6 ms·

VLC vs. the App Stores

142 points by mpweiher 3y ago

dangus 3y ago
> or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes. The answer to this one is obvious. Drop support for API <30. The older version of the app will work well enough for those users. At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Don’t bother with the Windows Store or Mac App Store. Those users don’t need app stores. I think it’s not up to the individual developers to make these platforms a good place for their users. The platform owners already control that fate. If your Android TV device becomes a brick with apps that can’t be updated after ~5 years that should teach the customer to find something else next time.
- Wowfunhappy 3y ago
  > The answer to this one is obvious. Drop support for API <30. The older version of the app will work well enough for those users. > At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Would a user who does not already have VLC installed be able to download it in this scenario?
- ravetcofx 3y ago
  Windows Store is needed for users On Windows 10/11 S mode and Windows on ARM I believe.
  - dangus 3y ago
    So like, 10 people? I don't even know where you buy a computer that comes with S mode, my understanding is that it was massively unpopular, and you can turn off S mode. Windows on ARM can install software outside of the Windows Store, and VLC offers an EXE binary for it.
  - nosrepa 3y ago
    That mode can be unlocked via the windows store iirc.
- david_allison 3y ago
  API >=30 is ~60% of Android devices, it's a significant number of users and adds significantly to e-waste
  - flas9sd 3y ago
    off by a line - 75% according to apilevels.com / statcounter. But true, apilevel pace is relentless
    - david_allison 3y ago
      Interesting! Thanks Android Studio [Iguana | 2023.2.1 Patch 2 | Built April 4 2024] states that for minSDK API 30, an app will run on 59.8% of devices.
- alerighi 3y ago
  > At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Well for who already has the app installed, but if one is on API <30 and wants to install VLC from the Play Store, it can't.
  - dangus 3y ago
    Split the app then. Rename the current one to VLC (Legacy) and publish the new versions in a new app.
rodric 3y ago
VLC is up to date on F-Droid, for what it’s worth
- squiffsquiff 3y ago
  Really? I am seeing version 3.5.4 from 14 months ago in F-Droid, same as Google Play version
  - Semaphor 3y ago
    Same as the version on their website, so it seems the TFA issue is about a future issue.
DigitalHackOp 3y ago
> For now, iOS App Store still allows us to ship for iOS9, but until when? Did they expect that Apple would stop dropping support for old hardware for them?
Jyaif 3y ago
> either we give them our private signing keys, What is their thread model exactly? Are they aware that Android and the PlayStore is made by Google? Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices with exactly the right ressources, saving bandwidth and disk space for users. I just had a look and right now I see that VLC is shipping hundreds of KB of pngs that are going to be unused, because they are shipping pngs for all the DPIs.
- earnesti 3y ago
  I have been not developing for app stores, how does exactly this work? Why does Google want the private signing keys? Why it is not some certificate or something?
  - watermelon0 3y ago
    Play Store needs to modify APK, to remove unneeded resources, and then repackage and re-sign it with the original signing key. Android requires signature with the same signing key, when updating the application.
    - hnburnsy 3y ago
      So any government can come along and tell Google to repackage a special version of the app for delivery to certain targets or a targeted population? That is seriously messed up, I hope they don't cave.
      - deleted 3y ago
        [deleted]
- Hizonner 3y ago
  Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is bad key hygiene, and exposes the keys to many threats of many kinds. The people who maintain Android are not the people who curate the Play Store, nor are they necessarily using exactly the same tools or infrastructure. Letting the Play Store subvert security unilaterally enlarges the human, organizational, and technical attack surface for any number of threat actors. Furthermore it's easier to unobtrusively modify one user's copy of VLC than to modify one user's copy of Android, and also easier to change it back to cover your tracks. All of this significantly increases the chance of the whole system being subverted by any of a variety of threat actors from random rogue employees right on up to nation states. > Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices That could have been done without giving (any part of) Google the keys, using an obscure technique known as "a system design and manifest format that aren't minimum-effort-by-minimum-talent garbage". This is all really, really basic stuff. You don't just go around giving away giant attack surfaces for free. And Google is getting it wrong because doing it right would be slightly inconvenient.
tombert 3y ago
It seems less horrible on Android than iOS at least. It is still relatively easy to sideload stuff, even on Android TVs. I manually installed ScummVM that way, it wasn’t hard. What’s still concerning to me in the US is how the courts seem “just ok” with no reasonable ability to sideload on iPhones, giving Apple more or less unilateral authority to squash competition if they want. I know it’s technically possible to sideload on iOS if you have a Mac and directly compile the App yourself in Xcode, but Macs are pretty expensive, and that requires understanding dev tools and the like.
- blackeyeblitzar 3y ago
  Doesn’t side loading still pop up a warning message about security that helps deter users from going outside the Play store?
  - aspenmayer 3y ago
    Yes, you have to enable the setting to install from unknown sources, which has a warning message prominently displayed. https://developer.android.com/distribute/marketing-tools/alternative-distribution#unknown-sources https://developer.android.com/distribute/marketing-tools/alt...
- talldayo 3y ago
  Hopefully, enabling that sort of sideloading as a possibility is the end-goal. Like you said, the market impact is obvious; it gives Apple complete and irrefutable control over what kind of competition can exist on their platform. Apple's game-plan seems to be deliberately ruining the iOS experience until regulators give up. There has been nothing more sad (or less unexpected) than Apple's tragic fall from grace. Maybe they were rotten from the start, but it feels like this squandered golden age of mobile computing is what they'll be remembered for. 15 long years of spooling up the money printers and praying nobody gets loud enough for the regulators to hear. What a sad waste of all our lives.
