Facebook allegedly skirts Google Play store with latest update • Hacker News Board

Re: Facebook allegedly skirts Google Play store with latest update

#11

Post by lost_name » Fri, Mar 15, 2013, 5:35 PM UTC

I don't think it's important that just any app is "skirting the store" (plenty do that already, it's not an issue). What is interesting is that Facebook is doing it.

Auto Updates are part of the Android store already, so this doesn't even offer new functionality. However, it does offer Facebook a couple interesting options.

1) They could force users to update, possibly to versions with more permissions. The keyword here is force, which the Play store won't do.

2) They could update devices that don't use the Play or Amazon store, if the application was somehow on the phone (from the carrier or manufacturer, perhaps). I think this is most likely.

3) They could remove most permissions from the Facebook app on the store, only to have the app request them after requiring an update.

Re: Facebook allegedly skirts Google Play store with latest update

#12

Post by randallu » Fri, Mar 15, 2013, 5:36 PM UTC

sp332 wrote: post #8

ishansharma wrote: post #4

Why does this make big headlines? Does it somehow violate Google's Terms and Conditions or is it something that hasn't been done before? P.S. I am not an Android user, so I might be unaware of obvious benefits/harms.

This might be unexpected, but I can't see how it would violate any ToS. Google explicitly allows alternative app stores and side-loading apps. Even apps sold through the play store often have in-app purchases which significantly change the app functionality. I think changing permissions after being installed is pretty odd. Other than that, this has been done before. The Battle for Wesnoth app is just a wrapper that d…

Presumably this downloads new executable code (or bytecode) rather than data. I could put up a shell app which does the same thing to download exploits after a while. This is why Apple has the "don't download code" rule (and why they had a "no interpreters" rule).

So maybe it's OK in the ToS right now, but I can understand why it shouldn't be OK, especially on a platform with so many local exploits (like Samsung's world-writable /dev/mem equivalent, etc).

EDIT: Actually they're just grabbing a new APK, which is weirder in a way since they are literally duplicating the Play Store mechanism but avoiding the good things that the Play Store tries to do for customers (static analysis for security risks, etc). Why wouldn't they just notify the user that a new version is available from Play? Bizarre choice.

Re: Facebook allegedly skirts Google Play store with latest update

#13

Post by Mahn » Fri, Mar 15, 2013, 6:06 PM UTC

This is bad. Facebook doing this can potentially lead other devs following, and if this happens we'll end up in a ecosystem mess where every app does whatever it well pleases.

Re: Facebook allegedly skirts Google Play store with latest update

#14

Post by fps » Fri, Mar 15, 2013, 6:19 PM UTC

lost_name wrote: post #11

I don't think it's important that just any app is "skirting the store" (plenty do that already, it's not an issue). What is interesting is that Facebook is doing it. Auto Updates are part of the Android store already, so this doesn't even offer new functionality. However, it does offer Facebook a couple interesting options. 1) They could force users to update, possibly to versions with more permissions. The keyword h…

Plenty of apps force updates through the play store by disabling functionality remotely in the currently installed application. I've had games and other applications that have no legitimate need for remote server interactions become disabled because a newer version is available, where any attempt to launch the application redirects to the play store page instead. This isn't good, and most of those applications don't last on my devices, but that isn't a completely unheard of practice.

Re: Facebook allegedly skirts Google Play store with latest update

#15

Post by sp332 » Fri, Mar 15, 2013, 8:13 PM UTC

cbhl wrote: post #10

Sujan wrote: post #3

How are they doing that technically?

They're just distributing the APK, and having you install it manually, from the looks of it.

But by default, doesn't Android refuse to install APKs that don't come from the Play store?

Re: Facebook allegedly skirts Google Play store with latest update

#16

Post by SixteenBlue » Fri, Mar 15, 2013, 8:43 PM UTC

sp332 wrote: post #15

cbhl wrote: post #10

Earlier quoted context omitted.

They're just distributing the APK, and having you install it manually, from the looks of it.

But by default, doesn't Android refuse to install APKs that don't come from the Play store?

Yes, that's the default setting. So your options are to change that setting and update, get constantly buzzed with notifications to update, or uninstall. I uninstalled.

Re: Facebook allegedly skirts Google Play store with latest update

#17

Post by emil10001 » Fri, Mar 15, 2013, 11:38 PM UTC

I wrote a post on why this is a really bad idea: http://www.recursiverobot.com/post/45447666701/facebook-upda...

Re: Facebook allegedly skirts Google Play store with latest update

#18

Post by cbhl » Sat, Mar 16, 2013, 1:52 AM UTC

SixteenBlue wrote: post #16

sp332 wrote: post #15

Earlier quoted context omitted.

But by default, doesn't Android refuse to install APKs that don't come from the Play store?

Yes, that's the default setting. So your options are to change that setting and update, get constantly buzzed with notifications to update, or uninstall. I uninstalled.

Sadly, this is sucky on both ends of the equation.

When I interned at Facebook two years ago, it was a PITA to change the API to work around bugs that were fixed in old versions of FB4A because people wouldn't upgrade -- whereas the vast majority of iOS users upgraded the Facebook app within days of a new release showing up in the App Store. The addition of non-Play devices makes this even worse.

Granted, I had my own reasons for not wanting to upgrade, so I can sympathize with users, too. (Facebook was pre-installed on my device, and upgrading caused it to take up space in the 180 MB volatile/userdata partition on my Nexus One. I eventually solved the issue by buying a Galaxy Nexus, but I recognize not everyone can buy new phones that frequently.)

Re: Facebook allegedly skirts Google Play store with latest update

#19

Post by cbhl » Sat, Mar 16, 2013, 1:58 AM UTC

sp332 wrote: post #15

cbhl wrote: post #10

Earlier quoted context omitted.

They're just distributing the APK, and having you install it manually, from the looks of it.

But by default, doesn't Android refuse to install APKs that don't come from the Play store?

I still think that is a terrible default for the truly paranoid.

Google could, at any time, initiate a cloud-to-device intent to install arbitrary software that you "wanted" from Google Play. They don't unless they ask you to, but the capability is there.

The bigger thorn is if you're on a device where the manufacturer or carrier has hidden or removed the option to install arbitrary APKs.

Re: Facebook allegedly skirts Google Play store with latest update

#20

Post by cbhl » Sat, Mar 16, 2013, 2:01 AM UTC

duaneb wrote: post #2

I know this is commonplace on desktops, but it really freaks me out on my phone. Especially with Facebook's track record of, say, going through my contacts and adding the facebook "email" (which nobody in their right mind would use over a real email system), consistently (but technically legally) violating my privacy, and enabling opt-out "features" that are usually unasked for and unwanted. In short, Facebook is the…

Technically, Google can install arbitrary software on your phone -- Google Play installations are served by "push", not "pull".

If you own a cell phone, you're already screwed from a privacy standpoint with carriers tracking which tower you're connected to.

tl;dr: You should be freaked out, but not by this.