Same happened for CoMaps (which unfortunately does not have 12+ years of presence going for it)

I have three apps on the Play Store, they all take a couple hours to pass review and their auto-testing/review systems often catch little bugs I didn't almost immediately.

Getting a new app on the store is a bit cumbersome, but it should be.

From what I was able to see from the outside, App Store has had semi-automated reviews for updates in basically forever (+ some random spot checks), presumably based on some introspection that only triggers a human review if a new system API was used.

Hopefully the process is straight forward so others can easily pick it up.

Part of the value of F-Droid is the curated distribution model that hopefully catches the worst behaving developers that think they have a god given right to your data though.

It took the whole year before v21 was finally approved, so seems only fair they publish minor v21 revisions multiple times a day!

21.37.42-SECONDARY is an interesting version number, don't they like final-final2 in their version numbers?

I just updated 2 dormant apps for the first time in 10 years; It took 2 days, and the apps were approved on a sunday.

What are bots doing for two weeks

Huh.

On the flip side, googles release infra provides much more functionality for apps that already has scale. I wish apple were more production oriented too.

Gotta love that Google enforces rules on developers that it won’t even enforce on itself. Such a great look.

Thank you for Ankidroid!

You guys are awesome, thank you.

This isn't my experience. My updates usually get accepted within hours. Apple takes days usually.

TFA is a post from an established developer and showing a screenshot for the submission of an update to a longstanding app (Conversations XMPP chat client).

Some reviews are clearly automated, some get a light human review, and some involve a human really looking hard. New apps seem to get a more rigorous human review for their first 2-4 submissions. Or at least humans looking over automated test screenshots etc. One reviewer apparently only looked at screenshots because they missed something that would be blindingly obvious on the prior screen if they did it themselves.

The explosion in LLM app development has clearly created a bottleneck at the human review steps. Not only delays but much more “dumb” rejections from likely over-stressed humans.

How would a reviewer catch that?

Regulation is already addressing that. I encourage you to read up on the Cyber Resilience Act.

The amount of "Do not put hands here" labels I've seen on lawnmowers would suggest that, yes, someone did sue and win (or at the least got a settlement) and thus the lawyers forced the companies to put disclaimers and warnings on the lawnmower, directly on the top of the deck in plain sight.

Yes, and when they fail to do so, there are laws in place for liability of third party, or when their own irresponsible actions affects others.

Well, computers first stop being magical machines that no person can learn how to use safely, then.

And, honestly, if you think the endpoint safety problem doesn't apply to you, you are part of the problem.

Yes and no.

The computer itself won't really do anything. But I'm sure suicides go up when people lose all their money, or get personal private details leaked, and so on.

Depends on what those computers are responsible for.

"One [software fault] was when the operator incorrectly selected X-ray mode then in 8 seconds quickly changing to electron mode, which allowed the electron beam to be set for X-ray mode without the X-ray target being in place"

Therac-25 is an important software-development case study but a torturous stretch of "Using a computer wrong"

I'm sure you can think of many examples where it does though.

More a problem of those stores still not being properly validated rather a dumping ground for extensions, than anything else.

does not help

Is that true - do you not see significantly fewer of those installs on random PCs now than you did years ago? And that's even with the current situation not being what I'd call fully locked down.

20 years of being tech support for countless family members and acquaintances says that nothing can possibly make people care about "digital hygiene". An iPad, Chromebook, or similar inflexible device is perfect for most people, and marketing more flexible devices to them has been a mistake since the beginning.

Maybe a drivers license should be needed to have a phone.

Well cars kill people, granny using the password “password” does not. We can’t prevent all levels of stupidity and carelessness.

If people want to have dumb passwords and download malware, then so be it. You think they can’t do that today with the google play store? Of course they can. Most malware on android comes from the Google play store.

I agree, but what I disagree with is the idea that everyone must be prevented from freely installing software on their own devices to make sure unskilled people cannot be tricked into doing it.

