Feeds

New Google Play terms ban non-store app updates

Rug pulled from under Facebook's auto-updates

3 Big data security analytics techniques

Google has amended the policies of its Play app store for Android to prohibit third-party app update mechanisms, in a move seemingly designed to put the kibosh on a contentious feature being tested by Facebook.

As of Friday, the "Dangerous Products" section of the Chocolate Factory's Google Play Developer Program Policies - which prohibits such things as Trojans, viruses, and spyware - now includes an additional sentence:

An app downloaded from Google Play may not modify, replace or update its own APK binary code using any method other than Google Play's update mechanism.

In other words, apps sold through Google Play must also distribute all future updates through Google Play, which in turn ensures that the updates will be subject to the Chocolate Factory's security and other policies.

El Reg contacted Google to learn the reason for the new language, but we received no response. But the change does appear to be aimed at Facebook, which in March began testing a version of its Android app that can download security fixes and feature updates automatically in the background, via a "silent update" feature.

"We're working quickly to improve Facebook for Android and want to make sure everyone is using the best version of our app," explains an entry on the social network's Help Center.

Helpfully, the Facebook app will only auto-update over Wi-Fi, so it won't sap users' data plans. But the silent update feature still stirred up some controversy, because it requires users to disable the Android feature that blocks installation of apps from sources other than Google Play. Third-party app stores are widely considered a leading vector for Android malware.

More generally, apps that can modify their own code without Google's intervention make it harder for the online giant to police its app store for spyware, scams, and other illicit doings. A user might download a seemingly innocuous app from Google Play, for example, only to have the app later update itself with new code that turns it into spyware.

Under the new wording of Google's developer policies, all such mechanisms, including the one being tested by Facebook, are clearly verboten.

Note, however, that the new restriction only applies to apps purchased through Google Play. Apps purchased through Amazon's Appstore, for example, can still receive updates via any mechanism that Amazon's terms allow.

The policy also doesn't appear to apply to Facebook Home, the social network's "immersive" Android skin, when it comes pre-installed on phones such as the HTC First – although it's not yet clear how Facebook plans to distribute updates for those devices.

The Register reached out to Facebook to learn what its next move might be in light of Google's policy change, but a spokesperson declined to comment. ®

Top three mobile application threats

More from The Register

next story
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Inside the Hekaton: SQL Server 2014's database engine deconstructed
Nadella's database sqares the circle of cheap memory vs speed
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.