Imagine if the power company cut off people’s electricity in error 1/10 of the time. That’s insane and dangerous.

Apps are an important part of the economy and having a false positive rate of 10% when the consequence is severely harming a company is unacceptable.

Not sure if it means regulators should get involved but Google (and to a certain extent Apple) have had this problem for many years and it doesn’t seem like market forces are going to change their policy.

I think the angle to take here is that Google is being anticompetitive by blocking a mail competitor from Android. So I think anti-trust is the existing set of laws that apply and hopefully will be pursued.

Hopefully it’s just Google’s stupidity and not malice, but I think all the data to determine that is private and confidential to Google so requires some legal compulsion for evidence in order to investigate.

Very often, the policy violation cited is very very broad, and "worst case", but not enough information is given to find the specific issue.

In this case, it is my understanding that firstly it isn't clear what the actual allegation is (making it very unhelpful for the developer, as they can't meaningfully respond), but that the suspicion is it may be linked to an (off by default) option to show the favicon of a sending email domain.

That would entail making a DNS request to the domain in question, and then looking for a favicon on the domain. That doesn't seem in any way related to spyware as it's off by default, user requested, and not sending information to a third party.

Valid point around the exact APK uploaded for distribution - I'm not sure of the state of the art for reproducible builds on Android, but the full gradle configs are in the repo for creating GitHub or Play Store releases as far as I can see - if reproducibility in android has got any better, you can likely get to the same binary, modulo API keys and similar, as the developer seems pretty diligent at tagging releases etc.

If this statistics is true, then Google is removing lots and lots of legitimate apps. This is exactly why a monopoly is bad. 90% is nowhere close enough accuracy for such a system.

You should also know that this is the developer of the popular Xposed modules XPrivacy and XPrivacyLua. These modules allow one to 'spoof' data to apps on Android, such as the wifi SSID, device identifier, etc. It is a lot more fine grained and in depth than Androids default permissions. Not saying that has something to do with this but it is something to keep in mind, politically speaking.

In my experience 9/10 times are spurious detections.

Just recently, we had 2 customers that had their apps suspended because Google detected a non-existent HockeySDK

> about 9/10 times when Google removes an app it's because it is actually doing some very shady spyware type stuff

If Google removes apps for invalid reasons 1/10 the time, that's a big window for abuse.

"It seems"???

Really?

That suggests you don't know what you are talking about. You are talking about a very popular app. If it is doing something shady shouldn't there be hard evidence by now?

Could you post the source for the 9/10 claim? Thanks!

and as a counterpoint: FDroid gave FairEmail a clean bill of health.

FairEmail, if popular, would give users the unfortunate ability to sidestep an appendage of the lucrative ecosystem of googles surveillance capitalism by eschewing the default email client.

FDroid clearly didn't detect how the app queries contacts from an external server. Neither does FDroid check if the app uses newer better APIs to conduct its activity.

Why would google care about the email client people use. They may care about the email provider people use, because that‘s where all data passes through. But I‘m fairly certain that for all they care, you could have your mail printed or view them as an expressive modern dance piece.

> Why would google care about the email client people use.

Because the "client" is where advertising can be most easily inserted to monetize that user.

But they don’t. Or does the default mail client on Android come with built-in advertisement?

Personally I don't know, as I use K-9 Mail from F-Droid.

But from the viewpoint of an advertising company, keeping the option open to insert ads, even if they may not be doing so at this time, is in their best interests.

I trust FDroid more than I trush Google.

I'd rather not trust either. Right now both can impersonate any developer out there and nobody would be any wiser.

true. but fdroid has the better track record.

> FDroid gave FairEmail a clean bill of health.

This means nothing.

according to boole1854[1] the app was uploading contacts to be able to download favicons, without disclosing that it was uploading contacts.

1: https://news.ycombinator.com/item?id=31434975

Looking at the code, it wasn't uploading contacts - rather it retrieved the favicons by looking on the domain in question, when a user turned that feature on manually.

Some apps do upload user contacts - they take the whole list, and cart it off to their own server. The app doesn't seem to be sending anything to its own server - it's fetching something the user asked it to fetch.