I believe the App Store has switched to automated reviews, at least for updates. I've had my app updates approved in <1h on a regular basis starting this summer.
From what I was able to see from the outside, App Store has had semi-automated reviews for updates in basically forever (+ some random spot checks), presumably based on some introspection that only triggers a human review if a new system API was used.
Part of the value of F-Droid is the curated distribution model that hopefully catches the worst behaving developers that think they have a god given right to your data though.
The Google Play review process has been slower and more painful than the App Store review process for 5+ years at this point. At least you get to communicate with real people at Apple; it’s all bot-driven with Google.
On the flip side, googles release infra provides much more functionality for apps that already has scale. I wish apple were more production oriented too.
Team effort, but thank you!! I've just taken the next month and a half off to work on things full time. I'm excited!
The next update won't be huge, (Google required us to make all screens 'edge to edge'[0], which took up most of my time last month). I'm hoping for some solid improvements now that's out the way, once the release pipeline has returned to normal.
Feel free to get in touch if you fancy contributing.
If you can get your agent of choice to run up the app in an emulator and navigate the whole thing taking screenshots then tasks like edge-to-edge can be pretty hands off.
The way I did it was to firstly get accessibility identifiers on everything. Then have it record everything I do on an emulator to navigate the entire app. Then left it for a while to work out how to actually use the app via the emulator. Once you have this sort of baseline. A lot of changes are really quite pleasant. I often ask for an HTML gallery of screenshots covering a few device sizes as the step before I bother running it on a device myself.
We use Roborazzi[0], which is an excellent screenshot library, but:
* We target minSdk 24
* We're still using XML views
* We target a large variety of form factors
* We have a lot of screens, and these have a lot of configuration options.
I really wish it was "point an agent at it, and walk away", but many screens ended up being hours of iteration with Fable driving my phone/an emulator to produce an acceptable outcome.
Given that my Pixel 9 Pro has system screens which are still broken under edge to edge, it's not an easy change, and takes up time which could have been going towards feature development.
For new accounts yes, for older accounts it's much faster in my experience.
Apple has it's own issues, they often just answer with a random question so they can kick the review down the line. "Are you sure this is your pricing?" "Can you confifrm you have not selected that country" and then you have to wait another 2 days.
TFA is a post from an established developer and showing a screenshot for the submission of an update to a longstanding app (Conversations XMPP chat client).
Some reviews are clearly automated, some get a light human review, and some involve a human really looking hard. New apps seem to get a more rigorous human review for their first 2-4 submissions. Or at least humans looking over automated test screenshots etc. One reviewer apparently only looked at screenshots because they missed something that would be blindingly obvious on the prior screen if they did it themselves.
The explosion in LLM app development has clearly created a bottleneck at the human review steps. Not only delays but much more “dumb” rejections from likely over-stressed humans.
MAYBE operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all. Apple and Google are WELL past due for regulation in this space. The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
And before someone says "well akshully you can technically do it on Android," Google has been working tirelessly to make it as onerous as possible for both developers and customers. For example, users need to separately authorise each app (browser, files manager, alternative store, etc) to install an APK from outside the Play Store. Google also does background scans using "Play Protect" which will periodically delete apps Google doesn't approve of. This happened to me with SmartTubeNext. I have a dozen other ways Google ensures users are discouraged from stepping outside the Play Store.
And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
I'm not saying we have the perfect system but anything that slants the system towards "easier downloads" or "less gatekeeping" brings large, obvious risks. I don't see how regulation would address them.
How about treating people like adults for a start? How about starting public awareness campaigns about proper digital hygiene. Not everything has to be nanny state garbage.
At some point computers need to stop being treated as magical boxes that no reasonable person can learn how to use safely. We expect people who use cars to learn how to use them safely, we expect people who use lawnmowers to not stick their fingers in them. Computers have been a part of daily life for normies for decades at this point, it's infantilizing to suggest that average, non-tech savvy people can't learn to use (not necessarily build, repair, etc.) them properly and need to be protected from them.
People have to successfully get through a state exam in order to drive cars in first place, can be jailed, get fined when not driving them safely, or forbidden for life to ever drive again.
People that accidentality cut their fingers in lawnmowers due to lack of safety features are allowed to sue the lawnmower company.
What I would agree is that it is about time computing gets the same liability laws that the rest of the world already has in place and no EULAs that work around local laws should be considered valid in any form or shape.
Do you hate open source and want only projects where their authors can afford liability insurance and are willing to put themselves in the firing line of a legal system that can be both arbitrary and capricious? Because that’s what you seem to want.
On power tools, appliances, etc. the safety features are usually at the user's latitude to bypass. They are usually a hint (don't microwave your dog), not a hard barrier ("I'm sorry, Dave. I'm afraid I can't do that"). A spinning blade is covered by a grill you can trivially remove without needing to contact the manufacturer to allow it.
I agree that the defaults should be secure, but you can't force security on people without creating parallel issues which are maybe worse. Centralizing this power in a single point can have orders of magnitude bigger blast radius than a security failure on an app.
At some point users have to take responsibility and be accountable for their actions. We can't just infantilize them forever as if a magical hand will always be over them protecting and having their best interest in mind. And we certainly shouldn't punish every user for the sake of some of them.
The computer itself won't really do anything. But I'm sure suicides go up when people lose all their money, or get personal private details leaked, and so on.
