7 ms·

Our Android app is frozen in carbonite

349 points by zdw 2y ago

MichaelTheGeek 2y ago
Sad to see it go.
aftbit 2y ago
I respect the "fine we'll take our ball and go home then" approach to put some actual pressure on Google. I do wonder if they could have just chosen to stop offering Google Drive support on Android and instead pivot to storing content on their own servers with a simple data export option, or using something like Dropbox instead. It really seems like this latest cloud compliance battle was just the straw that broke the camel's back, and the real problem is that the Android app wasn't earning that much money as it was, so this was a convenient time and reason to kill it.
- 1970-01-01 2y ago
  Why do all android app roads always lead to Google's app store? Why not move everything to another app store, such as Amazon's? All the code, work, time, and other sacrifices aren't worth giving them a shot? https://en.wikipedia.org/wiki/List_of_Android_app_stores https://en.wikipedia.org/wiki/List_of_Android_app_stores
  - Zak 2y ago
    Ask Epic Games. The short answer is that you will not make very much money from your Android app if it isn't in Google's store.
    - ajsnigrutin 2y ago
      That's because everyone is using the google store. If a critical mass of software moved to an <alternative store>, maybe even become cheaper (because that store only takes 20% instead of 30%), people would switch. It's like chat applications... if most of your friends are using MSN messenger, you'll be using it too... if most of them also use icq, and it's cheaper than MSN, and it also has two more friends that don't use MSN, you'll switch to icq.
      - s1artibartfast 2y ago
        you need a store where the cost to use it in parallel is so low that companies are willing to take the chance. One of those costs imposters and bad players using the alternative store. I would settle for apps proving the files for sideloading on their website, and the vast majority wont even do that.
      - Gigachad 2y ago
        Users have basically no reason to move over because they have no problems with the play store. Apps only move over for their own business reasons like saving on fees or avoiding privacy restrictions.
        ajsnigrutin 2y ago
        ...or avoiding google fees for in app purchases. ...or avoiding freedom of speech limitations (telegram). etc. The problem is, that you now have to go to that services' site, download the apk there and then get promptet "an update is available", download, install, etc., with the benefits of a package management system. You have alternative stores like f-droid, but there are almost no apps there, that would make "normal users" install it... for now. Same for others.
        Gigachad 2y ago
        The fees can be avoided by making the subscription on the web ui and then continuing to use the main app. The speech restrictions maybe have some merit, but right now Telegram basically only restricts extreme hate speech / borderline terrorist content to mobile users. The majority of users don’t care to access this anyway.
        ajsnigrutin 2y ago
        Telegram restricts a lot of stuff on the play store version, be it piracy related or just basic news from eg. russian sources or any other country that the EU/US/google doesn't like. App downloaded directly from telegram.org doesn't have such limitations. Considering the pressures from EU, I guess they'll have to censor that too relatively soon... maybe even everything pro-trump. Sometimes you want other news sources than the bbc/cnn.
  - fidotron 2y ago
    Not all stores are created equal. If you use non Play Store stores on a device with the Play Store you will get a lot more prompts constantly reminding you of how unsafe it is and how comfy and warm it was back on the Play Store. Google are damned if they do and damned if they don’t on that, but it is deserved, they have burned so much goodwill in the Android space.
    - talldayo 2y ago
      > If you use non Play Store stores on a device with the Play Store you will get a lot more prompts constantly reminding you of how unsafe it is and how comfy and warm it was back on the Play Store. I am an F-Droid user, and I have only ever seen this a single time, when I first enabled sideloading in a pop-up. Maybe it's only a Samsung thing, but I have never gotten a Play Store nag related to third-party software stores in my life.
      - fidotron 2y ago
        Do those fdroid installed apps auto update?
        talldayo 2y ago
        As of v1.19 and Android 12, yes. That's not a nag regardless.
        fidotron 2y ago
        So that change was in February 2024 and only for Android 12 and above which is <50% of the Android market. If you don't believe this is deliberate nagging I don't know what to tell you.
        talldayo 2y ago
        I used iOS before Android, I know what nags look like.
        2y ago
  - rvnx 2y ago
    You get a lot of organic installs from Google Play Store, and almost none from alternative stores like Huawei or Amazon Store. This is because it is where there is the traffic.
  - rerdavies 2y ago
    I've tried a couple of alternate stores, including Amazon's store. Absolutely zero revenue. And insane amounts of paperwork.
sionisrecur 2y ago
Why do the apps even need direct access to Google drive? Android should give a generic API to access a folder with files and whether this folder lives in local storage or Google drive or even another provider should be the user's decision.
- charrondev 2y ago
  This seems ok at first glance, and you can “kind of” get this feeling. And android and iOS you can bring up a generic file picker that will let the user select any file or save a file to a user chosen location, and then the application gets access to an opaque file handle to read/write there. Platforms like Google Drive, Box, DropBox, OneDrive and local files are all options here. Unfortunately as far as I remember there is no way to gain access to that location persistently. Your copy of the file through this mechanism is just a copy of that file, so I couldn’t say have 50 files in my app that I granted access to being in some file system location that syncs (like google drive) without having constantly be repicking that file location.
  - scarface_74 2y ago
    On iOS, an app has access to its own folder in at least iCloud Drive that can be accessed via the app or via the Files App.
    - Gigachad 2y ago
