23 ms·

Android now forces apps to include proprietary code for push notifications

665 points by lelf 7y ago

geofft 7y ago
You can still write free software that uses it and produces a not-entirely-free artifact when compiled, though, right? (Is there a distribution restriction on the artifact, or is it impermissible to link it with GPL apps, or something?) I'm curious if the free software apps are compelled not to link it to preserve the free software status of their code, or just voluntarily refusing on principle (which is laudable, to be clear).
- icebraining 7y ago
  Only if you are the author of all the code, so that the GPL doesn't actually apply to you. In this case, the Telegram-FOSS people take the original Telegram source (which is GPL licensed) and redistribute it, so they can't distribute a non-entirely-free apk without violating the original license. Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff.
  - saagarjha 7y ago
    Telegram violates multiple open source licenses, so I wouldn’t hold it up as an example.
    - krn 7y ago
      > Telegram violates multiple open source licenses Any examples for those who would like to learn more about this?
      - lloeki 7y ago
        Interested too. There seems to be a lot of Telegram bashing but every assertion I saw eventually failed to be backed up†, if at all attempted. This ends up triggering my BS detector every single time, and the significant influx of such occurrences makes me think of some astroturfing/FUD campaign. † I also do my homework when fact checking, but failed to turn up anything relevant, only more non-backed up assertions or obviously inflated beyond proportion facts twisted beyond recognition. I may very well miss something, that's why if backing up material is known by the detractors it's always worthwhile to share (which applies to any pro/con discussion really)
        saagarjha 7y ago
        I’m doing the research work for you, though it’ll be a while before I can stop procrastinating for long enough to write a whole thing about it. While you wait, https://github.com/overtake/TelegramSwift/issues/163 https://github.com/overtake/TelegramSwift/issues/163 is probably a good start.
      - saagarjha 7y ago
        I have a thing I’m writing that will go into more detail, but in short Telegram’s client applications (which are licensed under various incarnations of the GPL) are updated frequently while the source code in their publicly available repositories lags far behind. In addition, they use a number of open source libraries that at the very least require attribution, but Telegram does not follow their terms.
        mehrdadn 7y ago
        > while the source code in their publicly available repositories lags far behind I don't think this violates GPL. GPL requires you to be able to receive the source if you want to, not that it be on an online repository. You might have to request it and have it sent to you.
        saagarjha 7y ago
        I mean, I could, but I think it's fair for me to assume that the GitHub repository that the official website links to as the source code for their client is where they’d publish up-to-date code.
        mehrdadn 7y ago
        They might well publish it right there if you ask. Just saying they haven't violated the license as long as they have a written offer to provide you with the source code somehow if you ask. (That's what GPLv2 seems to require.)
        Conan_Kudo 7y ago
        They provide no alternative "written offer". On the website, they directly point to GitHub for the source code offer: https://telegram.org/apps#source-code https://telegram.org/apps#source-code
        saagarjha 7y ago
        I have asked.
      - DannyBee 7y ago
        FWIW: It's trivially true on Android, at least in the world they posit. The FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android/AOSP is Apache v2. Additionally, their own codebase contains a bunch of Apache v2 licensed stuff, like exoplayer2, recyclerview, libtgvoip, fastdateparser, ABSL, etc. They do not appear to be even giving attribution as required (or at least i can't find it) They are in no worse a position than they were yesterday: >ag -Ri apache will produce tons of matches like this one: TMessagesProj/jni/libtgvoip/webrtc_dsp/absl/strings/internal/m emutil.cc 3:// Licensed under the Apache License, Version 2.0 (the "License"); 7:// http://www.apache.org/licenses/LICENSE-2.0
    - icebraining 7y ago
      Irrelevant; they can still sue the Telegram-FOSS team, even if they are themselves in violation of other licenses.
      - saagarjha 7y ago
        I’m not fully aware of the situation regarding Telegram-FOSS, but I’d assume Telegram can sue them for license violations regarding code that they own the rights to.
    - kemonocode 7y ago
      I have yet to see any proof of this. Granted, it's true that Telegram's backend is closed-source and that part of the infrastructure is completely opaque, but at least they're sincere about it, unlike Signal's open-but-not-quite[1] approach. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
      - saagarjha 7y ago
        > I have yet to see any proof of this. See https://github.com/overtake/TelegramSwift/issues/163 https://github.com/overtake/TelegramSwift/issues/163. I don’t know too much about Signal other than the fact that it exists, so I can’t judge it in comparison to Telegram.
  - caf 7y ago
    Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff. Or even just copying bits of GPL-licensed code in themselves.
- deleted 7y ago
  [deleted]
- userbinator 7y ago
  Thought experiment: write an application that automatically downloads and combines code with all sorts of legally incompatible licenses to create an application and installs it on an Android device. If personally doing it is legal (and basically unenforceable), what about making it easy for others to? Besides, unless you're a "radical Stallmanist" (for lack of better term), chances are you have a mix of proprietary and FOSS and use it together on whatever data you work with. This is why I think IP laws make no sense, arbitrary restrictions are arbitrary and stupid.
  - tannhaeuser 7y ago
    IANAL, but I think that would be regarded as a circumvention device by a court. I hope you're not basing your opinion regarding laws entirely on this contrived case :)
    - gpderetta 7y ago
      which 'effective' access control prevention would this circumvent?
  - Wowfunhappy 7y ago
    My understanding is that what you describe is completely legal. ZFS on Linux is a good example of this. ZFS and the Linux kernel are both open source, but their licenses are incompatible with one another—ie, you can't combine the code. A common workaround for this problem is to compile the source on the user's machine. When you install ZFS in Debian, apt will automatically download the ZFS and Linux source code, recompile the kernel with ZFS included, and install the result. This is all completely invisible to the user, except for the absurdly long install time.
    - mnw21cam 7y ago
      Note - Debian only compiles and installs a kernel module for ZFS, which isn't quite as extreme as compiling the entire kernel.
- krn 7y ago
  Ubuntu gets around any possible GPL violations by offering to download and install proprietary drivers (ex., Nvidia) and codecs during installation process. Could something similar work for Android apps?
  - jimmaswell 7y ago
    GPL seems like it gets in the way more than it helps.
  - izacus 7y ago
    Yes, it would work - you could deliver the push notification module as a separate APK which talks to the main application part. It's still way more complexity than adding a GPL lib to your app.
  - antpls 7y ago
    Just curious, does it means that a proprietary application downloaded through an open-source GPL script makes the whole (application + script) "GPL compliant" ?
  - seba_dos1 7y ago
    The mechanism used by Ubuntu for such drivers is completely unrelated to GPL violations. It's just there so the non-free software doesn't get installed by default. If there would be any violation without it, there would still be a violation with it.
- javagram 7y ago
  https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html > The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. so anything that is not distributed with the operating system needs to be available as source code, so that you can credibly offer to distribute the source code to the recipients.
jmkni 7y ago
I'd love to know just how different/bare bones AOSP (Android Open Source Project) is to regular Android. As an experiment, I'd love to compile it, put it on a spare phone and use it as my daily driver for a week.