20 years of being tech support for countless family members and acquaintances says that nothing can possibly make people care about "digital hygiene". An iPad, Chromebook, or similar inflexible device is perfect for most people, and marketing more flexible devices to them has been a mistake since the beginning.
I don't know. Literally every single person I help with tech support makes me doubt this is possible. People do not care in the slightest and treat suggestions to learn basic digital hygiene as if you've asked them to a computer science degree in its entirety.
Even super basic stuff like remembering a single secure password instead of reusing the same 2 or 3 basic initials-dob-symbol permutations that were probably pwned 10 years ago seems insurmountable.
We could force Google to operate its app review service independently. Users could use it and pay for it, or alternatives. Currently Google forces everyone to use their own mediocre service and pay for it without knowing exactly where and how much you pay.
If libraries didn't exist could not be created today. People tend to say that "it is impossible" when it actually only needs to be well organized.
Splitting git tech-monopolies it is a survival need. Or we do it, or we will end up with a collapsed society. Entities that spy on all citizens and gatekeep access to news and services are contrary to basic human rights and democracy.
I wonder if people would be happy replacing the "Google approves developers" system with a "government requires your ID and address on file so you can be held liable for your apps" system. I suspect not.
If you don't agree with a decision made by your government, you can vote for someone else next time.
If you don't agree with a decision made by Google, what do you do?
The people I vote for never win. Am I really any more empowered with the government than I am with Google? At least with Google I can de-google my life (with some significant losses of convenience, but it is doable)
Personally, I find it easier to live with a decision I don't support if I was simply out-numbered in a fair vote, rather than out-powered by some random company on some random continent.
As for doing without Google, I'm kinda doing that myself (using a Linux phone even). But tbh, I think that nowadays moving to another country to escape a government you fundamentally disagree with is easier than moving away from Google.
The only part that would really be novel is the liability.
I would be shocked if you could publish an iOS app without Apple being able to tell the government who you are. Less because Apple cares and more because Apple requires you to pay, which is very hard to do anonymously for something like this (I’d bet the options they offer are effectively “credit card only”).
2. still review apps uploaded to Google Play, but don't force users to use Google Play
If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
But the motivation here isn't just security, it's control. Google doesn't want anyone to have an Android device that is independent of Google services.
If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
So this doesn't solve the issue pointed in the OP.
don't force auto-updates
I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
So this doesn't solve the issue pointed in the OP.
Yes it does. This is their point:
The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
It should be as easy for me to use an alternate storefront - or download directly from a site - straight to my phone. The googleplay store, which is (somewhat) curated and (generally) "safer" can also exist. I, as a user, get to decide which path I want to take. This is literally no different from my desktop and laptop, we already live this life. MacOS allows me to download .dmg files and install (though they are admittedly getting increasingly annoying/friction-y about it) at my own risk. Why should my phone be any different? It’s a small computer. That’s it.
It’s about user choice. It’s my hardware, so I can do with it what I want so long as I’m not using it to inflict harm on others.
People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes.
Clearly we need to regulate the kitchen knife industry more. There should be a central authority that sells authorized kitchen knives with at max 6cm length and all other knives should only be available to certified chefs.
Once we have outlawed the longer knives and strong restrictions on ordinary kitchen tools become normal we should just outlaw knives altogether. You can still hurt yourself with a short knife. Only chefs should ever be allowed to own such a dangerous tool. Just buy or order readily prepared food. Why would you do this weird nerd thing called cooking anyway? Just choose from the official list of allowed foods.
The idea that we have to prevent people from being in control of their own computers — that's what a smartphone is — is deeply dystopian and authoritarian.
How about the same thing we do when companies leak half-the-nation's personal data twice a month. Nothing.
When companies get hacked and millions lose their personal data, nobody cares. When individuals get hacked, it's a major issue that justifies locking down consumer's hardware to protect them from the burden of controlling their own devices. See how that works?
And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
Security at its core comes down to trusting the supply chain that provides the software that runs on your hardware. There are many alternative secure supply chain models, but ultimately users often are incapable of making great choices on what is trustworthy. It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.
Comparing phones to PCs isn't a great comparison because PCs don't have a great track record and the amount of personal data and ease of installing lots of apps is quite different. Of course the current arrangement is far from perfect, but acknowledging the problems it's trying to solve is an important step towards trying to find a solution that is better.
Your complaint about Android .apk install is... similar to unsigned software installs on Windows in some cases (not a great argument, I know, but the same as the vast majority of users would be used to).
As for SmartTube, their keys were compromised. Inconvenient, but it wasn't about hostility to self-installed applications.
Key compromise sucks and is hard to protect against. That said the Apple/Google app stores are also full of scams where people lose a lot of real money:
"Apple and Google are WELL past due for regulation in this space."
There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores and external payment methods. It also prevents Apple from playing anti-competitive games with App Store rules, like banning hyperlinks within apps that could be used to allow the user to make a payment elsewhere.
The current US government won't do anything to follow suit, but hopefully a future one might.
There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores
So does that mean:
1. People in the EU can continue to use F-Droid etc. exactly as they have in the past, permanently? No Google verification of developers needed?
2. People are free to install apps from any APK they choose?
The US government acts here in favour of a monopoly market. Trump violates free market principles; quite interesting how Trump works against core capitalistic means, in favour of personal corruption.
