Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Post mortem: Thanks and lessons learned (elnorr.com)
91 points by antr on Jan 29, 2014 | hide | past | favorite | 34 comments


So I install a random app that includes PingJam. Another flashlight app or something.

So the flashlight app then goes and monitors my phone calls, intercepts them to display ads (at no point is it clear that the app is responsible for that) and probably relays my called numbers to PingJam?

Are you fucking kidding me? It's straight malware and you should be fined triple for every dollar you ever made. Google should fire whoever inside their organization enabled you to run this scam for longer than a month.

(Anyone still have the SDK or an app that used this? I'd love to see if it leaked caller ids to them. Holy privacy invasion.)


I really hate being this cynical, but I dare say they were simply ahead of the curve. The over-under on google doing this themselves? Two years?


The article states that it happened immediately after Google released a very similar feature on Android.


Is this what they did? I check out their site and was unable to find out where and when exactly were they showing ads and which data were collected from phones and send to advertizers.


Never mind, the "We show an ad only in the context of a call to or from a business." in their faq http://pingjam.com/faq/ is probably what you mean. So, I guess I will suddenly see ads if they detect I'm calling to business, but I will have no idea which app caused it. Genial.

I would not knowing install app that does that.

If only I could filter playstore by permissions. That would make it that much more usable. As it is now, it take too much time to scroll down till first app that does not require too many of them.

Or control better what kind of data applications see. Anything would be better then current "we pretend you are in control, but will make it as hard as possible for you to exercise that control."

End of rant.


Dude, chill. Apps using Pingjam displayed a very concise and clear explanation of the caller Id functionality at startup, including a screenshot, and activated it only if the user explicitly agreed to it. Ads appeared only on calls which were identified (I.e. when you got value from it), and the ads were always relevant to the call (e.g. when you called a spa you were offered a coupon for spa treatments) Every caller id screen and every ad had clear attribution to the app that brought it, plus a button to immediately opt out of the service.


Here's a screenshot I found of the permissions screen (http://blog.andromo.com/wp-content/uploads/2013/04/pingjam-d...).

There's no screenshot of the type of ads I'm going to get and the actions are not clear whether I'm "OK"ing acknowledgment or if I am enabling the ads. To an average user who doesn't want to read, I would expect them to just press OK because it seems like a standard first time user startup screen. Would "cancel" close the app? I wouldn't be surprised if most opt-ins were not truly intentional.

To me this is a dark pattern. The notification should have clearly asked "Would you like to enable caller ads?" and "Yes" or "No".


I'm an iPhone user, so take this with a grain of salt, but it is utterly incomprehensible to me that a phone OS would allow an application I install to "monitor my phone calls [and] intercepts them to display ads"

You fucking kidding me? And you paid money for this phone?


There are some pretty powerful permissions that apps can request. This allows interesting apps to exist that can't be done on iOS.

It's up to users to not install apps that request permissions they don't agree with, although that is indeed not presented ideally.


> Google should fire whoever inside their organization enabled you to run this scam for longer than a month.

From the post, it sounds like Google is itself running this "scam":

> FTA: I don’t know whether we got kicked out because 24 hours before banning our apps Google launched an almost identical feature in Android 4.4 or if it’s something else.

[Can anyone confirm?]


  Pingjam was a monetization solution for Android app developers
  ...
  Google Play kicked out over 1,000 apps that worked with us from their app store
this whole article paints Google in the usual HN-friendly light of 'big bad unapproachable Google being evil', without giving any detail on what this 'monetization solution' actually was, and why Google wasn't being entirely reasonable to kick it to the kerb.

edit: yeah, thought so. they push contextual ads based on who you're calling. no surprises that got killed.


I've experienced enough about Google to believe that their experience could be exactly what was described.

On the other hand looking at links like https://angel.co/pingjam I have to admit that they were doing something that was going to feel a lot like privacy invasion. Knowing who you were calling, and using that to target relevant ads?


Facebook is now scanning SMS on Android, ostensibly for 2 factor authentication, but it's easy to see them mining the data for advertising purposes. I wonder how Google will react to that.


They took a course of being completely dependent on the benevolence of Google. That is a big risk, but maybe more common than you would think. I mean, Apple can kick your app out of the market, yet a lot of startups depend on the app store.

Pingjam seemed to have gone the extra mile, by seeking close cooperation with Google, also in terms of EULA. I can imagine them feeling hard done-by Google.

I must admit am not in any position to judge the Google license agreement and their possible non-compliance.


Their website is still up http://pingjam.com if you want to see what it was.


The site doesn't seem to say a thing about what they actually did to make money (the AngelList description does, though).


It does if you dig deeper in the website. Looks like pulling info from caller ID and using that for monetisation... which is icky, as far as I'm concerned.


Almost as bad as pushing contextual ads based on what you are searching for, eh?


Those ads are confined within Google when you are searching. This is an ad that pops up when you're not using the app which to me sounds more like a classic toolbar add-on type of deal.


> To this date, I don’t know what made Google suddenly not like us. I don’t know whether we got kicked out because 24 hours before banning our apps Google launched an almost identical feature in Android 4.4 or if it’s something else

Google has been accused of being "evil" in recent years, but I find it strange that they'd pull 1,000 apps with no forewarning and no explanation as to why. Surely they must have given you advance notice, perhaps a chance to change your service? Either that or your service was doing something unethical or clearly against Google's terms, and it was just a matter of time until they killed it.

