15 ms·

Google contacted me directly to help restore FairEmail on the Play Store

212 points by cf100clunk 4y ago

dbg31415 4y ago
I wrote this as a comment the last time this came up. After reading what I could read, seems like there was a legitimate security concern, and rather than work on it the dev just sort of said, "Meh, I don't want to do non-dev things, let's just cancel this project. It's not fun anymore." Paraphrased. He also wrote: > Core problem > Google. There is no sensible way to appeal in case of bad reviews or alleged violations of Play store policies. > People. They are generally pretty demanding and on the other hand everything should be free. > Myself. An old and grumpy developer, who maybe should retired. I 100% believe all of those points, but especially with open-source devs... most people who do those projects do them to avoid "real software" -- what I mean by that is the process that it takes to make enterprise software or software at scale. Project Managers, Product Owners, UX Designers, QA Testers, Security Consultants, etc. Most open-source projects tend to be the software equivalent of some guy in his garage building a model train set... just something you can do for fun to flex your skills. Focus on building, but not having to deal with the overhead of communicating, taking input, and compromising with others. Anyway, building a side project is fine. But... like in another post someone was complaining about the certification cost of dealing with Google Data as a 3rd Party Developer... and like... I can't get on board with the sympathy bandwagon there. I want there to be a stringent process before Google even gives app developers the ability to request access to my data -- even if it's on my behalf. And so... back to the analogy, building a model train is fine, but like... wanting to build a fully operational train all by yourself, and have others use it, ride on it, rely on it... at some point, it needs to turn into a "real" project. One of the hardest things about dealing with open-source projects is all the original creators of those projects who just don't want to play nice, and don't want to grow a team to grow and support their code. One thing I've done when an agency or company I work for has used open-source code, we try and at least set up a lunch and learn with the creator. Good to get their vision of where the code is going, good to have that line if we need them to fix bugs. But like... 99% of the time, I know that any input we give... there's just no point. The creator doesn't want input, he only really wants to play in his basement with his model train. Buy him lunch, give him as big of a guest lecture stipend as I can, and move on.
- deleted 4y ago
  [deleted]
- pvg 4y ago
  https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=author%3Adang%20copy%20paste%20comments&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
csdvrx 4y ago
It shows that most people are nice, and try to do the right thing even if mistakes can happen. However, it is sad that PR campaigns are required to reach out to an actual human being who cares.
- lin83 4y ago
  I'm not sure there is anyone nice here. This is likely cynical corporate damage control at best or the work of an annoyed Google employee who happens to use this app and took a personal interest. I love Fairmail and as a paid user I'm glad it's back on the PlayStore but nothing about this makes me think better of Google or anyone in charge there.
  - rjzzleep 4y ago
    Especially since the fix seems to have been to expand the table in the privacy policy. On top of that most of these seem to be features you have to explicitly enable.
    - encryptluks2 4y ago
      Yeah, how could Google requiring a developer to disclose data collection be a good thing? Geez people, let's continue the outrage at Google and demand that no developer have to disclose data collection. /sarcasm
      - Dylan16807 4y ago
        Except google didn't ask for that, they gave a factually wrong rejection reason and wouldn't communicate properly. Also the part they were likely mad at was not data collection.
  - csdvrx 4y ago
    > This is likely cynical corporate damage control at best or the work of an annoyed Google employee I fully disagree with your take. You are assuming the default is negative. I think your explanation might be possible, but that by default it's wrong, as most people are not cynical/annoyed or any other negative quality. My fundamental belief is that most people are nice and want to do good things. If you are surrounded by cynical/annoyed people, you may be in a toxic environment, which may taint your judgement for other situations. NB: either one of us could be making a fundamental attribution error https://en.wikipedia.org/wiki/Fundamental_attribution_error https://en.wikipedia.org/wiki/Fundamental_attribution_error and it might be hard to find the truth, as it boils down to beliefs.
bronikowski 4y ago
That's all well and good but I wish we could avoid the entire circus from the start. I hate the power companies have over distribution channels, the eternal struggle between convince and freedom.
- ajross 4y ago
  It's worth pointing out that the app seems genuinely to have been in violation of the Play Store Malware policy (see the "Spyware" section at https://support.google.com/googleplay/android-developer/answer/9888380?hl=en https://support.google.com/googleplay/android-developer/answ...) The nature of email clients, especially ones that integrate with cloud-hosted spam and filtering services, is that they're naturally going to have trouble with that policy absent great care with specifying exactly what gets collected. The "fix" here seems to have been to update their policy documentation to describe exactly that.
  - bronikowski 4y ago
