Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android now forces apps to include proprietary code for push notifications

reddit.com

Post reply on HN
Print view View original

201–210 of 284 posts

Re: Android now forces apps to include proprietary code for push notifications

#201

Post by kevin_thibedeau »

maxaf wrote: post #142
soulofmischief wrote: post #140

Earlier quoted context omitted.

I don't think you're focusing on the entire picture. Some people here like iOS for the reasons you described. However I'm willing to bet, unless you can show me otherwise, that it's a vocal minority. I don't know of anyone personally who is happy that Apple disallows GPL code. Comparing Apple's digital Fort Knox with Google's unsupervised free-for-all is a false dichotomy. There exists a happy medium, where power use…

Please forgive me for being unnecessarily obtuse this early on a Monday morning. Where does Apple say that GPL code isn’t allowed on the App Store? I ask entirely out of my selfish need to avoid unpleasant surprises later on.

The issue is that the Apple dev ecosystem creates encumbrances that prevent users of GPL binaries from relinking them. That is a GPL violation and such binaries are not compliant with the license.

Re: Android now forces apps to include proprietary code for push notifications

#202

Post by bubblethink »

habosa wrote: post #166
jchw wrote: post #88

I was confused for a moment because I thought the Firebase SDK was open source. Interestingly, though, the Android version appears to be only partly open source. I did not find an explanation as to why some of the source is not available, it is mentioned on the Github repository but not explained. In any case, I don’t see the code for Cloud Messaging in there. It may not be that it is done out of secrecy, though. A c…

[Firebase team member here] Our goal is to open source all of our SDKs, and we have steadily open-sourced more of them over time. The SDKs you see on GitHub right now are all standalone, they don't require communicating with Google Play services running on the device. Our bar for moving an SDK to GitHub is that it has to be more than a source dump, it must be the source of truth for that team's development. Right now…

Is there a plan to a) Support use of FCM without play services (i.e., in AOSP)? b) If not, is there any legit path forward for cases like these short of them forking AOSP ?

Re: Android now forces apps to include proprietary code for push notifications

#203

Post by izacus »

gubbrora wrote: post #184
joshuamorton wrote: post #169

Earlier quoted context omitted.

Often times even having configuration options creates surface for security issues. A good example of this is that there were scams that involved having people paste some script into their chrome devtools and steal data. This worked fairly effectively. Facebook ended up doing some magic to show a warning message in the devtools console to tell people that no, you really shouldn't paste random stuff here, it will do ba…

Hence why I said encrypted. The impulse to protect people from themselves is a dangerous one. In the article itself we see that in practice it is used to push inescapable spyware. "But our spyware is better than their spyware!" Google says they will protect you. But the truth is they are just concern trolling to shut down marginally worse competitors. For kids and elderly that can't make decisions on their own it cou…

Google actually released Capillary, which makes E2E encrypted FCM messages easier to implement: https://security.googleblog.com/2018/06/end-to-end-encryptio...

But yeah, if you want to avoid Google's servers, then it's not enough. But in that case, you're probably on Google-free LineageOS anyway right?

Re: Android now forces apps to include proprietary code for push notifications

#204

Post by izacus »

throwaway2048 wrote: post #176
joshuamorton wrote: post #169

Earlier quoted context omitted.

Often times even having configuration options creates surface for security issues. A good example of this is that there were scams that involved having people paste some script into their chrome devtools and steal data. This worked fairly effectively. Facebook ended up doing some magic to show a warning message in the devtools console to tell people that no, you really shouldn't paste random stuff here, it will do ba…

I very much doubt that Google is making the GCM push code proprietary for these reasons.

No the truth tends to be more banal - making everything replacable in configurable means more (paid) engineering work for Google engineers for what's, essentially, building infrastructure for competition. What would be the compelling business case for Google to do more work to enable removal of their own product?

Re: Android now forces apps to include proprietary code for push notifications

#205

Post by SkyBelow »

joshuamorton wrote: post #169
jimktrains2 wrote: post #163

Earlier quoted context omitted.

That something is configurable doesn't negate the ability to have sane defaults that most people won't touch.

Often times even having configuration options creates surface for security issues. A good example of this is that there were scams that involved having people paste some script into their chrome devtools and steal data. This worked fairly effectively. Facebook ended up doing some magic to show a warning message in the devtools console to tell people that no, you really shouldn't paste random stuff here, it will do ba…

Is the solution to begin, to a degree, treating adults as children?