- grenoire 7y ago
  Practically, it's very difficult. LineageOS people are trying to work on that, but it's just a very big hassle with the variety of OEM components running amok the industry.
  - jmkni 7y ago
    I'll check out LineageOS, thanks
- iaml 7y ago
  You won't get play store, default apps and apps from store itself. You can install f-droid, some other store or use microG as replacement for google services and apkmirror as a store, but you'll probably have some problems with compatibility.
- realusername 7y ago
  You can't get anything running with AOSP, there's not a single common phone which would run without random Android blobs & custom kernel changes. Then once you add those blobs, you need to add MicroG to have any hope to run any moderately popular app.
- Iolaum 7y ago
  You can get a close enough view on this by finding a phone supported by LineageOS and installing it without anything esle (e.g. no fdroidPriviligedExtension, no openGapps etc). Alternatively, or maybe even better to what you ask, if you have a Pixel phone you can build RattlesnakeOS, again without adding anything like openGapps, which is almost pure AOSP iirc.
- pzmarzly 7y ago
  I was using clean LineageOS for over 2 years, recently switching to LineageOS+microG. I'm using APKPure and F-Droid for apps, Chrome for browsing (as in Firefox, last time I checked, one tap separates you from losing all open tabs). Some apps refuse to work or break (e.g. Bitwarden does not sync), some have degraded functionality (e.g. WhatsApp sometimes does not ring when someone is calling you), many are just spamming "This program will not run without Google Play Services" (but there is Xposed module called something like "This program will run" that gets rid of these). In case of Google Maps, I'm using old version (9.69.1), and for Youtube, I'm using NewPipe. Overall I liked the experience, battery life (especially with greenify) was amazing.
hajxg 7y ago
I like Reddit comments, they are always so insightful. I always feel like I've gained a few IQ points after reading them; after an evening reading Reddit, I became Einstein, now I'm testing my new theory of everything. Thanks Reddit
- sascha_sl 7y ago
  Funny, I always get that reading HN comments, but then again, I can't really compare, I've cut down on reading reddit comments years ago, maybe it's time I follow suit for HN.
Mbaqanga 7y ago
One day Google will regret having made Android open source and will try to fix it, but is it possible?
- TeMPOraL 7y ago
  I think they already do. Isn't it what Play Services is really all about?
  - squarefoot 7y ago
    They never did. Releasing the source contributed creating the developers ecosystem we have today. What Google fears more than the Armageddon would be someone making a truly FOSS operating system capable of running on Android devices, and they prevent that by keeping device drivers and firmware tightly locked.
    - extropy 7y ago
      IMO Android is working towards having a compatibility layer so that drivers can be freely shared across distros. Look up Project Treble.
      - imtringued 7y ago
        That still requires cooperation from the SoC vendors. If they aren't interested then Treble will go nowhere.
        lern_too_spel 7y ago
        Treble is required by the Vendor Test Suite for Android 8 and higher. https://source.android.com/devices/architecture https://source.android.com/devices/architecture
        anchpop 7y ago
        This is probably still in Google's best interest, since it greatly reduces the cost for OEMs to distribute updates (and updates are one area where Android severely lags behind iOS)
deogeo 7y ago
Perhaps it is time to treat Google as the enemy, because that is how it is treating us.
- throwayEngineer 7y ago
  Google puts 1 restriction, they are the enemy. Apple has created priopritary connectors, closed off systems, paid barriers to entry, and banning apps from their store. Where is Apple and Microsoft on the scale from Friend to Enemy?
  - pfortuny 7y ago
    Hi. Nobody said they are the friends here. Just that Google is not.
    - SketchySeaBeast 7y ago
      In this case I guess there are no friends, only enemies?
      - throwayEngineer 7y ago
        Rank the enemies since op avoided that. Since things are not black and white, it should be reasonable to differentiate between Apple, Google, and Microsoft.
      - entropea 7y ago
        The corporation will put its best interests before anyone else's. Doing something like this where 99% of the world won't know or even care is likely in their best interests no matter how unethical its actions are. There tend to be very few true 'friends' because of it. People are normalized to this corporate dance and keep expecting less and less for more.
    - ajross 7y ago
      On HN, the overwhelmingly common paradigm is that conflict in the tech industry is to be understood as part of a existential conflict between Apple and Google. A comment that starts "Google is evil" is all but guaranteed to come from someone with a iOS device in her pocket. And in this case I think the point is valid: this policy is bad, both because battery management and notification policy really needs to be part of the core OS in AOSP and not a proprietary add-on and because of the licensing glitch reported here where the client library isn't GPL-compatible. But that's just one policy. Across the fence of the war mentioned above, it's a GPL-incompatible wasteland where absolutely nothing is possible at all. If you care about free software in the abstract and want to view your war along those lines: Google is behaving badly and needs to be admonished. Apple is clearly The Enemy.
shawnz 7y ago
I think this is misleading. To me it seems the issue is that app developers are being forced to use the proprietary Firebase service, but they are NOT being forced to use a proprietary library from what I can tell. The library in fact DOES have an open source version available: https://firebaseopensource.com/projects/firebase/firebase-android-sdk/ https://firebaseopensource.com/projects/firebase/firebase-an...
- Tepix 7y ago
  Nope! firebase-messaging is missing from this open source version.
  - evilDagmar 7y ago
    Sounds like an opportunity for someone to sit down and write one. The API and docs for it are fairly palatable and offer some very reasonable guidance on things like exponential backoff. It still doesn't mean that they're going to be able to go without a persistent notification if they want to run their own background service, but that's a change that everyone is required to deal with. "Secret" background services were abused egregiously by bad actors and sloppy coders alike in the past and it's time for that to stop. This carp some people are floating about it incurring "warning" is nonsense--if they looked at the developer docs they'd see how easy it is to avoid that happening.
- icebraining 7y ago
  From what I can tell, you need firebase-messaging, which doesn't seem to be on that list. Am I reading it wrong? Edit: seems I was reading correctly: https://github.com/firebase/firebase-android-sdk/issues/125#issuecomment-481566392 https://github.com/firebase/firebase-android-sdk/issues/125#...
  - shawnz 7y ago
    Ah, thanks for the clarification.
kartan 7y ago
> Problem: The Firebase Android client library is proprietary, meaning FOSS apps can not use it. Apps that do not comply are reported to the user as "using too much battery". This is a standard on the industry. From 1999: https://www.theregister.co.uk/1999/11/05/how_ms_played_the_incompatibility/ https://www.theregister.co.uk/1999/11/05/how_ms_played_the_i... It doesn't matter how much money Google is going to have to pay in the future as a fine for this practice. The amount of money that they will get for kicking out the competition is going to be way higher. That is a learned lesson from Microsoft (and probably others before them).
- pfortuny 7y ago
  So, if I understand correctly, the GPL prevents you from using a non-free library in your code? (Asking honestly: I have tried to find this elsewhere but the FSF page on the GPL is rather ... convoluted). If that is so, then this is obviously a killer and quite seemingly arbitrary requirement. Your MS example is quite good.
  - striking 7y ago
    Your code is no longer completely FOSS when you do that. It depends on a binary blob that you can't see into.
    - pfortuny 7y ago
      Yes, yes, but I guess BSD-licence-using developers do not care too much about it.
    - astazangasta 7y ago
      Dependencies are different than source code. You can write FOSS that runs on Windows, which is a dependency and not FOSS.
