4 ms·

And also third party app stores (e.g. F-droid) can't autoupdate the apps for "security" reasons. One can only circumvent this by flashing a patch via phone reco

And also third party app stores (e.g. F-droid) can't autoupdate the apps for "security" reasons. One can only circumvent this by flashing a patch via phone recovery... which is fairly tedious and scary even for a tecnhical person, let alone regular users.

Wowfunhappy 6y ago
Wait, this is news to me! What aspect of Android is making autoupdates impossible? Apps can replace their contents, and apps can run in the background... shouldn't that be all you need?
- heavyset_go 6y ago
  Android requires users to go through the explicit install and upgrade screen to upgrade apps outside of the Play Store. That means that F-Droid can't upgrade applications in the background, nor can they be upgraded automatically. Batch installs are also disabled for third party app stores.
  - Wowfunhappy 6y ago
    But isn't an app fundamentally just a collection of files? What is stopping F-Droid from replacing those files? Are executable bits special or something?
    - heavyset_go 6y ago
      Look into the Android security model, it's more complicated than vanilla Linux where you can just log in as root and fiddle with files if you want to get something done.
    - karlicoss 6y ago
      Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data storage (which is represented as /data/data/$APPNAME on the filesystem). But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data. This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it. But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.
    - karlicoss 6y ago
      I've reread your comments, and realized I might have answered a different question in my comment before :) In theory, you could request broad permissions, and have an interpreter sitting inside your app, dynamically loading its own code over the wire, so you'll never have to update from the app store (unless you want more permissions granted). But as far as I understand, this is forbidden by the Play Store policies (e.g. Facebook got told off for doing this https://arstechnica.com/information-technology/2013/04/google-bans-self-updating-android-apps-possibly-including-facebooks/ https://arstechnica.com/information-technology/2013/04/googl... ). Although I'd imagine it's easy to slip such code past reviewers, unless your app is very popular and worthy a more thorough review that can catch it. Also I'd imagine there is some grey area there, e.g. your whole app could be a webview simply displaying web frontend -- surely it's okay to dynamically load javascript? Not sure how the policy works in such cases.
ngold 6y ago
Fdroid pops up and ask to update apps. It's very easy.
- monocasa 6y ago
  Not as easy as autoupdating, and far more annoying for the general user.
  - rightbyte 6y ago
    My Firefox mobile was updated during the night and changed the UI completely, moving the bar to the bottom etc and it is just all bad. I see not having auto updates as a feature. Mostly it is just annoying changes and I prefer to know when updates happens so I can track things that break and blame the update.
- heavyset_go 6y ago
  I don't find it easy to have to individually upgrade each app because Google decided that third part app stores are not allowed to batch upgrade in the background.

Wowfunhappy 6y ago

Wait, this is news to me! What aspect of Android is making autoupdates impossible? Apps can replace their contents, and apps can run in the background... shouldn't that be all you need?

heavyset_go 6y ago
Android requires users to go through the explicit install and upgrade screen to upgrade apps outside of the Play Store. That means that F-Droid can't upgrade applications in the background, nor can they be upgraded automatically. Batch installs are also disabled for third party app stores.
- Wowfunhappy 6y ago
  But isn't an app fundamentally just a collection of files? What is stopping F-Droid from replacing those files? Are executable bits special or something?
  - heavyset_go 6y ago
    Look into the Android security model, it's more complicated than vanilla Linux where you can just log in as root and fiddle with files if you want to get something done.
  - karlicoss 6y ago
    Android apps are heavily containerized, so unless you gave the app a filesystem permission, it can't write to it. By default they can only use their 'own' data storage (which is represented as /data/data/$APPNAME on the filesystem). But even if you allow filesystem access, it's only for 'non-system' partitions (e.g. sdcard). Unless you rooted your phone (also a pretty tedious operation with a potential to brick the phone), normal apps can't even read files on the system partition, let alone overwrite them, except their 'own' data. This is good from the security point, e.g. you can run pretty much any app and simply remove it if you feel like it's suspicious and asking for too many permissions. Similar to running a random Docker image: you can try out software without taking risks of losing control over your system, allowing certain capabilities if necessary (e.g. ports, paths). There might be a Docker vulnerability of course, but it's pretty unlikely for you as an individual to be targeted by it. But it's extremely frustrating when you know what are you doing and which risks you are willing to take, but have to jump through hoops to do things that are otherwise trivial on desktop.
  - karlicoss 6y ago
    I've reread your comments, and realized I might have answered a different question in my comment before :) In theory, you could request broad permissions, and have an interpreter sitting inside your app, dynamically loading its own code over the wire, so you'll never have to update from the app store (unless you want more permissions granted). But as far as I understand, this is forbidden by the Play Store policies (e.g. Facebook got told off for doing this https://arstechnica.com/information-technology/2013/04/google-bans-self-updating-android-apps-possibly-including-facebooks/ https://arstechnica.com/information-technology/2013/04/googl... ). Although I'd imagine it's easy to slip such code past reviewers, unless your app is very popular and worthy a more thorough review that can catch it. Also I'd imagine there is some grey area there, e.g. your whole app could be a webview simply displaying web frontend -- surely it's okay to dynamically load javascript? Not sure how the policy works in such cases.

ngold 6y ago

Fdroid pops up and ask to update apps. It's very easy.

monocasa 6y ago
Not as easy as autoupdating, and far more annoying for the general user.
- rightbyte 6y ago
  My Firefox mobile was updated during the night and changed the UI completely, moving the bar to the bottom etc and it is just all bad. I see not having auto updates as a feature. Mostly it is just annoying changes and I prefer to know when updates happens so I can track things that break and blame the update.
heavyset_go 6y ago
I don't find it easy to have to individually upgrade each app because Google decided that third part app stores are not allowed to batch upgrade in the background.