Re: Android now forces apps to include proprietary code for push notifications

#206

Post by bubblethink »

jchw wrote: post #88

I was confused for a moment because I thought the Firebase SDK was open source. Interestingly, though, the Android version appears to be only partly open source. I did not find an explanation as to why some of the source is not available, it is mentioned on the Github repository but not explained. In any case, I don’t see the code for Cloud Messaging in there. It may not be that it is done out of secrecy, though. A c…

>At face value, this really does seem problematic for open source projects. Can a GPL app link to (the non-open parts of) the Firebase SDK? My guess would be no.

This is only partly a licensing issue. The larger problem is that the f-droid crowd has little to no desire to rely on FCM/GCM or other network services offered by google. At the very least, use of FCM would have to a part of AOSP or other (official) free software for it to even gain some legitimacy. At the moment, it is behind the play services ToS. And this still doesn't answer the question, "what if I don't want to use FCM?" If google's answer is, "Well, fork AOSP if you don't like it", we know that is a non-answer due to google's other tactics.

Re: Android now forces apps to include proprietary code for push notifications

#207

Post by AshamedCaptain »

tjohns wrote: post #172
saurik wrote: post #91

Earlier quoted context omitted.

The phrase "running continuously" makes it sound like they are doing something... but they aren't: they are blocked reading on a socket. The only time they would run is if they receive information, which is exactly when they would run anyway (as they got a notification). The difference in battery usage would essentially be down to subtle effects caused by the private memory of that process (which might be negligible)…

GCM/FCM will delay low priority notifications, in order to batch as many together as possible. On top of that, the cell networks don't allow keeping a socket open for more than a few minutes without sending keepalive packets. Unlike on desktop, keeping a socket open isn't "free" on mobile. Waking up the cell radio has a significant penalty on battery life. (And yes, Android batches up process wakeups as well. See the…

So you just batch the keepalives, like the old Nokias were doing. Reaching 1 month long battery lifes with Jabber on.

Absolutely no difference 1 having to send 1 keepalive every 5 minutes than 30.

This is just a subversion of basic networking in order to centralize everything through a single provider and as usual the users are trained to see it as necessary without questioning it.

Re: Android now forces apps to include proprietary code for push notifications

#208

Post by vinay_ys »

tjohns wrote: post #172
saurik wrote: post #91

Earlier quoted context omitted.

The phrase "running continuously" makes it sound like they are doing something... but they aren't: they are blocked reading on a socket. The only time they would run is if they receive information, which is exactly when they would run anyway (as they got a notification). The difference in battery usage would essentially be down to subtle effects caused by the private memory of that process (which might be negligible)…

GCM/FCM will delay low priority notifications, in order to batch as many together as possible. On top of that, the cell networks don't allow keeping a socket open for more than a few minutes without sending keepalive packets. Unlike on desktop, keeping a socket open isn't "free" on mobile. Waking up the cell radio has a significant penalty on battery life. (And yes, Android batches up process wakeups as well. See the…

> On top of that, the cell networks don't allow keeping a socket open for more than a few minutes without sending keepalive packets. Unlike on desktop, keeping a socket open isn't "free" on mobile.

You are wrong. Cell networks don't prevent you from keeping a socket open for however long you want. For how to keep your sockets alive, see https://developer.android.com/reference/android/net/SocketKe...

Re: Android now forces apps to include proprietary code for push notifications

#209

Post by veeti »

icebraining wrote: post #34
kbumsik wrote: post #27

I'm not an Android dev, but according to the source in the article [1] this limitation is applied since Oreo, which is released two years ago. Why this problem arises today? [1]: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

Until April 11, 2019 you could use GCM instead of the Firebase system.

The GCM client is/was also proprietary. There is nothing new here.

Re: Android now forces apps to include proprietary code for push notifications

#210

Post by pkaye »

Despegar wrote: post #170
izacus wrote: post #132

Earlier quoted context omitted.

> It doesn't matter how much money Google is going to have to pay in the future as a fine for this practice. The amount of money that they will get for kicking out the competition is going to be way higher. That is a learned lesson from Microsoft (and probably others before them). The competition in this case is Apples iOS, for which even HackerNews users love to harp over and over and over again how amazing it is an…

The difference is Apple has been the same from the beginning. There was no bait and switch. People who bought Apple products knew what Apple was and will be and what the terms were. With Google there is a bait and switch (and it doesn't really just apply to this particular story). They came to market defining themselves as the open alternative to Apple to get market share and developer interest (and evangelism), and…

Apple has the majority market share in the US. I think they need to be forced to open up for alternative app stores.
Post reply on HN