5 ms·

The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. That's bearable though unpleas

The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. That's bearable though unpleasant when you have one or two pieces of software that rarely get updated, that's absolutely impossible when you have 10+ pieces of software - you'll sit there for 5 minutes just approving install prompts every week, which isn't something a normal human is going to do. It doesn't help that FDroid is pretty broken, and constantly pops up notifications about updates that don't work/aren't actionable (i.e. tapping the notification doesn't result in an install prompt followed by a successful installation, instead I get various errors etc.). Also, apparently the FDroid review process is even slower than the Play store review process.

pmlnr 6y ago
That's a feature, not a bug. Believe it or not, people don't like app/sw updates. Devs and money people do.
grishka 6y ago
> there doesn't seem to be a way for alternative app stores to silently update software Yes — because that's something reserved for privileged system apps. You have to root your device to take advantage of that, or make a custom ROM with the alternative store in it. Having that ability as a permission you could grant to any app is an immense security risk. But then there are "device administrator" apps that can literally factory reset the device... I don't know. Maybe package installation should be part of that. Especially now that the legacy permission model was taken care of — if you install an app that doesn't support runtime permissions, you'll get a list of its permissions with toggles next to them when you run it for the first time. > you'll sit there for 5 minutes just approving install prompts every week Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years?
- GordonS 6y ago
  If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? > Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years? Sure, I'm even old enough to remember this but on cassettes and floppy disks! But - software now is much more complex than it used to be - most software has dependencies on other libraries/frameworks, and has to deal with communication and encryption (where it is all to easy to make subtle mistakes). IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates.
  - neop1x 6y ago
    > If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? It often means that. :( But it is not that bad for some devices. Geeks from Lineage community regurarly update closed vendor code in the LineageOS. So if you are lucky and Lineage is well-supported on your device, you can still have root nowadays with up-to-date vendor blobs. For example I rooted my Xperia XZ2 Compact and I am quite happy with it. By using Magisk and Magisk Hide, I am still able to use Google Pay. At the same time, I can use Titanium Backup and f-droid root extension to let f-droid install updates automatically. I hope this device will last me for a long time as I don't see many alternatives - most other phones are too big for me, too old/slow or unsupported.
  - grishka 6y ago
    > software now is much more complex than it used to be I'd say software now is much more complex than it needs to be. It's made to ease the life of the developer, usually an inexperienced one, at the expense of the user. > IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates. If people would stop rewriting things that already work fine, we'll run out of vulnerabilities at some point. Or, if you must rewrite them and have a good reason to do so, at least use a memory-safe language. Even C++ is much better than C and raw pointers. Anything is better than C and raw pointers. Yet all major OS kernels and most userspace components are written in C and use raw pointers and vulnerabilities in those are being found all too often.
- quotemstr 6y ago
  > Having that ability as a permission you could grant to any app is an immense security risk A risk to whom? There is no permission that is a "security risk" so long as it's the device owner granting that permission.
- im3w1l 6y ago
  How very convinient for Google that "security" means competitors can't have feature parity. But then why are you saying there aren't any hurdles?
exikyut 6y ago
The non-root way to silently update is to install a DPC (device policy controller). Has existed for the past 10 years to support enterprise MDM. Only catch is that to install the DPC you have to factory reset your phone to place it into the special state where no accounts have "ever" been signed in to, which is what allows a DPC to be installed. (Removing all accounts from the device may also work) The nice thing is that once the DPC is installed you can `adb install -r` (reinstall, ie update) it without needing to factory reset. Just don't uninstall it accidentally :D
- morsch 6y ago
  Is that something I can do to my phone to make updates via F-Droid more seamless?
  - exikyut 6y ago
    Sadly no. I actually went full-on "wait a minute...!" a few weeks ago when I discovered this, but practically speaking, nobody's going to do it ("what, factory reset my phone?! hahaha NO"), and so implementing the necessary support would ultimately be a giant burden. Technically 100% possible, but practically never going to happen. If someone were willing to write and maintain the necessary plumbing and then poked F-Droid, it would be interesting to see if they cooperated, but they may well be reluctant to.
thu2111 6y ago
The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. Does this actually matter? On the desktop it's normal for apps to update themselves. Is there some fundamental reason an Android app cannot do this too?
- Macha 6y ago
  Yes. The application's executable is not writeable to the app. You need to go through the package installer. This requires a system controlled prompt for the user to confirm an installation, and requires a seperate permission to even ask which is not allowed for third party apps published to the play store (https://developer.android.com/reference/android/Manifest.permission#INSTALL_PACKAGES https://developer.android.com/reference/android/Manifest.per...).
  - iggldiggl 6y ago
    Er, not quite. The permission required to trigger the app install prompt for an APK is REQUEST_INSTALL_PACKAGES, which is available to third-party apps.
TheJoYo 6y ago
even google play store has a hard time silently updating these days.