      Google drive also has this functionality where apps can persistently access any files they created. There are a ton of options here that don’t involve unlimited access to all files.
      - scarface_74 2y ago
        ElI5: what is the problem then? Why would I want to give a random app access to all of my files on Google Drive?
Zak 2y ago
It seems like the entire fight is over Google Drive, which is not a hard requirement for pretty much any Android app. While Google's behavior here strikes me as ridiculous, dropping Drive support seems much more rational than dropping Android support entirely.
- eightysixfour 2y ago
  What would that workflow look like - users copy their files from Drive to their device, edit them, and then put them back on Drive?
  - wonger_ 2y ago
    Bring-your-own-sync! Apps can be local-first, reading and writing to files on the device. Then each user can choose their own syncing service like Syncthing or Resilio Sync, which runs in the background and automatically syncs those files to your other devices.
    - eightysixfour 2y ago
      That sounds miserable. This is why apps end up enshittified with forced cloud services.
      - jasonjayr 2y ago
        For apps that use the local system, and after fighting through google's restrictions, syncthing has been a dream between my android, windows + linux systems. I Don't have to think about it. The restrictions imposed by the platform is why each app needs to have it's own half-implemented sync to it's own platform or some other cloud provider.
  - Gigachad 2y ago
    It’s less manual than that, the app opens the OS file picker which has unlimited access, the user selects the file, the file is then made available for the app to access, the app can then save it to Google drive. What it can’t do is grab your entire drive file list and contents the moment you sign in.
FredPret 2y ago
In short, Google bureacratized them almost to death over Google Drive access, and then offered up a solution where they pay KPMG for an annual audit. But the audit would cost them two months of revenue, every year. So: > So, as of today, we’re not just accepting our frozen-in-carbonite fate. We’re embracing it. We’re going to take the app offline. By making a native app, you're donating free developer time to the platform owner. If they're not making it worth it for you, screw them.
- Gigachad 2y ago
  To some extent, if you can’t afford a yearly audit, you can’t afford unlimited access to users sensitive documents. It’s much like handling credit card data or toxic waste. Most people and small orgs should avoid it at all costs. Thankfully Google offers a lot of less risky permission scopes that don’t require audits.
  - NavinF 2y ago
    Yeah that seems totally fair. How many users really intend to give full access to an app made by someone that can't afford $500/year? Most non-devs would be sketched out
phsource 2y ago
We've had to go through this process for the app I have, and it definitely was cumbersome and makes the process a huge pain. Fortunately, after a while Google often lets you switch to a Tier 1 assessment, which involves using various tools to analyze your code and make improvements without shelling out a ton of money. At the same time, Google is in a tough spot here. The files and documents in your Google Drive (or Gmail) are incredibly sensitive. One possible solution is using the https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.file OAuth scope, which only lets you access files a user has explicitly shared with the app. I'm curious if iA Writer has limitations that makes this a bad user experience, but from a user security point of view, I can see why I want the apps that get to see my whole Google Drive audited too. [1] https://developers.google.com/drive/api/guides/api-specific-auth https://developers.google.com/drive/api/guides/api-specific-...
- deleted 2y ago
  [deleted]
- Gigachad 2y ago
  As a user of Google drive, I’m so glad it works like this. I have a ton of random apps that store stuff in my drive that I don’t fully trust, and it’s very reassuring that they only have permission to read the files that they created. I’m certain that if the full drive access was easy to get, they would all use that as the path of least resistance. And some of those apps would be sucking all of my data out to some random server.
  - greiskul 2y ago
    Yup. And it needs to be something that has to be done regularly, either every time the app updates or on a fixed schedule. Otherwise you would get a similar ecosystem that happened with some browser extensions, where a benign developer goes, writes an useful app, gets the permissions for that and a user base, then some shady company comes and acquires the app and updates it to use the permission to suck up all data. Sure it's an annoying process for developers, but Google has to think of the user privacy when creating the policies around these kind of permissions.
grumple 2y ago
We have a similar experience developing for android. They ask us to change things constantly, fill out endless paperwork, most of which is irrelevant to us (we have to verify a payments account for our free, ad free, no in app sales app). Every so often it's a random change to requirements around this permission or that, or more information needed for a security or data policy.
whimsicalism 2y ago
This is all downstream of stuff like the Cambridge Analytica scandal - the public views misuse of these APIs as the fault of the institution so they’re now incredibly cautious about access.
- apwell23 2y ago
  > Cambridge Analytica scandal Would it be considered a scandal if happened in 2022.
  - deleted 2y ago
    [deleted]
throwawayffffas 2y ago
Just move everything to your own storage instead of Google Drive. And maybe have your desktop or web app interface with Google drive.
hn_throwaway_99 2y ago
I only read the first part of the article, but having dealt with Drive API scopes and their issues previously, I feel there is just a major misunderstanding here. The "fully open" Drive API read/write scopes should be highly restricted by default (because they essentially give you access to a user's entire drive), and these are the ones that Google added much more stringent security requirements a couple years ago, e.g. requiring a security audit. However, there is also a much less sensitive Drive API scope, 'drive.file', which is non-sensitive. It lets an app read and write only files the app owns (or read files a user picks through the file picker control). Thus, I don't understand why the ia.net app would require more than the drive.file scope. I have no doubt that Google's messaging wasn't clear on the transition process when they first created drive.file scope (and I personally wasted a ton of time with bugs in Google's own file picker when using that scope), but it is a much better solution.
