As an iPhone user and an Android developer my lessons learnt, over the time, are:

1. Do not trust Google to vet the apps in the play store. They won't; they don't even try.

2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat

3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of course, you won't be hacked - you pay this price by using Googled Android anyway)

4. If you couldn't find a well known app on Play Store - head to https://www.f-droid.org

5. Do not, just do not download any other app on your phone (treat it as a no exception rule) unless you know what you are doing and possibly can look at the code - find something decent as an APK from GitHub et al.

6. Be very miserly when it comes to doling out permissions to apps. Your default should be "no".

7. Privacy (not really) and safety are just superficial polish by Google on Android OS - their core and only focus developing the OS is: making it as much of an ad platform as they can and on top of that how to get a bigger and bigger cut of the overall ad revenue with every release.

You speak like if you were any kind of authority.

Nowadays anybody can be an Android developer, India is full of teenagers doing it.

TL;DR

The part of pg's comments that relates to your comments is this part:

"Saying that an author lacks the authority to write about a topic is a variant of ad hominem—and a particularly useless sort, because good ideas often come from outsiders. The question is whether the author is correct or not. If his lack of authority caused him to make mistakes, point those out. And if it didn't, it's not a problem."

But in general, Paul Graham isn't saying anything that is novel to this site's comment guidelines:

Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.

Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.

https://news.ycombinator.com/newsguidelines.html#comments

"Don't be a dick, because plenty of people are smarter than you, and even people who are not smarter than you can come up with really good ideas and perspectives."

I was a teenager doing Android Development in 2010. What difference does age make in this discussion?

What I mean is that it's not a valid argument to establish the authority of the speaker.

Why isn't it? Teenagers in India can have authority on a subject and more experience in certain areas than I do.

I'm not taking their post completely on faith. It matches up with my previous experiences, including the article we're currently talking about and related articles I've read.

Is there a specific issue you have with their point, or did you just want to point out that they're not special for making apps?

I've had the same issue as the author of the post.

The barcode scanner wasn't any shitty app, it was the one that was recommended a long time ago by Google authenticator. I had left it installed on my phone and it must had had the dodgy update that got it banned from the app store.

> the one that was recommended a long time ago by Google authenticator

That's where I remember it from, thanks! However I think there's some confusion here: the one the blog mentions is not https://play.google.com/store/apps/details?id=com.google.zxi... (github based, relatively trustworthy looking, recommended by Google Authenticator back in the day), it's the now removed qrcodescanner app: https://webcache.googleusercontent.com/search?q=cache:38t1gW...

I think those bad reviews on https://play.google.com/store/apps/details?id=com.google.zxi... are because the malware probably used the zxing qr library, and there might be traces left in it, or these users are just confused (or the malware app deliberately pointed low star reviewers to the github competitor app in the play store). As others have stated, this github app with the bad reviews hasn't been updated for a long time.

If the malware is also in https://github.com/zxing/zxing , I really hope they do a postmortem to explain how. The fact that https://play.google.com/store/apps/details?id=com.google.zxi... still exists though, while the app mentioned in the blog has been removed by google, makes me think the zxing app is clean.

Hang on a second, something is fishy here. I had an issue that the mirrors what was happening on the zxing reviews. I was getting a full page ad every 15 minutes or so after unlocking my phone.

The rub? It wasn't this app. It was another one that was also called barcode scanner. It was also beginning to garner negative reviews, which the developer (had a Ukranian email address) had begun responding to saying the app was perfectly legal because it was serving ads only inside the app itself.

I'm wondering if that deluge of bad reviews is directed at the wrong app? I'll look to see if I can still find the google play page for the one I had.

Also, I had that app for a LONG time before it started displaying this kind of behavior just last month, which also corresponds to the bad reviews starting on the zxing app.

The ads went away when I uninstalled it and reported it.

I went through all the apps I've installed in the past, and the only barcode scanner I've ever installed was this one:

https://play.google.com/store/apps/details?id=com.google.zxi...

So it might be another completely unrelated app that triggered the issue, or it might be this one, no idea!

I've reset my phone to factory and re-installed only as and when I needed an app and so far no more ads.

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware.

That kinda blows my mind.

That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.

I wouldn’t. Some malware can hide a lot deeper than a factory reset can erase.

Such behavior needs privilege escalation thanks to sandbox. I don't believe crap app can do privilege escalation for constantly updated phone.

Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.

I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.

If you don't fear as a binary then threat assessment and mitigation cost may be a factor. Could be a closet ios user.

That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.

I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact.

We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there.

I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.

At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things.

I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.

I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it?

(my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)

Yes - it's very easy to do a factory reset on your phone.

No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other.

Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones.

What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch.

Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.

Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage.

That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.

AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.

Indeed.

If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache).

AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.

> No - There is no 'easy' way to store/restore the entire phone as I believe Apple does.

I think Android phones with the Google Services Framework installed do provide such a way. Alternatively, if you're using a custom ROM (like GrapheneOS on Pixel devices), you can use Seedvault[0] for full backups of your phone. It basically acts as a drop-in replacement of the backup service provided by Google.

[0]: https://github.com/seedvault-app/seedvault

I had a QR scanner installed for _years_ before it started (in December) giving me chrome pop-ups for spammy links. The dev is even on the app store lying saying the ads are in the app when the app is actually covertly waking itself up to open chrome.

IMO: the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware. The only way to even help that is via community review (note that apple doesn't review internal behavior of the apps or instrument them in any way, they just have someone try using them behind a proxy) and enforcing public available source code like fdroid.

"the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware"

This was a side-loaded app on an unlocked phone. What am I missing?

My takeaway from this post is never use Android. Not that I ever would.