    That's one of my issues, of course. With half-automated/decided by unaccountable forces strict reading of the "law" (store policy) you get outcomes like that. It would be much better to have "spirit of the law" reading of the policies, but that requires engaged staff/high touch verification process. Google is unwilling to go that way so our only recourse is to make a ruckus and hope we'll get the ear of someone who can whisper to the emperor. It works, but it scales badly.
    - cupofpython 4y ago
      >engaged staff/high touch verification process this does not scale well either
  - miloignis 4y ago
    Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when it is.
ushakov 4y ago
how many developers are not as lucky as you and Google doesn’t give a f?
- deleted 4y ago
  [deleted]
AshamedCaptain 4y ago
This is nice: https://github.com/M66B/FairEmail/blob/master/PRIVACY.md#summary-of-shared-data https://github.com/M66B/FairEmail/blob/master/PRIVACY.md#sum... Albeit I am undecided whether we should really force every FLOSS developer to create a table like this, apparently Google has decided that yes, we do.
- duskwuff 4y ago
  > Albeit I am undecided whether we should really force every FLOSS developer to create a table like this I don't see any reason why open-source software should get a free pass on privacy issues.
  - bee_rider 4y ago
    I think it depends more on the business model. If an open source project is really just somebody releasing their own code, they don't have any obligation at all to the end user. If a business is releasing open source code and has some business model that ultimately turns that into profit (even indirectly, for example via selling your private info), then they have an moral obligation to be clear on how they are making money. On the other hand, the app stores have no obligation to host projects generally.
    - usr1106 4y ago
      The Google app store has an interest to publish all kind of apps, FOSS or not. It supports their "the customer is the product" business model. Apple has an interest to publish the same apps. It supports their "keep the users in the walled garden" business model. Both form an unhealty duopoly from both app developers and end users point of view. Saying they have no obligation to host an app might be correct, but it's a very limited perspective of the whole situation.
    - pmontra 4y ago
      If they release the source and I'm building the app, maybe you're right but it would be nice to know how they it handles privacy without having to read every single line. If they distribute the app there is little difference from a closed source install. Again, "read the code and learn what we do about privacy" would be pretty hostile.
lizardactivist 4y ago
Only because they got so much flak for it. But it's great the app is back.
- deleted 4y ago
  [deleted]
encryptluks2 4y ago
If you look at the changes in the privacy policy, and as others had brought up before, this ban was warranted. There was a lot of data collection happening that wasn't disclosed.
- m-p-3 4y ago
  Warranted or not, what is unacceptable is the lack of transparency in the whole process. At least point the developer towards a path into compliance, not just black-holing them altogether.
  - encryptluks2 4y ago
    I agree the process could be improved, but if they post policies and developers fail to read them and follow them they really only have to say they violated their policies.
    - lolinder 4y ago
      If interpretation of the policies were consistent, to the point where I could reasonably guess that the violation was in something I changed recently, I would agree with you. However, both platforms' policy enforcement is often wildly inconsistent. Rules get ignored and then suddenly enforced. Some reviewers are more persnickety than others. Something that's been passing under the radar for years might be suddenly interpreted as in violation of a policy while they're reviewing a minor bugfix. In that situation, "you violated a policy" is useless for figuring out the problem in any reasonably large app. (That said, it sounds like this dev did get an explanation.)
      - g_p 4y ago
        In this case, it seems like "recency" was a big issue - the change wasn't recent in any sense of the word, since it seems like the feature has been there since at least mid 2020. [0] The explanation in this case also seemed to focus on a (false) assertion the app uploaded the user's contact list - the app wasn't doing that. If a user turned on fetching favicons (it was off by default, with a red-coloured privacy warning in the app), then the app would fetch a favicon for received emails in non-junk folders, directly from the server in question. If apps are expected to treat the user's DNS server as hostile, then web browsers had better talk about how they send user browsing history to third parties (by querying DNS!). Similarly, the app connecting to the site and asking for a favicon is not really a leak to a third party, as the domain is owned by the sending user. If they chose to outsource their website to a third party, that's their choice (and problem). If the app was uploading user contacts to a third party, that would be very bad. It wasn't. But rival apps do (for monetisation etc.) Making benign apps write declarations that suggest it is doing something akin to that is (to be cynical) helpful for Google and other ad/data supported business model actors, who benefit from obscuring their practices by forcing others to make similar-looking declarations. [0] https://github.com/M66B/FairEmail/commit/57cf22b1193b43ca9795f7561bdb0427427ed734 https://github.com/M66B/FairEmail/commit/57cf22b1193b43ca979...
m-p-3 4y ago
What is disturbing is that this direct contact is the exception and not the norm for their level of customer service. This shows how complacent Google is in their almost dominant position, and will only go to an acceptable level of support if their moderator's AI dark-patterns makes them look bad.