I don't really understand why a well designed sandbox and permissions system doesn't solve the problem.

A shocking number of people have passwords like "shovel"

You expect people to treat devices with respect and responsibility? The VAST majority of people use their phones to stream an infinite sequence of clickbait, ai slop, and conspiracies for 6 to 8 hours a day.

I've worked with dozens of businesses over the years and you can't even get businesses with real money and consequences on the line to follow basic security practices. My current project is updating dozens of windows domain controllers that are still on 2012 R2. Aka critical infrastructure that hasn't been getting updates for years.

We could force Google to operate its app review service independently. Users could use it and pay for it, or alternatives. Currently Google forces everyone to use their own mediocre service and pay for it without knowing exactly where and how much you pay.

If libraries didn't exist could not be created today. People tend to say that "it is impossible" when it actually only needs to be well organized.

Splitting git tech-monopolies it is a survival need. Or we do it, or we will end up with a collapsed society. Entities that spy on all citizens and gatekeep access to news and services are contrary to basic human rights and democracy.

macos

MacOS has been moving to a more locked down model over the years - increasingly difficult to install unsigned applications, SIP, etc.

Windows

I think Windows is incredibly impressive for its ability to run binaries from many years ago, but I don't think there's much people would point to as a positive regarding Windows’ approach to app security.

What for? Malicious actors have no shortage of stolen identities.

That is already a requirement in any civilized country. You cannot run a business without a registered ID, address, etc. for tax purposes.

For free (like for real no microtransactions) that is different. For the rest, they already have that.

It's virtually the case, google and apple accounts require ID verification, which in turn can be requested by the gov in case of an investigation.

Personally, I find it easier to live with a decision I don't support if I was simply out-numbered in a fair vote, rather than out-powered by some random company on some random continent.

As for doing without Google, I'm kinda doing that myself (using a Linux phone even). But tbh, I think that nowadays moving to another country to escape a government you fundamentally disagree with is easier than moving away from Google.

You probably have some sort of legal rights and ability to challenge decisions made by your government.

If you're banned from Google? Good luck, you're fucked.

The only part that would really be novel is the liability.

I would be shocked if you could publish an iOS app without Apple being able to tell the government who you are. Less because Apple cares and more because Apple requires you to pay, which is very hard to do anonymously for something like this (I’d bet the options they offer are effectively “credit card only”).

Agree, what I'm saying is "it is mine and we should treat it as mine, same as my laptop/desktop." We both agree the current status quo is not that, I'm saying what it should be.

I'm sure everyone would love non-technical people to stay behind dozens of security patches for apps they may use everyday because they forgot to press update.

this is identifying the tension yeah, but if a review process regularly takes weeks or months, then the security patches are still missing

People accidentally hurt themselves with kitchen knives every day. They are also very often used for violent crimes

People are rightfully nervous when they see someone walking down the street swinging a knife i.e openly misusing it or treating it casually

People don't realize how much software is being misused or treated too casually. They might be similarly bothered by lax security on databases and data leaks if they realized that it represented a threat to them

How about the same thing we do when companies leak half-the-nation's personal data twice a month. Nothing.

When companies get hacked and millions lose their personal data, nobody cares. When individuals get hacked, it's a major issue that justifies locking down consumer's hardware to protect them from the burden of controlling their own devices. See how that works?

And what should we do about apps' getting hacked, sending out malicious updates that get auto-updated and thereby infecting tens of millions or billions of phones simultaneously?

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

I didn’t write the previous comment, but I think the point here is that there is a long-running trend aiming to protect users both from malicious intent and to a certain extent from themselves. In the past, viruses had it easy to infect and spread computers because of both inattentive users clicking on mails claiming someone loved them, and the default access mode for any user granting them admin access.

Even though review processeses generally do not exist for computers, they are part of that same trend.

And outside stores we have Windows’ UAC and Mac’s annoying-but-understandable “this dmg is sus” dialogues. Granted they are review processes but they’re often what keeps common users from wrecking their devices.

I believe people in HN also remember the days before we had MMUs.

And I'm sure everyone remembers ransomware.

No one is saying OS shouldn't have security measures, permissions/entitlements and app sandboxing, user land, etc.

I still don't understand why my desktop/laptop is allowed to be 'owned' by me. but my iPhone is a closed-gardened where I'm just a guest in a device I own. and that's nearly what Google is now doing.

Sandbox, ACL, scan, sign, revoke bad actors.

We should have web installs by now. The only reason we don't is because Google and Apple like cash and their little monopolies are easy money.

Big tech loves to "protect us". See Anthropic and OpenAI worried about intelligence.

Google doesn't care that its AdSense ads marketplace is flooded with malware. Or that YouTube is rife with scams. Wonder why not. The blatant policy contradiction couldn't be because money, right?

We already had enough proof of vulnerabilities in the OS code and Manufacturers (eg. Samsung/Lenovo/etc privileged apps)

Vulnerabilities aren't intentional.

reviewed apps that were used for fraud or access as bad actors

The App Developer Verification program, Android Advanced Protection Mode, and Play Protect are all systems put in place in response to "bad actors".

Just because something is not perfect that does not mean it's worthless. Most things security things operate this way where it's impossible to stop all malware or attacks.

I'm not sure how much manual review in these stores is for security rather than content and enforcement of business rules.

I imagine nearly all the security review is automated scans, and not the source of the delays.

It does generally make sense that the OS vendor needs to play a key part in helping ensure trusted parties are involved in the supply chain.

this position of privilege is what the OS vendor (google in this case) wants, because it spells profit.

I dont trust it.

The only trust i have is community trust. Piracy works on this trust, and it has worked for very long.

Hard to find better solutions when we have no agency to enact them. The “arrangement” was one-sided from the start.

Sorry, I think I misunderstood your argument as whataboutism.

For the former there is: https://github.com/privacyguides/verified-apps-android

Key compromise sucks and is hard to protect against. That said the Apple/Google app stores are also full of scams where people lose a lot of real money:

https://www.macrumors.com/2026/07/27/apple-app-store-fake-bi...

This is the first time I've seen a complaint about giving permission to an app to install another app. The SmartTubeNext issue was due to the developer's keys being stolen. If you want to keep an app signed with stolen keys, you can disable Play Protect. If Play Protect uninstalled apps that Google disliked instead of apps with known vulnerabilities, people would mass disable Play Protect, which would defeat its purpose.

Yes. Even beyond that, people outside the EU are free to install apps from any APK they choose.

Yea, but apple and google keep finding out loopholes and unfaithful compliance, it is time for EU to have some backbone.

The US government acts here in favour of a monopoly market. Trump violates free market principles; quite interesting how Trump works against core capitalistic means, in favour of personal corruption.

The EU is not interested in liberating phone operating systems because it goes against their digital wallet push which forces everyone to use an attested, Google/Apple sanctioned device and operating system.

Haha, oh the poor mega tech companies?! As if. Google sees a market, it wants to capture it. Same as Apple did.

This case has nothing to do with "gatekeepers". It is about the Play Store, operated by Google.

People still can install/run whatever they like on their PCs, so why further restrictions needed or am I missing something? Also, further restrictions doesn't seem to work on the mobile/TV market where actual malware still infects iOS/Android/TV devices despite all the "hops" that it has too go through.

Code signing with warnings about non-signed apps is enough

operating systems shouldn't have gatekeepers which can deny access to billions of customers for any and no reason at all

This is exactly why I use a GNU/Linux phone that runs a desktop operating system with no artificial restrictions. Debian repositories are good enough to save me from malware, aren't they?

I am on an Android 10 system... gate keeping wasn't this bad during the Android 10 times...so i fairly use software stores like f-droid... simpmusic is one app I use frequently from f droid....no application so far has been deleted automatically. I guess Google has been upping the gatekeeping with newer systems as they come out

yeah my 'promptly AI' alarm clock almost always spends 7 days, as soon as the binary changes, even descriptions changes take several days

Sounds like a clear "find another store" message to me.