- mgraczyk 2y ago
  This is exactly right. I just finished the process to get drive.readonly for my app. It was a huge pain in the ass, and Google was not very helpful. Google recommends you pay $720 for a CASA lab assessment, which consists of some random dude in an apartment in SF running an open source script against a .zip of your codebase, then that guy emails Google saying you "passed". However, the goal is noble, to prevent malware and scam apps from accessing people's drives. It doesn't sound like the app from the article needs these more restricted scopes.
  - Gigachad 2y ago
    Being a huge pain in the ass probably does filter out a lot of trivial malware that doesn’t have the resources to jump though these hoops, especially when it might only last a week or so before they get shut down and have to start again.
    - xethos 2y ago
      If you've covered the personal frustration angle, I'll point to how it also changes the financial odds of turning a profit with malware. ~$700 USD for a week (before getting discovered) means you better turn a profit fast - and if you can't, there's not much point getting that full storage scope
sonofhans 2y ago
Some comments are asking, “Why not just ditch Google Drive support?” Well, how would a cloud-enabled writing app do on Android without Google Drive support? About as well as the same app on iOS without iCloud support — roadkill, I expect. I’ve used iA Writer on many platforms for years and I love it. It’s a simple Markdown editor that stores stuff in your cloud of choice. There are a million of these apps, but iA Writer has been high quality and regularly updated for a long time.
- fattire 2y ago
  Why not use the storage access framework, which is agnostic to where the files are being saved whether local or remote? By selecting the file to open or naming it to save, you choose a destination and permission is implicitly granted to that location for that file. Could be google drive or the local file system or any cloud provider app that supports SAF. No storage permissions needed, and it's been around for years and years. https://www.youtube.com/watch?v=C28pvd2plBA https://www.youtube.com/watch?v=C28pvd2plBA
petee 2y ago
Funny Google requires a phone and email for Play Store users to contact, yet most of the major apps contact email addresses are "we dont read this; No Reply. But here is our crappy forum"
sorbusherra 2y ago
Sounds like Google has turned into Nokia. History repeats itself.
cecida 2y ago
There are few things more depressing than having to deal with companies like Accenture, EY, KPMG etc. It's a world of FUD, upsell, more consultants, nothing getting done, lots of slides, new "junior senior Global Consultant for Microservices" type stuff. They are literally a cancer on innovation and just getting things done. They destroy the ethos of a company through deliberate intransigence.
meiraleal 2y ago
Wow. This is unbelievable. I'm wondering about creating only a PWA or building Android + iOS apps and this article made me decide with going PWA-only, I'm not going to deal with this. The competition in the official app stores is so big that it is not really worth it anyway
jhbadger 2y ago
I'm (or was) a hobbyist programmer on Android. I have a handful of free apps but Google has made it so onerous to actually get things in the store these days. I've given up; it may be worth the time of a big software studio to handle all the busywork they make you do these days, but it certainly isn't for a hobbyist. Yes, I know Apple is supposed to be even worse, but Android was supposed to be the reasonable platform in regard to this nonsense.
f33d5173 2y ago
> And before anyone says this is the price of an “open” OS—well, we don’t have this problem on Windows.5 Cue drum roll...
crossroadsguy 2y ago
I really would have expected an app like iA to not depend on either Google or Apple's sync - because both suck in their own rights. iCloud is just technically inferior by the way - I mean most of the time it's a coin toss on whether and how it works even for their own usage like iCloud Tabs, iCloud Messages and Photos and what not. As of now I try to avoid any app that is married to either Google (drive or whatever is the latest there) or Apple (iCloud) sync. Because my experience with these has been really inferior. Anyway that means I have to either use a Google a/c which I do not use anymore for personal needs or iCloud which is clearly inferior. Imho it's better to offer an e2ee custom server wherever you can (preferably on top of some open standard/spec). I am past "but I would rather trust robustness of Google and Apple's backend" after these 3-4 years. And I can completely relate to the pain of supporting all those Android models and their sub-models and their sub-sub-models. It used to be a real nightmare when I had to deal with that. ---------- Having said - I have felt the might of these big companies in a very small way recently. My Play Store account (which I kept for learning/testing purposes - sharing apps among friends etc) was terminated even though I fulfilled the criteria 2 days before the last date. No refund was provided either because I could not find out how to add a bank account and they didn't share even though I had asked them 3 weeks in advance for that info. I would ask "how to add a bank account" and they would reply with the same text "… please add a bank account for refund…" and I would again immediately reply asking "..but how the hell I can add a bank account - there is no info on this in your docs and whatever I could find doesn't even apply because I can't see those settings in the first place"… and they would respond with the exact same text again and again and again. I checked - I was indeed communicating with humans. After the last day I received the final response: "…was deleted..requirement... T&C.. and there will be no further response". That was it.
- kstrauser 2y ago
  Are you sure that's still true? iCloud use to have its issues, no doubt. I don't remember the last time I had to deal with any of that. It's been a couple years at least.
  - crossroadsguy 2y ago
    Yes I am sure and it is still true.
ghoomketu 2y ago
