Your app is not compliant with Google Play Policies: A story from hell

https://sylviavanos.nl/blog/2021/12/24/google_play_hell.html

by ajdude • 5 years ago

395 189 5 years ago

which one is more incompetent as a service company - Amazon, Google, Facebook, or Apple?

I think my ranking would be Google, Apple, Facebook, Amazon, but that is not so much decided via any sort of logical evaluation but only due to my feeling on the matter.

buscoquadnary2• 5 years ago

For all the problems Amazon has and causes I will say I've always found their support to be pretty excellent. From what I understand Amazon's foundibg philosophy is focused on just serving the customer at the cost of any other externality and that's where most of the conterversy surrounding them comes from is placing whatever is needed to please the customer above every other concern. But that means when working with them they are pretty great.

Whereas it seems like Google and Facebook view you as a resource simply to have value extracted from and moved on.

As for Apple, well there are no problems you're just holding the phone wrong.

_fat_santa2• 5 years ago

I've personally never contacted Facebook or Google support, seems like a futile effort. I do agree out of all the companies, Amazon seems to have support figured out the most, at least they make it easy for the customer. I had a package that was not delivered, actually pretty sure it was delivered but then stolen (apartment had a package locker so it was the delivery drivers fault).

When I contacted Amazon I was expecting them to talk for a while to determine what happened but no, immediate no questions asked refund. Amazon I'm sure has issues around delivery, but as a customer I could care less if a package gets lost once in a while if the company is immediately going to correct the issue.

smallerfish• 5 years ago

Amazon's FBA support on the other hand is horrendous, possibly betraying their more adversarial relationship with their sellers. I was so annoyed by repeated incompetence that not only did I stop doing FBA side projects, but I (mostly) cut out my Amazon shopping and am unlikely to recommend AWS as a first option to a client in future.

derbOac• 5 years ago

Not everyone has the same experiences with Amazon. I guess I've had pretty good experiences with Amazon as a retail customer per se, in terms of delivery and returns, but beyond that it's an entirely different story.

I had an experience very similar to the one in this article, for example:

https://consumerist.com/2013/06/18/amazon-cancels-my-6000-or...

heavyset_go3• 5 years ago

From what I understand Amazon's foundibg philosophy is focused on just serving the customer at the cost of any other externality and that's where most of the conterversy surrounding them comes from is placing whatever is needed to please the customer above every other concern. But that means when working with them they are pretty great.

I have tried for years to report counterfeits on Amazon to their customer support to no avail. They don't want to collect that data, it seems, despite the severe effects their products can have on customers.

bkav• 5 years ago

Google is awful. I worked at a company in a now-legal business with a YouTube channel from the not-as-legal days… it has incredibly unprofessional and embarrassing branded footage and there was nothing we were able to do to pull the channel down. (No one currently working there has the login)

faeyanpiraat• 5 years ago

I think AWS is the best, but only because you can have a paid support plan, and real humans will reply to your support requests.

wvenable• 5 years ago

I've used Amazon support proper for Fire TV stick issues and a human (via chat) was able to resolve my problem relatively quickly and painlessly.

jamesfinlayson• 5 years ago

Agreed - I don't think AWS Support is cheap (but my company pays) but it is good.

masklinn• 5 years ago

Never interacted with facebook in any position, the rest is completely correct.

Google is absolutely trash at support, Apple is quite bad (in store support used to be rather good, services was always shit), Amazon is competent at least.

thinkingemote2• 5 years ago

For the record I had a simple oauth problem flagged by Facebook and emailed with a number of humans there successfully. I'm a non enterprise/paying dev. It felt reasonably okay and quick, as if they read and listened to my responses.

disruptiveink• 5 years ago

Amazon is also in the easiest position to offer support, since for the bulk of support queries, if all else fails, they can just absorb the cost and refund the customer. The customer is usually not any worse than when they started if they do this.

The money spent on a purchase is fungible. There is no obvious monetary refund to give to someone who can't update their app, got their YouTube channel taken down or got their Instagram handle stolen.

VRay• 5 years ago

ugh, that's annoying.. At least you made it onto HackerNews, so your problem might get silently resolved in the shadows

It really sucks that Google can't be bothered to provide 5 minutes of human support despite taking such an enormous cut of all revenue from these apps

duhast5• 5 years ago

1. It wouldn’t be 5 minutes. This could easily take hours to resolve.

2. Even with human support, companies like this would continue to be incentivised not to share what exactly triggered the ban in order to protect their systems from spam and abuse. You can’t provide services to billions of people without automation.

3. Human reviews would be performed by humans. Have you ever met humans? You’re replacing an imperfect system with another imperfect system except now things are slower and cost more.

inetknght• 5 years ago

in order to protect their systems from spam and abuse

Spam and abuse would fall afoul of the CFAA in the US and similar laws in the EU.

Outside of the US? Well maybe those apps shouldn't even be available in the US or EU.

Spam and abuse only happens because the criminals perpetuating it do it without real consequence.

pixl97• 5 years ago

On number 2, why?

If your program is abusive, have the abuser remove the function until it's no longer abusive. The entire we cant tell you does seem like crap.

lbriner• 5 years ago

not to share what exactly triggered the ban in order to protect their systems from spam and abuse

That's kind of true but I think that a company the size of Google could afford to assign someone to look into providing more information in a scenario like, "you are using geo-location without asking permission". Since the need for permission is not a secret, telling the vendor this causes less friction and makes people hate you a bit less.