      - bscphil 7y ago
        As long as it doesn't require linking to a proprietary Windows library to interface with the NT api. That would violate at least the GPL 2. Though you could do it yourself, and release your own code as GPL (and the combined work as proprietary), no one else could distribute the full work under the GPL because of the incompatibility.
kbumsik 7y ago
I'm not an Android dev, but according to the source in the article [1] this limitation is applied since Oreo, which is released two years ago. Why this problem arises today? [1]: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/master/Notifications.md https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...
- icebraining 7y ago
  Until April 11, 2019 you could use GCM instead of the Firebase system.
  - veeti 7y ago
    The GCM client is/was also proprietary. There is nothing new here.
megous 7y ago
Can this fall under system library exception? For example if you're building mingw32 based GPL C app, you're linking to all kinds of windows system libraries and there's no need for them to be under GPL. If this notification library is available to anyone on Android and is part of the Android system platform, can it be the same, like some DLL that does notifications on windows?
- izacus 7y ago
  No it doesn't, because the code that receives push notifications isn't part of AOSP.
  - shawnz 7y ago
    But my "system" isn't AOSP. It's my OEM's specific packaging of AOSP along with Google services and other components. Why should the line be drawn around AOSP specifically?
- jakear 7y ago
  I think it depends on if the library is distributed with the app or with the system. In this case, the library would be distributed with the app I believe, meaning it would not be exempted.
  - damnyou 7y ago
    I think this is true for GPLv2 but not for v3. But IANAL.
    - deleted 7y ago
      [deleted]
ddrager 7y ago
This has been coming for a while. We attempted to create a push-based notification system based on MQTT. It worked well, then the notifications started getting lost. Turns out, the receiver service was getting killed in the background. We found out the best way to get reliable notification was through Google's own GCM (which has now moved to Firebase Cloud Messaging. We learned its incredibly difficult, if not impossible to build an app (with reliable notifications) that do not use Google services. You can say its in an effort to maximize battery resources, which I totally understand, but by requiring a Google service (and now library) you are truly tied in to and reliant on their systems. BTW, as others have pointed out, there are open source Firebase libraries (https://firebaseopensource.com/projects/firebase/firebase-android-sdk/ https://firebaseopensource.com/projects/firebase/firebase-an...)
- bchimp 7y ago
  This has been true for awhile once they forced apps to use API26 or higher (if you want to be listed in the Play store, and really, there is no other place if you want decent exposure.) I had a similar experience switching from "real background" to using FCM. I understand the battery saving motivation, but the problem is that the performance of the google service is terrible. The response time of my simple notification system was nearly instantaneous, but OK google, I'll play your game. I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM. Reading the google docs, apparently google will deprioritize notifications that are shown but "not intereacted with" in a timely manner, so that is another source of delay. I think the crux of the matter is that notifications have multiple purposes: signaling, and advertising, etc. Google hasn't provided a way for an app to declare its use case. So, you get policies to prevent notification spam creeping in and messing with basic app signaling functionality. In the end, I kept both my "in-house" notifications for use by older Androids, and a kluge that uses FCM in addition, with some hacks to get somewhat better FCM performance. I live with the notification in Oreo+ and just tell users to ignore it (but honestly, I don't think users care that much.)
  - antpls 7y ago
    > I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM. (from what I remember of some android documentations) Your definition of "high priority" is different from Google's one, which is also different from the end-user's definition. Google probably favors the end-user's preferences more than the developer's preferences. If the user wants all notifications asap from a particular app, the system will do a best effort to deliver, given all the other apps notifications and the current battery level.
gdrift 7y ago
I think the only difference is that foreground service must show a notification that's all. Users will learn to just disable those useless notifications.
Ajedi32 7y ago
So to summarize, to save battery all notifications on Android (since two versions ago) have to go through a single notification service (rather than each app having the option of continuously running in the background and maintaining a connection with its own notification service). Recently Google killed their GCM notifications service in favor of Firebase Cloud Messaging, which (unlike GCM) unfortunately doesn't have an open source library available for it at the moment. Does that sound right so far? Anyway, the Telegram-FOSS team claims that this doesn't _actually_ save battery: > Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification. But this seems rather unlikely to me. Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? Or am I just misreading that statement?
- runeks 7y ago
  > Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? A single application running in the background probably uses only a small amount of extra power compared to the notification service alone. However, a couple dozen applications -- all running in the background in order to enable notifications -- probably consume a lot more power than a single service.
  - Ajedi32 7y ago
    There's also a wide variety of possible implementations of a notification service, and not all of them will necessarily be as power efficient as what Telegram-FOSS does.
    - AstralStorm 7y ago
      And Android's battery monitoring should flag them accordingly, not rely on presence of some library.
      - ahupp 7y ago
deleted 7y ago
[deleted]
jcriddle4 7y ago
Google probably wants one stream of data coming in that they have complete access to. Also probably make it more convenient to tap for the NSA
- 5trokerac3 7y ago
  This was my first thought as well. If you can't get encrypted messaging apps to use the SMS service siphon you can at least snag notification text - and most people allow the message to be in the notification.
deleted 7y ago
[deleted]
segmondy 7y ago
Google is one of the most evil companies out there for a company that started out with don't be evil. The have some very smart people, some amazing tech, but unfortunately they have some very evil people working for them help bent on maintaining their advantage by any means necessary. Without using Google's push notifications, you are going to end up with something that works about 75% of the time. When this first started happening to me, I lost tons of time thinking it was a bug only to finally realize I needed to use Google's library to get reliability for what once worked.
- throwayEngineer 7y ago
  >Google is the most evil, of the companies that started with "don't be evil". Curious, what companies use that same phrase you are comparing it to? Or if that isn't what you meant, where is Apple and Microsoft on the Good vs Evil dichotomy?
jchw 7y ago
I was confused for a moment because I thought the Firebase SDK was open source. Interestingly, though, the Android version appears to be only partly open source. I did not find an explanation as to why some of the source is not available, it is mentioned on the Github repository but not explained. In any case, I don’t see the code for Cloud Messaging in there. It may not be that it is done out of secrecy, though. A cursory glance of the iOS SDK shows what seems to be the full iOS portion of Firebase Cloud Messaging: https://github.com/firebase/firebase-ios-sdk/tree/master/Firebase/Messaging https://github.com/firebase/firebase-ios-sdk/tree/master/Fir... Though that also raises its own question: doesn’t iOS effectively enforce APNS, and all third party providers actually must go through that? I imagine going through a single provider really can improve battery life. Each push provider needs to background fetch. FWIW, as far as I know, FCM and APNS are both free to use indefinitely. I’ve always found this a bit perplexing since I can’t even really fathom how many messages an app like Facebook or Twitter would push per month. I wonder what the odds are of this ever changing. The cynical viewpoint could go either way. At face value, this really does seem problematic for open source projects. Can a GPL app link to (the non-open parts of) the Firebase SDK? My guess would be no. Hope this can be resolved :( There’s some really great stuff on F-Droid, like Amaze file manager. (Disclosure: I work for Google, but not on Android. I don’t even use Android phones anymore.)