Recently, there have been scam Android apps in India that request access to users’ contact lists. These apps then blackmail users by threatening to send deepfake videos to their contacts, falsely accusing them of heinous acts like rape. Tragically, some individuals have even committed suicide due to this blackmail(1). So dozens of people have actually killed themselves because they mistakenly gave a permission on their phone.. just let that sink in. Google is in a difficult position. On one hand, they need to protect user data with strict security measures. On the other hand, these measures can be seen as overly restrictive. It’s a delicate balance, and unfortunately, there’s no easy solution. (1) https://www.thequint.com/news/india/bbc-chinese-loan-app-documentary-scam-laws-suicide-in-india https://www.thequint.com/news/india/bbc-chinese-loan-app-doc...
- meiraleal 2y ago
  The world would benefit of a better solution that is for the Indian Justice system deal with the issue.
  - Spivak 2y ago
    Or you just put the burden on the developer who has a very high interest in jumping through hoops since money is on the other end.
  - sunshowers 2y ago
    Perhaps, but we must all play the cards we are dealt.
fyrn_ 2y ago
AI alwayd ahd a pretty major apple lean, and from the post's misunderstanding of google drive permissions (global vs file scopes), it's clear that is still true. About not to matter though since they are killing the android app.
ericcj 2y ago
They’re removing API access to Google Photos as well now the only “integration” is for other apps to open the Google Photos app https://news.ycombinator.com/item?id=41604241 https://news.ycombinator.com/item?id=41604241
askvictor 2y ago
The bureaucracy involved in getting anything into any of the app stores basically make them untenable for side-project/one-man-band developers. At first it felt like a democratization of distribution, but now it's completely turned around, and is worse than before app stores, as the app store is effectively a monopoly on that particular platform (yes, I know you can get around that on Android, but most people won't/don't). And desktop OS are trying to move that way as well. I guess web-apps are probably the only real solution.
soup10 2y ago
This mirrors my experience with Android, ported a game, jumped through all the regulatory hoops, got in on the app store, then endless bureaucratic nonsense to keep it there.
psanford 2y ago
I have an opensource android app on the app store. I was a little annoyed/worried that the 'Verify your Play Console Developer account' was going to be super painful since I'm not running a business or trying to make money off my app. The messaging was, shall we say, confusing. They wanted you to choose a verification deadline for some reason. The email talked about a D-U-N-S number, and an official document verifying your identity. When my verification time came up, I basically didn't have to do anything. I checked a checkbox saying I was an individual, not a business/organization. I didn't have to verify my identity (maybe I did that when I first created the google play account). Even though my situation was not the same as the OP's, I do have a lot of sympathy for them. Its a pain to distribute apps through the play store (or the app store). I would opt out of there were a real alternative.
FpUser 2y ago
>"In order to get our users full access to their Google Drive on their devices, we now needed to pass a yearly CASA (Cloud Application Security Assessment) audit. This requires hiring a third-party vendor like KPMG." This is just plain extortion. I am curious how much masqueraded kickbacks Google gets from those auditors.
cageface 2y ago
Supporting the play store is increasingly not worth the trouble. It's already questionable from a revenue standpoint and they're making it an ever more hostile place for all but the biggest corporate developers.
jauntywundrkind 2y ago
It's a pity systems like remotestorage.io or Tim Berners-Lee's Solid hasn't gotten serious traction. Ideally there wouldn't even be Google Drive integration! Ideally we'd just have a mount on our devices that syncs. This is how I use Logseq, for example. It's a little weird and frustrating that mobile phones seem to lack virtual filesystem support (like FUSE), so the sync app in use is just rsyncing to local storage, basically, which is kind of fine, but it means there's no chance to have say my home movies collection available directly from my phone. This story isn't really one about Android or mobile, but the general beatdown on mobile really squaders what should be the most impressive expansive electronic device to have filled the world.
rammer 2y ago
Casa approval is a necessary step, we have gone through that for one of our apps approval that requires Google drive write access. Yes you are essentially asking users to give a whole lot of information because giving access to Google drive technically also gives access to a lot of the Gmail attachments because people tend to save them in Google drive. You can't fault Google with being trying to be too careful. If you think this was painful try accessing the shopify marketplace.
mvdtnz 2y ago
I don't know why anybody develops anything for these scumbag companies (Apple and Google). There's plenty of money to be made making software for the web. I have never written a single line of Android or iOS code and have had a very successful career so far. Supporting these companies is a choice.
gnarbarian 2y ago
Progressive Web App. you don't need app stores
kellanpham88 2y ago
The truly scary thing about undiscovered lies is that they have a greater capacity to diminish us than exposed ones. When people cheat in any arena, they diminish themselves-they threaten their own self-esteem and their relationships with others by undermining the trust they have in their ability to succeed and in their ability to be true. Cheating is the most disrespectful thing one human being can do to another. If you aren’t happy in a relationship, end it before starting another one. respect a person who is loyal in a relationship, by cheating on him or her. If you succeed in cheating on someone, don’t think that the person is a fool, realize that the person trusted you much more than you deserve. If you notice any suspicious act on your partner if he or she is cheating. You need to write MR FRED to help you remotely spoof on the target phone to retrieve text messages, call logs, social media activities, bank information and many more. They deliver the best services and get you the peace of mind you deserve. Email: hackxtechn (at) Gm Ail C Om. Best wishes…