Sure, you might also have a "secret" system that does something like "if failed 5 times in a row, blacklist them" but that is just security by obscurity and doesn't seem to stop that many people. Also, in the case where the vendor is an easily verifiable company selling, presumably, something that is fairly easy to view/check, it doesn't seem to be asking for much to either get a human or to get some automated messages.

Apparently they employ 140K people! That is a lot of people to not provide any human support.

quambene2• 5 years ago

Right, my history of suffering went on for 11 months.

Unfortunately, I don't know anyone at Google and I didn't made it to HN.

metalised3• 5 years ago

That's what I was hoping about my similar problem with facebook, but alas ... no kind HN denizens have offerred any help yet :)

Post is still here if anyone's interested or can help: https://news.ycombinator.com/item?id=29876423

sourcecodeplz• 5 years ago

I’ve read the post, its just how it is with their policies being evaluated by automations and not humans. Nothing you can do but work around them sadly.

onion2k3• 5 years ago

I’ve read the post, its just how it is with their policies being evaluated by automations and not humans.

No, it's definitely a problem with the humans. It's just that the humans in question aren't customer support humans. It's Google's engineering humans that are to blame for shipping these poor quality experiences. They might be able to invert binary trees on whiteboards pretty well, but they suck at making an HTML page that explains why their system isn't working for you.

notreallyserio4• 5 years ago

The engineers at Google Play really have got to feel embarrassed at how bad this situation has been over the years. How could they have a conversation with an Android developer that's had to deal with the lack of support?

marcus_holmes3• 5 years ago

I see this and think of all the millions of apps that the code controls. I don't know how many do fail validation, but it's clearly not a vast number, definitely under 1%.

Given that they're also clearly training a model for this, based on a large number of inputs and rules, then this is pretty good.

Their end goal is clearly to be able to remove humans from this process completely. Which is good - it's shitty work.

From my point of view as an app customer, this is fine. I don't see apps that fail validation, and there are too many (shitty) apps anyway - more validation is good.

From my point of view as an entrepreneur, I approve. Clearly they can live with a certain level of false negatives, and that makes sense from a business point of view as they save so much in the validation process.

From my point of view as a developer, however, it's a dumpster fire and I'm not going anywhere near it.

justin_oaks• 5 years ago

I find it interesting that people blame the engineers when they're the bottom of the hierarchy. It's their bosses that prioritize their work, decide whether their work is good enough, and decide whether to fix something that's broken.

It's not the individual engineers who decide whether the company will have a culture of helping users and/or app developers, or treating them like resources to exploit.

It's not the individual engineers who choose to have no humans involved in the app review process.

Some engineers are incompetent, yes, but it's the bosses who keep the incompetent folks working at the company instead of finding better people.

nottorp3• 5 years ago

And I thought I was joking when I kept saying that Google uses Machine Learning!(tm) for everything...

Edit: on further thinking, the last problem about needing login info for an app that doesn't have accounts is probably due to some poor soul on minimum wage trying to make their review quota for the day.

dncornholio• 5 years ago

Parsing text is not machine learning. It's the lack of machine learning thats causing the issues IMO. Because this system just flags everything with the word free in it.

cocoflunchy• 5 years ago

I have the same experience with the Google Play Store. For all the complaints people have about the Apple App Store, at least their reviewers are human and you can discuss things with them. And they block updates but don't remove the app without warning!

My experience with the Google Play store: I get an email on a friday night after working hours stating that the app of my company was removed after a routine check and that I have to follow an appeal process to get it back. (The reason being that we had 2 apps in the store, one for production use and one for training). Only after pinging people I knew working at Google was I able to get my support case prioritized and the app unblocked.

A second time we had our app deleted from the store because we used background geolocation and failed to comply in time with the new reporting requirements. Once again, no warning and no grace period except a generic "Google Play policy update" email 6 months earlier...

I guess we're just lucky to have a B2B app that we can install via APK to our customers' phones if needed.

buscoquadnary2• 5 years ago

The number of times I've heard of people only getting support from Google because they know someone on the inside is quite astonishing.

If I were an Google employee looking to make a few extra bucks I'd definitely start offering to help "nudge" account issues for a few extra bucks under the table.

duhast5• 5 years ago

What is astonishing is that despite the scale at which they operate we rarely hear about the problems. False positives seem to be ridiculously low.

erhk• 5 years ago

Dont worry, google is working hard to make sure that even employees are unable to do anything of that sort. Gather the world's information and make it uniformally unsupported.

thayne• 5 years ago

That would almost certainly violate some contract you signed when you were hired.

ceejayoz• 5 years ago

Oh, I've no doubt that's happening in all the major tech companies.

Amazon employees got caught doing this.

https://www.justice.gov/usao-wdwa/pr/six-indicted-connection...

analog31• 5 years ago

There could be an app for that -- a clearing house that lets you submit an issue and have it taken up by an employee, with anonymity, for a fee. It could be the Uber for access to insider support.

ynx• 5 years ago

Stuff like this does happen at the big companies, but it's also rooted out (when you're that big, you can afford to have internal security teams that investigate this stuff) and the offenders get fucked by legal (and fired, obviously). Usually quietly because of the PR damage it would otherwise cause.

kingcharles3• 5 years ago

Every time I get fucked-up support dead-ends like this now I go to war against the management of that company. I pay to get hold of all the home phone/cellphones/personal email addresses of the highest position employees I can find and bug the shit out of them until one of them capitulates and gets a minion to fix the problem.

