111–120 of 284 posts
And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while. If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.
They also use a ton of Apache2 libraries (at least 5 or 6) directly in their source repo.
They don't appear to even bother to properly give attribution/etc for the used software, so yeah.
Earlier quoted context omitted.
Google puts 1 restriction, they are the enemy. Apple has created priopritary connectors, closed off systems, paid barriers to entry, and banning apps from their store. Where is Apple and Microsoft on the scale from Friend to Enemy?
Hi. Nobody said they are the friends here. Just that Google is not.
And in this case I think the point is valid: this policy is bad, both because battery management and notification policy really needs to be part of the core OS in AOSP and not a proprietary add-on and because of the licensing glitch reported here where the client library isn't GPL-compatible.
But that's just one policy. Across the fence of the war mentioned above, it's a GPL-incompatible wasteland where absolutely nothing is possible at all. If you care about free software in the abstract and want to view your war along those lines: Google is behaving badly and needs to be admonished. Apple is clearly The Enemy.
And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while. If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.
Earlier quoted context omitted.
So, if I understand correctly, the GPL prevents you from using a non-free library in your code? (Asking honestly: I have tried to find this elsewhere but the FSF page on the GPL is rather ... convoluted). If that is so, then this is obviously a killer and quite seemingly arbitrary requirement. Your MS example is quite good.
The GPL requires that all code with the software under the license to also comply with the GPL, which includes libraries. Therefore, it's simply not possible (legally) to use non-GPL compatible libraries with GPL software. A lot of open-source licenses are compatible, such as the MIT or BSD license, but proprietary licenses are not obviously.
And, it should be noted, the LGPL license, which exists for exactly this purpose!
Earlier quoted context omitted.
So, if I understand correctly, the GPL prevents you from using a non-free library in your code? (Asking honestly: I have tried to find this elsewhere but the FSF page on the GPL is rather ... convoluted). If that is so, then this is obviously a killer and quite seemingly arbitrary requirement. Your MS example is quite good.
If you are the creator of the GPL software you can do what you like, link Firebase to it, distribute the app and release your code as GPL. You're effectively 'granting yourself' a proprietary license to use your code and a GPL license for everyone else to use it. However it means nobody else can release their own apps (with notifications) on Android based on your code, or anyone else's GPL code. As soon as they link…
And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while. If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.
Signal already implements it. Signal uses E2E encryption, so your attack vector doesn't work. https://community.signalusers.org/t/gcm-will-be-removed-from...
End-to-end encryption is just that. That Firebase library is running on the client phone (aka, an end), if Google put code into the library allowing it to download updates it would also be running in Signal's context which would allow it to trivially dump and exfiltrate messages, memory, etc from the Signal process.
Now, we have no reason to believe such a mechanism is used here to my knowledge, but if they really wanted to, it would defeat end-to-end encryption.
Earlier quoted context omitted.
Telegram violates multiple open source licenses, so I wouldn’t hold it up as an example.
> Telegram violates multiple open source licenses Any examples for those who would like to learn more about this?
The FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android/AOSP is Apache v2.
Additionally, their own codebase contains a bunch of Apache v2 licensed stuff, like exoplayer2, recyclerview, libtgvoip, fastdateparser, ABSL, etc.
They do not appear to be even giving attribution as required (or at least i can't find it)
They are in no worse a position than they were yesterday:
>ag -Ri apache
will produce tons of matches like this one:
TMessagesProj/jni/libtgvoip/webrtc_dsp/absl/strings/internal/m emutil.cc
3:// Licensed under the Apache License, Version 2.0 (the "License");
7:// http://www.apache.org/licenses/LICENSE-2.0This has been coming for a while. We attempted to create a push-based notification system based on MQTT. It worked well, then the notifications started getting lost. Turns out, the receiver service was getting killed in the background. We found out the best way to get reliable notification was through Google's own GCM (which has now moved to Firebase Cloud Messaging. We learned its incredibly difficult, if not imposs…
This has been true for awhile once they forced apps to use API26 or higher (if you want to be listed in the Play store, and really, there is no other place if you want decent exposure.) I had a similar experience switching from "real background" to using FCM. I understand the battery saving motivation, but the problem is that the performance of the google service is terrible. The response time of my simple notificati…
(from what I remember of some android documentations) Your definition of "high priority" is different from Google's one, which is also different from the end-user's definition. Google probably favors the end-user's preferences more than the developer's preferences. If the user wants all notifications asap from a particular app, the system will do a best effort to deliver, given all the other apps notifications and the current battery level.
Perhaps it is time to treat Google as the enemy, because that is how it is treating us.