349 points by zdw 2y ago

Sad to see it go.

I respect the "fine we'll take our ball and go home then" approach to put some actual pressure on Google. I do wonder if they could have just chosen to stop offering Google Drive support on Android and instead pivot to storing content on their own servers with a simple data export option, or using something like Dropbox instead. It really seems like this latest cloud compliance battle was just the straw that broke the camel's back, and the real problem is that the Android app wasn't earning that much money as it was, so this was a convenient time and reason to kill it.

1970-01-01 2y ago
Why do all android app roads always lead to Google's app store? Why not move everything to another app store, such as Amazon's? All the code, work, time, and other sacrifices aren't worth giving them a shot? https://en.wikipedia.org/wiki/List_of_Android_app_stores https://en.wikipedia.org/wiki/List_of_Android_app_stores
- Zak 2y ago
  Ask Epic Games. The short answer is that you will not make very much money from your Android app if it isn't in Google's store.
  - ajsnigrutin 2y ago
    That's because everyone is using the google store. If a critical mass of software moved to an <alternative store>, maybe even become cheaper (because that store only takes 20% instead of 30%), people would switch. It's like chat applications... if most of your friends are using MSN messenger, you'll be using it too... if most of them also use icq, and it's cheaper than MSN, and it also has two more friends that don't use MSN, you'll switch to icq.
    - s1artibartfast 2y ago
      you need a store where the cost to use it in parallel is so low that companies are willing to take the chance. One of those costs imposters and bad players using the alternative store. I would settle for apps proving the files for sideloading on their website, and the vast majority wont even do that.
    - Gigachad 2y ago
      Users have basically no reason to move over because they have no problems with the play store. Apps only move over for their own business reasons like saving on fees or avoiding privacy restrictions.
      - ajsnigrutin 2y ago
        ...or avoiding google fees for in app purchases. ...or avoiding freedom of speech limitations (telegram). etc. The problem is, that you now have to go to that services' site, download the apk there and then get promptet "an update is available", download, install, etc., with the benefits of a package management system. You have alternative stores like f-droid, but there are almost no apps there, that would make "normal users" install it... for now. Same for others.
        Gigachad 2y ago
        The fees can be avoided by making the subscription on the web ui and then continuing to use the main app. The speech restrictions maybe have some merit, but right now Telegram basically only restricts extreme hate speech / borderline terrorist content to mobile users. The majority of users don’t care to access this anyway.
        ajsnigrutin 2y ago
        Telegram restricts a lot of stuff on the play store version, be it piracy related or just basic news from eg. russian sources or any other country that the EU/US/google doesn't like. App downloaded directly from telegram.org doesn't have such limitations. Considering the pressures from EU, I guess they'll have to censor that too relatively soon... maybe even everything pro-trump. Sometimes you want other news sources than the bbc/cnn.
- fidotron 2y ago
  Not all stores are created equal. If you use non Play Store stores on a device with the Play Store you will get a lot more prompts constantly reminding you of how unsafe it is and how comfy and warm it was back on the Play Store. Google are damned if they do and damned if they don’t on that, but it is deserved, they have burned so much goodwill in the Android space.
  - talldayo 2y ago
    > If you use non Play Store stores on a device with the Play Store you will get a lot more prompts constantly reminding you of how unsafe it is and how comfy and warm it was back on the Play Store. I am an F-Droid user, and I have only ever seen this a single time, when I first enabled sideloading in a pop-up. Maybe it's only a Samsung thing, but I have never gotten a Play Store nag related to third-party software stores in my life.
    - fidotron 2y ago
      Do those fdroid installed apps auto update?
      - talldayo 2y ago
        As of v1.19 and Android 12, yes. That's not a nag regardless.
        fidotron 2y ago
        So that change was in February 2024 and only for Android 12 and above which is <50% of the Android market. If you don't believe this is deliberate nagging I don't know what to tell you.
        talldayo 2y ago
        I used iOS before Android, I know what nags look like.
      - 2y ago
- rvnx 2y ago
  You get a lot of organic installs from Google Play Store, and almost none from alternative stores like Huawei or Amazon Store. This is because it is where there is the traffic.
- rerdavies 2y ago
  I've tried a couple of alternate stores, including Amazon's store. Absolutely zero revenue. And insane amounts of paperwork.

sionisrecur 2y ago

Why do the apps even need direct access to Google drive? Android should give a generic API to access a folder with files and whether this folder lives in local storage or Google drive or even another provider should be the user's decision.

charrondev 2y ago
This seems ok at first glance, and you can “kind of” get this feeling. And android and iOS you can bring up a generic file picker that will let the user select any file or save a file to a user chosen location, and then the application gets access to an opaque file handle to read/write there. Platforms like Google Drive, Box, DropBox, OneDrive and local files are all options here. Unfortunately as far as I remember there is no way to gain access to that location persistently. Your copy of the file through this mechanism is just a copy of that file, so I couldn’t say have 50 files in my app that I granted access to being in some file system location that syncs (like google drive) without having constantly be repicking that file location.
- scarface_74 2y ago
  On iOS, an app has access to its own folder in at least iCloud Drive that can be accessed via the app or via the Files App.
  - Gigachad 2y ago
    Google drive also has this functionality where apps can persistently access any files they created. There are a ton of options here that don’t involve unlimited access to all files.
    - scarface_74 2y ago
      ElI5: what is the problem then? Why would I want to give a random app access to all of my files on Google Drive?