- habosa 7y ago
  [Firebase team member here] Our goal is to open source all of our SDKs, and we have steadily open-sourced more of them over time. The SDKs you see on GitHub right now are all standalone, they don't require communicating with Google Play services running on the device. Our bar for moving an SDK to GitHub is that it has to be more than a source dump, it must be the source of truth for that team's development. Right now that's not possible for FCM because of the dependency it has on Google Play services.
  - jchw 7y ago
    Thanks for the clarification, seems pretty straightforward to me.
  - 7y ago
mtgx 7y ago
And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while. If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.
- lern_too_spel 7y ago
  Signal already implements it. Signal uses E2E encryption, so your attack vector doesn't work. https://community.signalusers.org/t/gcm-will-be-removed-from-google/3888/41 https://community.signalusers.org/t/gcm-will-be-removed-from...
  - buildzr 7y ago
    > Signal uses E2E encryption, so your attack vector doesn't work. End-to-end encryption is just that. That Firebase library is running on the client phone (aka, an end), if Google put code into the library allowing it to download updates it would also be running in Signal's context which would allow it to trivially dump and exfiltrate messages, memory, etc from the Signal process. Now, we have no reason to believe such a mechanism is used here to my knowledge, but if they really wanted to, it would defeat end-to-end encryption.
    - lern_too_spel 7y ago
      In that case, Signal can run the integration in another process. It's extra work, but it also gets around the GPL issue for the main application, so if Google doesn't solve that itself, it's easy for someone else to and share the solution with everybody. It would also be easy to spot if Google put an updater inside the library because the requested permissions for using the library would change.
    - shawnz 7y ago
      If this is your angle, then they wouldn't need you to load any library for them to be able to do this attack. They have root, so they could do the attack regardless of firebase being open source.
ridaj 7y ago
Misleading title... Real title something like: apps that use Android push notifications without Firebase, including GPL-licensed apps, now reported as "using too much battery"
paulcarroty 7y ago
Good luck for people who still believe in marketing term "Android is Open Source".
- lern_too_spel 7y ago
  How does this change that?
orblivion 7y ago
So are we, fans of FOSS, all-in on the Librem phone at this point?
- ocdtrekkie 7y ago
  I'm just waiting to find out if someone will get Librem 5 working with a Verizon approved networking module before I jump in. But yes, very excited.
DannyBee 7y ago
Since the FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android libraries are usually Apache 2.0, you have always had a problem. They also use a ton of Apache2 libraries (at least 5 or 6) directly in their source repo. They don't appear to even bother to properly give attribution/etc for the used software, so yeah.
- coding123 7y ago
  This is so damn true I am LMAO at the other comments. So basically the entire community can get around the problem by releasing an Apache2 lic'd library that wraps whatever it is they need from firebase. We'd be at a place no different from any other "FOSS" App on android today. And https://opensource.stackexchange.com/a/4642 https://opensource.stackexchange.com/a/4642
evilDagmar 7y ago
This is pretty darned incorrect on a number of fronts. Skipping for the moment that a random histronic Reddit post is being considered "news"... > "Google started leveraging its de-facto monopoly on Android distributions by forcing all apps to use its proprietary service Firebase for push notifications." A number of logical leaps of faith need to be made before the word "force" carries any truth, but no one's "forcing" anyone to do anything. A developer can still use the FCM or not, it's up to them. If a developer simply refuses to interface with any sort of proprietary code then it's a wonder they'll touch any commercial product at all (iOS included). ..and since Telegram-FOSS were cited as a source for this mess, here's the very first part of [i]their[/i] statement, which is also not true: > Since Android 8.0 Oreo, Google doesn't allow apps to run in the background anymore, requiring all apps which were previously keeping background connection to exclusively use its Firebase push messaging service. Sooo very not true. Android [i]does[/i] still allow apps to run in the background. The developer docs caution against doing so without good reason because so many developers try very hard to ignore the lifecycle methods, resulting in many wasted clockcycles and reduced battery life. But the Telegram team didn't stop there, so let's unpack the rest: > Sadly, if the app would set the notification to lower priority (to hide it a bit in the lower part of the notification screen), you would immediately get a system notification about Telegram "using battery", which is confusing and is the reason for this not being the default. Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification. First, it's not a "warning". It's simply a statement. ...and yes, if you're going to maintain a separate push notification service of your own (I'm looking at [i]you[/i], Facebook.) you [i]are[/i] going to be using at least a few clockcycles. There's no way around this. The backgrounded apps notification is also as "judgement free" as any notification can possibly get. On my phone right now, running Android 8.0... "3 apps are using battery". One of these is my own app (which happens to be a homescreen widget), another is Life360, and another is GSam Battery Monitor. Tap that notification and a list appears, headed up with "Apps running in background" with "Tap for details on battery and data usage" and lists the apps with their icons. Tap one and it shows what resources the app [i]is[/i] actually using. GSAM... 52Mb of RAM, and ~55kB of data in the last month. 0% battery used since last full charge. My app, 0% battery (probably not enough to count as a whole percent) use since last full charge, 5.84MB of internal memory, no data usage. I don't know how other people might view them, but to me these seem like vindications. None of that information is being presented in any way that that should be construed as condemning or accusatory, let alone "misleading". If Telegram-FOSS doesn't want users throwing a fit about their resource usage, perhaps they should spend a little time grooming user expectations to be more reasonable. The reddit user who posted this mess, on the other hand... A five-year old account that only occasionally posts anything that doesn't smell of astroturf, and this one post is nearly 80% of their karma. Seems like they've decided to make a foray into outrage-farming.
Khaine 7y ago
“the definition of open: "mkdir android ; cd android ; repo init -u git://android.git.kernel.org/platform/manifest.git ; repo sync ; make"” [1] Not anymore. Having basic android open source help when everything is pushed into the proprietary play store [1] https://mobile.twitter.com/Arubin/status/27808662429 https://mobile.twitter.com/Arubin/status/27808662429
EGreg 7y ago
What do you mean FOSS apps can’t use a proprietary library? The library’s license says that it cannot be used by AGPL software? Because if not, the FOSS authors can just make builds for Android with it.
DigitalTerminal 7y ago
I am confused. The repo you linked to hasn't had a release since 2016, and I cannot find a reference to that library ANYWHERE else. The firebase android sdk, which is what I would guess you would use (though I don't do android, so could still be wrong) is apache. What am I missing?
astannard 7y ago
Amoungst this big thread, I've not noticed any evidence for this and the original article does not back this up with anything. Is the allegation that google are using battery warnings to push people towards using firebase notifications? Has anyone any experience of this?

