircode.eu/ [2] https://github.com/M66B/FairEmail/releases https://github.com/M66B/FairEmail/releases [3] https://news.ycombinator.com/item?id=26386374 https://news.ycombinator.com/item?id=26386374 [4] https://news.ycombinator.com/item?id=31426915 https://news.ycombinator.com/item?id=31426915 [5] https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334

boole1854 4y ago
[Copied from my post on the other HN thread about this (https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334)]: I guess I'll take the contrarian view here: the developer violated a reasonable Play Store policy, refused to fix the problem, and received an expected outcome. If you read the details of the Play Store complaint, you will see that they say the app was uploading information from the user's contact list without properly disclosing to the user that this was happening [1]. This is a violation of Play Store policy (a disclosure is required). It's not an unreasonable policy. You can see in the app's source code where some of this happens [2]. In short, the contact list is read off the device, email addresses associated with each contact are parsed out, and the app does HTTP requests to remote servers to get the favicon associated with each email contact domain. Note that this is the sending of information off each user's contact list (the email address domains) to those remote servers. As such, it requires a disclosure to the user. The developer's response is that he refuses to add a disclosure to the app because he is not uploading "contact info". [3]. Ok... not a great response. Certainly I would expect apps to disclose whether or not they are using any information on my contact list to reach out to third-party servers, even if only domain names. In any case, it's Play Store policy. In the end, he finally removed the favicon feature. And Play agreed to allow the app back into the store. [4] But he has not yet backed down on shutting down the whole project because he's still upset. Sources [1] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913731 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f... [2] https://github.com/M66B/FairEmail/blob/master/app/src/main/java/eu/faircode/email/ContactInfo.java https://github.com/M66B/FairEmail/blob/master/app/src/main/j... [3] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913771 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f... [4] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86914375 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...
- dang 4y ago
  Please don't copy comments into other threads. Besides lowering the signal/noise ratio of the site, it makes merging threads a pain because it adds a subthread merge to the problem! - that is, we have to turn all the replies to your copied comment into replies to the original comment in order to be fair to the repliers. If threads need merging, you (or anyone!) are welcome to let us know at hn@ycombinator.com. That's how I found out about this case.
  - boole1854 4y ago
    Good to know, thanks.
- sureglymop 4y ago
  Could you please elaborate? How exactly is getting a favicon for each of these domains possibly "sending of information off each users contact list"?
  - xnx 4y ago
    It sounds like you answered your own question. The domain of a contact is private information that I don't want shared without my consent, even if the domain isn't as high resolution as the full email address. In many cases the domain is all you need. Example: Imagine I have the contact z@markzuckerberg.com in my address book, or customerservice@embarassing-medical-condition.org.
dang 4y ago
Comments moved to https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334.

123 points by richardboegli 4y ago

boole1854 4y ago

[Copied from my post on the other HN thread about this (https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334)]: I guess I'll take the contrarian view here: the developer violated a reasonable Play Store policy, refused to fix the problem, and received an expected outcome. If you read the details of the Play Store complaint, you will see that they say the app was uploading information from the user's contact list without properly disclosing to the user that this was happening [1]. This is a violation of Play Store policy (a disclosure is required). It's not an unreasonable policy. You can see in the app's source code where some of this happens [2]. In short, the contact list is read off the device, email addresses associated with each contact are parsed out, and the app does HTTP requests to remote servers to get the favicon associated with each email contact domain. Note that this is the sending of information off each user's contact list (the email address domains) to those remote servers. As such, it requires a disclosure to the user. The developer's response is that he refuses to add a disclosure to the app because he is not uploading "contact info". [3]. Ok... not a great response. Certainly I would expect apps to disclose whether or not they are using any information on my contact list to reach out to third-party servers, even if only domain names. In any case, it's Play Store policy. In the end, he finally removed the favicon feature. And Play agreed to allow the app back into the store. [4] But he has not yet backed down on shutting down the whole project because he's still upset. Sources [1] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913731 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f... [2] https://github.com/M66B/FairEmail/blob/master/app/src/main/java/eu/faircode/email/ContactInfo.java https://github.com/M66B/FairEmail/blob/master/app/src/main/j... [3] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86913771 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f... [4] https://forum.xda-developers.com/t/app-5-0-fairemail-fully-featured-open-source-privacy-oriented-email-app.3824168/post-86914375 https://forum.xda-developers.com/t/app-5-0-fairemail-fully-f...

dang 4y ago
Please don't copy comments into other threads. Besides lowering the signal/noise ratio of the site, it makes merging threads a pain because it adds a subthread merge to the problem! - that is, we have to turn all the replies to your copied comment into replies to the original comment in order to be fair to the repliers. If threads need merging, you (or anyone!) are welcome to let us know at hn@ycombinator.com. That's how I found out about this case.
- boole1854 4y ago
  Good to know, thanks.
sureglymop 4y ago
Could you please elaborate? How exactly is getting a favicon for each of these domains possibly "sending of information off each users contact list"?
- xnx 4y ago
  It sounds like you answered your own question. The domain of a contact is private information that I don't want shared without my consent, even if the domain isn't as high resolution as the full email address. In many cases the domain is all you need. Example: Imagine I have the contact z@markzuckerberg.com in my address book, or customerservice@embarassing-medical-condition.org.

dang 4y ago

Comments moved to https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334.