- margalabargala 4y ago
  I'm still willing to celebrate this happening. An exception to normally bad behavior, and the first instance of a genuine change in approach, look identical. Example: how many people here were skeptical of Microsoft having a change of heart regarding open source back in 2012? And now a decade later, it's clear that was genuine.
  - xigoi 4y ago
    I'm still not convinced about that. For one, they're running the biggest closed-source Git hosting service (GitHub) and exploiting open-source projects to fuel their paid proprietary service (Copilot).
    - TedDoesntTalk 4y ago
      Open-source does not mean “I won’t try to earn money from this.”
      - xigoi 4y ago
        But it does mean “the source is available”, which it isn't for both GitHub and Copilot.
        TedDoesntTalk 4y ago
        When were GitHub and copilot announced to be open source?
        4y ago
davidkuennen 4y ago
As a developer who makes a decent amount of money on the App Store and Play Store I would pay for premium support. The biggest threat for my business is some AI killing my app on a false positive with no way to resolve the issue.
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
- VWWHFSfQ 4y ago
  They'll figure out a way to get you to pay $1,000/year for priority messaging with Premium Support Chat Bot.
- spear 4y ago
  "Nice app you have here. It would be a shame if something bad were to happen to it."
- LegitShady 4y ago
  create a problem and then charge people extra for 'support' to solve it. i dont even blame you.
- AdmiralAsshat 4y ago
  One would think Google taking 30% of the app sale would be enough to entitle a developer of a paid app to "premium" support, but I guess not.
  - gbriel 4y ago
    They should probably give you premium support automatically for free once you reach some threshold of sales. It makes sense for them to retain their share at that point.
jmyeet 4y ago
Just another data point that the only way to resolve issues like this is to kick up enough fuss on a site like this or on social media so that a real human can look at and resolve your issue. It's support prioritization by follower count.
- deleted 4y ago
  [deleted]
- klabb3 4y ago
  The best part is that the arsonist who put out their own fire gets to be a hero. The app store model has been shown time and time again to fail at the very issues it's supposed to solve, especially at scale. I can empathize with the desire for manual curation at an early stage and even blacklists for known malware. However, what we have today is a guilty-until-proven-innocent extortion scheme.
josephcsible 4y ago
I'm glad this got resolved, but it's not good that it had to be special-cased. Google really needs to fix their policies so that this kind of problem can be fixed through the normal channels that are available to everyone.
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
okasaki 4y ago
Anyone else having problems with gmail? Today FairEmail stopped working on my gmail account - I get an AUTHENTICATIONFAILED Invalid credentials error. I'm using the fdroid version, so I have to use IMAP instead of oauth2 for gmail (why? who knows, it works for office365).
- deleted 4y ago
  [deleted]
- KevinGlass 4y ago
  Google dropped support for IMAP text authentication on May 30th but didn't enforce it globally until today. If you check the "Allow less secure apps" section of your Google account settings you'll see it's been removed. You must use OAuth2 if you want to continue to use an external email client.
  - blendergeek 4y ago
    If you create an "app password", you can continue using whatever email app you want. https://support.google.com/accounts/answer/185833 https://support.google.com/accounts/answer/185833
    - deleted 4y ago
      [deleted]
  - okasaki 4y ago
    Oh, I see. Thanks. I'm not sure what to do then - I have a Huawei phone so I'm only using fdroid for apps. The Fdroid version of FairEmail doesn't support gmail with oauth because of "Google security features" (??). It's only supported on the Google Play version. I'm vaguely aware that there are sites out there where you can download apks, but that seems unwise.
    - tredre3 4y ago
      > there are sites out there where you can download apks, but that seems unwise. You can download Aurora Store form F-Droid. It is a Google Play frontend with an anonymous login mechanism and fetches APKs directly from Google. You can try installing Fairemail through that but I'm not sure if it will fix the login issue by itself (maybe it also wants the chrome webview or google play services?).
mabbo 4y ago
It feels like Google ought to have a small team of developer advocates whose sole job is to find apps that are in trouble and then work with the developers like humans. It doesn't need to be 100 people. Just 10 or 20 even. Just provide some kind of human touch to the support of the developers who make the Android app store worth a damn. Write documentation to better help other developers get out of these kinds of holes. Work to improve the messaging when apps are rejected so that it's easier to know what to do. It doesn't seem worth putting time and energy into making an app if I know a bot can suddenly end my project and there's nothing I can do about it, and no one whose job it is to help me.
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
- bastardoperator 4y ago
  It's a feature, for Google. They get to absolve themselves of any and all responsibility when it comes to their platform. Blame the bots, the system, the software, but not a single person is actually responsible for actions being taken. If we look at Youtube and DMCA, it's clear who Google cares about and it's certainly not individual users.
- thrdbndndn 4y ago