Not sure how it works behind the scene, but our app (present on the store since 2018) is taking a couple hours at best with Google, and usually less than 24h with Apple.
Very much likely an automated triage based on code change or complexity.
You shouldn't have shipped that bug in the first place, I would say. If the bug comes from an Android update, I assume that developers have had access to betas long before the system update is rolled out.
For all the complaining about Apple's store, the Play Store has always been worse imo. You can't even release an app without first doing a beta test with at least a dozen people.
You can't even release an app without first doing a beta test with at least a dozen people.
Perhaps I'm misunderstanding what you are saying here but less than a month ago I released a brand new app with no beta period, direct to production (white labeled app, which is why I didn't need a beta)
Same happened to me yesterday, I published a new app and it was reviewed and published within a few hours without any beta testing. but I think this is why I see people ready to buy old playstore accounts for real money, maybe this only affects new accounts
I'm just working on my first app (thanks to AI...) and if you have a new dev account created sometime after 2023 they are making you do a 12 person, 14 day beta run before anything else occurs, apparently.
Yeap latest CoMaps update took ~16 days to review (the longest wait for us so far) and two support tickets (submitted first after ~9 days and got "we have expedited it", 5 days later still in review, so submitted one more ticket).
Before that we had a hotfix update (a very small change) and still it took longer than a week and a support ticket (after which it had been approved in a day)...
We push updates for our app pretty frequently and they've been passing review in an average time of 1 hour (around 7 updates in the last 60 days). Hope it stays that way.
Apple's App Review has also been slipping over the past few months. I have multiple apps that have taken days, up to a week to be approved.
What's most galling is that if you use CapacitorJS or similar you can ship app updates instantly to your users but if you write native first-class OS citizen apps you are penalized.
There is nothing quite so annoying as having a fix for a bug people are running into and have zero control over when it will get out to them.
In the last month, I had to go through the review process twice, and twice I needed to contact them personally after waiting for 1 week of waiting. It did however helped, after every human contact I was reviewed within a few hours.
I got this explanation from them...
We are currently experiencing a higher-than-normal amount of inquiries and have been unable to respond in the time frame that we would prefer. During these periods of high volume, the app review time will take longer than average, and we cannot currently provide a concrete timeline for when your specific app(s) will be finished with the process
I've had same experience. Brand new iOS apps are taking weeks. My latest all took 3 weeks to get reviewed and approved. Updates to existing apps are fast though (1-2 days).
Also, sometimes, apps will go in review and then just stay in that state for 3-4 days before approval. No idea why.
Everyone that ingests code is seeing an order of magnitude more of it thanks to LLMs, even existing apps are producing more updates. It's the same sort of thing github keeps failing to keep up with.
Strong argument in favor of web vs native apps. If you need bluetooth on iOS checkout the web bluetooth iOS safari extension i've been working on recently: https://beacio.com
Yes, a truly Open Web is the solution that we need. It already works everywhere with a single codebase, and is more secure and private than native apps.
But Apple prevents that by forcing all browsers to use terrible WebKit on iOS.
With Signal, the biggest issue we have is that review times are extremely inconsistent. Sometimes it's 4 hours, sometimes it's 5 days, and there's no visibility as to why. Our working theory is that there's automated and manual queues, and occasionally, for whatever reason, we fall into the manual queue. But when you work on an app that has weekly updates, randomly getting hit with a review time of several days really throws off your groove. And it can obviously be terrible for moments where you're fixing a critical issue.
Has it ever happened where your submission goes to review and then just sits in the "In Review" state for many days? I am talking 4-5 days? or sometimes longer than a week? And then it gets approved?
I hope someone will sue the ever-loving shit out of Apple when their foot dragging prevents a critical update from going out in time to prevent a 0-day from being widely exploited.
I'm partly to blame. I accidentally ran an illegal unregulated money transference service over Google Play.
It let users cash out their Google Play Credits for real cash, which I automatically wired them.
Someone then hacked in to a major bookstore chain, stole piles of Google Play Gift cards, activated them using their access, and used my app to get cash for them.
Luckily, the whole thing blew up on me before I got in serious trouble, rightfully so, and the app was removed by Google, then an investigation followed. A ton of copycat apps popped up immediately after, then a few months months later Google announced their app review process.
When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).
It was risky because I didn't actually receive any money from Google until about a month later.
FWIW, this has not been my experience. Google Play usually approves within 24 hours for me still. Apple has been taking over a week though.
When Shopify announced their shift from React Native, this is actually what was on top of mind for me. Week+ delays for critical bugfixes is insane. Being able to patch things with OTA updates is tablestakes at this point.
We should write more web apps, more PWAs and have some sort of a way to distribute those without proprietary app stores. It's true not every mobile app can be a web app, but for a lot of cases web apps work great.
If you know how many get rich quick guru online are teaching people vibes code and submit apps and faceshift to other apps later, you won’t be surprised the App Store model is no longer sustainable.
Maybe I'm just incredibly lucky, but my reviews on Google Play take roughly an hour and appear to be entirely automated. My initial review was about a week, but everything after that has been 1hr. My Apple reviews are still around a day and my initial review was one month. The Google process is painless and is almost as easy as a web deploy, the Apple process feels much less certain that it will go smoothly and Apple actually regularly opens the app even months after release. This is presumably to check for problematic UGC, but feels rather unnerving.