  - metalspoon 3y ago
    Apple was always rotten unless Jobs kicked their ass. Once they kicked Jobs out and he came back to kick their ass again. He was the hero.
mjevans 3y ago
I _would_ like Android to have a more finely grained security model. > E.G. for files/folders... * Official not hobbled FS application, 'opens' files * Same Directory (read only) allowed access * Same Directory (write also) allowed access * Path & subpath RO * Path & subpath RW * Full ('SD card' only?) RO * Full ('SD card' only?) RW For VLC, depending on if I want it to encode files or not, whitelisting specific paths to look for files is what I'd want. It'd be nice if some of the other issues could be elaborated upon. Like that weird Android TV API version issue.
- alerighi 3y ago
  What I don't like about Android is that you need root to have full access to your filesystem. That to me is a shame, let me have a privileges that allows me to get access to app data. The current Android permission model doesn't allow, for example, to browse the data of the applications, i mean their folder in /data. For example if I want to backup app data on a cloud service, or make a full backup of the device, I simply can't. Either the app has to support a backup and restore feature to external storage, or you can't. Or I want to make some kind of integration that requires reading/writing directly on the sqlite database of an app, because it doesn't provide the facility that I need. To me it doesn't make a lot of sense, and it's the only reason I root my devices.
  - bakugo 3y ago
    Agreed, accessing app data is the main reason I still root my Android devices today. Fun fact: whenever you download an image from the official Twitter android app, it saves a copy of that image to the app's data (not cache) and just leaves it there, forever. Since I have root, it doesn't really matter since I can literally just load up a file manager and delete the files as I would on a PC. But without root, there's nothing you can do about it other than wipe the app data completely every once in a while. Thankfully you don't lose much when doing this for this app, but this is far from the only app that has this sort of issue.
  - nurettin 3y ago
    That would even make sense with the current restrictions. Just have a root shell app which gives unrestricted access to all folders. If the user wants to start it, they must authenticate.
__rito__ 3y ago
I understand their delay in updating the Google Play Store version. Why is the F-droid entry 14 months behind?
- fantyoon 3y ago
  Unless VLC is one of the historic cases, F-Droid builds apps from source themselves [1]. They are more like a Linux Distro than an app store in that way. VLC hasn't had a new stable version tagged since 3.5.4 so that's what F-Droid ships[2]. [1]: https://f-droid.org/en/docs/FAQ_-_App_Developers/#will-my-app-be-built-from-source https://f-droid.org/en/docs/FAQ_-_App_Developers/#will-my-ap... [2]: https://code.videolan.org/Skantes/vlc-android/-/blob/master/NEWS?ref_type=heads https://code.videolan.org/Skantes/vlc-android/-/blob/master/...
ChrisMarshallNY 3y ago
Holy cow. If these folks can't contact someone, then I wonder who can? I assume it's because they won't make any money for the platform.
- rnd0 3y ago
  I'm guessing congresscritters and senators can; but not their aides or anyone lower down the foodchain.
- emeril 3y ago
  I've gotten the distinct impression that the only way to get google to fix something that isn't directly affecting their cash flow (e.g., a single user getting inappropriately (???) locked out of their account, some free app like vlc issue...) that you have to directly contact someone you know personally who works at google I haven't had a problem and I don't even work in tech but I personally know at least 3 people who work at google off the top of my head... this VLC guy should know way more That said, it's no excuse for Google's now, legendary, lack of customer service... or... just post on HN or know a reporter from NYT to write something up...
hwbunny 3y ago
VLC is a fine player, but it's very slow with new features. How come a project this big has to rely on donations? The extension API is terrible. One of my pet peeves are the subtitles. You cannot take screenshots without subtitles when it's on, because it's rendered on the same overlay as the video. Please put the subtitles on an overlay... If the audio volume can be on an overlay, so can the subtitles be. VLC needs to ramp up development and UI efforts, because PotPlayer is a much better, feature laden player, although it's Windows only :(.
jbk 3y ago
_(President of VideoLAN here)_ The remark here is that AppStores have so much power that they are forcing limiting rules, and few people complain, because they have no choices. On Android, we can either give Google our private (!) key or not support existing Android versions, and there is (as usual for Google) no one to discuss this with. On Windows, they changed soo many times the backend of their store, that even with support from the top of the hierarchy, we cannot even update our desktop apps (change a URL, not even a binary…) Apple, so far, is less annoying, but to support old versions (iOS9 or 10) is an always on battle. Apple AppStores does not allow GPL, Microsoft does not allow GPLv3 and Unity does not even allow LGPL… It’s very frustrating and time consuming, but because we don’t make money out of those, and we are on more platforms than anyone, we can complain publically…
- heyoni 3y ago
  There was wording in googles latest terms of service that seemed to imply that there would be recourse for certain violations and they wouldn’t jump straight to closing accounts and ignoring users’ pleas…I wonder if that’s a cultural shift that might extend to developer accounts and their android app store. If not today, hopefully soon.
- blackeyeblitzar 3y ago
  Thank you for a wonderful product and for drawing attention to this issue. Given all the anticompetitive changes from Microsoft recently, I am worried desktops are only going to get worse and become fully like mobile devices soon. I think current antitrust legislation isn’t enough. We need different laws with easier enforcement. And instead of wasting time with laws and legal battles, we just need trillion dollar companies to be heavily taxed and use that money to fund competition.
- Const-me 3y ago
  On Android, I think you can ignore the app store. I have never agreed to the ToS so none of the google’s services work on my phone, and I never used google account on the device. The play store is unavailable, yet I can install programs packaged into APK format. BTW, I use VLC-Android-3.5.4-arm64-v8a.apk to listen to internet radios I’ve subscribed. Very few players support M3U files with streaming URLs inside which include API key to authenticate. VLC does.
deleted 3y ago
[deleted]