  I have been thinking of this (as well as for things like YouTube), but I honestly can't tell if it's feasible considering their size. Even the "legit" uses would be enormous let alone people who abuse it. At the very least, I don't think even 100 people would be able to cover it.
kjrose 4y ago
Considering how many of these "Google killed my X, Y or Z" posts I've seen on Hacker News. This really doesn't feel like anything to celebrate. It is just further proof that Google could, in theory, provide the support at the level necessary for these things, but just won't. Honestly, I know their job is hard, but if they simply put a legitimate task force together to figure out how to provide support at scale (even if it costs a premium to handle it, or possibly even a premium to do a proper appeal), I could see it helping immensely. Basically, if you want to do an appeal for something, it will cost, and depending on the violation and how often the violation is, the cost goes up. The appeal requires them to be clear about what the violation is, and what needs to be done to resolve it. Perhaps even make it that if you get an appeal with clear details and you resolve the issue, a certain percentage of the money will be refunded. Basically, instead of assuming everyone who their algorithms says is total evil is evil, they allow some form of good will that would help businesses, individuals and organizations work with them. I know the spammers and scammers are a huge pain, but then fine, charge them for the cost. The ones that are legit will pay and will work with Google if Google will work with them.
- deleted 4y ago
  [deleted]
indymike 4y ago
I've been a FairEmail user for a long time, and the product is fantastic, and I'm very happy this got worked out. FairEmail has always been excellent at explaining settings and their privacy ramifications, and I'm hoping that Google's switch to oauth doesn't break Fair Email's ability to check both my work profile email and home email google accounts. It's absolutely deflating when an app gets removed from a store, and a lot of times the rejection messages are terse and hard to make sense out of, and honestly, the developer has a lot invested in their app.
- deleted 4y ago
  [deleted]
  - deleted 4y ago
    [deleted]
deleted 4y ago
[deleted]
dang 4y ago
Recent and related: EFF and EU should respond to Google taking FairEmail off the Play store - https://news.ycombinator.com/item?id=31433051 https://news.ycombinator.com/item?id=31433051 - May 2022 (51 comments) FairEmail stopping development after Google falsely flags app as spyware - https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 - May 2022 (322 comments) FairEmail may be Ending Development - https://news.ycombinator.com/item?id=31426915 https://news.ycombinator.com/item?id=31426915 - May 2022 (6 comments) Previously: FairEmail: Open-source, privacy friendly email app for Android - https://news.ycombinator.com/item?id=26386374 https://news.ycombinator.com/item?id=26386374 - March 2021 (117 comments)
ldiracdelta 4y ago
The cartel giveth and the cartel taketh away. Blessed be the cartel.
- deleted 4y ago
  [deleted]
1vuio0pswjnm7 4y ago
"All my projects have been terminated after Google falsely flagged FairEmail as spyware without a reasonable opportunity to appeal." Would anyone classify Google's projects as "spyware". It is, after all, their "business model" to conduct surveillance. Whereas I doubt this author is making Google-sized profits, or even a modest livelihood, from his PlayStore apps, even if the apps were "spyware". Google is the undisputed king of spyware unless the user believes that her interests are always 100% aligned with Google's interests and nothing Google does can ever harm them. In order to hold such beliefs one would also have to ignore the millions in fines Google continues to pay for privacy incursions. I have been using one of this author's other programs, NetGuard, from FDroid, in lockdown mode, for computer running non-rooted Android. I have not seen anything like it, i.e., a user-controlled application firewall as a standalone app, for iOS. I am not aware of any competing apps for Android either. It appears to be a one-of-a-kind app, AFAICT. If someone knows of better option for selectively blocking traffic from apps, let's hear about it and the reasons why it is better. The assumption that Google is more trustworthy than any single app author is questionionable. It is that dogma upon which the "app store" concept depends. For example, can Google really compete with this author with respect to protection from spyware. Let's consider some facts. The author offers user-controlled protection from spying in NetGuard. Google offers Google-controlled protection from spying in the form of app store vetting. The former is open source, users can compile it themselves, and it does not report back to a mothership. The later is not something any user compiles themselves, it not controlled by the user, it is controlled by Google, it does report back a mothership, and the motherwhip's "business model" depends on that surveillance. The later, namely Android, Google apps and Google "services", are, by definition, spyware. Google collects data about pocket computer owners and uses it in undisclosed ways. There is simply no way for a pocket computer user to know the many things that Google does with the data it collects from spying. The only instances where she may learn about what Google does with her data are when facts are disclosed in response to discovery requests in litigation and those facts are made public. Even if she becomes aware of such facts, there is generally no way for her to limit what Google does with her data according to her own preferences. NetGuard allows users to selectively block or allow traffic to selected domains on a per app basis.
- 1vuio0pswjnm7 4y ago
vanous 4y ago
Thank you for all the work on FairEmail. I wanted to purchase it for a while and now I did, via F-droid, in the wake of these events.