Zak 2y ago

It seems like the entire fight is over Google Drive, which is not a hard requirement for pretty much any Android app. While Google's behavior here strikes me as ridiculous, dropping Drive support seems much more rational than dropping Android support entirely.

eightysixfour 2y ago
What would that workflow look like - users copy their files from Drive to their device, edit them, and then put them back on Drive?
- wonger_ 2y ago
  Bring-your-own-sync! Apps can be local-first, reading and writing to files on the device. Then each user can choose their own syncing service like Syncthing or Resilio Sync, which runs in the background and automatically syncs those files to your other devices.
  - eightysixfour 2y ago
    That sounds miserable. This is why apps end up enshittified with forced cloud services.
    - jasonjayr 2y ago
      For apps that use the local system, and after fighting through google's restrictions, syncthing has been a dream between my android, windows + linux systems. I Don't have to think about it. The restrictions imposed by the platform is why each app needs to have it's own half-implemented sync to it's own platform or some other cloud provider.
- Gigachad 2y ago
  It’s less manual than that, the app opens the OS file picker which has unlimited access, the user selects the file, the file is then made available for the app to access, the app can then save it to Google drive. What it can’t do is grab your entire drive file list and contents the moment you sign in.

FredPret 2y ago

In short, Google bureacratized them almost to death over Google Drive access, and then offered up a solution where they pay KPMG for an annual audit. But the audit would cost them two months of revenue, every year. So: > So, as of today, we’re not just accepting our frozen-in-carbonite fate. We’re embracing it. We’re going to take the app offline. By making a native app, you're donating free developer time to the platform owner. If they're not making it worth it for you, screw them.

Gigachad 2y ago
To some extent, if you can’t afford a yearly audit, you can’t afford unlimited access to users sensitive documents. It’s much like handling credit card data or toxic waste. Most people and small orgs should avoid it at all costs. Thankfully Google offers a lot of less risky permission scopes that don’t require audits.
- NavinF 2y ago
  Yeah that seems totally fair. How many users really intend to give full access to an app made by someone that can't afford $500/year? Most non-devs would be sketched out

phsource 2y ago

We've had to go through this process for the app I have, and it definitely was cumbersome and makes the process a huge pain. Fortunately, after a while Google often lets you switch to a Tier 1 assessment, which involves using various tools to analyze your code and make improvements without shelling out a ton of money. At the same time, Google is in a tough spot here. The files and documents in your Google Drive (or Gmail) are incredibly sensitive. One possible solution is using the https://www.googleapis.com/auth/drive.file https://www.googleapis.com/auth/drive.file OAuth scope, which only lets you access files a user has explicitly shared with the app. I'm curious if iA Writer has limitations that makes this a bad user experience, but from a user security point of view, I can see why I want the apps that get to see my whole Google Drive audited too. [1] https://developers.google.com/drive/api/guides/api-specific-auth https://developers.google.com/drive/api/guides/api-specific-...

deleted 2y ago
[deleted]
Gigachad 2y ago
As a user of Google drive, I’m so glad it works like this. I have a ton of random apps that store stuff in my drive that I don’t fully trust, and it’s very reassuring that they only have permission to read the files that they created. I’m certain that if the full drive access was easy to get, they would all use that as the path of least resistance. And some of those apps would be sucking all of my data out to some random server.
- greiskul 2y ago
  Yup. And it needs to be something that has to be done regularly, either every time the app updates or on a fixed schedule. Otherwise you would get a similar ecosystem that happened with some browser extensions, where a benign developer goes, writes an useful app, gets the permissions for that and a user base, then some shady company comes and acquires the app and updates it to use the permission to suck up all data. Sure it's an annoying process for developers, but Google has to think of the user privacy when creating the policies around these kind of permissions.

grumple 2y ago

We have a similar experience developing for android. They ask us to change things constantly, fill out endless paperwork, most of which is irrelevant to us (we have to verify a payments account for our free, ad free, no in app sales app). Every so often it's a random change to requirements around this permission or that, or more information needed for a security or data policy.

whimsicalism 2y ago

This is all downstream of stuff like the Cambridge Analytica scandal - the public views misuse of these APIs as the fault of the institution so they’re now incredibly cautious about access.

apwell23 2y ago
> Cambridge Analytica scandal Would it be considered a scandal if happened in 2022.
- deleted 2y ago
  [deleted]

throwawayffffas 2y ago

Just move everything to your own storage instead of Google Drive. And maybe have your desktop or web app interface with Google drive.

hn_throwaway_99 2y ago

I only read the first part of the article, but having dealt with Drive API scopes and their issues previously, I feel there is just a major misunderstanding here. The "fully open" Drive API read/write scopes should be highly restricted by default (because they essentially give you access to a user's entire drive), and these are the ones that Google added much more stringent security requirements a couple years ago, e.g. requiring a security audit. However, there is also a much less sensitive Drive API scope, 'drive.file', which is non-sensitive. It lets an app read and write only files the app owns (or read files a user picks through the file picker control). Thus, I don't understand why the ia.net app would require more than the drive.file scope. I have no doubt that Google's messaging wasn't clear on the transition process when they first created drive.file scope (and I personally wasted a ton of time with bugs in Google's own file picker when using that scope), but it is a much better solution.