This is one part where it should really just be done by AI for 99% of the cases. Just have a security focused AI model that is biased towards flagging things a bit more conservatively.
Only apps that get flagged by the AI reviewer then have to go through a separate, slower human review process.
I just released a game [1] on both iOS and Android.
The Google Play process is more thorough. There are a lot of steps and you need to clear them one by one. This means waiting several days between each step. The Play Console dashboard is quite well documented to be honest but can be overwhelming. The main obstacle is that you need to find at least 12 testers to play your game for 2 weeks straight. I ended up paying a service to test my app.
On iOS, the process is a bit more obscure. It's fairly easy to submit an app, but then you don't really know what's happening. You can only see a status like "Pending review". And then one day, you are approved.
Overall, the iOS process felt easier for me. As long as your build succeeds and you provide the correct information, your game can be live within a week. The Android process took more than a month in total.
In fact, I'd support Google with this policies if they'd also take full accountability if my phone gets hacked. Do they? No, so it's unfair and a bad authoritarian way to create another walled garden.
I just pulled a PWA app off the app store and I am going to keep it a pure PWA. It's installable, offline-first. I know I feel like I'm swimming against the current but I would love people to try to push for awareness of PWA installs more.
Anecdata: I've pushed out dozens of small code fixes to My PlayHome Plus over the past month and none of them took more than a few hours to be reviewed.
Same happened for CoMaps (which unfortunately does not have 12+ years of presence going for it)
The google review process is the best advertising for f-droid there could ever be.
Longer than an average App Store review (which is heavily criticized for being too long)? Hilarious
I believe the App Store has switched to automated reviews, at least for updates. I've had my app updates approved in <1h on a regular basis starting this summer.
From what I was able to see from the outside, App Store has had semi-automated reviews for updates in basically forever (+ some random spot checks), presumably based on some introspection that only triggers a human review if a new system API was used.
F-Droid's great but their build queue has had multi week waits too, difference is you can see exactly where your build is stuck instead of guessing.
You can also choose to host your own repositories like futo and new pipe do.
Hopefully the process is straight forward so others can easily pick it up.
Part of the value of F-Droid is the curated distribution model that hopefully catches the worst behaving developers that think they have a god given right to your data though.
Now, let's compare with "google friendly" apps: https://www.apkmirror.com/uploads/?appcategory=youtube :)
It took the whole year before v21 was finally approved, so seems only fair they publish minor v21 revisions multiple times a day!
21.37.42-SECONDARY is an interesting version number, don't they like final-final2 in their version numbers?
I just updated 2 dormant apps for the first time in 10 years; It took 2 days, and the apps were approved on a sunday.
The Google Play review process has been slower and more painful than the App Store review process for 5+ years at this point. At least you get to communicate with real people at Apple; it’s all bot-driven with Google.
Huh.
On the flip side, googles release infra provides much more functionality for apps that already has scale. I wish apple were more production oriented too.
AnkiDroid (~17 years old) submitted our latest alpha on Sept 03, 2026, 4:40 am. Still pending review.
thanks for your app! using it for learning danish and finding it very useful.
Team effort, but thank you!! I've just taken the next month and a half off to work on things full time. I'm excited!
The next update won't be huge, (Google required us to make all screens 'edge to edge'[0], which took up most of my time last month). I'm hoping for some solid improvements now that's out the way, once the release pipeline has returned to normal.
Feel free to get in touch if you fancy contributing.
[0] https://developer.android.com/develop/ui/views/layout/edge-t...
If you can get your agent of choice to run up the app in an emulator and navigate the whole thing taking screenshots then tasks like edge-to-edge can be pretty hands off.
The way I did it was to firstly get accessibility identifiers on everything. Then have it record everything I do on an emulator to navigate the entire app. Then left it for a while to work out how to actually use the app via the emulator. Once you have this sort of baseline. A lot of changes are really quite pleasant. I often ask for an HTML gallery of screenshots covering a few device sizes as the step before I bother running it on a device myself.
We use Roborazzi[0], which is an excellent screenshot library, but:
* We target minSdk 24
* We're still using XML views
* We target a large variety of form factors
* We have a lot of screens, and these have a lot of configuration options.
I really wish it was "point an agent at it, and walk away", but many screens ended up being hours of iteration with Fable driving my phone/an emulator to produce an acceptable outcome.
Given that my Pixel 9 Pro has system screens which are still broken under edge to edge, it's not an easy change, and takes up time which could have been going towards feature development.
[0] https://github.com/takahirom/roborazzi/
Gotta love that Google enforces rules on developers that it won’t even enforce on itself. Such a great look.
Thank you for Ankidroid!
You guys are awesome, thank you.
This isn't my experience. My updates usually get accepted within hours. Apple takes days usually.
For new accounts yes, for older accounts it's much faster in my experience.
Apple has it's own issues, they often just answer with a random question so they can kick the review down the line. "Are you sure this is your pricing?" "Can you confifrm you have not selected that country" and then you have to wait another 2 days.
TFA is a post from an established developer and showing a screenshot for the submission of an update to a longstanding app (Conversations XMPP chat client).
Some reviews are clearly automated, some get a light human review, and some involve a human really looking hard. New apps seem to get a more rigorous human review for their first 2-4 submissions. Or at least humans looking over automated test screenshots etc. One reviewer apparently only looked at screenshots because they missed something that would be blindingly obvious on the prior screen if they did it themselves.