212 points by cf100clunk 4y ago

I wrote this as a comment the last time this came up. After reading what I could read, seems like there was a legitimate security concern, and rather than work on it the dev just sort of said, "Meh, I don't want to do non-dev things, let's just cancel this project. It's not fun anymore." Paraphrased. He also wrote: > Core problem > Google. There is no sensible way to appeal in case of bad reviews or alleged violations of Play store policies. > People. They are generally pretty demanding and on the other hand everything should be free. > Myself. An old and grumpy developer, who maybe should retired. I 100% believe all of those points, but especially with open-source devs... most people who do those projects do them to avoid "real software" -- what I mean by that is the process that it takes to make enterprise software or software at scale. Project Managers, Product Owners, UX Designers, QA Testers, Security Consultants, etc. Most open-source projects tend to be the software equivalent of some guy in his garage building a model train set... just something you can do for fun to flex your skills. Focus on building, but not having to deal with the overhead of communicating, taking input, and compromising with others. Anyway, building a side project is fine. But... like in another post someone was complaining about the certification cost of dealing with Google Data as a 3rd Party Developer... and like... I can't get on board with the sympathy bandwagon there. I want there to be a stringent process before Google even gives app developers the ability to request access to my data -- even if it's on my behalf. And so... back to the analogy, building a model train is fine, but like... wanting to build a fully operational train all by yourself, and have others use it, ride on it, rely on it... at some point, it needs to turn into a "real" project. One of the hardest things about dealing with open-source projects is all the original creators of those projects who just don't want to play nice, and don't want to grow a team to grow and support their code. One thing I've done when an agency or company I work for has used open-source code, we try and at least set up a lunch and learn with the creator. Good to get their vision of where the code is going, good to have that line if we need them to fix bugs. But like... 99% of the time, I know that any input we give... there's just no point. The creator doesn't want input, he only really wants to play in his basement with his model train. Buy him lunch, give him as big of a guest lecture stipend as I can, and move on.

deleted 4y ago
[deleted]
pvg 4y ago
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=author%3Adang%20copy%20paste%20comments&sort=byPopularity&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

csdvrx 4y ago

It shows that most people are nice, and try to do the right thing even if mistakes can happen. However, it is sad that PR campaigns are required to reach out to an actual human being who cares.

lin83 4y ago
I'm not sure there is anyone nice here. This is likely cynical corporate damage control at best or the work of an annoyed Google employee who happens to use this app and took a personal interest. I love Fairmail and as a paid user I'm glad it's back on the PlayStore but nothing about this makes me think better of Google or anyone in charge there.
- rjzzleep 4y ago
  Especially since the fix seems to have been to expand the table in the privacy policy. On top of that most of these seem to be features you have to explicitly enable.
  - encryptluks2 4y ago
    Yeah, how could Google requiring a developer to disclose data collection be a good thing? Geez people, let's continue the outrage at Google and demand that no developer have to disclose data collection. /sarcasm
    - Dylan16807 4y ago
      Except google didn't ask for that, they gave a factually wrong rejection reason and wouldn't communicate properly. Also the part they were likely mad at was not data collection.
- csdvrx 4y ago
  > This is likely cynical corporate damage control at best or the work of an annoyed Google employee I fully disagree with your take. You are assuming the default is negative. I think your explanation might be possible, but that by default it's wrong, as most people are not cynical/annoyed or any other negative quality. My fundamental belief is that most people are nice and want to do good things. If you are surrounded by cynical/annoyed people, you may be in a toxic environment, which may taint your judgement for other situations. NB: either one of us could be making a fundamental attribution error https://en.wikipedia.org/wiki/Fundamental_attribution_error https://en.wikipedia.org/wiki/Fundamental_attribution_error and it might be hard to find the truth, as it boils down to beliefs.

bronikowski 4y ago

That's all well and good but I wish we could avoid the entire circus from the start. I hate the power companies have over distribution channels, the eternal struggle between convince and freedom.

ajross 4y ago
It's worth pointing out that the app seems genuinely to have been in violation of the Play Store Malware policy (see the "Spyware" section at https://support.google.com/googleplay/android-developer/answer/9888380?hl=en https://support.google.com/googleplay/android-developer/answ...) The nature of email clients, especially ones that integrate with cloud-hosted spam and filtering services, is that they're naturally going to have trouble with that policy absent great care with specifying exactly what gets collected. The "fix" here seems to have been to update their policy documentation to describe exactly that.
- bronikowski 4y ago
  That's one of my issues, of course. With half-automated/decided by unaccountable forces strict reading of the "law" (store policy) you get outcomes like that. It would be much better to have "spirit of the law" reading of the policies, but that requires engaged staff/high touch verification process. Google is unwilling to go that way so our only recourse is to make a ruckus and hope we'll get the ear of someone who can whisper to the emperor. It works, but it scales badly.
  - cupofpython 4y ago
    >engaged staff/high touch verification process this does not scale well either
- miloignis 4y ago
  Which part of the spyware section were they in violation of? Pretty much everything on that table has to be explicitly enabled and does the obvious thing when it is.