Something doesn't add up here...

Edit: after looking at the site (http://pingjam.com/), I have no idea what kind of advertising service this is, but it looks pretty nasty (in call popup ads?). Site itself is also very, very vague, providing little information on the service itself, and lots of fluff.

tl;dr - we made a shitty service and Google killed it.


You add Ads on top of a fundamental function of a phone???

Sorry, but it is correct that google kick you out.

And i cant believe that app users understand what they installed in background. I think many users complained about the ads and thats why google react.


On a more general note, I enjoy reading these post-mortems. Not out of a wry malicious pleasure, but it is certainly a learning experience.

Is there some place where these are gathered for common benefit? Maybe get into more depth with interviews, because this post-mortem for instance leaves a lot of questions unanswered.

The top Google link is a CBinsights blog post, but that does not really cover it. I would consider starting this as a side-project. Would this be interesting?


> Would this be interesting?

Of course it would! but make sure to create a profile for each company, what they are trying to achieve, how, etc..

And then all the biography of the company.. what events ocurred.. also analisys could be collected from bright folks of what they were doing right and wrong.. just some ideas :)

We can learn much more from failures compared to the successful enterprises.. we dont hear much from the failed side of the trench. and thats a shame..


"Don't rely on just 1 platform as much as possible"

Look at Zynga => they relied on FB

Look at Angry Birds (initially) => they relied on Apple

Look at Moz => they relied on Google (scraping rankings)

Look at Xobni => they relied on Microsoft

Look at Rapportive => they relied on Google/Gmail

Look at TweetDeck (before acquisition) => they relied on Twitter

It's not black and white. Sometimes you just get unlucky. Sometimes you get lucky.


Just a quick note: Moz's domain authority and page authority score is what is used the most in the industry. It relies on their farm crawling the web and seeing who's linking to who. Their business is NOT heavily dependent on Google. Rankings is one of many features.


"To stress the point, if your startup has one point of failure that is controlled by one entity – do what you can to not be totally dependent on that single entity. Develop for other platforms, decouple from the ecosystem. Do whatever it takes to get out from under their thumb."

This is the most important part that most don't seem to grab

This has caused several people to go under. Another company doesn't owe you nothing, be that Linkedin, Twitter, Facebook, Google

If your product rests on only one base, you are under a great risk


Don’t operate in a market where a single player can arbitrarily decide to kill you. Especially don’t work in a market that’s controlled by an entity that explicitly refuses to communicate with you (or anyone else) or to explain their guidelines.

That really says it all. As another commenter pointed out, yeah, sometimes you get lucky... but I say "why tempt fate"? Some people go to Vegas and bet their life's savings on the roulette wheel and come out with a bundle. Most people that go to Vegas come back with their wallets lighter than when the went.

Some people bet on a platform that they don't control, with no SLA or contractual agreements to protect themselves, and subject themselves to the capricious whims and foibles of Google, Apple, Microsoft, IBM, Twitter or whoever, and some of them succeed wildly. That doesn't mean it's a good idea to do this.

There's an old saw that says the two worst strategic mistakes you can make are "launching a ground invasion of Russia in the winter, and partnering with Microsoft". I'd like to offer up a new version of that:

"The three worst strategic mistakes you can make are launching a ground invasion of Russia in the winter, partnering with Microsoft, and tying your app to a single-source platform you have no control over".


Lesson learned: don't expect a business built on breach of standards of conduct to be sustainable.

Monitoring call records and targeting ads based on them sounds very close to what the NSA has been exploiting in mobile apps (c.f. revelations a couple days ago). Atrocious. I blame both Pingjam and the app developers for callously abusing end-user trust and integrating with such a shady third-party.

This also reminds me of top comment on the $50,000 Twitter name social engineering attack article[1]: setup a list of vendors that have pathetic security practices, but in this case the list would be of apps that integrate shady third-parties.

I'm not sure if these guys are super-slick sheisters or legitimately clueless. This 'woe-is-us' blog post, written in the style of the humble lean innocent entrepreneur, certainly strikes me as disingenuous.

[1] https://news.ycombinator.com/item?id=7142523


Thank you all for your comments.

The intent of the post was to share experiences and lessons, not to promote what we did at Pingjam. We already went through that discussion several months ago when we were working to get Pingjam accepted by developers. Some developers (including very respectable apps) liked our service and tried us out, some did not. To each their own. Since I don't think it's useful to discuss what we did - I'll refrain from fully explaining what we did, why we thought it was a good thing, the value that the service provided to users or how we made sure to follow best practices on opt-ins, opt-outs, privacy, etc'. You are welcome to think what you want about our service.

Regardless of whether you like the service we provided or not, we went through a certain set of experiences that can be useful to others. If you choose to take anything from that - I hope it helps you in whatever you are doing.


>the reality is that we've failed.

I'm seeing this a lot lately. Paraphrasing UK driving test examiners, it should be "You didn't FAIL; you just didn't succeed this time."


Until the money is in the bank you don’t have an investment.

There is a lot of talk about what went wrong, but I think this is the most transferable lesson spanning startups of every kind.


You made ad/malware available for phones as a slimy monetization gimmmick for 1000's of apps. Wish you would have learned another lesson.


Maybe a better lesson to be learned: don't be scum


yuck.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: