https://f-droid.org/en/packages/com.google.zxing.client.andr...
I mean, I could very well make an open source app and then load some malware in the apk in addition to the well behaved thing... Are they immune from this attack?
Every significant review system is being gamed to the point of being unusable, and yet stories about not being able to trust them keep being reported as if this were somehow noteworthy. For every one of these stories that rises to a thread on HN, how many other small time vendors are getting screwed by someone who is willing to pay a room full of people in some 3rd-world country to debase their competitor's online presence?
But it's still not stabilized, society has not yet found out how to deal with all this.
It's like when there were no speed limits for cars or standard signage. There was more freedom but it was way more dangerous and unpredictable and also as a result, not yet as useful as it could be.
It's not necessarily anybody's fault. A company like Google maybe sees itself as a company but it's way past that. It really provides quite essential platforms for people, families, cities, you name it. And also the platform for content creators and developers and businesses. Many of these don't have a proper contract with the platform. It doesn't scale to have lawyers to be involved in every point to point dealing either.
My assumption is that there is going to be maturation of these platforms, common rules and terms. Governments and WTO could be involved.
https://play.google.com/store/apps/details?id=com.srowen.bs....
One solution might be to only publish reviews/ratings from accounts with a minimum spend threshold and unique active payment details. This would effectively price out the scammers.
The sheer scale of situations where the top review is negative describes something that ... is not a bug, is actually supposed to be that way, is how the dang app works by design for good reason ... is bonkers.
It seems like reviews are driven by people who don't know, and respond reviews by to people who don't know who describe what sounds like fundamentally broken things... so they give it a thumbs up and they're both completely ignorant.
The volume of people who do know the app and would see / write a review seems like it is MUCH smaller.
I had a game app update recently. I went to update it (one of the few times I go directly to the play store app). There at the top is a review that described how they saw opposing players "just disappear" during the game and raged about that 'bug'. But it's not a bug the game has some fog of war and view distance type mechanic. It's entirely expected / appropriate.... but there it is the top review.
Heh. One of Google's featured reviews for ZXing is a one star review from someone who said they started getting popup ads, and looked up the issue on a web forum which said it was ZXing's fault. It has 30+ thumbs up.
Absolutely pathetic.
I've left online reviews a total of maybe 5 times ever. It was only ever to help very small businesses with very few reviews who gave me an exceptional and unexpected result in one way or another.
This statement seems very suspect to confirmation bias. How would you get to know if what you think is genuine was actually fake? This part of feedback loop is completely missing, and hence I find your above statement hard to believe.
When people don't know why Google banned their 15 year accounts I wonder if it's not from innocent stuff like this.
Anybody complaining about app stores has forgotten how bad the alternatives are. And community-maintained repositories aren't a solution, that's just the app store model but on a smaller scale so it's less of a Target for bad actors. If ubuntu's universe repo had to suffer the same amount of abuse as the play store does, it would crumble in a day.
I disagree strongly.
Most community supported Linux distributions have fairly arduous processes by which members of the community become trusted users / MOTUs / etc. It is not simply a matter of deciding to upload something, creating an account, and clicking a button. To deliberately upload a malicious package into Universe (or similar repos in other distributions), you would have to methodically worm your way into a community over time, participating on IRC, helping contribute innocuous changes to other packages, training new users, and so on. You'd then have to apply for the ability to upload, having demonstrated both skill and the ability to work with other members of the community, as well as the need for permission to upload a specific package. This process would take months or years.
And then, you'd have to keep any changes you made pretty cleverly hidden. Anything obviously phoning home or popping up full screen ads would instantly blow your cover, wasting the whole effort you put into it. It's simply not worth it. And that's before you realize how extensively open source the build pipelines for most distributions tend to be. (I can - and have - examined the actual build process used by multiple Arch Linux packages.)
This is completely incomparable to the process for uploading to Google Play. At best you're going to have to pass some automated checks. But it's an ecosystem built around closed-source (so no peer review) software, quasi-anonymous developers, and software funded by advertising. It's infinitely easier to sneak something into an app store, get a bunch of users, and get away with it (temporarily) than it is to put malware in the repositories of a modern Linux distribution.
sure. or you find somebody who's already done that and pay them some money.
The usual process for this with mobile apps is not to pay someone a lot of money to ship malware, but rather to buy the person's account, app, and the source code outright. This has the advantage of not having to be explicit about what you're up to, gives the original developer plausible deniability, and gives you way more control. Plus it makes reputation laundering way easier and since the app is still closed source you can make any changes you want without anyone being the wiser.
All of this is completely different from how community supported repositories are run.
It is just 'protection'.
The "real" government is really just another mob anyway. Pay your [protection money/taxes] or get your shop [busted up/shut down] and have other bad things happen to you.
https://play.google.com/store/apps/details?id=com.robinhood....
TL;DR someone apparently cloned ZXing Barcode Scanner, added annoying ads, uploaded it to the Play Store with the same name. Soon enough the malicious clone got taken down. Legitimately pissed off people who installed the malicious clone are leaving angry reviews for the non-malicious original (presumably because the malicious clone is gone from the Play Store).
This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus.
It takes a special kind of scum to slander an open source project in order to push malware.
[1]: https://play.google.com/store/apps/details?id=com.google.zxi...