ushakov 4y ago

how many developers are not as lucky as you and Google doesn’t give a f?

deleted 4y ago
[deleted]

AshamedCaptain 4y ago

This is nice: https://github.com/M66B/FairEmail/blob/master/PRIVACY.md#summary-of-shared-data https://github.com/M66B/FairEmail/blob/master/PRIVACY.md#sum... Albeit I am undecided whether we should really force every FLOSS developer to create a table like this, apparently Google has decided that yes, we do.

duskwuff 4y ago
> Albeit I am undecided whether we should really force every FLOSS developer to create a table like this I don't see any reason why open-source software should get a free pass on privacy issues.
- bee_rider 4y ago
  I think it depends more on the business model. If an open source project is really just somebody releasing their own code, they don't have any obligation at all to the end user. If a business is releasing open source code and has some business model that ultimately turns that into profit (even indirectly, for example via selling your private info), then they have an moral obligation to be clear on how they are making money. On the other hand, the app stores have no obligation to host projects generally.
  - usr1106 4y ago
    The Google app store has an interest to publish all kind of apps, FOSS or not. It supports their "the customer is the product" business model. Apple has an interest to publish the same apps. It supports their "keep the users in the walled garden" business model. Both form an unhealty duopoly from both app developers and end users point of view. Saying they have no obligation to host an app might be correct, but it's a very limited perspective of the whole situation.
  - pmontra 4y ago
    If they release the source and I'm building the app, maybe you're right but it would be nice to know how they it handles privacy without having to read every single line. If they distribute the app there is little difference from a closed source install. Again, "read the code and learn what we do about privacy" would be pretty hostile.

lizardactivist 4y ago

Only because they got so much flak for it. But it's great the app is back.

deleted 4y ago
[deleted]

encryptluks2 4y ago

If you look at the changes in the privacy policy, and as others had brought up before, this ban was warranted. There was a lot of data collection happening that wasn't disclosed.

m-p-3 4y ago
Warranted or not, what is unacceptable is the lack of transparency in the whole process. At least point the developer towards a path into compliance, not just black-holing them altogether.
- encryptluks2 4y ago
  I agree the process could be improved, but if they post policies and developers fail to read them and follow them they really only have to say they violated their policies.
  - lolinder 4y ago
    If interpretation of the policies were consistent, to the point where I could reasonably guess that the violation was in something I changed recently, I would agree with you. However, both platforms' policy enforcement is often wildly inconsistent. Rules get ignored and then suddenly enforced. Some reviewers are more persnickety than others. Something that's been passing under the radar for years might be suddenly interpreted as in violation of a policy while they're reviewing a minor bugfix. In that situation, "you violated a policy" is useless for figuring out the problem in any reasonably large app. (That said, it sounds like this dev did get an explanation.)
    - g_p 4y ago
      In this case, it seems like "recency" was a big issue - the change wasn't recent in any sense of the word, since it seems like the feature has been there since at least mid 2020. [0] The explanation in this case also seemed to focus on a (false) assertion the app uploaded the user's contact list - the app wasn't doing that. If a user turned on fetching favicons (it was off by default, with a red-coloured privacy warning in the app), then the app would fetch a favicon for received emails in non-junk folders, directly from the server in question. If apps are expected to treat the user's DNS server as hostile, then web browsers had better talk about how they send user browsing history to third parties (by querying DNS!). Similarly, the app connecting to the site and asking for a favicon is not really a leak to a third party, as the domain is owned by the sending user. If they chose to outsource their website to a third party, that's their choice (and problem). If the app was uploading user contacts to a third party, that would be very bad. It wasn't. But rival apps do (for monetisation etc.) Making benign apps write declarations that suggest it is doing something akin to that is (to be cynical) helpful for Google and other ad/data supported business model actors, who benefit from obscuring their practices by forcing others to make similar-looking declarations. [0] https://github.com/M66B/FairEmail/commit/57cf22b1193b43ca9795f7561bdb0427427ed734 https://github.com/M66B/FairEmail/commit/57cf22b1193b43ca979...

m-p-3 4y ago

What is disturbing is that this direct contact is the exception and not the norm for their level of customer service. This shows how complacent Google is in their almost dominant position, and will only go to an acceptable level of support if their moderator's AI dark-patterns makes them look bad.

