2 ms·

Would really love to know more details about their struggles on Android Play Store and Windows Store. Edit: Windows Store - https://twitter.com/videolan/statu

Would really love to know more details about their struggles on Android Play Store and Windows Store. Edit: Windows Store - https://twitter.com/videolan/status/1759688788232523788?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet https://twitter.com/videolan/status/1759688788232523788?ref_... Android Play Store - https://twitter.com/videolan/status/1771102415279763909?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet https://twitter.com/videolan/status/1771102415279763909?ref_...

ryandrake 3y ago
For those who don't want to follow even more Twitter links: It looks like for Windows Store, they are unable to contact a human at Microsoft for technical help, and for Android Play, the store itself is insisting on obtaining their private signing keys and that they drop support for older API versions.
- KingMob 3y ago
  An important note about their Windows store issue: they've been trying to get help for two years now.
- orf 3y ago
  What specific technical things do they need help with? Being more clear than “we just need a human to talk to” is better.
  - lostmsu 3y ago
    Yeah, that one is suspect.
  - jaybeavers 3y ago
    Having submitted a number of “product breaking bug reports” through official channels while using a paid support incident, can confirm Kafkaesque and a multi year support process. Oh, I can get a person to “respond” to a problem with a paid support incident. But the person responding is clearly hired only based on their ability to respond to an English email, once a week, with either, “thank you, I will forward that to our engineering team” or “thank you for your patience, our engineers are still looking into that issue.” Severity, impact, paid support, none of that matters. Heck, it’s impossible to tell if it’s an actual person or just a sophisticated shell script.
emj 3y ago
> With Play App Signing, Google manages and protects your app's signing key for you and uses it to sign optimized, distribution APKs that are generated from your app bundles There is no meaning of having a private signing key if is not private. Why does Google need me to upload a private key if they are then free to use it on their own? https://support.google.com/googleplay/android-developer/answer/9842756 https://support.google.com/googleplay/android-developer/answ...
- deleted 3y ago
  [deleted]
- orf 3y ago
  Sure there is. You’re increasing the scope of the key to include a third party, but… it’s one that controls the OS, distribution channels, publishing platform, SDK, the tools used to publish APKs, even the device drivers on your phone. If they want to maliciously modify the VLC apk, there isn’t anything you can do to stop them.
  - emj 3y ago
    I think we all understand why Google might have a need to sign the binaries themselves. The point is that if they are creating binaries it should be signed by Google using a key uploaded by me it is just unnecessary.
    - deleted 3y ago
      [deleted]

ryandrake 3y ago

For those who don't want to follow even more Twitter links: It looks like for Windows Store, they are unable to contact a human at Microsoft for technical help, and for Android Play, the store itself is insisting on obtaining their private signing keys and that they drop support for older API versions.

KingMob 3y ago
An important note about their Windows store issue: they've been trying to get help for two years now.
orf 3y ago
What specific technical things do they need help with? Being more clear than “we just need a human to talk to” is better.
- lostmsu 3y ago
  Yeah, that one is suspect.
- jaybeavers 3y ago
  Having submitted a number of “product breaking bug reports” through official channels while using a paid support incident, can confirm Kafkaesque and a multi year support process. Oh, I can get a person to “respond” to a problem with a paid support incident. But the person responding is clearly hired only based on their ability to respond to an English email, once a week, with either, “thank you, I will forward that to our engineering team” or “thank you for your patience, our engineers are still looking into that issue.” Severity, impact, paid support, none of that matters. Heck, it’s impossible to tell if it’s an actual person or just a sophisticated shell script.

emj 3y ago

> With Play App Signing, Google manages and protects your app's signing key for you and uses it to sign optimized, distribution APKs that are generated from your app bundles There is no meaning of having a private signing key if is not private. Why does Google need me to upload a private key if they are then free to use it on their own? https://support.google.com/googleplay/android-developer/answer/9842756 https://support.google.com/googleplay/android-developer/answ...

deleted 3y ago
[deleted]
orf 3y ago
Sure there is. You’re increasing the scope of the key to include a third party, but… it’s one that controls the OS, distribution channels, publishing platform, SDK, the tools used to publish APKs, even the device drivers on your phone. If they want to maliciously modify the VLC apk, there isn’t anything you can do to stop them.
- emj 3y ago
  I think we all understand why Google might have a need to sign the binaries themselves. The point is that if they are creating binaries it should be signed by Google using a key uploaded by me it is just unnecessary.
  - deleted 3y ago
    [deleted]