665 points by lelf 7y ago

You can still write free software that uses it and produces a not-entirely-free artifact when compiled, though, right? (Is there a distribution restriction on the artifact, or is it impermissible to link it with GPL apps, or something?) I'm curious if the free software apps are compelled not to link it to preserve the free software status of their code, or just voluntarily refusing on principle (which is laudable, to be clear).

icebraining 7y ago
Only if you are the author of all the code, so that the GPL doesn't actually apply to you. In this case, the Telegram-FOSS people take the original Telegram source (which is GPL licensed) and redistribute it, so they can't distribute a non-entirely-free apk without violating the original license. Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff.
- saagarjha 7y ago
  Telegram violates multiple open source licenses, so I wouldn’t hold it up as an example.
  - krn 7y ago
    > Telegram violates multiple open source licenses Any examples for those who would like to learn more about this?
    - lloeki 7y ago
      Interested too. There seems to be a lot of Telegram bashing but every assertion I saw eventually failed to be backed up†, if at all attempted. This ends up triggering my BS detector every single time, and the significant influx of such occurrences makes me think of some astroturfing/FUD campaign. † I also do my homework when fact checking, but failed to turn up anything relevant, only more non-backed up assertions or obviously inflated beyond proportion facts twisted beyond recognition. I may very well miss something, that's why if backing up material is known by the detractors it's always worthwhile to share (which applies to any pro/con discussion really)
      - saagarjha 7y ago
        I’m doing the research work for you, though it’ll be a while before I can stop procrastinating for long enough to write a whole thing about it. While you wait, https://github.com/overtake/TelegramSwift/issues/163 https://github.com/overtake/TelegramSwift/issues/163 is probably a good start.
    - saagarjha 7y ago
      I have a thing I’m writing that will go into more detail, but in short Telegram’s client applications (which are licensed under various incarnations of the GPL) are updated frequently while the source code in their publicly available repositories lags far behind. In addition, they use a number of open source libraries that at the very least require attribution, but Telegram does not follow their terms.
      - mehrdadn 7y ago
        > while the source code in their publicly available repositories lags far behind I don't think this violates GPL. GPL requires you to be able to receive the source if you want to, not that it be on an online repository. You might have to request it and have it sent to you.
        saagarjha 7y ago
        I mean, I could, but I think it's fair for me to assume that the GitHub repository that the official website links to as the source code for their client is where they’d publish up-to-date code.
        mehrdadn 7y ago
        They might well publish it right there if you ask. Just saying they haven't violated the license as long as they have a written offer to provide you with the source code somehow if you ask. (That's what GPLv2 seems to require.)
        Conan_Kudo 7y ago
        They provide no alternative "written offer". On the website, they directly point to GitHub for the source code offer: https://telegram.org/apps#source-code https://telegram.org/apps#source-code
        saagarjha 7y ago
        I have asked.
    - DannyBee 7y ago
      FWIW: It's trivially true on Android, at least in the world they posit. The FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android/AOSP is Apache v2. Additionally, their own codebase contains a bunch of Apache v2 licensed stuff, like exoplayer2, recyclerview, libtgvoip, fastdateparser, ABSL, etc. They do not appear to be even giving attribution as required (or at least i can't find it) They are in no worse a position than they were yesterday: >ag -Ri apache will produce tons of matches like this one: TMessagesProj/jni/libtgvoip/webrtc_dsp/absl/strings/internal/m emutil.cc 3:// Licensed under the Apache License, Version 2.0 (the "License"); 7:// http://www.apache.org/licenses/LICENSE-2.0
  - icebraining 7y ago
    Irrelevant; they can still sue the Telegram-FOSS team, even if they are themselves in violation of other licenses.
    - saagarjha 7y ago
      I’m not fully aware of the situation regarding Telegram-FOSS, but I’d assume Telegram can sue them for license violations regarding code that they own the rights to.
  - kemonocode 7y ago
    I have yet to see any proof of this. Granted, it's true that Telegram's backend is closed-source and that part of the infrastructure is completely opaque, but at least they're sincere about it, unlike Signal's open-but-not-quite[1] approach. [1] https://signal.org/blog/the-ecosystem-is-moving/ https://signal.org/blog/the-ecosystem-is-moving/
    - saagarjha 7y ago
      > I have yet to see any proof of this. See https://github.com/overtake/TelegramSwift/issues/163 https://github.com/overtake/TelegramSwift/issues/163. I don’t know too much about Signal other than the fact that it exists, so I can’t judge it in comparison to Telegram.
- caf 7y ago
  Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff. Or even just copying bits of GPL-licensed code in themselves.
deleted 7y ago
[deleted]
userbinator 7y ago
Thought experiment: write an application that automatically downloads and combines code with all sorts of legally incompatible licenses to create an application and installs it on an Android device. If personally doing it is legal (and basically unenforceable), what about making it easy for others to? Besides, unless you're a "radical Stallmanist" (for lack of better term), chances are you have a mix of proprietary and FOSS and use it together on whatever data you work with. This is why I think IP laws make no sense, arbitrary restrictions are arbitrary and stupid.
- tannhaeuser 7y ago
  IANAL, but I think that would be regarded as a circumvention device by a court. I hope you're not basing your opinion regarding laws entirely on this contrived case :)
  - gpderetta 7y ago
    which 'effective' access control prevention would this circumvent?
- Wowfunhappy 7y ago
  My understanding is that what you describe is completely legal. ZFS on Linux is a good example of this. ZFS and the Linux kernel are both open source, but their licenses are incompatible with one another—ie, you can't combine the code. A common workaround for this problem is to compile the source on the user's machine. When you install ZFS in Debian, apt will automatically download the ZFS and Linux source code, recompile the kernel with ZFS included, and install the result. This is all completely invisible to the user, except for the absurdly long install time.
  - mnw21cam 7y ago
    Note - Debian only compiles and installs a kernel module for ZFS, which isn't quite as extreme as compiling the entire kernel.
krn 7y ago
Ubuntu gets around any possible GPL violations by offering to download and install proprietary drivers (ex., Nvidia) and codecs during installation process. Could something similar work for Android apps?
- jimmaswell 7y ago
  GPL seems like it gets in the way more than it helps.
- izacus 7y ago
  Yes, it would work - you could deliver the push notification module as a separate APK which talks to the main application part. It's still way more complexity than adding a GPL lib to your app.
- antpls 7y ago
  Just curious, does it means that a proprietary application downloaded through an open-source GPL script makes the whole (application + script) "GPL compliant" ?
- seba_dos1 7y ago
  The mechanism used by Ubuntu for such drivers is completely unrelated to GPL violations. It's just there so the non-free software doesn't get installed by default. If there would be any violation without it, there would still be a violation with it.
javagram 7y ago
https://www.gnu.org/licenses/old-licenses/gpl-2.0.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.html > The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. so anything that is not distributed with the operating system needs to be available as source code, so that you can credibly offer to distribute the source code to the recipients.