I just harassed the C-suite of a unicorn that wouldn't give me a refund for something that wasn't delivered. "We can't give you a refund because FedEx says it was delivered." IT WAS DELIVERED TO SOMEONE ELSE AND THEN FEDEX COLLECTED IT AND RETURNED IT AS YOU CAN SEE IN THE TRACKING LOGS. "Thank you for your e-mail. As the package shows that it was delivered you will need to take this up with FedEx. I cannot help you further with this enquiry." A weekend of texting and emailing the management and now suddenly I have them giving me their corporate email addresses and a promise to have it fixed after the holiday.

johnyzee• 5 years ago

I swear I am not a Google plant. I JUST went through the same process the OP did (literally yesterday).

The Play reviewer took down the app because they thought they needed sign-in information to test it (like the OP). However, this was based on a misunderstanding of some menu item in the app - the app, in fact, is perfectly usable without signing in.

I replied to the original email I had received about the problem, and... A few days later, a real human replied that they agreed with my take, and had removed the objection. However, they had found other policy violations, regarding the maturity rating viz-a-viz the app contents (it's a game). They included screen shots, showing that they had not only played the game, but pretty thoroughly, too.

Again, I followed the recommendations to comply (went over the rating wizard) and requested a re-evaluation. This was done a day later and the app re-instated. Done.

I was super surprised about how well the process worked. I even went through the trouble of completing their little support survey with praise. I had been bracing myself for a Kafkaesque nightmare when the app was taken down, considering just how many app updates Google reviewers must be going through on a daily basis, and I'm pretty sure each violation is met with some sort of discussion from the developer's side. Not to mention the reputation Google has earned for support. It goes to show that people have different experiences, and not all of them are negative.

EDIT: Just wanted to add that I don't think the OP's story is particularly egregious either. So Google auto-translates your app title? I guess you opted into this somewhere, at least they don't do this for my app. And I would never assume that Google would sit and hand-translate app titles to every language. And in either case, it actually looks like OP got timely and fairly accurate advice. I must sound like some starry-eyed Google fanboy, but I'm really not, just not seeing it here.

quambene2• 5 years ago

Google did recently update its review process. I was complaining about its previous review process for 10 months at least. It's a little better now.

Previously, an app was suspended without any warning. You even couldn't comply with their requirements neither because they would deactivate access to the app in question in Google Play Console. Your only chance was an appeals request. Your app still suspended in the meantime which could be months. And you might loose all ratings, reviews, and downloads of your app.

My feedback at this time was:

An easy but important improvement in Google Play:

1.) Don't suspend and remove the complete package id from Google Play, but instead just prevent the specific app update from publishing

2.) If the app update doesn't comply with Google's policies, then give developers the opportunity to fix that

3.) Developer submits a new app update which does comply

4.) App update gets approved by Google

5.) Google is happy and developers are happy

Which might be the case now. At least in Germany.

Liquid_Fire• 5 years ago

So Google auto-translates your app title? I guess you opted into this somewhere, at least they don't do this for my app.

The way I understood it, what they are actually doing is auto-translating the localised (by the developer) title back to English for the purpose of running automated checks on it, and rejecting based on this automatic translation turning a word that implies nothing about price in the original language into the English word "free".

bryanrasmussen2• 5 years ago

So Google auto-translates your app title?

I mean my reading is that she and her translators hand translate the title, and then Google uses Google Translate to make sure it follows particular rules, and one of the rules it should not say it is free?

And I would never assume that Google would sit and hand-translate app titles to every language.

maybe the assumption is that they would not autotranslate app titles for the target language of a particular app store. I mean you do understand that the app stores of different languages are obviously not in English? And that there is a very long and funny tradition of translating from one language to English and back to show how things get lost in translation?

At least if they used google translate they should have some sort of tool that allowed you to see if there were some suggested texts that would be less problematic so a reviewer (or bot in this case I suppose) could ask the developer. So that it could say you used the word vrij, which is most commonly understood as free, but there are these other usages which did you intend. Get a result and then run it past a human very quick for an ok / not ok decision. But no, Google translate is good enough.

just not seeing it here.

I have a hard time seeing how it is not crystal clear.

on edit: fixed missing words.

mdoms• 5 years ago

And they block updates but don't remove the app without warning!

Epic would like a word.

ocdtrekkie2• 5 years ago

The key is whether or not your violation impacts revenue. Almost any other issue will not get you the full wrath of Google and Apple. Cut them out of their 30% and they'll act harshly.

perryizgr8• 5 years ago

The reason Catima isn’t on alternative app stores isn’t because there is something wrong with them, it’s because there is something wrong with Google Play.