mgraczyk 2y ago
This is exactly right. I just finished the process to get drive.readonly for my app. It was a huge pain in the ass, and Google was not very helpful. Google recommends you pay $720 for a CASA lab assessment, which consists of some random dude in an apartment in SF running an open source script against a .zip of your codebase, then that guy emails Google saying you "passed". However, the goal is noble, to prevent malware and scam apps from accessing people's drives. It doesn't sound like the app from the article needs these more restricted scopes.
- Gigachad 2y ago
  Being a huge pain in the ass probably does filter out a lot of trivial malware that doesn’t have the resources to jump though these hoops, especially when it might only last a week or so before they get shut down and have to start again.
  - xethos 2y ago
    If you've covered the personal frustration angle, I'll point to how it also changes the financial odds of turning a profit with malware. ~$700 USD for a week (before getting discovered) means you better turn a profit fast - and if you can't, there's not much point getting that full storage scope

sonofhans 2y ago

Some comments are asking, “Why not just ditch Google Drive support?” Well, how would a cloud-enabled writing app do on Android without Google Drive support? About as well as the same app on iOS without iCloud support — roadkill, I expect. I’ve used iA Writer on many platforms for years and I love it. It’s a simple Markdown editor that stores stuff in your cloud of choice. There are a million of these apps, but iA Writer has been high quality and regularly updated for a long time.

fattire 2y ago
Why not use the storage access framework, which is agnostic to where the files are being saved whether local or remote? By selecting the file to open or naming it to save, you choose a destination and permission is implicitly granted to that location for that file. Could be google drive or the local file system or any cloud provider app that supports SAF. No storage permissions needed, and it's been around for years and years. https://www.youtube.com/watch?v=C28pvd2plBA https://www.youtube.com/watch?v=C28pvd2plBA

petee 2y ago

Funny Google requires a phone and email for Play Store users to contact, yet most of the major apps contact email addresses are "we dont read this; No Reply. But here is our crappy forum"

sorbusherra 2y ago

Sounds like Google has turned into Nokia. History repeats itself.

cecida 2y ago

There are few things more depressing than having to deal with companies like Accenture, EY, KPMG etc. It's a world of FUD, upsell, more consultants, nothing getting done, lots of slides, new "junior senior Global Consultant for Microservices" type stuff. They are literally a cancer on innovation and just getting things done. They destroy the ethos of a company through deliberate intransigence.

meiraleal 2y ago

Wow. This is unbelievable. I'm wondering about creating only a PWA or building Android + iOS apps and this article made me decide with going PWA-only, I'm not going to deal with this. The competition in the official app stores is so big that it is not really worth it anyway

jhbadger 2y ago

I'm (or was) a hobbyist programmer on Android. I have a handful of free apps but Google has made it so onerous to actually get things in the store these days. I've given up; it may be worth the time of a big software studio to handle all the busywork they make you do these days, but it certainly isn't for a hobbyist. Yes, I know Apple is supposed to be even worse, but Android was supposed to be the reasonable platform in regard to this nonsense.

f33d5173 2y ago

> And before anyone says this is the price of an “open” OS—well, we don’t have this problem on Windows.5 Cue drum roll...

crossroadsguy 2y ago

I really would have expected an app like iA to not depend on either Google or Apple's sync - because both suck in their own rights. iCloud is just technically inferior by the way - I mean most of the time it's a coin toss on whether and how it works even for their own usage like iCloud Tabs, iCloud Messages and Photos and what not. As of now I try to avoid any app that is married to either Google (drive or whatever is the latest there) or Apple (iCloud) sync. Because my experience with these has been really inferior. Anyway that means I have to either use a Google a/c which I do not use anymore for personal needs or iCloud which is clearly inferior. Imho it's better to offer an e2ee custom server wherever you can (preferably on top of some open standard/spec). I am past "but I would rather trust robustness of Google and Apple's backend" after these 3-4 years. And I can completely relate to the pain of supporting all those Android models and their sub-models and their sub-sub-models. It used to be a real nightmare when I had to deal with that. ---------- Having said - I have felt the might of these big companies in a very small way recently. My Play Store account (which I kept for learning/testing purposes - sharing apps among friends etc) was terminated even though I fulfilled the criteria 2 days before the last date. No refund was provided either because I could not find out how to add a bank account and they didn't share even though I had asked them 3 weeks in advance for that info. I would ask "how to add a bank account" and they would reply with the same text "… please add a bank account for refund…" and I would again immediately reply asking "..but how the hell I can add a bank account - there is no info on this in your docs and whatever I could find doesn't even apply because I can't see those settings in the first place"… and they would respond with the exact same text again and again and again. I checked - I was indeed communicating with humans. After the last day I received the final response: "…was deleted..requirement... T&C.. and there will be no further response". That was it.

kstrauser 2y ago
Are you sure that's still true? iCloud use to have its issues, no doubt. I don't remember the last time I had to deal with any of that. It's been a couple years at least.
- crossroadsguy 2y ago
  Yes I am sure and it is still true.