jmkni 7y ago

I'd love to know just how different/bare bones AOSP (Android Open Source Project) is to regular Android. As an experiment, I'd love to compile it, put it on a spare phone and use it as my daily driver for a week.

grenoire 7y ago
Practically, it's very difficult. LineageOS people are trying to work on that, but it's just a very big hassle with the variety of OEM components running amok the industry.
- jmkni 7y ago
  I'll check out LineageOS, thanks
iaml 7y ago
You won't get play store, default apps and apps from store itself. You can install f-droid, some other store or use microG as replacement for google services and apkmirror as a store, but you'll probably have some problems with compatibility.
realusername 7y ago
You can't get anything running with AOSP, there's not a single common phone which would run without random Android blobs & custom kernel changes. Then once you add those blobs, you need to add MicroG to have any hope to run any moderately popular app.
Iolaum 7y ago
You can get a close enough view on this by finding a phone supported by LineageOS and installing it without anything esle (e.g. no fdroidPriviligedExtension, no openGapps etc). Alternatively, or maybe even better to what you ask, if you have a Pixel phone you can build RattlesnakeOS, again without adding anything like openGapps, which is almost pure AOSP iirc.
pzmarzly 7y ago
I was using clean LineageOS for over 2 years, recently switching to LineageOS+microG. I'm using APKPure and F-Droid for apps, Chrome for browsing (as in Firefox, last time I checked, one tap separates you from losing all open tabs). Some apps refuse to work or break (e.g. Bitwarden does not sync), some have degraded functionality (e.g. WhatsApp sometimes does not ring when someone is calling you), many are just spamming "This program will not run without Google Play Services" (but there is Xposed module called something like "This program will run" that gets rid of these). In case of Google Maps, I'm using old version (9.69.1), and for Youtube, I'm using NewPipe. Overall I liked the experience, battery life (especially with greenify) was amazing.

hajxg 7y ago

I like Reddit comments, they are always so insightful. I always feel like I've gained a few IQ points after reading them; after an evening reading Reddit, I became Einstein, now I'm testing my new theory of everything. Thanks Reddit

sascha_sl 7y ago
Funny, I always get that reading HN comments, but then again, I can't really compare, I've cut down on reading reddit comments years ago, maybe it's time I follow suit for HN.

Mbaqanga 7y ago

One day Google will regret having made Android open source and will try to fix it, but is it possible?

TeMPOraL 7y ago
I think they already do. Isn't it what Play Services is really all about?
- squarefoot 7y ago
  They never did. Releasing the source contributed creating the developers ecosystem we have today. What Google fears more than the Armageddon would be someone making a truly FOSS operating system capable of running on Android devices, and they prevent that by keeping device drivers and firmware tightly locked.
  - extropy 7y ago
    IMO Android is working towards having a compatibility layer so that drivers can be freely shared across distros. Look up Project Treble.
    - imtringued 7y ago
      That still requires cooperation from the SoC vendors. If they aren't interested then Treble will go nowhere.
      - lern_too_spel 7y ago
        Treble is required by the Vendor Test Suite for Android 8 and higher. https://source.android.com/devices/architecture https://source.android.com/devices/architecture
        anchpop 7y ago
        This is probably still in Google's best interest, since it greatly reduces the cost for OEMs to distribute updates (and updates are one area where Android severely lags behind iOS)

deogeo 7y ago

Perhaps it is time to treat Google as the enemy, because that is how it is treating us.

throwayEngineer 7y ago
Google puts 1 restriction, they are the enemy. Apple has created priopritary connectors, closed off systems, paid barriers to entry, and banning apps from their store. Where is Apple and Microsoft on the scale from Friend to Enemy?
- pfortuny 7y ago
  Hi. Nobody said they are the friends here. Just that Google is not.
  - SketchySeaBeast 7y ago
    In this case I guess there are no friends, only enemies?
    - throwayEngineer 7y ago
      Rank the enemies since op avoided that. Since things are not black and white, it should be reasonable to differentiate between Apple, Google, and Microsoft.
    - entropea 7y ago
      The corporation will put its best interests before anyone else's. Doing something like this where 99% of the world won't know or even care is likely in their best interests no matter how unethical its actions are. There tend to be very few true 'friends' because of it. People are normalized to this corporate dance and keep expecting less and less for more.
  - ajross 7y ago
    On HN, the overwhelmingly common paradigm is that conflict in the tech industry is to be understood as part of a existential conflict between Apple and Google. A comment that starts "Google is evil" is all but guaranteed to come from someone with a iOS device in her pocket. And in this case I think the point is valid: this policy is bad, both because battery management and notification policy really needs to be part of the core OS in AOSP and not a proprietary add-on and because of the licensing glitch reported here where the client library isn't GPL-compatible. But that's just one policy. Across the fence of the war mentioned above, it's a GPL-incompatible wasteland where absolutely nothing is possible at all. If you care about free software in the abstract and want to view your war along those lines: Google is behaving badly and needs to be admonished. Apple is clearly The Enemy.

shawnz 7y ago

I think this is misleading. To me it seems the issue is that app developers are being forced to use the proprietary Firebase service, but they are NOT being forced to use a proprietary library from what I can tell. The library in fact DOES have an open source version available: https://firebaseopensource.com/projects/firebase/firebase-android-sdk/ https://firebaseopensource.com/projects/firebase/firebase-an...

Tepix 7y ago
Nope! firebase-messaging is missing from this open source version.
- evilDagmar 7y ago
  Sounds like an opportunity for someone to sit down and write one. The API and docs for it are fairly palatable and offer some very reasonable guidance on things like exponential backoff. It still doesn't mean that they're going to be able to go without a persistent notification if they want to run their own background service, but that's a change that everyone is required to deal with. "Secret" background services were abused egregiously by bad actors and sloppy coders alike in the past and it's time for that to stop. This carp some people are floating about it incurring "warning" is nonsense--if they looked at the developer docs they'd see how easy it is to avoid that happening.
icebraining 7y ago
From what I can tell, you need firebase-messaging, which doesn't seem to be on that list. Am I reading it wrong? Edit: seems I was reading correctly: https://github.com/firebase/firebase-android-sdk/issues/125#issuecomment-481566392 https://github.com/firebase/firebase-android-sdk/issues/125#...
- shawnz 7y ago
  Ah, thanks for the clarification.

kartan 7y ago

> Problem: The Firebase Android client library is proprietary, meaning FOSS apps can not use it. Apps that do not comply are reported to the user as "using too much battery". This is a standard on the industry. From 1999: https://www.theregister.co.uk/1999/11/05/how_ms_played_the_incompatibility/ https://www.theregister.co.uk/1999/11/05/how_ms_played_the_i... It doesn't matter how much money Google is going to have to pay in the future as a fine for this practice. The amount of money that they will get for kicking out the competition is going to be way higher. That is a learned lesson from Microsoft (and probably others before them).