I don't understand. Why are erroneous policy violations in google play preventing them from launching it on Huawei or Samsung?

phdelightful• 5 years ago

I agree, it's not clear. Maybe it's because the developer has sunk so much time into dealing with Google Play that she hasn't been able to release it on other platforms, or she's discouraged from trying to do so and getting hit with another round of insanity.

jeroenhd• 5 years ago

Getting boned because of the inability of the English language to distinguish between free and free, that's a new ring of machine learning hell.

probably_wrong• 5 years ago

But... Spanish does have a difference between "libre" and "gratis", and the translated title is using the correct one. I guess they are also trying to catch synonyms and doing a terrible job at it.

sp332• 5 years ago

It's not a machine learning issue. A human would make the same translation. The issue is that the match should be run in the original language, not translated to English at all.

tyingq2• 5 years ago

Meanwhile, lots of other apps with 'Free' in the title, description, etc.

https://play.google.com/store/search?q=free&c=apps

Including some Google owned ones like YouTubeTV.

billynomates• 5 years ago

Yeah they only review when you make a new release, so maybe these apps just haven't been updated in a while

nguyenkien• 5 years ago

Nah. Probably exclude app already in store.

tyingq2• 5 years ago

"Text Free - Call and Text Now" Updated January 10, 2022

"Free Now" - Update January 11, 2022

Many other examples have recent updates too.

TrianguloY2• 5 years ago

Not quite, it is only reviewed when you make an update to the play store description, not when you publish a new version.

leros• 5 years ago

I went through a similar hell getting compliance to use a certain Google API after getting algorithmically flagged. Months of back and forth, with conflicting approvals and rejections. The same automated emails over and over sprinkled with emails from humans who kind of understood.

I will never again use any Google service for business purposes if I can avoid it.

jeffbee• 5 years ago

The play store review program is there to serve the installing users, not the app authors, so even a high rate of obvious false positives is probably considered acceptable.

simion314• 5 years ago

The play store review program is there to serve the installing users, not the app authors, so even a high rate of obvious false positives is probably considered acceptable.

This article should provove that Google incompetence exists and it works in both ways, it blocks good apps and there is no reason why bad apps would get away. I mean code like

if(shity title translation constains an word from illegalWordsInEnglishList) proves there is no super clever AI here but at best a quick workaround , so if quick workaround or shity code is allowed why would you be convinced that the "security" scans are better? (we found that 100% Apple security scans are as bad so I won't be surprised if a Google dev also created a list of illegalAPUIs and does a naive search that clever developers can get around with a bit of clever reflection/dynaimc class or obfuscation)

TL:DR I am not convinced that badly implemented policies and shiutty implemented security scans do not affect the users.

Hizonner3• 5 years ago

So, how am I "served" by being denied actually useful apps, while I am still offered a vast array of malware and crap?

pastrybanking• 5 years ago

The implementation of the Play Stores policies for consumers is also fundamentally broken. In my country's version of the Play Store, the number two ranking app is currently rated at 2.6 with multiple complaints of users losing money to an alleged scam.

neoneye2• 5 years ago

I have a similar story about the App Store. I wanted to move my app to another owner, but Apple has detected it's a plagiarism of my original app. Now I have neither the original app on the App Store, and the new owners app is stuck. It seems to be automated rejection without a human taking an actual look at the problem.

My app is open source https://github.com/triangledraw/TriangleDraw-iOS

nopakos• 5 years ago

I once got a warning for sexual content. The offensive phrase was "Virgin Mary".

raverbashing• 5 years ago

So the right hand built machine translation and the left hand falls for naive Scunthorp problems like it's an intern writing a PHP app? (Or worse, a human with zero critical thinking)

Why am I not surprised...

ComradePhil2• 5 years ago

I'm genuinely interested in hearing from people who believe that Apple and Google should have a monopoly on deciding what apps people can run on their phones.

In case of Google's Android, one can still install third party App Stores, even they take away auto-updates and such. Apple is a much worse offender.

In either case, why does anyone think that they should have a monopoly there and why is nothing being done to fight it? Many years ago the EU forced Microsoft to release Windows versions without a default media player or a default browser. Yet, nothing has been done to Apple and Google. Why?

duhast5• 5 years ago

How would you realistically solve this problem? Part of what makes these platforms so attractive to the end user is in fact app curation. Strict control over APIs and power usage, all sorts of minimum standards and mandatory integrations are contributing enormous value to these ecosystems.

foxfluff3• 5 years ago

I would allow fair competition and let the user choose.

You don't need a monopoly to have curated storefronts. For example, GOG is curated and if I don't like their curation, I can look at Steam or a plethora of other stores.

F-Droid has its own kind of curation, which I prefer to Google's curation; it gives me a decent guarantee that I'm looking at free software, and antifeatures are usually hilighted. However, I don't have to use F-Droid if I don't want to.

So maybe another entity can provide better curation that Google does. And maybe another entity can offer an uncurated store; if users prefer that, it's their choice.

Hizonner3• 5 years ago

What makes these platforms attractive to the end user is that they're the only things available for sale down at the phone store. And what makes the decision between the two available choices is what your friends have, or what you already have, or what's on sale, or about a trillion other things that are more likely to be "top of mind" for the average buyer.

I bet not one user in 1000 gives any thought to "app curation" before they choose a phone.

Ostrogodsky• 5 years ago

I coulda/sorta buy this argument for Apple(though I am pretty sure that is not the main reason people buy Iphones) , but for Android?? Curation??? Hahahahhahahahahaha

ComradePhil2• 5 years ago

I would not mind my apps on iOS being curated by Microsoft for example and some people would probably prefer their apps on Android devices being curated by Apple... or Microsoft or EFF or Mozilla or Signal or say a new community of volunteers who come together just for this purpose.

It could also be that I trust a group of vendors while I don't trust some others as a user. For example, someone would maybe want their Android apps to be delivered by Apple, Samsung and Mozilla... but not by Google or Amazon for example.

