Inside baseball on smartphone application approval processes
September 30th, 2009 | by elisabeth | Published in Android, cybersecurity, iphone | 1 Comment
As promised, here’s some of what we learned about the app approval process from Google and Apple’s letters to the FCC. There’s nothing ground-shaking, but a few details of interest to smartphone obsessives.
Apple says a staff member tests every submission for technical issues like bugs and unauthorized protocols. More holistically, they look for signs that an app might “degrade the core experience of the iPhone” (as they worried Google Voice might?)—a sort of unquantifiable factor. The FCC also asked Apple for a list of rejected apps and the reasons for the rejections. Apple listed several, none of which I’d ever heard of, which were all bounced for unimpeachable reasons—crashed during loading, displayed sexual content without a 17+ rating, etc.
The approval staff consists of around 40-full time reviewers, two of whom review each app. Given the 8500 new or updated apps Apple claims to receive each week, that means each app gets about 5.5 minutes of attention (40 hours in a week, divided by 8500 apps split between 40 people, divided by two since each is looked at twice). No wonder it’s hard to get everything done perfectly. I just continue to wonder how this system will scale. 40FT employees is nothing to scoff at, but those employees are overwhelmed now and the number of apps is just going to keep increasing.
Google doesn’t have staff reviewing Android apps when they’re submitted; instead, they perform a “limited automated analysis” to identify technical issues with loading and running the program. Once an application is in the Market, users have the ability to red-flag it. Some unspecified number of flags triggers review by a live person. The app can be taken down if it violates anything in the developer agreement; Google says it’s taken down about 1% of apps posted, mostly for adult content and copyright violations. That number is much higher than I would have thought—I’ve heard almost nothing about apps being removed from the Market.
I’m curious whether Apple’s in-person testing for bugs catches significantly more than Google’s automated screen.
As a bonus, some info on Symbian’s process. Symbian doesn’t get as much attention from the blog world—much of its market is international, and it’s not associated with a high-profile phone like the iPhone—but it’s installed on almost half of the world’s mobile phones and so is a big player. According to a Symbian spokesperson, apps are tested automatically for viruses, then “random samples” are tested by an employee before going live. This came up recently because a Chinese firm developed an SMS worm that infected phones running the Symbian OS. Users were sent a message inviting them to click a link within the text; that downloaded the worm, and sent similar messages to every contact in the user’s phone, racking up fees for all those texts. (It’s not clear to me whether this was totally malicious or if the firm had some way of making money off the scheme. I haven’t seen anything to suggest they had any kind of deal with the carrier.)
The Symbian story points out why it’ll be crucial for Apple and Google to get this process right. People are going to start writing viruses for phones—that happens whenever there’s a market to exploit. The question will be if those companies can keep malware off the phones, and how consumers will respond if they can’t.
—By Elisabeth Oppenheimer
November 10th, 2009 at 2:53 pm (#)
[...] days. If it’s true that almost half the apps are being reviewed twice, that could strain an already-small staff that reviews apps. —Only a few hundred developers can live off solely their App Store [...]