FOSS isn’t magic. Reviewing the source code doesn’t guarantee that the version you get matches the code you were provided. You unconditionally should not get any exemptions to store policy because your code is open source. That’s a terrible idea.
Having actual written policies and meeting other criteria are the rules for a reason. If you’re unwilling to follow them, not being on the play store is 100% your fault. It’s not Google being mean.
FOSS isn’t magic. Reviewing the source code doesn’t guarantee that the version you get matches the code you were provided. You unconditionally should not get any exemptions to store policy because your code is open source. That’s a terrible idea.
No one has suggested exemptions. Otherwise you need to quote where you get that idea from. You’re not grasping the fact that code enables criteria to be verified. It therefore needs no exemption.
The terrible idea we are grappling with is the idea to not review source code that is available. If the code does not match the binary, that is Google’s problem. Google is the repository and has the sole responsibility for either ensuring reproducable builds are in play (to the extent that they care) or compiling it themselves. But I doubt Google genuinely cares as the Playstore is proven to have a quite poor quality standard relative to other repositories.
Having actual written policies and meeting other criteria are the rules for a reason.
Those policies are not above criticism. If Google’s policies fail to include code reviews as verification that criteria is satisfied, that’s on Google and they have no expectation of not being condemned for their incompetent policy.
Yes, you are. The issue they’re complaining about is that they’re being held to additional standards because they ask for a sensitive permission. They absolutely should be.
Being FOSS should literally not be considered in any way at any point in the app acceptance process. It’s terrible policy that’s much worse than the policy that you’re complaining about.
The issue they’re complaining about is that they’re being held to additional standards because they ask for a sensitive permission.
That’s not Snikket’s complaint. Snikket naturally satisfies the standards at hand because they do not export address book data, so they have no reason to object to the standards Google is failing to verify. Their complaint is rightfully about Google’s incompetence in evaluating their compliance. It’s clear from Snikket’s account what a shit show it is at Google who failed copious times to evaluate their software.
There’s nothing more terrible in the position of a software repository than the incompetence of neglecting to review code as part of the acceptance process. I can’t think of a more foolish policy than to ignore the code of software for which you are trying to endorse the quality of.
B. Code review takes a very large amount of highly qualified man hours to not work.
Not if a machine does it. And even if they use humans, it takes even more man hours to do the alternative dynamic analysis and traffic analysis. Code review saves countless man hours even if done 100% manually by humans.
C. Requiring review of proprietary code exposes Google to a crazy amount of antitrust and IP liability. Again, to not work.
Not applicable to FOSS code.
Code review doesn’t happen because it’s a laughably stupid idea that has virtually no chance of being beneficial in any way. It’s not an oversight.
Code reviews happen at every organisation I have worked for to catch unwanted code before deployment and testing. The reason we review code before testing is because it’s cheaper to review code than to test it. It’s laughably stupid to think code review doesn’t work only to then to spend more money on verification tests.
An organization reviewing its own code is not the same, or similar in any way, to an organization reviewing a large volume of external code for malicious intent. And it doesn’t work for a wide variety of reasons (including the one I already gave you that binaries don’t provide you any guarantees that they’re from the source). Onboarding is universally slow because new people take weeks to months to actually meaningfully understand big projects.
Again, you’re asking for FOSS code to get some special treatment and bypass the requirements already in place. It’s completely absurd, because every single one of those tests would still be unconditionally mandatory to get any kind of actual confidence in security. Choosing to skip them because someone in India skimmed the code would be way past gross negligence.
An organization reviewing its own code is not the same, or similar in any way, to an organization reviewing a large volume of external code for malicious intent.
This is neither of those cases. This is trivially searching the code for where the address book API is called, and inspecting only the relevant code to that object for a specific usage. If you review the whole volume of code for the entire application, you’re doing it wrong. It’s trivial and for the reasons I’ve already explained, less effort than dynamic analysis and traffic analysis.
And it doesn’t work for a wide variety of reasons (including the one I already gave you that binaries don’t provide you any guarantees that they’re from the source).
And you apparently missed the response because you’ve neglected to address it. It was a defeated claim.
Onboarding is universally slow because new people take weeks to months to actually meaningfully understand big projects.
You’re thinking about hiring heads to work on code they need to understand in depth in order to edit the code. That’s not the case here. Code reviews are much cheaper than onboarding developers.
Again, you’re asking for FOSS code to get some special treatment and bypass the requirements already in place.
Again, no exemption has been requested. Google is either smart enough to make use of info at their disposal, or they are not. (answer: they are not).
It’s completely absurd, because every single one of those tests would still be unconditionally mandatory to get any kind of actual confidence in security.
Only if you do it wrong. A code review gives more confidence about what happens with the address book than testing. Only a fool would needlessly spend money on the more costly and redundant black box approach which yields results (guesswork!) with less confidence¹. Sure you can also do the black box analysis but that’s just wasting money when the bar has already been cleared. You would do both if lives depended on the code, but such standards are far above Google’s standards.
Choosing to skip them because someone in India skimmed the code would be way past gross negligence.
You’re still not getting it. No one advocates for an exemption. You need to get that out of your head. A code review is a way to more cheaply do the verification with higher confidence, not to bypass it.
¹ Hence why Google failed many times to get it right.
“Just searching the code where the address book API is used” most certainly does not give you increased confidence. Obfuscation is not that difficult. You can only possibly gain confidence if you fully understand every single line of code.