The phone makers could still control their frontends and interface of their stores as they please... but to absolutely not allow certain apps from vendors altogether even if the user REALLY wants to install it on their device is a completely different thing (which is the case now as far as Apple is concerned).

Note: In the above examples when I am naming companies and organizations, I'm imagining a world where any of these companies can have hosting service for their own curated list of apps where developers would submit their apps for various platforms and users can add these as sources on their App Store. There could be a chain of trust for new app store source vendor, where a group of third party organizations decide who to give or take away these rights from.

Const-me• 5 years ago

Strict control over APIs and power usage

These are doable with technical measures. Modern OS kernels are multi-user, when implemented properly, their user isolation features are very hard to break. If an OS doesn’t want apps to have some APIs, it shouldn’t expose that API to apps. For instance, Linux doesn’t allow users to pretend they’re someone else, but that’s not enforces by curation, instead the APIs like setresuid() only work if the caller is a root.

Similarly, if the OS doesn’t like high resource usage of background services, it has technical tools to enforce various limits. An easy enforcement method is killing the offending process. For instance, in Windows Phone 7, background audio agents were limited to 15 MB RAM. If a background audio process exceeds that limit, the OS silently kills the process, audio stops playing.

When something is doable with technical measures or curation, technical measures are almost always better because the curation is fundamentally unreliable.

sam0x17• 5 years ago

Legislation mandating all platforms to allow for third party app stores to exist with zero functionality/feature penalties in terms of what those apps are able to do (Apple can't gatekeep certain features as only supported by Apple app store apps). I would dovetail this with legislation limiting app store cuts to 5%.

balls1872• 5 years ago

I'm genuinely interested in hearing from people who believe that Apple

I'm old. I like that I can generally trust installing apps on my phone because Apple vets them. It is one less thing for me to think about.

Likewise, I have young children. I also like that I can generally install an age appropriate app for them, because Apple's vetting process. Again one less thing for me to think about.

On the flip side, I banned the kids youtube app, until Google came down hard and removed ads and started moderating videos aimed at kids. Prior to that, it's algorithm was serving up highly questionable content to kids. Now, I feel more confident letting my kids watch videos on Kids Youtube (though I typically have the sound off...)

phreack3• 5 years ago

But the question is why you shouldn't be able to sideload an app at all. Having a curated store is pretty cool, and you can have that while also letting users install their own apps manually (even with barriers, making it as hard as they like).

Aaargh203182• 5 years ago

I'm genuinely interested in hearing from people who believe that Apple and Google should have a monopoly on deciding what apps people can run on their phones.

It’s not so much that I prefer that Apple/Google can decide what I can install on my phone, it’s that I prefer that they decide for my mother and father who click on every ‘accept’ button without reading to just get it out of the way, or my aunt who forwards every facebook scam she encounters and every a-technical person in my life who I would have to bail out time and again if this were not the case.

freedomben7• 5 years ago

If there was an option in the settings menu to disable this, would you be worried about your mother and father finding it and changing it from the (safe) default?

AussieWog93• 5 years ago

I'm not actually so sure of that.

Despite the "review" process at Google, my grandparents still managed to infect their Android devices with all kinds of malicious apps (mostly adware).

Interestingly, neither have ever installed a virus on their Windows PCs.

_fat_santa2• 5 years ago

Clearly this was a fuck-up with machine learning, and while it is worrying, what's more worrying is the consequences when this goes beyond just developer app reviews.

I'm worried we will have another British Post Office Scandal[1] but on a much worse scale. Bad technology coupled with everyone in charge thinking the technology is infallible.

[1] https://en.wikipedia.org/wiki/British_Post_Office_scandal

javajosh3• 5 years ago

This kind of incompetence makes me seriously doubt that Google is doing anything to more substantially review apps for deeper security issues, either statically or at runtime.

The asymmetry of effort in this situation is profound: consider that you spend all your time and effort writing a, long, complex, thoughtful message by hand (the app), taking hundreds or thousands of hours, but then they respond with machine generated message that cost them 10ms of computer time.

The solution, I think, is obvious: Google needs a "zone defense" with the play store, a much larger (and expensive) staff, to do in-depth app reviews and be a stable, stateful relationship with the developer over time. This person would, in fact, become a 3rd party "expert" on a small set of apks and their contents, with a "feel" for what is changing over time, with the core mission of protecting users from malice, but working with devs, as a human being.

freedomben7• 5 years ago

That sounds awesome to me, but if they were going to do that the cost of submitting an Android app (or the % take by Google on sale) would have to sky rocket to make it worth it. As someone who rejoices in small developers, I would hate to see that.

I think it's ok to do automated review for round 1, but I would like to see a human field appeals. Over time I would also think that will help find edge cases and cracks in the automation so that it can be further improved.

Edit: Based on other comments here, it sounds like that may be what Google is starting to do

UncleMeat5• 5 years ago

This kind of incompetence makes me seriously doubt that Google is doing anything to more substantially review apps for deeper security issues, either statically or at runtime.

I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vulns and ensure that you don't inundate users with false positives, forcing them down the admittedly limited support channels.

The solution, I think, is obvious: Google needs a "zone defense" with the play store, a much larger (and expensive) staff, to do in-depth app reviews and be a stable, stateful relationship with the developer over time. This person would, in fact, become a 3rd party "expert" on a small set of apks and their contents, with a "feel" for what is changing over time, with the core mission of protecting users from malice, but working with devs, as a human being.

This sort of exists. Google pays external hackers who find vulns in popular apps via a rewards program. These don't need to be Google's apps. There may be other systems for top partners or specific kinds of apps (the org is big) but I'm not aware of anything personally.

Expanding beyond a small subset of apps is challenging. Not only are there millions of apps, each app contains tens, hundreds, or even thousands of individual apks. The staff needed to have a concierge for each app would be absolutely freaking enormous, perhaps even larger than the number of people on the planet who actually have deep security expertise on the Android platform.

advael• 5 years ago

Sounds to me like what you're saying is that the walled-garden approach of needing to approve every app that ever gets developed as a whole is what's infeasible without creating kafkaesque conditions dealing with their automation, and I fail to see how you've made a case for this automation being all that good in the first place, given that your main argument for it is that it's found "millions of vulns in apps over the years" but then later cite "millions of apps" as a reason you can't expand the support team.

I would suggest that it might be worthwhile to use OS-level features to stop apps from behaving maliciously in more general ways, but a lot of what I would consider malicious behavior (e.g. sending user analytics to third parties, feeding them misleading ads, messing with other processes, etc) is part of google's business model or claims of added value in many cases, so that seems unlikely to happen.

You are nonetheless astute to point out that we can't really blame the individual or even group-wise incompetence of their support teams here. What it is worthwhile to blame is the entire business model of trying to own and control a platform that supports so many users in the first place without giving them the autonomy to self-govern. No company can possibly be so many things to so many people and not screw them over. In a way, it's the same problem planned economies have. Even making the very generous assumption that this is never out of malice or greed, we can still view the major problems millions of people face due to this scale and inflexibility as practically inevitable.

javajosh3• 5 years ago

Google pays external hackers who find vulns in popular apps via a rewards program.

How does that work? Is the submission farmed out to a 3rd party as part of the verification process, and proactively checked? Or is it reactive, similar to a bug bounty? Are there people out there making their living running apks in desktop simulators looking for issues?

I always wondered about the economics of checking huge quantities of arbitrary code (well, bytecode) for vulnerabilities, even for a 30% cut (which is probably 0 for 99% of apps, right? I would expect a power law distro). Kinda sounds like Google solved this by running the apks through something like a CI/CD gauntlet and then...hoping for the best.

And of course you can't be too transparent or bad actors will game the system. It's almost as if, as a sibling commentor mentions, it's just not possible to adequately run a walled garden that adequately detects malice at scale.

Here's an idea: instead of charging 30%, you should waive that if the dev team agrees to vet 5 other apps for you, over time, especially the open source ones.

RNCTX• 5 years ago

I actually know the team that does security vuln automation for Google Play. They've found millions of vulns in apps over the years. One of the challenges they face is precisely this sort of headline: how do you use static analysis to find vulns and ensure that you don't inundate users with false positives, forcing them down the admittedly limited support channels.

Pay people to do tiered support.

"but that costs money"

Make less. Or don't have an app store.

buu700• 5 years ago

Obligatory reminder that a backdoor was added to the Play Store last summer: https://www.xda-developers.com/google-play-apk-replacement-p...

I wouldn't be surprised in the least to find out that "Android App Bundles" were the ultimate result of a secret FISA ruling.

foxfluff3• 5 years ago

Some Google engineer probably thought they were very clever when they applied "the algorithm" to translated titles.

Pretty fucking draconian some of those rules, if you ask me. In games and works of art it's not uncommon to have a title longer than 30 characters. Nevermind when you have different editions or things that are related to the main title.

So how does this actually work? Why is 'Life is Strange: Before the Storm' (33 characters) on Google Play? https://play.google.com/store/apps/details?id=com.squareenix...

f137• 5 years ago

Until recently the limit was 35, and 50 earlier still.

Google enforces new limits on app updates, so this game was not updated recently.

bitwize• 5 years ago

The rules can be and are waived for big-time publishers.

jsnell• 5 years ago

So, the relevant bit from the Play Store policy documents is probably: https://support.google.com/googleplay/android-developer/answ...

That policy seems very reasonable. Is the policy being misapplied here? Hard to say, since it's describing the spirit of the rules rather than an exhaustive list of specific violations. It doesn't seem that anything in the title would be misleading. But the original title is kind of irrelevant; whether the app is libre or not has no bearing on its functionality.

xeromal2• 5 years ago

Yeah, once I caught gist of what was bothering them, I would've just nuked Libre from the title and all translations.

Just call it the Card Wallet and be done with it.

sdoering2• 5 years ago

This would be practical - but what about companies like "Free Now" that are (at least currently) seemingly allowed to keep operating under that name in the Play store.

Why delete something from the name that is actually transporting information for the user just because Google arbitrarily decides that for this rue the mistranslation comprises a rule break while other apps (with probably bigger marketing spend on Google) are allowed to keep "Free" in the name.

Imho is not the rules per se. It is the mistranslation and also the arbitrary enforcement that reminds me personally of stories by Kafka (the author, not the tech).

AtNightWeCode2• 5 years ago

My experience of Google Play is that it is 100% corrupted. I worked with companies that tried to get their apps back onto Google Play for YEARS without success. How do you solve something like “this app is not compliant with program X” when the app was never registered for that program for just that reason?

…and the "support".

ugjka• 5 years ago

Google is specifically anti-support from their beginnings because they have this belief that everything can be solved algorithmically.

AtNightWeCode2• 5 years ago

When you work for companies that make Google a lot of money. Google does all the work for you, so you do not even need to care about support in the first place.

