Well done! I didn't want to promote either the app or the fake listing, but you did find it. As you can see, the App Store listing uses the ClipGrab icon (which isn't on the website but you'll see it if you download the app) and, well, the name.
It also claims to be "Trusted by 1M+ users" ... while having 6 reviews with an average of 2/5 stars.
So yeah, it doesn't claim to do the same thing in the description - but it's vague enough that a casual reader might think it does. And the fact that they use the name and the icon makes it pretty obvious that they're trying to trick people who are looking for an iOS version of ClipGrab into paying them money. This is also made evident by the fact that I have received a number of complaints from users who were convinced, they had paid for a "pro version" of ClipGrab that was now simply not doing what they expected.
Thanks! Its so weird that Apple claims the App Store monopoly is necessary to ensure they can vet apps and protect users - but then they don't even let you report an obvious scam.
The App Store listing is pretty clearly a scam and the app is clearly pretending to be my app when it isn't. It's also not some small obscure app, it is well-known enough that there there are Wikipedia articles in serveral languages about it.
So Apple should really be taking action on both counts, in my opinion.
Isn’t that what Apple must check and may be doing by “All they seem to have done so far is forward my complaint to the author of the scam listing” (depending on how they worded that)?
Also, all you formally complained about is a trademark infringement. Global trademark law is complex. Maybe somebody else managed to get a trademark with the same name, too? I guess that’s unlikely, but Apple can’t assume that.
If he did have a trademark he could go to Apple and say specifically "this is a case of trademark infringement" and probably not need a lawyer but he'd also have the basis for a civil lawsuit.
> Also, all you formally complained about is a trademark infringement
Which is precisely why I asked if there's a better way to report scam apps that I might have missed. But unfortunately it doesn't seem to be the case and you don't seem to have an answer either.
> The App Store listing is pretty clearly a scam and the app is clearly pretending to be my app
What leads you to make these allegations?
As far as I can tell, it is not pretending to be your app or claiming any affiliation. The app doesn't even do the same things your does. It's just named the same. It seems a pretty obvious app name.
They probably just came up with the name and didn't bother to Google for prior art. Do you have a trademark on the name? If so, that should squash it from the App Store. Otherwise, I think you're hosed.
That said, it's at best a pretty low quality app with atrocious in-app prices.
Do you have real-world experience deploying PoW captchas? I'd love to give them a try but I'm worried my forms will end up getting overwhelmed with spam if I switch away from hCaptcha.
As someone who as founded companies in Germany, I can understand a lot of the frustration with some parts of the process. It does indeed feel archaic that the notary has to read everything out aloud and the process for opening a bank account is maybe not terribly compicated but still more complicated than it needs to. The fact that getting a VAT number can take so long is also really infuriating.
With that being said, it seems like the author received some poor advice from their law firm:
1) If the author mostly does consulting and contract work, a sole proprietorship would have been the better option as many others here have already pointed out.
2) The UG & Co. KG construct is unnecessarily complex for a small company; it does have some advantages but if they really wanted a limited liability company, they should have used the "Musterprotokoll" (standard protocol) for setting up a UG; that would probably have cost less than €500.
Lawyers love to suggest GmbH/UG & Co KG though because it means more fees for them.
3) The advice they got regarding the name was almost certainly incorrect. First of all, "case law" is not really a thing in civil law countries like Germany. The company name usually gets checked by the local chamber of commerce (IHK) and while there are some rules (you're not allowed to just call your company the equivalent of "Supermarket Co", "Plenty UG" would have almost certainly been fine. And if the IHK says it's fine, the court will accept it too.
Anyways, now that you have your company, I wish you all the best with it. You have exciting times ahead and the frustrating bit is (almost) over :-)
Well, that's why I am asking for practical experience using these tools. Maybe most form spam bots are (still) not advanced enough to complete PoW captchas. Have you tried Altcha or mCaptcha in production?
I have tried everything so far. Something like recaptchav3 will block most headless browsers but very invasive, solving it raises cost quite (for the auto solvers).
Notably no matter what the advertised repositories say So-called „pure play“ (%100% local, no tracking) kind of PoW captcha doesn't do anything for if you are a target and specifically having tools written for you.
For example: I work at a company for MMO game, and as such have to look at what is made. Our form requires numerous so-called invasive features featuring multi-step, TLS analysis, fingerprinting, WebGL, and more. People write dedicated tools to brute force login details or spoof spam, that includes full browser automation and don't care about 100% Usage of CPUs. (I do not have any say in this manner and its out of my scope, I do not "like" this kind of invasiveness)
It depends on your threat model and what is this for. A personal blog a regular one will be fine, any will do. Anything someone will write targeted tool for all self hosted PoW will do nothing.
If you are getting generic form spam simply renaming your field or adding one random invisible field is sufficient to stop automated bot traffic until someone writes a targeted for your.
Thanks for sharing! My current experience is that honeypot fields are often ignored by the bots we're dealing with, but adding hCaptcha is pretty reliable in getting rid of them.
What do you usually name them? You typically want opaque names on all fields and various combinations (some fields auto-filled in with JS that clones the email field, some need to be left blank, some filled in during the onsubmit JS hook..)
So yeah, it doesn't claim to do the same thing in the description - but it's vague enough that a casual reader might think it does. And the fact that they use the name and the icon makes it pretty obvious that they're trying to trick people who are looking for an iOS version of ClipGrab into paying them money. This is also made evident by the fact that I have received a number of complaints from users who were convinced, they had paid for a "pro version" of ClipGrab that was now simply not doing what they expected.