The explosion in LLM app development has clearly created a bottleneck at the human review steps. Not only delays but much more “dumb” rejections from likely over-stressed humans.
MAYBE operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all. Apple and Google are WELL past due for regulation in this space. The fact that we cannot download and install software from the internet onto our phones JUST like we can do with our computers is a symbol of our inept and ineffective politicians.
And before someone says "well akshully you can technically do it on Android," Google has been working tirelessly to make it as onerous as possible for both developers and customers. For example, users need to separately authorise each app (browser, files manager, alternative store, etc) to install an APK from outside the Play Store. Google also does background scans using "Play Protect" which will periodically delete apps Google doesn't approve of. This happened to me with SmartTubeNext. I have a dozen other ways Google ensures users are discouraged from stepping outside the Play Store.
And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?
I'm not saying we have the perfect system but anything that slants the system towards "easier downloads" or "less gatekeeping" brings large, obvious risks. I don't see how regulation would address them.
How would a reviewer catch that?
Regulation is already addressing that. I encourage you to read up on the Cyber Resilience Act.
How about treating people like adults for a start? How about starting public awareness campaigns about proper digital hygiene. Not everything has to be nanny state garbage.
Many of us have routinely cleaned computers from adults that installed several Ask Jeeves and Yahoo toolbars.
At some point computers need to stop being treated as magical boxes that no reasonable person can learn how to use safely. We expect people who use cars to learn how to use them safely, we expect people who use lawnmowers to not stick their fingers in them. Computers have been a part of daily life for normies for decades at this point, it's infantilizing to suggest that average, non-tech savvy people can't learn to use (not necessarily build, repair, etc.) them properly and need to be protected from them.
People have to successfully get through a state exam in order to drive cars in first place, can be jailed, get fined when not driving them safely, or forbidden for life to ever drive again.
People that accidentality cut their fingers in lawnmowers due to lack of safety features are allowed to sue the lawnmower company.
What I would agree is that it is about time computing gets the same liability laws that the rest of the world already has in place and no EULAs that work around local laws should be considered valid in any form or shape.
Do you hate open source and want only projects where their authors can afford liability insurance and are willing to put themselves in the firing line of a legal system that can be both arbitrary and capricious? Because that’s what you seem to want.
Anyone is allowed to sue the lawnmower company. Did they win?
On power tools, appliances, etc. the safety features are usually at the user's latitude to bypass. They are usually a hint (don't microwave your dog), not a hard barrier ("I'm sorry, Dave. I'm afraid I can't do that"). A spinning blade is covered by a grill you can trivially remove without needing to contact the manufacturer to allow it.
I agree that the defaults should be secure, but you can't force security on people without creating parallel issues which are maybe worse. Centralizing this power in a single point can have orders of magnitude bigger blast radius than a security failure on an app.
At some point users have to take responsibility and be accountable for their actions. We can't just infantilize them forever as if a magical hand will always be over them protecting and having their best interest in mind. And we certainly shouldn't punish every user for the sake of some of them.
Well, computers first stop being magical machines that no person can learn how to use safely, then.
And, honestly, if you think the endpoint safety problem doesn't apply to you, you are part of the problem.
Using a computer wrong doesn't kill people.
Yes and no.
The computer itself won't really do anything. But I'm sure suicides go up when people lose all their money, or get personal private details leaked, and so on.
Depends on what those computers are responsible for.
ehm: https://en.wikipedia.org/wiki/Therac-25
20 years of being tech support for countless family members and acquaintances says that nothing can possibly make people care about "digital hygiene". An iPad, Chromebook, or similar inflexible device is perfect for most people, and marketing more flexible devices to them has been a mistake since the beginning.
I don't know. Literally every single person I help with tech support makes me doubt this is possible. People do not care in the slightest and treat suggestions to learn basic digital hygiene as if you've asked them to a computer science degree in its entirety.
Even super basic stuff like remembering a single secure password instead of reusing the same 2 or 3 basic initials-dob-symbol permutations that were probably pwned 10 years ago seems insurmountable.
We could force Google to operate its app review service independently. Users could use it and pay for it, or alternatives. Currently Google forces everyone to use their own mediocre service and pay for it without knowing exactly where and how much you pay.
And what do windows / linux / macos do about apps getting hacked to billions of pc's simultaneously? How is that a new problem?
If libraries didn't exist could not be created today. People tend to say that "it is impossible" when it actually only needs to be well organized.
Splitting git tech-monopolies it is a survival need. Or we do it, or we will end up with a collapsed society. Entities that spy on all citizens and gatekeep access to news and services are contrary to basic human rights and democracy.
I wonder if people would be happy replacing the "Google approves developers" system with a "government requires your ID and address on file so you can be held liable for your apps" system. I suspect not.
What for? Malicious actors have no shortage of stolen identities.
That is already a requirement in any civilized country. You cannot run a business without a registered ID, address, etc. for tax purposes.
For free (like for real no microtransactions) that is different. For the rest, they already have that.
It's virtually the case, google and apple accounts require ID verification, which in turn can be requested by the gov in case of an investigation.
If you don't agree with a decision made by your government, you can vote for someone else next time. If you don't agree with a decision made by Google, what do you do?
The people I vote for never win. Am I really any more empowered with the government than I am with Google? At least with Google I can de-google my life (with some significant losses of convenience, but it is doable)
Personally, I find it easier to live with a decision I don't support if I was simply out-numbered in a fair vote, rather than out-powered by some random company on some random continent.