UIUC_063• 5 years ago

I think you were lucky they told you anything. On Quora they just say "your answer was deleted for violating Quora policies. Click here to read our policies."

This sort of "tell them nothing" approach seems pervasive in the online world. Blame the lawyers.

Their lawyers must caution them "Don't give any details. That just opens us up to more questions & legal actions." The fact that it's completely self-serving and proves they don't give a shit about you is kinda irrelevant. Who are you, after all? There are millions just like you.

freedomben7• 5 years ago

I despise the tell them nothing approach and I think it's despicable, but that said I think there is a more legitimate reason than the lawyers. If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store.

I don't think that justifies the harm it does to regular people, but it is a lot less sinister than just CYA.

I actually blame tech media who capitalize on every "malware in the Play Store!!!" story a lot more, and the Apple apologists who use any news of malware on Android (even if it only applies to people downloading pirated apps and sideloading them with root) to trumpet how insecure Android is. Personally I think that bad press is the primary driver behind the modern policies.

UIUC_063• 5 years ago

Could be, actually. The press sucks: a bunch of untrained people too lazy to get off their laptops and talk to people.

I don't think Quora falls into that "spammer" category, though. No one is seeking to make any serious money from it, AFAICT.

aperrien• 5 years ago

At that point, why not put up an option for paid tech support? It would make life costly for the spammers, and give an option for people with a critical and legitimate problem.

rendaw• 5 years ago

Japan immigration does this too - they reject applications but won't say why it was rejected, because people wanting to enter the country for illegal reasons might be able to use that information:

https://www.mofa.go.jp/j_info/visit/visa/faq.html

jevoten4• 5 years ago

If the person is a spammer or otherwise not legit and you tell them what they did wrong, it's a lot easier to hack around the problem and beat the automated moderation and get your malware into the store.

Is it? Because spammers and malware writers are the only ones that already know what they did wrong - spamming and malware! While everyone else is left guessing.

donarb• 5 years ago

It just amazes me that developers try to cram editorializing into the title of the app, when you're already given a search word field and a description field in which to tell the world about your app. IRL nobody searches for "Cheerios - Toasted Whole Grain Oat Cereal for the Whole Family".

Brian_K_White• 5 years ago

Why even have names then? Might as well just be a serial number that isn't displayed, and a bag of keyword fields that also aren't displayed but can be searched.

A name has to convey some sort of meaning, otherwise everything will be a billion versions of Verizon. A toothbrush would be indistiguishable from a tax prep software by their names.

And of course people search for every one of those words in that long cheerios name. You can't search for a thing by it's short unique meaningless name until after you find it by searching for what you want, like toasted oat cereal or wallet of freedom.

phreack3• 5 years ago

It's sad but if you search for 'cereal', you're going to see the one with the awful title higher up in rankings.

stickfigure• 5 years ago

I feel this just shows lack of imagination in the search algorithm. It seems pretty trivial to discourage this kind of thing - to start with, how about penalizing longer titles or longer lists of keywords?

Let the publisher decide whether to rank low for lots of words, or high for a few.

hbn• 5 years ago

This is something Google does themselves. Their listing for Chrome is "Google Chrome: Fast & Secure", Keep is "Google Keep - Notes and Lists"

posmonerd• 5 years ago

I’ve also had horrible experiences with the Google Play people. Will never consider publishing on that platform again, huge waste of resources and personal time.

Fortunately PWAs are a thing.

charcircuit• 5 years ago

Title (en_US): "Catima - The Free Card Wallet"
This proved my theory: Google was using Google Translate to translate the app titles instead of reviewing them with native speakers.

Why would they use Google translate on an en_US string?

bilalq• 5 years ago

I've run into issues with both Google and Apple that were just ridiculous.

One time, Google randomly ceased payment processing for our app. When I reached out to them, the support staff were not at all helpful and said an "account specialist" would be needed and that they would forward the case along. Afterwards, I got an email saying that they would respond in 24-48 hours. After days of waiting, they finally message me asking for passport photos. I send them over, get another "24-48 hour message", and then two days later they reply back saying they want the exact same documents again. Insane! I send it again and mention that I already sent these. They wait two days and reply back that they actually want my co-founder's passport now. I reply back with that. Then they send another "please wait 24-48 hours" message.

At this point, I tried reaching out to friends at Google to see if they could escalate internally for me. A case got created, but two days later I get an email saying that this is something that the Google Pay team manages, not the Play Store team. Apparently, Google's org chart was my problem.

After all this, a response comes back saying "Your account is currently suspended you submitted documents which cannot be used to verify your account details. Our team has responded to you with specifics about what needs to be submitted in order for them to complete our review." Except they hadn't. I responded back about how both my cofounder and I submitted every document they asked for multiple times and answered all their questions to no avail. I pleaded with them to please let me speak to a human about this. After yet another agonizing 96 hours, our case was resolved and payment processing was re-enabled. We were bleeding money at the time and had been paying thousands of dollars a month to their ridiculous 30% highway robbery tax on subscriptions.

While not quite as bad, Apple blocked an app update because the current reviewer didn't like our subscription group separation. The only problem is that the app release in question had no such changes and the subscription group setup had already been approved in a previous release. The setup made sense and used common practices for A/B testing different prices, but the Apple agent we got on the phone with wouldn't have it. They insisted we release an update that would break existing subscribers to comply with their policies. Two bugfix updates were rejected for nonsensical reasons. We went through an escalation channel to get them out. When we submitted updates again, the reviewers magically had no more issues with things they'd already approved in the past.

