#1 - You can e-mail google play support (googleplay-developer-support@google.com or use the contact form in the developer dashboard which is in the right top hand corner...its a question mark) for them to e-mail you a list of apps upon request. If you used air and packaged apks from version 3.6 and up they will be on this list if you used Captive Runtime. #2 - Chris Campbell I received an e-mail from google play support in response to the e-mail that they sent me with my list. I asked them about the deadline and heres what they said to me: Hi Keyeske, Thanks for getting back to me. I do not have a date I can share with you at the moment. That being said, we encourage all developers to prioritize upgrading to a newer version of OpenSSL in order to protect their users. Hope this helps. Please let us know if we can help with anything else. So looks like no deadline as of yet but its urgent. Kind of a soft critical warning. Had me in panic rage for a few days just to receive a wonderful please don't panic we haven't set a deadline sort of e-mail haha. We should get well acquainted with the folks at Google and contact support often so we can get better information and notice warnings in the future. I wish I could have the ability to go to Google I/O and ask questions like this at their Google Play Store Developers fireside chat... can't ask when I'm watching it through stream. ... View more

Hey Just received a response from Eric Davis from the Android Security Team from the Android Development Community Page on Google Plus on this issue: Anyone else receive this e-mail from "Google Play Team"?Security Alert: You… He writes "Hi all, I’m on the Android Security Team.  In response to your questions: (1) You can determine which apps are using OpenSSL via ("$ unzip -p YourApp.apk | strings | grep "OpenSSL"") (2) Please update the all statically linked versions of OpenSSL to 1.0.1h, 1.0.0m, or 0.9.8za. (3) If you are using a 3rd party library that bundles OpenSSL, please notify the 3rd party and work with them to address this." edit: a few other devs also discovered that it is the apks that are bundled with captive runtime instead of the ones using shared runtime which is anything potentially Air 3.6 and up. ... View more

I just got off the chat with Google Play Developer Live Chat I found out a few things from a very dry conversation. 1. Google is aware their execution of this e-mail has worried developers (a summary from the tsr). We need to contact them a lot more! So, in the upper right hand corner of the Developer Console, there is a question mark. CLICK it. Click on Live Chat, but make sure its between 11am to 5pm PST and please tell them your issue. Please copy and paste the e-mail you were sent that created this all in the first place. Socially blog and share this issue so that others are aware! 2. If you demand a list of apps affected, they will tell you how many and what apps via e-mail. You have to be persistent. Mine was 95. I know it was more but that leads me to #3 3. Not all Air SDK versions were affected. My older apps that were created/published against Air 3.2, 3.3, 3.4 and 3.5 were not on the list. However 3.8 and up were which included the latest game I added that was using 13. Probably because those were the ones that included captive runtime and the others did not. The older games I updated a few months ago showed up, but the paid ones, since they were not updated did not show up unless they were newer apps. 4. This can get very ugly if Google just issues the notices and carries out removing apps without full explanation. We are not the only ones with this issue, yet they (the google reps) are telling us to search the internet to find a solution to correct the apps. ... View more

Hello, Thank you for the response. We really appreciate that you guys are working on the issue! However, we do not know for certain these very important things since Google is throwing this issue at US DEVELOPERS: 1. When is the deadline to correct our apps so that they comply with OpenSSL 1.0.1h?? I've got 200 or so it will take some time... every time ... 2. Could other frameworks that use an APK packager have the same issue (i.e. outdated Google SDK or NDK for Eclipse)?? 3. How many times do we need to keep our Apps updated? What if we no longer have the ability to correct the apps and Google removes them even when the apps are unpublished (app suspension) and risk the issue of having our Developer Account terminated (since users can still download apps even when they are unpublished but not suspended if they downloaded them before like Flappy Bird?) Please I encourage you all to use the live chat feature in Google Play Developer dashboard (11am - 5pm PST) Lets get this fixed on both sides! ... View more

Hello, Just want to say that we also have received this message. We have over 200+ apps on Google Play. Some of them native and some using Adobe Air. This is a really hard job to do with two people if this is truly the case of updating our apps to the latest air sdk version. However, I have asked other developers and some of them received the same e-mail yet they were not using Adobe Air for their apps, they were using Native Java. Why did Google leave such a vague message on something very detrimental to us all if we do not get to the bottom of the issue????? We have used so many different versions of Air SDK (since 2011) that its not funny. Starting from CS5 to CC. Some apps have captive runtime and some do not.... Also why did Google e-mail us developers for a issue like this when they should have contacted Adobe in the first place if it is truly the runtime issue?????? ... View more