As for doing without Google, I'm kinda doing that myself (using a Linux phone even). But tbh, I think that nowadays moving to another country to escape a government you fundamentally disagree with is easier than moving away from Google.
The only part that would really be novel is the liability.
I would be shocked if you could publish an iOS app without Apple being able to tell the government who you are. Less because Apple cares and more because Apple requires you to pay, which is very hard to do anonymously for something like this (I’d bet the options they offer are effectively “credit card only”).
That's a tangential issue.
1. don't force auto-updates
2. still review apps uploaded to Google Play, but don't force users to use Google Play
If the concern is what if users use an alternate source for apps and those have viruses, then.... okay. If the user wants to stay with strictly Google-vetted apps, they can. If desired, you could have an option on setup that users could choose to select that would put the device in a restricted mode that can only use apps installed from Google Play.
But the motivation here isn't just security, it's control. Google doesn't want anyone to have an Android device that is independent of Google services.
So this doesn't solve the issue pointed in the OP.
I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.
Yes it does. This is their point:
It should be as easy for me to use an alternate storefront - or download directly from a site - straight to my phone. The googleplay store, which is (somewhat) curated and (generally) "safer" can also exist. I, as a user, get to decide which path I want to take. This is literally no different from my desktop and laptop, we already live this life. MacOS allows me to download .dmg files and install (though they are admittedly getting increasingly annoying/friction-y about it) at my own risk. Why should my phone be any different? It’s a small computer. That’s it.
It’s about user choice. It’s my hardware, so I can do with it what I want so long as I’m not using it to inflict harm on others.
People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes.
Clearly we need to regulate the kitchen knife industry more. There should be a central authority that sells authorized kitchen knives with at max 6cm length and all other knives should only be available to certified chefs.
Once we have outlawed the longer knives and strong restrictions on ordinary kitchen tools become normal we should just outlaw knives altogether. You can still hurt yourself with a short knife. Only chefs should ever be allowed to own such a dangerous tool. Just buy or order readily prepared food. Why would you do this weird nerd thing called cooking anyway? Just choose from the official list of allowed foods.
The idea that we have to prevent people from being in control of their own computers — that's what a smartphone is — is deeply dystopian and authoritarian.
How about the same thing we do when companies leak half-the-nation's personal data twice a month. Nothing.
When companies get hacked and millions lose their personal data, nobody cares. When individuals get hacked, it's a major issue that justifies locking down consumer's hardware to protect them from the burden of controlling their own devices. See how that works?
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
Security at its core comes down to trusting the supply chain that provides the software that runs on your hardware. There are many alternative secure supply chain models, but ultimately users often are incapable of making great choices on what is trustworthy. It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.
Comparing phones to PCs isn't a great comparison because PCs don't have a great track record and the amount of personal data and ease of installing lots of apps is quite different. Of course the current arrangement is far from perfect, but acknowledging the problems it's trying to solve is an important step towards trying to find a solution that is better.
I'm not sure how much manual review in these stores is for security rather than content and enforcement of business rules.
I imagine nearly all the security review is automated scans, and not the source of the delays.
this position of privilege is what the OS vendor (google in this case) wants, because it spells profit.
I dont trust it.
The only trust i have is community trust. Piracy works on this trust, and it has worked for very long.
Hard to find better solutions when we have no agency to enact them. The “arrangement” was one-sided from the start.
Nintendo, Playstation, XBox,...
… should also be open, but that’s irrelevant to the discussion.
It is quite relevant as computing systems.
And yes, they also have apps besides games on their stores, and support external keyboards and mices.
Sorry, I think I misunderstood your argument as whataboutism.
Your complaint about Android .apk install is... similar to unsigned software installs on Windows in some cases (not a great argument, I know, but the same as the vast majority of users would be used to).
As for SmartTube, their keys were compromised. Inconvenient, but it wasn't about hostility to self-installed applications.
For the former there is: https://github.com/privacyguides/verified-apps-android
Key compromise sucks and is hard to protect against. That said the Apple/Google app stores are also full of scams where people lose a lot of real money:
https://www.macrumors.com/2026/07/27/apple-app-store-fake-bi...
The main difference is that signing a Windows binary doesn't require any third party review of the app content.
Signing an APK also doesn't require third party review of the app content.
But the context of this discussion is the difficulty of installing an APK from outside the Play Store.
There is major regulation in place already. EU's Digital Markets Act forces these OS gatekeepers to allow alternative app stores and external payment methods. It also prevents Apple from playing anti-competitive games with App Store rules, like banning hyperlinks within apps that could be used to allow the user to make a payment elsewhere.
The current US government won't do anything to follow suit, but hopefully a future one might.
So does that mean:
1. People in the EU can continue to use F-Droid etc. exactly as they have in the past, permanently? No Google verification of developers needed? 2. People are free to install apps from any APK they choose?
Yea, but apple and google keep finding out loopholes and unfaithful compliance, it is time for EU to have some backbone.
The US government acts here in favour of a monopoly market. Trump violates free market principles; quite interesting how Trump works against core capitalistic means, in favour of personal corruption.
yeah my 'promptly AI' alarm clock almost always spends 7 days, as soon as the binary changes, even descriptions changes take several days
Sounds like a clear "find another store" message to me.
I've noticed this
Google Play is regularly slower now than App Store Connect, which never used to be the case
Not sure how it works behind the scene, but our app (present on the store since 2018) is taking a couple hours at best with Google, and usually less than 24h with Apple.
Very much likely an automated triage based on code change or complexity.
A public FTP server is next app store.
Why can't you wait for a week? That doesn't sound like a long time.
For a critical bug fix, a week can be a very long time.
with ai agents and everything even hours can be a long time. I think google playstore should be responsible for all the damages...
For apps with a scale, it's a long time
Because? People wait far longer for much more important things in real life.
Speed is money. Yes people wait for 9 months for having a baby, doesn't mean you should wait 9 months for an app release. That is not a sound logic.
Yes, but one week to wait for your app is nothing to complain about.
Sometime there are 0 days etc.. So, maybe you should have broader view on things instead of simple assumption.
let's say you have a bug that makes your app unusable. If you can't get an update our for a week - people are going to just stop using your app.
You shouldn't have shipped that bug in the first place, I would say. If the bug comes from an Android update, I assume that developers have had access to betas long before the system update is rolled out.
You should want higher speed and quality of service from your vendors. In this case, apple is paid wonderfully for it.
For all the complaining about Apple's store, the Play Store has always been worse imo. You can't even release an app without first doing a beta test with at least a dozen people.
Perhaps I'm misunderstanding what you are saying here but less than a month ago I released a brand new app with no beta period, direct to production (white labeled app, which is why I didn't need a beta)
Same happened to me yesterday, I published a new app and it was reviewed and published within a few hours without any beta testing. but I think this is why I see people ready to buy old playstore accounts for real money, maybe this only affects new accounts
I'm just working on my first app (thanks to AI...) and if you have a new dev account created sometime after 2023 they are making you do a 12 person, 14 day beta run before anything else occurs, apparently.
As an individual that 'dozen people beta test' is required. It's not required if you're a business. Also depends on when your account was created.
https://support.google.com/googleplay/android-developer/answ...
Our app includes Android Auto, which I think is what causes it for us. Submitted 4 Sept, still in review.
Was only 48-72 hours until this year, where it randomly jumped to 2 weeks or longer like it still is.
It's really frustrating, and makes it very difficult to develop with, let alone reliably release features across platforms.
Yeap latest CoMaps update took ~16 days to review (the longest wait for us so far) and two support tickets (submitted first after ~9 days and got "we have expedited it", 5 days later still in review, so submitted one more ticket).
Before that we had a hotfix update (a very small change) and still it took longer than a week and a support ticket (after which it had been approved in a day)...
I think inconsistency is really annoying. Hard to rely on it. Most of our reviews clear with a couple hours, but sometimes it gets stuck for days.
This is why goverments have appeal processes and layers of tribunals. To be judged and found guilty by a corporation takes away all your rights.
We push updates for our app pretty frequently and they've been passing review in an average time of 1 hour (around 7 updates in the last 60 days). Hope it stays that way.
Apple's App Review has also been slipping over the past few months. I have multiple apps that have taken days, up to a week to be approved.
What's most galling is that if you use CapacitorJS or similar you can ship app updates instantly to your users but if you write native first-class OS citizen apps you are penalized.
There is nothing quite so annoying as having a fix for a bug people are running into and have zero control over when it will get out to them.
You would think that with the AGI that these companies are hyping the review happens in minutes. Weird.
Guess both are excused for not having up to the par approaches available.
By the way, the same is happening for the Apple Store.
Their review process is advocated as usually within 24 hours (and heavily advertised by Apple as such, see https://developer.apple.com/distribute/app-review/) and it is taking now much longer.
In the last month, I had to go through the review process twice, and twice I needed to contact them personally after waiting for 1 week of waiting. It did however helped, after every human contact I was reviewed within a few hours.
I got this explanation from them...
I'm guessing, AI slots invading the store.
I've had same experience. Brand new iOS apps are taking weeks. My latest all took 3 weeks to get reviewed and approved. Updates to existing apps are fast though (1-2 days).
Also, sometimes, apps will go in review and then just stay in that state for 3-4 days before approval. No idea why.
theres's hordes of sloppycats in every vertical. Check out how many birding apps have come out in the last 12 months for example
I know this is quite the controversial idea. But I'd personally love a fee per app, just to counter spam, say 100usd/app.
Everyone that ingests code is seeing an order of magnitude more of it thanks to LLMs, even existing apps are producing more updates. It's the same sort of thing github keeps failing to keep up with.
Strong argument in favor of web vs native apps. If you need bluetooth on iOS checkout the web bluetooth iOS safari extension i've been working on recently: https://beacio.com
Yes, a truly Open Web is the solution that we need. It already works everywhere with a single codebase, and is more secure and private than native apps. But Apple prevents that by forcing all browsers to use terrible WebKit on iOS.
Endless more information on all of this at
https://infrequently.org/series/browser-choice-must-matter/
https://open-web-advocacy.org
With Signal, the biggest issue we have is that review times are extremely inconsistent. Sometimes it's 4 hours, sometimes it's 5 days, and there's no visibility as to why. Our working theory is that there's automated and manual queues, and occasionally, for whatever reason, we fall into the manual queue. But when you work on an app that has weekly updates, randomly getting hit with a review time of several days really throws off your groove. And it can obviously be terrible for moments where you're fixing a critical issue.