pfortuny 7y ago
So, if I understand correctly, the GPL prevents you from using a non-free library in your code? (Asking honestly: I have tried to find this elsewhere but the FSF page on the GPL is rather ... convoluted). If that is so, then this is obviously a killer and quite seemingly arbitrary requirement. Your MS example is quite good.
- striking 7y ago
  Your code is no longer completely FOSS when you do that. It depends on a binary blob that you can't see into.
  - pfortuny 7y ago
    Yes, yes, but I guess BSD-licence-using developers do not care too much about it.
  - astazangasta 7y ago
    Dependencies are different than source code. You can write FOSS that runs on Windows, which is a dependency and not FOSS.
    - bscphil 7y ago
      As long as it doesn't require linking to a proprietary Windows library to interface with the NT api. That would violate at least the GPL 2. Though you could do it yourself, and release your own code as GPL (and the combined work as proprietary), no one else could distribute the full work under the GPL because of the incompatibility.

kbumsik 7y ago

I'm not an Android dev, but according to the source in the article [1] this limitation is applied since Oreo, which is released two years ago. Why this problem arises today? [1]: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/master/Notifications.md https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

icebraining 7y ago
Until April 11, 2019 you could use GCM instead of the Firebase system.
- veeti 7y ago
  The GCM client is/was also proprietary. There is nothing new here.

megous 7y ago

Can this fall under system library exception? For example if you're building mingw32 based GPL C app, you're linking to all kinds of windows system libraries and there's no need for them to be under GPL. If this notification library is available to anyone on Android and is part of the Android system platform, can it be the same, like some DLL that does notifications on windows?

izacus 7y ago
No it doesn't, because the code that receives push notifications isn't part of AOSP.
- shawnz 7y ago
  But my "system" isn't AOSP. It's my OEM's specific packaging of AOSP along with Google services and other components. Why should the line be drawn around AOSP specifically?
jakear 7y ago
I think it depends on if the library is distributed with the app or with the system. In this case, the library would be distributed with the app I believe, meaning it would not be exempted.
- damnyou 7y ago
  I think this is true for GPLv2 but not for v3. But IANAL.
  - deleted 7y ago
    [deleted]

ddrager 7y ago

This has been coming for a while. We attempted to create a push-based notification system based on MQTT. It worked well, then the notifications started getting lost. Turns out, the receiver service was getting killed in the background. We found out the best way to get reliable notification was through Google's own GCM (which has now moved to Firebase Cloud Messaging. We learned its incredibly difficult, if not impossible to build an app (with reliable notifications) that do not use Google services. You can say its in an effort to maximize battery resources, which I totally understand, but by requiring a Google service (and now library) you are truly tied in to and reliant on their systems. BTW, as others have pointed out, there are open source Firebase libraries (https://firebaseopensource.com/projects/firebase/firebase-android-sdk/ https://firebaseopensource.com/projects/firebase/firebase-an...)

bchimp 7y ago
This has been true for awhile once they forced apps to use API26 or higher (if you want to be listed in the Play store, and really, there is no other place if you want decent exposure.) I had a similar experience switching from "real background" to using FCM. I understand the battery saving motivation, but the problem is that the performance of the google service is terrible. The response time of my simple notification system was nearly instantaneous, but OK google, I'll play your game. I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM. Reading the google docs, apparently google will deprioritize notifications that are shown but "not intereacted with" in a timely manner, so that is another source of delay. I think the crux of the matter is that notifications have multiple purposes: signaling, and advertising, etc. Google hasn't provided a way for an app to declare its use case. So, you get policies to prevent notification spam creeping in and messing with basic app signaling functionality. In the end, I kept both my "in-house" notifications for use by older Androids, and a kluge that uses FCM in addition, with some hacks to get somewhat better FCM performance. I live with the notification in Oreo+ and just tell users to ignore it (but honestly, I don't think users care that much.)
- antpls 7y ago
  > I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM. (from what I remember of some android documentations) Your definition of "high priority" is different from Google's one, which is also different from the end-user's definition. Google probably favors the end-user's preferences more than the developer's preferences. If the user wants all notifications asap from a particular app, the system will do a best effort to deliver, given all the other apps notifications and the current battery level.

gdrift 7y ago

I think the only difference is that foreground service must show a notification that's all. Users will learn to just disable those useless notifications.

Ajedi32 7y ago

So to summarize, to save battery all notifications on Android (since two versions ago) have to go through a single notification service (rather than each app having the option of continuously running in the background and maintaining a connection with its own notification service). Recently Google killed their GCM notifications service in favor of Firebase Cloud Messaging, which (unlike GCM) unfortunately doesn't have an open source library available for it at the moment. Does that sound right so far? Anyway, the Telegram-FOSS team claims that this doesn't _actually_ save battery: > Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification. But this seems rather unlikely to me. Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? Or am I just misreading that statement?

runeks 7y ago
> Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? A single application running in the background probably uses only a small amount of extra power compared to the notification service alone. However, a couple dozen applications -- all running in the background in order to enable notifications -- probably consume a lot more power than a single service.
- Ajedi32 7y ago
  There's also a wide variety of possible implementations of a notification service, and not all of them will necessarily be as power efficient as what Telegram-FOSS does.
  - AstralStorm 7y ago
    And Android's battery monitoring should flag them accordingly, not rely on presence of some library.
    - ahupp 7y ago

deleted 7y ago

[deleted]

jcriddle4 7y ago

Google probably wants one stream of data coming in that they have complete access to. Also probably make it more convenient to tap for the NSA

5trokerac3 7y ago
This was my first thought as well. If you can't get encrypted messaging apps to use the SMS service siphon you can at least snag notification text - and most people allow the message to be in the notification.

deleted 7y ago

[deleted]

segmondy 7y ago

Google is one of the most evil companies out there for a company that started out with don't be evil. The have some very smart people, some amazing tech, but unfortunately they have some very evil people working for them help bent on maintaining their advantage by any means necessary. Without using Google's push notifications, you are going to end up with something that works about 75% of the time. When this first started happening to me, I lost tons of time thinking it was a bug only to finally realize I needed to use Google's library to get reliability for what once worked.

throwayEngineer 7y ago
>Google is the most evil, of the companies that started with "don't be evil". Curious, what companies use that same phrase you are comparing it to? Or if that isn't what you meant, where is Apple and Microsoft on the Good vs Evil dichotomy?

jchw 7y ago

I was confused for a moment because I thought the Firebase SDK was open source. Interestingly, though, the Android version appears to be only partly open source. I did not find an explanation as to why some of the source is not available, it is mentioned on the Github repository but not explained. In any case, I don’t see the code for Cloud Messaging in there. It may not be that it is done out of secrecy, though. A cursory glance of the iOS SDK shows what seems to be the full iOS portion of Firebase Cloud Messaging: https://github.com/firebase/firebase-ios-sdk/tree/master/Firebase/Messaging https://github.com/firebase/firebase-ios-sdk/tree/master/Fir... Though that also raises its own question: doesn’t iOS effectively enforce APNS, and all third party providers actually must go through that? I imagine going through a single provider really can improve battery life. Each push provider needs to background fetch. FWIW, as far as I know, FCM and APNS are both free to use indefinitely. I’ve always found this a bit perplexing since I can’t even really fathom how many messages an app like Facebook or Twitter would push per month. I wonder what the odds are of this ever changing. The cynical viewpoint could go either way. At face value, this really does seem problematic for open source projects. Can a GPL app link to (the non-open parts of) the Firebase SDK? My guess would be no. Hope this can be resolved :( There’s some really great stuff on F-Droid, like Amaze file manager. (Disclosure: I work for Google, but not on Android. I don’t even use Android phones anymore.)