pmlnr 6y ago

That's a feature, not a bug. Believe it or not, people don't like app/sw updates. Devs and money people do.

grishka 6y ago

> there doesn't seem to be a way for alternative app stores to silently update software Yes — because that's something reserved for privileged system apps. You have to root your device to take advantage of that, or make a custom ROM with the alternative store in it. Having that ability as a permission you could grant to any app is an immense security risk. But then there are "device administrator" apps that can literally factory reset the device... I don't know. Maybe package installation should be part of that. Especially now that the legacy permission model was taken care of — if you install an app that doesn't support runtime permissions, you'll get a list of its permissions with toggles next to them when you run it for the first time. > you'll sit there for 5 minutes just approving install prompts every week Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years?

GordonS 6y ago
If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? > Unpopular opinion: well-made software that serves its user doesn't need to be updated very often. Remember how you bought a program on a CD and used the exact same build for years? Sure, I'm even old enough to remember this but on cassettes and floppy disks! But - software now is much more complex than it used to be - most software has dependencies on other libraries/frameworks, and has to deal with communication and encryption (where it is all to easy to make subtle mistakes). IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates.
- neop1x 6y ago
  > If you root your device, doesn't that mean you will no longer be able receive Android OS software updates from the phone manufacturer? It often means that. :( But it is not that bad for some devices. Geeks from Lineage community regurarly update closed vendor code in the LineageOS. So if you are lucky and Lineage is well-supported on your device, you can still have root nowadays with up-to-date vendor blobs. For example I rooted my Xperia XZ2 Compact and I am quite happy with it. By using Magisk and Magisk Hide, I am still able to use Google Pay. At the same time, I can use Titanium Backup and f-droid root extension to let f-droid install updates automatically. I hope this device will last me for a long time as I don't see many alternatives - most other phones are too big for me, too old/slow or unsupported.
- grishka 6y ago
  > software now is much more complex than it used to be I'd say software now is much more complex than it needs to be. It's made to ease the life of the developer, usually an inexperienced one, at the expense of the user. > IMO, for security reasons alone, it's no longer realistic to expect software without at least occasional updates. If people would stop rewriting things that already work fine, we'll run out of vulnerabilities at some point. Or, if you must rewrite them and have a good reason to do so, at least use a memory-safe language. Even C++ is much better than C and raw pointers. Anything is better than C and raw pointers. Yet all major OS kernels and most userspace components are written in C and use raw pointers and vulnerabilities in those are being found all too often.
quotemstr 6y ago
> Having that ability as a permission you could grant to any app is an immense security risk A risk to whom? There is no permission that is a "security risk" so long as it's the device owner granting that permission.
im3w1l 6y ago
How very convinient for Google that "security" means competitors can't have feature parity. But then why are you saying there aren't any hurdles?

exikyut 6y ago

The non-root way to silently update is to install a DPC (device policy controller). Has existed for the past 10 years to support enterprise MDM. Only catch is that to install the DPC you have to factory reset your phone to place it into the special state where no accounts have "ever" been signed in to, which is what allows a DPC to be installed. (Removing all accounts from the device may also work) The nice thing is that once the DPC is installed you can `adb install -r` (reinstall, ie update) it without needing to factory reset. Just don't uninstall it accidentally :D

morsch 6y ago
Is that something I can do to my phone to make updates via F-Droid more seamless?
- exikyut 6y ago
  Sadly no. I actually went full-on "wait a minute...!" a few weeks ago when I discovered this, but practically speaking, nobody's going to do it ("what, factory reset my phone?! hahaha NO"), and so implementing the necessary support would ultimately be a giant burden. Technically 100% possible, but practically never going to happen. If someone were willing to write and maintain the necessary plumbing and then poked F-Droid, it would be interesting to see if they cooperated, but they may well be reluctant to.

thu2111 6y ago

The main hurdle is that (without rooting) there doesn't seem to be a way for alternative app stores to silently update software. Does this actually matter? On the desktop it's normal for apps to update themselves. Is there some fundamental reason an Android app cannot do this too?

Macha 6y ago
Yes. The application's executable is not writeable to the app. You need to go through the package installer. This requires a system controlled prompt for the user to confirm an installation, and requires a seperate permission to even ask which is not allowed for third party apps published to the play store (https://developer.android.com/reference/android/Manifest.permission#INSTALL_PACKAGES https://developer.android.com/reference/android/Manifest.per...).
- iggldiggl 6y ago
  Er, not quite. The permission required to trigger the app install prompt for an APK is REQUEST_INSTALL_PACKAGES, which is available to third-party apps.

TheJoYo 6y ago

even google play store has a hard time silently updating these days.