Thank you for Signal <3
Has it ever happened where your submission goes to review and then just sits in the "In Review" state for many days? I am talking 4-5 days? or sometimes longer than a week? And then it gets approved?
That's been happening randomly to me.
I hope someone will sue the ever-loving shit out of Apple when their foot dragging prevents a critical update from going out in time to prevent a 0-day from being widely exploited.
I wonder if there is a hidden step where they have to ask permission to fix 0-days, in case they are still useful to intelligence agencies.
I can imagine Apple probably has an automated review of a diff, and probably makes a manual review anytime a system API call changes
I'm partly to blame. I accidentally ran an illegal unregulated money transference service over Google Play.
It let users cash out their Google Play Credits for real cash, which I automatically wired them.
Someone then hacked in to a major bookstore chain, stole piles of Google Play Gift cards, activated them using their access, and used my app to get cash for them.
Luckily, the whole thing blew up on me before I got in serious trouble, rightfully so, and the app was removed by Google, then an investigation followed. A ton of copycat apps popped up immediately after, then a few months months later Google announced their app review process.
I love how casually you're dropping this incredible piece of internet lore as if somebody asked you how's the weather.
Haha. I used to have some blog posts detailing things a bit more, but I let it die when Heroku cancelled their original free tier years ago.
If you're inspired to rehash it here or another blog you'll have at least this additional reader.
What did you do with all the Google Play Credits?
When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).
It was risky because I didn't actually receive any money from Google until about a month later.
A week-plus review queue basically kills any chance of a quick hotfix for a free app.
Our app rarely takes longer than a day, but it doesn't have Android Auto support so maybe that's the difference?
Yea I noticed that as well. Even longer than Apple's.
FYI Samsung's is even worse.. 6-8 weeks. Hope you get it right the first time you submit your app.
I submitted Signage Sync (https://signagesync.app) last year, still on my third review. Fingers crossed:)
That's quick. The Slack App review takes 10+ weeks.
I haven't pushed an update since June, but this has not been my recent experience...
I'm not familiar with this space (new to Android), could someone explain why there hasn't been additional "app stores" appear that people can use?
There have been, but most non-technical users don't care or don't go through the hassle of using them.
Is there any that I should be looking into?
F-droid is the biggest one
Check out droidify or neo store for a better front end to f-droid
Why do people still want to make Google more powerful? I don't get it. Legislation must allow for break up of monopolies such as google play.
Sometimes several weeks in my recent submissions.
IMO/IME (as former mobile developer) mobile app development is obliterated.
This is fight for big dogs now.
FWIW, this has not been my experience. Google Play usually approves within 24 hours for me still. Apple has been taking over a week though.
When Shopify announced their shift from React Native, this is actually what was on top of mind for me. Week+ delays for critical bugfixes is insane. Being able to patch things with OTA updates is tablestakes at this point.
Interestingly, I published a completely new app yesterday, and it was reviewed and published in less than 2 hours.
We should write more web apps, more PWAs and have some sort of a way to distribute those without proprietary app stores. It's true not every mobile app can be a web app, but for a lot of cases web apps work great.
If you know how many get rich quick guru online are teaching people vibes code and submit apps and faceshift to other apps later, you won’t be surprised the App Store model is no longer sustainable.
Maybe I'm just incredibly lucky, but my reviews on Google Play take roughly an hour and appear to be entirely automated. My initial review was about a week, but everything after that has been 1hr. My Apple reviews are still around a day and my initial review was one month. The Google process is painless and is almost as easy as a web deploy, the Apple process feels much less certain that it will go smoothly and Apple actually regularly opens the app even months after release. This is presumably to check for problematic UGC, but feels rather unnerving.
This is one part where it should really just be done by AI for 99% of the cases. Just have a security focused AI model that is biased towards flagging things a bit more conservatively.
Only apps that get flagged by the AI reviewer then have to go through a separate, slower human review process.
I just released a game [1] on both iOS and Android.
The Google Play process is more thorough. There are a lot of steps and you need to clear them one by one. This means waiting several days between each step. The Play Console dashboard is quite well documented to be honest but can be overwhelming. The main obstacle is that you need to find at least 12 testers to play your game for 2 weeks straight. I ended up paying a service to test my app.
On iOS, the process is a bit more obscure. It's fairly easy to submit an app, but then you don't really know what's happening. You can only see a status like "Pending review". And then one day, you are approved.
Overall, the iOS process felt easier for me. As long as your build succeeds and you provide the correct information, your game can be live within a week. The Android process took more than a month in total.
[1] https://jgthms.com/hopera/
This will only change once a new player rises. We live in a world full of blind consumers that won't look out of the Google and Apple walled gardens.
In fact, I'd support Google with this policies if they'd also take full accountability if my phone gets hacked. Do they? No, so it's unfair and a bad authoritarian way to create another walled garden.
I just pulled a PWA app off the app store and I am going to keep it a pure PWA. It's installable, offline-first. I know I feel like I'm swimming against the current but I would love people to try to push for awareness of PWA installs more.
Anecdata: I've pushed out dozens of small code fixes to My PlayHome Plus over the past month and none of them took more than a few hours to be reviewed.
Can confirm. Took about 8 days for my last app update, and about 5 or 6 for the Play Store listing update.
As someone new to the app publishing world I am surprised at how strict the requirements are, given the absolute dross you can find published.