GuardianUK picked up on the Market woes story. The ADU gets a mention! (Though I’m not sure how I feel about being called ‘Disgruntled’. Perhaps ‘rightfully displeased?’)
Either way, I’m glad to see that this issue is attracting more attention in the media – unfortunately, Google still have not provided ANY COMMENT about this situation, which is why one of our demands is that Google assign a communications liaison to talk to the community about these issues.
The link is here, and here’s the body text:
Google’s smartphone app market is growing fast – but developers are calling foul over piracy and lack of transparency
Developers are concerned about app piracy on Android.
App developers are concerned that Google is being too lax in its regulation of the Android Market, where apps are made available for download to the millions of Android phones now in use – and allowing copyright infringements, as well as the risk of malware-laden apps, to flourish.
There are also concerns that it’s simply too hard to get discovered on the Market – meaning that unless you’re one of Google’s own apps, or a port of an iPhone app, you probably won’t feature in a prominent place where people might see your work.
Kevin Baker, an Android developer based in the UK, says that the combination of lack of discoverability and ease of copying and republishing is turning the Market toxic. Unlike Apple, where the iTunes App Store has rigorous pre-approval processes in which apps are run against a suite of tests to check that they comply with its rules, the Android Market allows anyone to post apps – although Google can then remove them from both the Market and any handsets to which they have been downloaded.
Baker told the Guardian:
“I have a game on the market called Sinister Planet which was released about eight months ago. Sales have been pretty slow, although picking up slowly over the months, despite a lot of great reviews. The main problem is that Android Market discoverablity is very poor, and Google themselves don’t help the situation by only featuring apps their are either (1) created by Google, or (2) iPhone ports. Independent developers like myself hardly ever get a look in.
“One of my customers emailed me three weeks ago, and informed me that another company was selling a version of my app – pirated and uploaded as their own. Of course I contacted Google right away. It took Google two days to take the app down. This publisher was also selling other versions of pirated games. I contacted the original developers of those games but they were still being sold a week later. You’d think [Google] might have a hotline for things like that!
“I would also note that the publisher selling the pirated games is still trading on the Android Market. They didn’t even get their account suspended. If there’s going to be malware hidden inside apps, it’s that the exact place where it would be? Why are these accounts still allowed to be trading? It’s negligent as far as I’m concerned.”
A screenshot from Baker’s Sinister Planet from his company Neolithic Software:
Screenshot on the Android Market from Kevin Baker’s Sinister Planet appAnd from the “pirated” Galaxy Wars:
Screenshot on the Android Market from Joyworld’s ‘Galaxy Wars’The publisher in question is Joyworld, which at present has just one game available on the official market, called World Wars, which has so far got more than a hundred reviews – almost all favourable. But a cached version on the Androlib site shows 14 games, which all look much the same – simple reheated versions of arcade games. They’re all free. The graphs on Androlib imply that Joyworld first appeared on the market on Thursday 17 February, with the first reviews appearing on 21 February.
The reviews of World Wars include one soon after its appearance which says “WTF? This is the exact same as The Wars”.
The Wars is a paid-for game published by Chillingo, based in Macclesfield. Comparing the screenshots from The Wars and from “World War”, they look extremely similar – notably, the backdrop of mountains and trees is identical in the screenshots – but those on The Wars is more detailed, implying that it is the original.
A screenshot on the Market from The Wars:
Screenshot from Android Market of The Wars, published by Chillingo. Note sprites and Menu button in lower left.
And from Joyworld’s World Wars:
Screenshot from Android Market of Joyworld’s World Wars. Note shape of sprites and Menu button.Baker says JoyWorld was selling his app under the name of “Galaxy War”, and adds: “They were also selling a game Monstie Wars, under the name of Demon Defense.” (Galaxy War is still linked on the Androlib site, where it claims that it was “developed for Android by Joyworld” and that “I am the developer of this application”.
The developer site link given for Joyworld is invalid. The Guardian has been unable to contact the developer.
