5 ms·

They did the same thing to our messaging app where I work. Claimed we were uploading contacts and removed our app; we definitely don't upload contacts, that's

They did the same thing to our messaging app where I work. Claimed we were uploading contacts and removed our app; we definitely don't upload contacts, that's a fact; the infra is also self-hosted so where would we be uploading them to? They only way we got them to allow it back was to add a privacy-policy notice to say that we upload contacts and why, despite the fact we actually don't...

xd1936 3y ago
What a terrible outcome.
ndr 3y ago
How do you know none of your sdk/deps doesn't either?
- ryandrake 3y ago
  Yours is a good question, and probably one of the places I'd look first. It doesn't deserve to be downvoted. Too many developers just yeet rando dependencies into their app without even remotely vetting/auditing them.
  - ndr 3y ago
    It's a sad truth, and extremely hard for small devs. Google and Apple are well positioned to help everyone do better here, but the game-theory doesn't make being transparent any easier.
- alias_neo 3y ago
  I work for the kind of employer, who has the kind of customers who won't allow us to leave this sort of thing up to chance. I can't be more specific, as I'm not authorised to speak on behalf of, or represent my employer; my words/opinions are my own etc. We know, because we have to know.
  - ndr 3y ago
    I didn't mean it was up to chance, it is technically quite hard to keep in check. At most places the most serious bit is some sort of compliance checks with vendors. And while that might carry legal consequences it's technically a pinky-promise. Nothing in the system enforces it in any way. Unless one does some technical analysis on every version of every deps one uses, a dep (maybe via one of its deps) can get compromised and how/when will anyone notice it? It is a technical challenge, and almost impossible for small devs. If you have a process in place to tackle this I'd love to learn about it, even if it has to stay in general terms.
tazjin 3y ago
Why didn't you just start distributing the APK yourself if it was a private thing at work?
- alias_neo 3y ago
  It's not a private thing, it's our product.
echelon 3y ago
Google and Apple need to be regulated and have their "oversight" of what software can be deployed to mobile devices removed. Google and Apple's role is to defend users. This nanny state solution is not the only way to accomplish that, and in fact, they only do this to extract as much value as possible from the marketplace.
- alias_neo 3y ago
  I fear that battle is lost; as we can see with Apple's response to EU regulation, it'll be all malicious-compliance, and even without that, the sheer scale of the status-quo means the chances of any alternative gaining traction is all but lost. An alternative app store gripping the mass-market is unlikely; a new entrant into the Android-iOS duopoly is unlikely, Google/Apple actually giving a shit about the apps and developers making the software to rake in cash for them is _unlikely_. Having been in the mobile-app-development space since the beginning of Android and iOS, I've given up. I don't use my personal developer accounts any more, and I don't do "mobile" at work any more. I'm just too jaded to care how wrong it all now.
  - marcosdumay 3y ago
    What works is splitting the monopolies up. The entity that licenses Android should not also sell applications, and the other way around.
addandsubtract 3y ago
> the infra is also self-hosted so where would we be uploading them to? ...? How does self-hosted make a difference in this scenario? Uploading means it's leaving the phone, regardless of the destination. It could be going to your server or AWS or anywhere else, and I would consider it being "uploaded".
- russelg 3y ago
  In this context, self-hosted probably means that the user/org hosts the service that the app connects to. i.e. Element connecting to your own matrix home server, or something like next/ownCloud.
  - alias_neo 3y ago
    Correct, this is what I meant. The customer hosts their own infra, wherever they wish.
    - addandsubtract 3y ago
      Oh, I see. Thanks for the clarification.

xd1936 3y ago

What a terrible outcome.

ndr 3y ago

How do you know none of your sdk/deps doesn't either?

ryandrake 3y ago
Yours is a good question, and probably one of the places I'd look first. It doesn't deserve to be downvoted. Too many developers just yeet rando dependencies into their app without even remotely vetting/auditing them.
- ndr 3y ago
  It's a sad truth, and extremely hard for small devs. Google and Apple are well positioned to help everyone do better here, but the game-theory doesn't make being transparent any easier.
alias_neo 3y ago
I work for the kind of employer, who has the kind of customers who won't allow us to leave this sort of thing up to chance. I can't be more specific, as I'm not authorised to speak on behalf of, or represent my employer; my words/opinions are my own etc. We know, because we have to know.
- ndr 3y ago
  I didn't mean it was up to chance, it is technically quite hard to keep in check. At most places the most serious bit is some sort of compliance checks with vendors. And while that might carry legal consequences it's technically a pinky-promise. Nothing in the system enforces it in any way. Unless one does some technical analysis on every version of every deps one uses, a dep (maybe via one of its deps) can get compromised and how/when will anyone notice it? It is a technical challenge, and almost impossible for small devs. If you have a process in place to tackle this I'd love to learn about it, even if it has to stay in general terms.

tazjin 3y ago

Why didn't you just start distributing the APK yourself if it was a private thing at work?

alias_neo 3y ago
It's not a private thing, it's our product.

echelon 3y ago

Google and Apple need to be regulated and have their "oversight" of what software can be deployed to mobile devices removed. Google and Apple's role is to defend users. This nanny state solution is not the only way to accomplish that, and in fact, they only do this to extract as much value as possible from the marketplace.

alias_neo 3y ago
I fear that battle is lost; as we can see with Apple's response to EU regulation, it'll be all malicious-compliance, and even without that, the sheer scale of the status-quo means the chances of any alternative gaining traction is all but lost. An alternative app store gripping the mass-market is unlikely; a new entrant into the Android-iOS duopoly is unlikely, Google/Apple actually giving a shit about the apps and developers making the software to rake in cash for them is _unlikely_. Having been in the mobile-app-development space since the beginning of Android and iOS, I've given up. I don't use my personal developer accounts any more, and I don't do "mobile" at work any more. I'm just too jaded to care how wrong it all now.
- marcosdumay 3y ago
  What works is splitting the monopolies up. The entity that licenses Android should not also sell applications, and the other way around.

addandsubtract 3y ago

> the infra is also self-hosted so where would we be uploading them to? ...? How does self-hosted make a difference in this scenario? Uploading means it's leaving the phone, regardless of the destination. It could be going to your server or AWS or anywhere else, and I would consider it being "uploaded".

russelg 3y ago
In this context, self-hosted probably means that the user/org hosts the service that the app connects to. i.e. Element connecting to your own matrix home server, or something like next/ownCloud.
- alias_neo 3y ago
  Correct, this is what I meant. The customer hosts their own infra, wherever they wish.
  - addandsubtract 3y ago
    Oh, I see. Thanks for the clarification.