Forcing a 30% cut isn't even the worst offense of these app stores. There's literally no easy recourse when things go wrong.

kingofspain• 5 years ago

Oof. I’ve had the user account one before from Play for an app that had no user accounts. Apple isn’t much better though - currently trying to argue that asking for user location (when a user clicks ‘use my location’) for a real estate app is reasonable. They are insistent it’s not a valid feature and won’t accept it til it’s removed.

kmeisthax• 5 years ago

I'm somehow both appalled, surprised, and unsurprised at the same time. Tech companies have a weird habit of jumping into language markets they don't actually have the staffing to properly serve. However, I never expected to see Google just outright machine-translating titles to do compliance checks on.

After 4 full days of trying to teach Google staff how a dictionary worked

Google's moderation policy is to treat any sort of complicated business situation as some kind of DDOS attack, as if you e-mailed your appeal buried deep within a ZIP bomb. They have strict computation quotas on wetware.

TrianguloY2• 5 years ago

About the log-in requirement, happened to me too on an app with a textbox used for searching (no login required anywhere). I just filled the login form with a sample search and wrote a little explanation. They accepted it on the spot (although I doubt they will ever read it)

npteljes2• 5 years ago

What OP unfortunately missed is a post like this: "Tell HN: You can't add “no ads” in your Play Store app's title"

https://news.ycombinator.com/item?id=29497680

sschueller• 5 years ago

Sadly the feature to filter out apps that have ads or in app purchases does not exist. Probably on purpose.

There are many utility apps with thousand of similar apps, most are garbage filled with ads but then there are a few made without app upselling or ads but until you find those you send a lot of time.

npteljes2• 5 years ago

Yeah, I gave up on the Play Store very quickly, and so now it's just F-Droid and the occasional play store install with Aurora. I just feel like that if I need to spend energy either way, then I'm better off spending it in the FOSS ecosystem.

seba_dos1• 5 years ago

Once I had my app rejected from Google Play, because they decided it was plagiarizing another application... which was actually the very same application posted by me somewhere else. Took some effort to convince them that I'm me, even despite of my Google account being registered on a domain that's prominently displayed as the first thing after launching the app.

Another time, they suddenly decided that "No information is gathered from users whatsoever." is not a valid privacy policy for a Free Software application that does not gather any information (it was a simple game that couldn't even store highscores locally).

mandeepj• 5 years ago

I went through similar hell recently. Google should just sell Google Play at this point.

https://news.ycombinator.com/item?id=29640436

invalidname• 5 years ago

We had a similar experience to the one here: https://dev.to/codenameone/google-play-kafkaesque-experience...

Google is worse than Apple in many regards.

ChrisClark• 5 years ago

Regarding the update at the bottom of the article, I also just got the email about needing to provide login info so they can review my app. An offline game that has no login functionality...

mondo2000• 5 years ago

Maybe I missed something, but I don't see how Google's conduct relates to the other app stores, as mentioned near the beginning of the article. Did she leave that part out?

metalised3• 5 years ago

It's the same with all of FAANG.

It's now been almost two months since my facebook page of 56k users was hacked, and nobody at facebook seems to give a shit: https://news.ycombinator.com/item?id=29876423

I just gave up and made a new page now. Hopefully the hacker won't manage to claim that one too.

kingcharles3• 5 years ago

There is a paid service to help you get these back.. O_O

https://hacked.com/

(I guess it is that common?)

metalised3• 5 years ago

$899

Holy c...!

digitalpacman• 5 years ago

My app has been removed from youtube oauth multiple times because we keep getting different verifiers. We've even had permission revoked after being approved. All we do is use a oauth to get their userid and read their livechat for a chatbot. They just can't get their shit together.

heavyset_go3• 5 years ago

Maybe we shouldn't be relying on Google and Apple to decide what we can run on our phones and tablets. Maybe we shouldn't let Apple and Microsoft decide what we can run on our computers, either.

MrDresden3• 5 years ago

I agree with the sentiment, however you are not forced to run Google's Android on your phone if you don't want to. It is just the most convenient OS to run (as it comes preloaded).

For the PC's (yes, an Apple laptop/desktop is a personal computer) you can always install Linux.

Try it, it's great!

heavyset_go3• 5 years ago

Software freedom is not just about being able to run Linux. Being able to run Linux doesn't help the billions of people who will never use anything other than the stock OS that ships on their phones, tablets or computers.

I bought a model of a phone that doesn't have LineageOS support because apparently it's a weird carrier model. The base model has AOSP support, though. Didn't realize that until a few months into ownership, and by then it was too late to return. I'm stuck with Google's Android.

I've been running Linux for like 19 years now.

MrDresden3• 5 years ago

I've been making Android applications professionally for a decade now, and I'm of the opinion that who ever manages the Play store, it's policies and developer relations should be fired on the spot along with at least the next two levels of management below.

It is frankly a burning dumpster fire.

I still don't see why the app is not on any of the other app stores that the author mentions though (only rages about Play and thus the app is only there?)

raxxorrax• 5 years ago

To be fair, he would be fired if people didn't develop against this environment. People have warned repeatedly that developers make themselves dependent. Money is good of course...

Your app is not compliant with Google Play Policies: A story from hell

Related Stories