ghoomketu 2y ago

Recently, there have been scam Android apps in India that request access to users’ contact lists. These apps then blackmail users by threatening to send deepfake videos to their contacts, falsely accusing them of heinous acts like rape. Tragically, some individuals have even committed suicide due to this blackmail(1). So dozens of people have actually killed themselves because they mistakenly gave a permission on their phone.. just let that sink in. Google is in a difficult position. On one hand, they need to protect user data with strict security measures. On the other hand, these measures can be seen as overly restrictive. It’s a delicate balance, and unfortunately, there’s no easy solution. (1) https://www.thequint.com/news/india/bbc-chinese-loan-app-documentary-scam-laws-suicide-in-india https://www.thequint.com/news/india/bbc-chinese-loan-app-doc...

meiraleal 2y ago
The world would benefit of a better solution that is for the Indian Justice system deal with the issue.
- Spivak 2y ago
  Or you just put the burden on the developer who has a very high interest in jumping through hoops since money is on the other end.
- sunshowers 2y ago
  Perhaps, but we must all play the cards we are dealt.

fyrn_ 2y ago

AI alwayd ahd a pretty major apple lean, and from the post's misunderstanding of google drive permissions (global vs file scopes), it's clear that is still true. About not to matter though since they are killing the android app.

ericcj 2y ago

They’re removing API access to Google Photos as well now the only “integration” is for other apps to open the Google Photos app https://news.ycombinator.com/item?id=41604241 https://news.ycombinator.com/item?id=41604241

askvictor 2y ago

The bureaucracy involved in getting anything into any of the app stores basically make them untenable for side-project/one-man-band developers. At first it felt like a democratization of distribution, but now it's completely turned around, and is worse than before app stores, as the app store is effectively a monopoly on that particular platform (yes, I know you can get around that on Android, but most people won't/don't). And desktop OS are trying to move that way as well. I guess web-apps are probably the only real solution.

soup10 2y ago

This mirrors my experience with Android, ported a game, jumped through all the regulatory hoops, got in on the app store, then endless bureaucratic nonsense to keep it there.

psanford 2y ago

I have an opensource android app on the app store. I was a little annoyed/worried that the 'Verify your Play Console Developer account' was going to be super painful since I'm not running a business or trying to make money off my app. The messaging was, shall we say, confusing. They wanted you to choose a verification deadline for some reason. The email talked about a D-U-N-S number, and an official document verifying your identity. When my verification time came up, I basically didn't have to do anything. I checked a checkbox saying I was an individual, not a business/organization. I didn't have to verify my identity (maybe I did that when I first created the google play account). Even though my situation was not the same as the OP's, I do have a lot of sympathy for them. Its a pain to distribute apps through the play store (or the app store). I would opt out of there were a real alternative.

FpUser 2y ago

>"In order to get our users full access to their Google Drive on their devices, we now needed to pass a yearly CASA (Cloud Application Security Assessment) audit. This requires hiring a third-party vendor like KPMG." This is just plain extortion. I am curious how much masqueraded kickbacks Google gets from those auditors.

cageface 2y ago

Supporting the play store is increasingly not worth the trouble. It's already questionable from a revenue standpoint and they're making it an ever more hostile place for all but the biggest corporate developers.

jauntywundrkind 2y ago

It's a pity systems like remotestorage.io or Tim Berners-Lee's Solid hasn't gotten serious traction. Ideally there wouldn't even be Google Drive integration! Ideally we'd just have a mount on our devices that syncs. This is how I use Logseq, for example. It's a little weird and frustrating that mobile phones seem to lack virtual filesystem support (like FUSE), so the sync app in use is just rsyncing to local storage, basically, which is kind of fine, but it means there's no chance to have say my home movies collection available directly from my phone. This story isn't really one about Android or mobile, but the general beatdown on mobile really squaders what should be the most impressive expansive electronic device to have filled the world.

rammer 2y ago

Casa approval is a necessary step, we have gone through that for one of our apps approval that requires Google drive write access. Yes you are essentially asking users to give a whole lot of information because giving access to Google drive technically also gives access to a lot of the Gmail attachments because people tend to save them in Google drive. You can't fault Google with being trying to be too careful. If you think this was painful try accessing the shopify marketplace.

mvdtnz 2y ago

I don't know why anybody develops anything for these scumbag companies (Apple and Google). There's plenty of money to be made making software for the web. I have never written a single line of Android or iOS code and have had a very successful career so far. Supporting these companies is a choice.

gnarbarian 2y ago

Progressive Web App. you don't need app stores

kellanpham88 2y ago

The truly scary thing about undiscovered lies is that they have a greater capacity to diminish us than exposed ones. When people cheat in any arena, they diminish themselves-they threaten their own self-esteem and their relationships with others by undermining the trust they have in their ability to succeed and in their ability to be true. Cheating is the most disrespectful thing one human being can do to another. If you aren’t happy in a relationship, end it before starting another one. respect a person who is loyal in a relationship, by cheating on him or her. If you succeed in cheating on someone, don’t think that the person is a fool, realize that the person trusted you much more than you deserve. If you notice any suspicious act on your partner if he or she is cheating. You need to write MR FRED to help you remotely spoof on the target phone to retrieve text messages, call logs, social media activities, bank information and many more. They deliver the best services and get you the peace of mind you deserve. Email: hackxtechn (at) Gm Ail C Om. Best wishes…