habosa 7y ago
[Firebase team member here] Our goal is to open source all of our SDKs, and we have steadily open-sourced more of them over time. The SDKs you see on GitHub right now are all standalone, they don't require communicating with Google Play services running on the device. Our bar for moving an SDK to GitHub is that it has to be more than a source dump, it must be the source of truth for that team's development. Right now that's not possible for FCM because of the dependency it has on Google Play services.
- jchw 7y ago
  Thanks for the clarification, seems pretty straightforward to me.
- 7y ago

mtgx 7y ago

And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while. If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.

lern_too_spel 7y ago
Signal already implements it. Signal uses E2E encryption, so your attack vector doesn't work. https://community.signalusers.org/t/gcm-will-be-removed-from-google/3888/41 https://community.signalusers.org/t/gcm-will-be-removed-from...
- buildzr 7y ago
  > Signal uses E2E encryption, so your attack vector doesn't work. End-to-end encryption is just that. That Firebase library is running on the client phone (aka, an end), if Google put code into the library allowing it to download updates it would also be running in Signal's context which would allow it to trivially dump and exfiltrate messages, memory, etc from the Signal process. Now, we have no reason to believe such a mechanism is used here to my knowledge, but if they really wanted to, it would defeat end-to-end encryption.
  - lern_too_spel 7y ago
    In that case, Signal can run the integration in another process. It's extra work, but it also gets around the GPL issue for the main application, so if Google doesn't solve that itself, it's easy for someone else to and share the solution with everybody. It would also be easy to spot if Google put an updater inside the library because the requested permissions for using the library would change.
  - shawnz 7y ago
    If this is your angle, then they wouldn't need you to load any library for them to be able to do this attack. They have root, so they could do the attack regardless of firebase being open source.

ridaj 7y ago

Misleading title... Real title something like: apps that use Android push notifications without Firebase, including GPL-licensed apps, now reported as "using too much battery"

paulcarroty 7y ago

Good luck for people who still believe in marketing term "Android is Open Source".

lern_too_spel 7y ago
How does this change that?

orblivion 7y ago

So are we, fans of FOSS, all-in on the Librem phone at this point?

ocdtrekkie 7y ago
I'm just waiting to find out if someone will get Librem 5 working with a Verizon approved networking module before I jump in. But yes, very excited.

DannyBee 7y ago

Since the FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android libraries are usually Apache 2.0, you have always had a problem. They also use a ton of Apache2 libraries (at least 5 or 6) directly in their source repo. They don't appear to even bother to properly give attribution/etc for the used software, so yeah.

coding123 7y ago
This is so damn true I am LMAO at the other comments. So basically the entire community can get around the problem by releasing an Apache2 lic'd library that wraps whatever it is they need from firebase. We'd be at a place no different from any other "FOSS" App on android today. And https://opensource.stackexchange.com/a/4642 https://opensource.stackexchange.com/a/4642

evilDagmar 7y ago

This is pretty darned incorrect on a number of fronts. Skipping for the moment that a random histronic Reddit post is being considered "news"... > "Google started leveraging its de-facto monopoly on Android distributions by forcing all apps to use its proprietary service Firebase for push notifications." A number of logical leaps of faith need to be made before the word "force" carries any truth, but no one's "forcing" anyone to do anything. A developer can still use the FCM or not, it's up to them. If a developer simply refuses to interface with any sort of proprietary code then it's a wonder they'll touch any commercial product at all (iOS included). ..and since Telegram-FOSS were cited as a source for this mess, here's the very first part of [i]their[/i] statement, which is also not true: > Since Android 8.0 Oreo, Google doesn't allow apps to run in the background anymore, requiring all apps which were previously keeping background connection to exclusively use its Firebase push messaging service. Sooo very not true. Android [i]does[/i] still allow apps to run in the background. The developer docs caution against doing so without good reason because so many developers try very hard to ignore the lifecycle methods, resulting in many wasted clockcycles and reduced battery life. But the Telegram team didn't stop there, so let's unpack the rest: > Sadly, if the app would set the notification to lower priority (to hide it a bit in the lower part of the notification screen), you would immediately get a system notification about Telegram "using battery", which is confusing and is the reason for this not being the default. Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification. First, it's not a "warning". It's simply a statement. ...and yes, if you're going to maintain a separate push notification service of your own (I'm looking at [i]you[/i], Facebook.) you [i]are[/i] going to be using at least a few clockcycles. There's no way around this. The backgrounded apps notification is also as "judgement free" as any notification can possibly get. On my phone right now, running Android 8.0... "3 apps are using battery". One of these is my own app (which happens to be a homescreen widget), another is Life360, and another is GSam Battery Monitor. Tap that notification and a list appears, headed up with "Apps running in background" with "Tap for details on battery and data usage" and lists the apps with their icons. Tap one and it shows what resources the app [i]is[/i] actually using. GSAM... 52Mb of RAM, and ~55kB of data in the last month. 0% battery used since last full charge. My app, 0% battery (probably not enough to count as a whole percent) use since last full charge, 5.84MB of internal memory, no data usage. I don't know how other people might view them, but to me these seem like vindications. None of that information is being presented in any way that that should be construed as condemning or accusatory, let alone "misleading". If Telegram-FOSS doesn't want users throwing a fit about their resource usage, perhaps they should spend a little time grooming user expectations to be more reasonable. The reddit user who posted this mess, on the other hand... A five-year old account that only occasionally posts anything that doesn't smell of astroturf, and this one post is nearly 80% of their karma. Seems like they've decided to make a foray into outrage-farming.

Khaine 7y ago

“the definition of open: "mkdir android ; cd android ; repo init -u git://android.git.kernel.org/platform/manifest.git ; repo sync ; make"” [1] Not anymore. Having basic android open source help when everything is pushed into the proprietary play store [1] https://mobile.twitter.com/Arubin/status/27808662429 https://mobile.twitter.com/Arubin/status/27808662429

EGreg 7y ago

What do you mean FOSS apps can’t use a proprietary library? The library’s license says that it cannot be used by AGPL software? Because if not, the FOSS authors can just make builds for Android with it.

DigitalTerminal 7y ago

I am confused. The repo you linked to hasn't had a release since 2016, and I cannot find a reference to that library ANYWHERE else. The firebase android sdk, which is what I would guess you would use (though I don't do android, so could still be wrong) is apache. What am I missing?

astannard 7y ago

Amoungst this big thread, I've not noticed any evidence for this and the original article does not back this up with anything. Is the allegation that google are using battery warnings to push people towards using firebase notifications? Has anyone any experience of this?