I ignored it because it’s idiotic. Google isn’t and shouldn’t be building code for you unless you pay for it.
Not doing literally every single test every other app is required to is an exemption.
One more time: a company having people review specific code for a specific purpose does not in any way resemble an adversarial code review against bad actors. There are no parallels. A code review gives you literally zero confidence that the writer isn’t malicious unless you comprehensively understand every single line. Open source project security is entirely and exclusively reputational.
FOSS isn’t magic. Reviewing the source code doesn’t guarantee that the version you get matches the code you were provided. You unconditionally should not get any exemptions to store policy because your code is open source. That’s a terrible idea.
Having actual written policies and meeting other criteria are the rules for a reason. If you’re unwilling to follow them, not being on the play store is 100% your fault. It’s not Google being mean.
No one has suggested exemptions. Otherwise you need to quote where you get that idea from. You’re not grasping the fact that code enables criteria to be verified. It therefore needs no exemption.
The terrible idea we are grappling with is the idea to not review source code that is available. If the code does not match the binary, that is Google’s problem. Google is the repository and has the sole responsibility for either ensuring reproducable builds are in play (to the extent that they care) or compiling it themselves. But I doubt Google genuinely cares as the Playstore is proven to have a quite poor quality standard relative to other repositories.
Those policies are not above criticism. If Google’s policies fail to include code reviews as verification that criteria is satisfied, that’s on Google and they have no expectation of not being condemned for their incompetent policy.
Yes, you are. The issue they’re complaining about is that they’re being held to additional standards because they ask for a sensitive permission. They absolutely should be.
Being FOSS should literally not be considered in any way at any point in the app acceptance process. It’s terrible policy that’s much worse than the policy that you’re complaining about.
That’s not Snikket’s complaint. Snikket naturally satisfies the standards at hand because they do not export address book data, so they have no reason to object to the standards Google is failing to verify. Their complaint is rightfully about Google’s incompetence in evaluating their compliance. It’s clear from Snikket’s account what a shit show it is at Google who failed copious times to evaluate their software.
There’s nothing more terrible in the position of a software repository than the incompetence of neglecting to review code as part of the acceptance process. I can’t think of a more foolish policy than to ignore the code of software for which you are trying to endorse the quality of.
A. Code review doesn’t work.
B. Code review takes a very large amount of highly qualified man hours to not work.
C. Requiring review of proprietary code exposes Google to a crazy amount of antitrust and IP liability. Again, to not work.
Code review doesn’t happen because it’s a laughably stupid idea that has virtually no chance of being beneficial in any way. It’s not an oversight.
You’re doing it wrong.
Not if a machine does it. And even if they use humans, it takes even more man hours to do the alternative dynamic analysis and traffic analysis. Code review saves countless man hours even if done 100% manually by humans.
Not applicable to FOSS code.
Code reviews happen at every organisation I have worked for to catch unwanted code before deployment and testing. The reason we review code before testing is because it’s cheaper to review code than to test it. It’s laughably stupid to think code review doesn’t work only to then to spend more money on verification tests.
An organization reviewing its own code is not the same, or similar in any way, to an organization reviewing a large volume of external code for malicious intent. And it doesn’t work for a wide variety of reasons (including the one I already gave you that binaries don’t provide you any guarantees that they’re from the source). Onboarding is universally slow because new people take weeks to months to actually meaningfully understand big projects.
Again, you’re asking for FOSS code to get some special treatment and bypass the requirements already in place. It’s completely absurd, because every single one of those tests would still be unconditionally mandatory to get any kind of actual confidence in security. Choosing to skip them because someone in India skimmed the code would be way past gross negligence.
This is neither of those cases. This is trivially searching the code for where the address book API is called, and inspecting only the relevant code to that object for a specific usage. If you review the whole volume of code for the entire application, you’re doing it wrong. It’s trivial and for the reasons I’ve already explained, less effort than dynamic analysis and traffic analysis.
And you apparently missed the response because you’ve neglected to address it. It was a defeated claim.
You’re thinking about hiring heads to work on code they need to understand in depth in order to edit the code. That’s not the case here. Code reviews are much cheaper than onboarding developers.
Again, no exemption has been requested. Google is either smart enough to make use of info at their disposal, or they are not. (answer: they are not).
Only if you do it wrong. A code review gives more confidence about what happens with the address book than testing. Only a fool would needlessly spend money on the more costly and redundant black box approach which yields results (guesswork!) with less confidence¹. Sure you can also do the black box analysis but that’s just wasting money when the bar has already been cleared. You would do both if lives depended on the code, but such standards are far above Google’s standards.
You’re still not getting it. No one advocates for an exemption. You need to get that out of your head. A code review is a way to more cheaply do the verification with higher confidence, not to bypass it.
¹ Hence why Google failed many times to get it right.
“Just searching the code where the address book API is used” most certainly does not give you increased confidence. Obfuscation is not that difficult. You can only possibly gain confidence if you fully understand every single line of code.
I ignored it because it’s idiotic. Google isn’t and shouldn’t be building code for you unless you pay for it.
Not doing literally every single test every other app is required to is an exemption.
One more time: a company having people review specific code for a specific purpose does not in any way resemble an adversarial code review against bad actors. There are no parallels. A code review gives you literally zero confidence that the writer isn’t malicious unless you comprehensively understand every single line. Open source project security is entirely and exclusively reputational.