I've noticed this

Google Play is regularly slower now than App Store Connect, which never used to be the case

Not sure how it works behind the scene, but our app (present on the store since 2018) is taking a couple hours at best with Google, and usually less than 24h with Apple.

Very much likely an automated triage based on code change or complexity.

A public FTP server is next app store.

with ai agents and everything even hours can be a long time. I think google playstore should be responsible for all the damages...

Sometime there are 0 days etc.. So, maybe you should have broader view on things instead of simple assumption.

And you know 100% all the bugs are visible at all times.

Review speed and slopness are related but not exclusive to each other.

Same happened to me yesterday, I published a new app and it was reviewed and published within a few hours without any beta testing. but I think this is why I see people ready to buy old playstore accounts for real money, maybe this only affects new accounts

I'm just working on my first app (thanks to AI...) and if you have a new dev account created sometime after 2023 they are making you do a 12 person, 14 day beta run before anything else occurs, apparently.

As an individual that 'dozen people beta test' is required. It's not required if you're a business. Also depends on when your account was created.

https://support.google.com/googleplay/android-developer/answ...

I suspect the same issue; I added Android Auto to my application on the latest release and the version I pushed on Sept 3th is still under review.

Yeap latest CoMaps update took ~16 days to review (the longest wait for us so far) and two support tickets (submitted first after ~9 days and got "we have expedited it", 5 days later still in review, so submitted one more ticket).

Before that we had a hotfix update (a very small change) and still it took longer than a week and a support ticket (after which it had been approved in a day)...

I generally see my legal system create severe delays

Better a delay that getting your account closed without recourse. But you are right, years of conservative governments have starved the government and its services are slower than they should around the west world.

We push updates for our app pretty frequently and they've been passing review in an average time of 1 hour (around 7 updates in the last 60 days). Hope it stays that way.

Apple's App Review has also been slipping over the past few months. I have multiple apps that have taken days, up to a week to be approved.

What's most galling is that if you use CapacitorJS or similar you can ship app updates instantly to your users but if you write native first-class OS citizen apps you are penalized.

There is nothing quite so annoying as having a fix for a bug people are running into and have zero control over when it will get out to them.

Guess both are excused for not having up to the par approaches available.

I've had same experience. Brand new iOS apps are taking weeks. My latest all took 3 weeks to get reviewed and approved. Updates to existing apps are fast though (1-2 days).

Also, sometimes, apps will go in review and then just stay in that state for 3-4 days before approval. No idea why.

theres's hordes of sloppycats in every vertical. Check out how many birding apps have come out in the last 12 months for example

I'm sure submissions have absolutely skyrocketed with model advancements since the beginning of the year. I'd be curious to see the numbers.

I know Github's commit numbers have been pretty staggering YoY.

I know this is quite the controversial idea. But I'd personally love a fee per app, just to counter spam, say 100usd/app.

Everyone that ingests code is seeing an order of magnitude more of it thanks to LLMs, even existing apps are producing more updates. It's the same sort of thing github keeps failing to keep up with.

True that. Apple has strong economic incentives to nerf PWAs, and I don't share their privacy concerns about web bluetooth. If anything, forcing users who need bluetooth to install shady third-party browsers creates way more risk. Based on beacio's download numbers, quite a few people would rather have web bluetooth available in their default browser.

It is rare that someone voluntarily exposes their lack of insight and integrity so thoroughly... Kudos..?

your argument amounts to "this person is incapable of being objective, let alone decent, because they work at xyz". Moreover, you literally didn't address a single thing presented in either link that i shared - which directly refute your nonsense. Pure ad hominem, and worse.