margalabargala 4y ago
I'm still willing to celebrate this happening. An exception to normally bad behavior, and the first instance of a genuine change in approach, look identical. Example: how many people here were skeptical of Microsoft having a change of heart regarding open source back in 2012? And now a decade later, it's clear that was genuine.
- xigoi 4y ago
  I'm still not convinced about that. For one, they're running the biggest closed-source Git hosting service (GitHub) and exploiting open-source projects to fuel their paid proprietary service (Copilot).
  - TedDoesntTalk 4y ago
    Open-source does not mean “I won’t try to earn money from this.”
    - xigoi 4y ago
      But it does mean “the source is available”, which it isn't for both GitHub and Copilot.
      - TedDoesntTalk 4y ago
        When were GitHub and copilot announced to be open source?
        4y ago

davidkuennen 4y ago

As a developer who makes a decent amount of money on the App Store and Play Store I would pay for premium support. The biggest threat for my business is some AI killing my app on a false positive with no way to resolve the issue.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
VWWHFSfQ 4y ago
They'll figure out a way to get you to pay $1,000/year for priority messaging with Premium Support Chat Bot.
spear 4y ago
"Nice app you have here. It would be a shame if something bad were to happen to it."
LegitShady 4y ago
create a problem and then charge people extra for 'support' to solve it. i dont even blame you.
AdmiralAsshat 4y ago
One would think Google taking 30% of the app sale would be enough to entitle a developer of a paid app to "premium" support, but I guess not.
- gbriel 4y ago
  They should probably give you premium support automatically for free once you reach some threshold of sales. It makes sense for them to retain their share at that point.

jmyeet 4y ago

Just another data point that the only way to resolve issues like this is to kick up enough fuss on a site like this or on social media so that a real human can look at and resolve your issue. It's support prioritization by follower count.

deleted 4y ago
[deleted]
klabb3 4y ago
The best part is that the arsonist who put out their own fire gets to be a hero. The app store model has been shown time and time again to fail at the very issues it's supposed to solve, especially at scale. I can empathize with the desire for manual curation at an early stage and even blacklists for known malware. However, what we have today is a guilty-until-proven-innocent extortion scheme.

josephcsible 4y ago

I'm glad this got resolved, but it's not good that it had to be special-cased. Google really needs to fix their policies so that this kind of problem can be fixed through the normal channels that are available to everyone.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]

okasaki 4y ago

Anyone else having problems with gmail? Today FairEmail stopped working on my gmail account - I get an AUTHENTICATIONFAILED Invalid credentials error. I'm using the fdroid version, so I have to use IMAP instead of oauth2 for gmail (why? who knows, it works for office365).

deleted 4y ago
[deleted]
KevinGlass 4y ago
Google dropped support for IMAP text authentication on May 30th but didn't enforce it globally until today. If you check the "Allow less secure apps" section of your Google account settings you'll see it's been removed. You must use OAuth2 if you want to continue to use an external email client.
- blendergeek 4y ago
  If you create an "app password", you can continue using whatever email app you want. https://support.google.com/accounts/answer/185833 https://support.google.com/accounts/answer/185833
  - deleted 4y ago
    [deleted]
- okasaki 4y ago
  Oh, I see. Thanks. I'm not sure what to do then - I have a Huawei phone so I'm only using fdroid for apps. The Fdroid version of FairEmail doesn't support gmail with oauth because of "Google security features" (??). It's only supported on the Google Play version. I'm vaguely aware that there are sites out there where you can download apks, but that seems unwise.
  - tredre3 4y ago
    > there are sites out there where you can download apks, but that seems unwise. You can download Aurora Store form F-Droid. It is a Google Play frontend with an anonymous login mechanism and fetches APKs directly from Google. You can try installing Fairemail through that but I'm not sure if it will fix the login issue by itself (maybe it also wants the chrome webview or google play services?).

mabbo 4y ago

It feels like Google ought to have a small team of developer advocates whose sole job is to find apps that are in trouble and then work with the developers like humans. It doesn't need to be 100 people. Just 10 or 20 even. Just provide some kind of human touch to the support of the developers who make the Android app store worth a damn. Write documentation to better help other developers get out of these kinds of holes. Work to improve the messaging when apps are rejected so that it's easier to know what to do. It doesn't seem worth putting time and energy into making an app if I know a bot can suddenly end my project and there's nothing I can do about it, and no one whose job it is to help me.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
bastardoperator 4y ago
It's a feature, for Google. They get to absolve themselves of any and all responsibility when it comes to their platform. Blame the bots, the system, the software, but not a single person is actually responsible for actions being taken. If we look at Youtube and DMCA, it's clear who Google cares about and it's certainly not individual users.
thrdbndndn 4y ago
I have been thinking of this (as well as for things like YouTube), but I honestly can't tell if it's feasible considering their size. Even the "legit" uses would be enormous let alone people who abuse it. At the very least, I don't think even 100 people would be able to cover it.