Google said that code signing, which identifies an app, is enforced on the Android Market and makes it harder for would-be pirates to copy and re-upload apps. Developers are also advised to use Android tools such as Proguard, which “shrinks, optimises and obfuscates your code”, leading to smaller executable files that are harder to reverse engineer. Application licensing for paid apps can also strengthen protections, Google suggests.
Baker responds that “I did use Proguard, and that didn’t stop my app being pirated and uploaded … and the License Checking Service is what we use to check an app has been paid for. It simply does a request to the Market to check the status (ie has the app been paid for). This works fine, if the hacker hasn’t removed that bit of code. Which is easy to do.”
Separately, another disgruntled developer, Rich Jones, has set up the “Android Developers’ Union“, demanding a bigger cut of app payments (Google presently takes 32%), better promotion that doesn’t rely on the order of entry, public bug tracking, better payment options, removal appeals and better liaison, and “algorithmic transparency” about how apps appear in searches on the Market.
Jones has claimed to have around 200 members; his own app, called Rapid Download!, was removed, apparently because it allowed easy downloading from sites that host pirated material – which breaks Google’s Market terms.
But piracy of apps, and its wider ramifications, could become a problem for the Android Market. Earlier this month, about 50 apps offered on the Android Market were found to be infected with malware that could take over – “root” – the phone once installed; they used a privilege escalation exploit to install a further application which could send user data back to a remote server, and potentially download further apps with root privileges. Thousands of people had downloaded the apps, which were copies of existing – harmless – apps that had been repackaged to include the malware.
Though Google subsequently removed the apps from the handsets using its remote “kill switch” functionality, and issued a program called “Android Market Security Tool” to remove any rootkit software from infected phones, the mobile security company LookOut warned that that too had been re-uploaded with malware added, apparently targeting Chinese users, who form one of the fastest-growing groups of Android owners.
Alicia diVitorrio, director of marketing at Lookout, suggested: “The growing trend to conceal malware in seemingly legitimate applications is just another reminder to always use discretion when downloading applications. Pay close attention to the developer name and publisher of the application – only download applications from developers you trust or know. Always read the reviews and check the ratings. As an additional precaution, check out third-party review sites like PC World, Appolicious or Cnet as well.” (The Guardian also reviews apps for all mobile platforms on its Apps Blog.)
The idea of “only downloading applications from developers you trust and know” however leaves unanswered the question of how you would “trust and know” a developer when the Android Market has more than 200,000 apps.
And even Google seems to have problems deciding which developers are trustworthy, as Baker discovered a fortnight ago:
“I woke up to an email from Google telling me my app has been suspended from the Market: ‘This is a notification that the application, Sinister Planet with package ID com.neosoft.SinisterPlanet has been removed from Android Market due to a violation of the Developer Content Policy. Please review the Content Policies and Business and Program Policies before you create or upload additional applications. Note that repeated violations may result in a suspension of your Android Market Publisher account. For more information, or to contact us, please reply to this email, or visit the Android Market Help Center. Thanks, The Android Market Team‘
“I’ve been selling my game all this time and not one complaint or problem. It’s just an arcade shooter. In fact I’m selling it in South Korea and the Korean Gaming Rating Board gave it the all-clear for ‘all ages’.
“So of course, I thought it must be some kind of error. I’ve since sent about 20 emails to Google asking for clarification and not one single reply. It’s like all my emails are marked as ‘spam’. I’ve spend all this time building up my sales and ratings, now I’ve got to start over. I also love the part where they threaten to suspend my account for repeated violations – without ever telling me what I did!
Google says that there is a link provided on the email that goes out to banned developers which lets them appeal a decision.
Baker responded that “I looked through Google’s official forums and there are lots of people in the same situation [as me]. Never get a response.”
Overall, Baker is not happy.
“There are currently apps called ‘Throw Shit at Stuff’, other apps to download illegal files, Google obviously value these apps much higher than mine, despite the fact that it had an average rating of >4.5 and was in the top 5% of Arcade games. Now I’ve had to start over again, despite putting maybe 500 hours of work into it over the past year.”
Baker’s conclusion? “I’ve got my app already approved for the Amazon Market, hopefully they can do a better job than Google. Google’s ‘open’ policy is a joke as far as I’m concerned.”
Your thoughts? Post them below!