You are not a serious person if you think that PWA installation is "simple and idiomatic on iOS". It is buried multiple menus, taps, drags etc... deep. Most chromium browsers present a button right in the address bar or at least conspicuously in the main menu. Moreover, they allow developers to ask for the ability to prompt users to install the app.

https://adactio.com/journal/18252

https://adactio.com/journal/22757

Apple forces their employees to debase themselves in order to defend this status quo. eg:

https://github.com/w3ctag/design-reviews/issues/1245

https://github.com/WebKit/standards-positions/issues/619

Take care. And keep that math not mathing!

safari is NOT capable of PWAs... > They deliberately hobble PWAs and make them very difficult to install.

Hit the share button, "Add to Home Screen" is very difficult to install?

The math is correct, see /about for methodology and this summary from the "How Scores Work" panel.

   About PWA Scores:

   • The main score shown is weighted for feature importance
   • Only stable (non-experimental) features are counted
   • Tap or hover any score to see:
      – Raw scores (simple % of supported features)
      – Experimental feature scores

Thank you for Signal <3

Has it ever happened where your submission goes to review and then just sits in the "In Review" state for many days? I am talking 4-5 days? or sometimes longer than a week? And then it gets approved?

That's been happening randomly to me.

I can imagine Apple probably has an automated review of a diff, and probably makes a manual review anytime a system API call changes

If you're inspired to rehash it here or another blog you'll have at least this additional reader.

A domain is only ~$12/year if you don't buy it through a scammy site like godaddy that adds fake fees or quadruples the cost after a year. WordPress is easy for blogs, or you can just vibe code something in an afternoon if you don't care to have comments. Even embedding forms or an emailing tool can be done statically. Heck, there's probably a free option out there for simple posting that I don't know about.

When you "spend" Google Play Credits in an app, Google Play treats those credits the same as if you paid with real money: they took 30% (their take isn't so steep today), I took 10%, and then I sent the user/buyer the remaining 60% directly from my bank account (I used Dwolla back then).

It was risky because I didn't actually receive any money from Google until about a month later.

A week-plus review queue basically kills any chance of a quick hotfix for a free app.

Our app rarely takes longer than a day, but it doesn't have Android Auto support so maybe that's the difference?

Yep, I always expect 2-3 months to get an app onto Samsung TVs and those are just variants of a white-label base which already passed their QA multiple times. LG is even worse for the initial review but they accept redirects to hosted apps so at least there's no need to ever deal with them again after launch.

That's quick. The Slack App review takes 10+ weeks.

I haven't pushed an update since June, but this has not been my recent experience...

I use Foxy Droid.

It's unfortunate the official f-droid client is an unusable mess. (I stopped using it years ago, maybe they fixed it.)

There's also f-droid classic, can't remember why I use foxy droid over it.

The Huawei AppGallery is hundreds of times bigger.

It's coming soon. Android have been pushed to accept third-party app stores.

A new era for choice and openness : https://android-developers.googleblog.com/2026/03/a-new-era-...

Why do people still want to make Google more powerful? I don't get it. Legislation must allow for break up of monopolies such as google play.

Sometimes several weeks in my recent submissions.

IMO/IME (as former mobile developer) mobile app development is obliterated.

This is fight for big dogs now.

FWIW, this has not been my experience. Google Play usually approves within 24 hours for me still. Apple has been taking over a week though.

When Shopify announced their shift from React Native, this is actually what was on top of mind for me. Week+ delays for critical bugfixes is insane. Being able to patch things with OTA updates is tablestakes at this point.

Interestingly, I published a completely new app yesterday, and it was reviewed and published in less than 2 hours.

We should write more web apps, more PWAs and have some sort of a way to distribute those without proprietary app stores. It's true not every mobile app can be a web app, but for a lot of cases web apps work great.

If you know how many get rich quick guru online are teaching people vibes code and submit apps and faceshift to other apps later, you won’t be surprised the App Store model is no longer sustainable.

Maybe I'm just incredibly lucky, but my reviews on Google Play take roughly an hour and appear to be entirely automated. My initial review was about a week, but everything after that has been 1hr. My Apple reviews are still around a day and my initial review was one month. The Google process is painless and is almost as easy as a web deploy, the Apple process feels much less certain that it will go smoothly and Apple actually regularly opens the app even months after release. This is presumably to check for problematic UGC, but feels rather unnerving.