kjrose 4y ago

Considering how many of these "Google killed my X, Y or Z" posts I've seen on Hacker News. This really doesn't feel like anything to celebrate. It is just further proof that Google could, in theory, provide the support at the level necessary for these things, but just won't. Honestly, I know their job is hard, but if they simply put a legitimate task force together to figure out how to provide support at scale (even if it costs a premium to handle it, or possibly even a premium to do a proper appeal), I could see it helping immensely. Basically, if you want to do an appeal for something, it will cost, and depending on the violation and how often the violation is, the cost goes up. The appeal requires them to be clear about what the violation is, and what needs to be done to resolve it. Perhaps even make it that if you get an appeal with clear details and you resolve the issue, a certain percentage of the money will be refunded. Basically, instead of assuming everyone who their algorithms says is total evil is evil, they allow some form of good will that would help businesses, individuals and organizations work with them. I know the spammers and scammers are a huge pain, but then fine, charge them for the cost. The ones that are legit will pay and will work with Google if Google will work with them.

deleted 4y ago
[deleted]

indymike 4y ago

I've been a FairEmail user for a long time, and the product is fantastic, and I'm very happy this got worked out. FairEmail has always been excellent at explaining settings and their privacy ramifications, and I'm hoping that Google's switch to oauth doesn't break Fair Email's ability to check both my work profile email and home email google accounts. It's absolutely deflating when an app gets removed from a store, and a lot of times the rejection messages are terse and hard to make sense out of, and honestly, the developer has a lot invested in their app.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]

deleted 4y ago

[deleted]

dang 4y ago

Recent and related: EFF and EU should respond to Google taking FairEmail off the Play store - https://news.ycombinator.com/item?id=31433051 https://news.ycombinator.com/item?id=31433051 - May 2022 (51 comments) FairEmail stopping development after Google falsely flags app as spyware - https://news.ycombinator.com/item?id=31432334 https://news.ycombinator.com/item?id=31432334 - May 2022 (322 comments) FairEmail may be Ending Development - https://news.ycombinator.com/item?id=31426915 https://news.ycombinator.com/item?id=31426915 - May 2022 (6 comments) Previously: FairEmail: Open-source, privacy friendly email app for Android - https://news.ycombinator.com/item?id=26386374 https://news.ycombinator.com/item?id=26386374 - March 2021 (117 comments)

ldiracdelta 4y ago

The cartel giveth and the cartel taketh away. Blessed be the cartel.

deleted 4y ago
[deleted]

1vuio0pswjnm7 4y ago

"All my projects have been terminated after Google falsely flagged FairEmail as spyware without a reasonable opportunity to appeal." Would anyone classify Google's projects as "spyware". It is, after all, their "business model" to conduct surveillance. Whereas I doubt this author is making Google-sized profits, or even a modest livelihood, from his PlayStore apps, even if the apps were "spyware". Google is the undisputed king of spyware unless the user believes that her interests are always 100% aligned with Google's interests and nothing Google does can ever harm them. In order to hold such beliefs one would also have to ignore the millions in fines Google continues to pay for privacy incursions. I have been using one of this author's other programs, NetGuard, from FDroid, in lockdown mode, for computer running non-rooted Android. I have not seen anything like it, i.e., a user-controlled application firewall as a standalone app, for iOS. I am not aware of any competing apps for Android either. It appears to be a one-of-a-kind app, AFAICT. If someone knows of better option for selectively blocking traffic from apps, let's hear about it and the reasons why it is better. The assumption that Google is more trustworthy than any single app author is questionionable. It is that dogma upon which the "app store" concept depends. For example, can Google really compete with this author with respect to protection from spyware. Let's consider some facts. The author offers user-controlled protection from spying in NetGuard. Google offers Google-controlled protection from spying in the form of app store vetting. The former is open source, users can compile it themselves, and it does not report back to a mothership. The later is not something any user compiles themselves, it not controlled by the user, it is controlled by Google, it does report back a mothership, and the motherwhip's "business model" depends on that surveillance. The later, namely Android, Google apps and Google "services", are, by definition, spyware. Google collects data about pocket computer owners and uses it in undisclosed ways. There is simply no way for a pocket computer user to know the many things that Google does with the data it collects from spying. The only instances where she may learn about what Google does with her data are when facts are disclosed in response to discovery requests in litigation and those facts are made public. Even if she becomes aware of such facts, there is generally no way for her to limit what Google does with her data according to her own preferences. NetGuard allows users to selectively block or allow traffic to selected domains on a per app basis.

1vuio0pswjnm7 4y ago

vanous 4y ago

Thank you for all the work on FairEmail. I wanted to purchase it for a while and now I did, via F-droid, in the wake of these events.