This is one part where it should really just be done by AI for 99% of the cases. Just have a security focused AI model that is biased towards flagging things a bit more conservatively.

Only apps that get flagged by the AI reviewer then have to go through a separate, slower human review process.

Given the sibling reply, I can imagine them claiming national security prevents them from releasing those records. But that’s okay; I am fairly certain we can find enough developers willing to tell their tales.

You can request an expedite review from Apple. We already did this, and our app was up in the next 1-2 hours.

Finding 12 testers was a struggle for my app [1]. Had to use a mix of LinkedIn begging, work colleagues, friends, and people from random Whatsapp groups I was in.

Once you get over that hurdle for your first release, at least you don't have to do it for every update.

The Play Console is a bit fiddly and I'm always getting random warnings that I need to comply with some new rule by an arbitrary date or my app will get delisted.

[1] https://play.google.com/store/apps/details?id=com.gads.hamil...

but can be overwhelming

That's an understatement and a half. It's massively over engineered and complicated, especially when compared with (say) the dashboard on Itch.

This will only change once a new player rises. We live in a world full of blind consumers that won't look out of the Google and Apple walled gardens.

In fact, I'd support Google with this policies if they'd also take full accountability if my phone gets hacked. Do they? No, so it's unfair and a bad authoritarian way to create another walled garden.

I'd love to see people distribute their apks directly.

Itch.io is an option for people who don't want to set up a site or handle payments. While they focus on games, they're cool with distributing non-games:

https://itch.io/blog/32835/itchio-isnt-just-for-games-check-...

I personally have a TrustedWebActivity. Most update doesn't need a review because I only need to update server-side. Behave like a PWA while being an Android App. (And you can implement Android Auto, other native stuff)

It allows the users to discover my web app through the Google Play Store. My app was also available as a PWA but I mostly push the TWA currently.

Anecdata: I've pushed out dozens of small code fixes to My PlayHome Plus over the past month and none of them took more than a few hours to be reviewed.

Can confirm. Took about 8 days for my last app update, and about 5 or 6 for the Play Store listing update.

As someone new to the app publishing world I am surprised at how strict the requirements are, given the absolute dross you can find published.

Meanwhile, the Web is ever more powerful. But now Android and iOS users expect to find things in the App store only.

I just submitted an open source android passive income app [0]. It's been two weeks and I'm still waiting. It's my first app though.

[0]: https://github.com/proxybasehq/proxybase-gui

I think that the app targeting Android Auto should be pointed out. Google Play reviews are mostly automated and it shouldn't take more than a few hours. Android Auto is heavily curated for good reasons.

Thank you! :)

I created a much more basic version of photopea (https://egeozcan.github.io/ketchup/) because I didn't even know it existed. This is very cool and fast!

This is a big part of why React Native (and especially EAS) is still my preferred native development platform. The ability to ship OTA updates directly without depending on platform reviews & rollout schedules is a killer feature I'm not sure I could live without.

AI is becoming part of how people experience the web every day. We want to make sure that doesn’t mean people are chained to one company’s self-serving pipeline.

Ah yes, the extremely diverse offering of OpenAI, Google, Anthropic, Microsoft, and Mistral (a fake "euro" chatbot). Mozilla is truly a "people's" company.

Depends on how trusted account/apps are. I have some old apps that are reviewed in 2-3 hours every time

Making Android apps was my introduction to publishing software. I remember in ~2011-2012 you could upload an APK and it would be published immediately and the Android Market had a "New" page which was just a chronological feed of recently published or updated apps. Just uploading your app update was an easy way to get ~500 free downloads which I found very exciting.

At the time I couldn't imagine paying $99 for an Apple Developer account and waiting a week to publish my app...

not my experience... I have most updates go through in <24h.