142 points by mpweiher 3y ago

> or we drop support for Android TV before API-30, and all our users on TV API<30 can’t get fixes. The answer to this one is obvious. Drop support for API <30. The older version of the app will work well enough for those users. At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Don’t bother with the Windows Store or Mac App Store. Those users don’t need app stores. I think it’s not up to the individual developers to make these platforms a good place for their users. The platform owners already control that fate. If your Android TV device becomes a brick with apps that can’t be updated after ~5 years that should teach the customer to find something else next time.

Wowfunhappy 3y ago
> The answer to this one is obvious. Drop support for API <30. The older version of the app will work well enough for those users. > At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Would a user who does not already have VLC installed be able to download it in this scenario?
ravetcofx 3y ago
Windows Store is needed for users On Windows 10/11 S mode and Windows on ARM I believe.
- dangus 3y ago
  So like, 10 people? I don't even know where you buy a computer that comes with S mode, my understanding is that it was massively unpopular, and you can turn off S mode. Windows on ARM can install software outside of the Windows Store, and VLC offers an EXE binary for it.
- nosrepa 3y ago
  That mode can be unlocked via the windows store iirc.
david_allison 3y ago
API >=30 is ~60% of Android devices, it's a significant number of users and adds significantly to e-waste
- flas9sd 3y ago
  off by a line - 75% according to apilevels.com / statcounter. But true, apilevel pace is relentless
  - david_allison 3y ago
    Interesting! Thanks Android Studio [Iguana | 2023.2.1 Patch 2 | Built April 4 2024] states that for minSDK API 30, an app will run on 59.8% of devices.
alerighi 3y ago
> At present nobody is getting updates. Giving updates to everyone >=31 is an improvement to the status quo. Well for who already has the app installed, but if one is on API <30 and wants to install VLC from the Play Store, it can't.
- dangus 3y ago
  Split the app then. Rename the current one to VLC (Legacy) and publish the new versions in a new app.

rodric 3y ago

VLC is up to date on F-Droid, for what it’s worth

squiffsquiff 3y ago
Really? I am seeing version 3.5.4 from 14 months ago in F-Droid, same as Google Play version
- Semaphor 3y ago
  Same as the version on their website, so it seems the TFA issue is about a future issue.

DigitalHackOp 3y ago

> For now, iOS App Store still allows us to ship for iOS9, but until when? Did they expect that Apple would stop dropping support for old hardware for them?

Jyaif 3y ago

> either we give them our private signing keys, What is their thread model exactly? Are they aware that Android and the PlayStore is made by Google? Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices with exactly the right ressources, saving bandwidth and disk space for users. I just had a look and right now I see that VLC is shipping hundreds of KB of pngs that are going to be unused, because they are shipping pngs for all the DPIs.

earnesti 3y ago
I have been not developing for app stores, how does exactly this work? Why does Google want the private signing keys? Why it is not some certificate or something?
- watermelon0 3y ago
  Play Store needs to modify APK, to remove unneeded resources, and then repackage and re-sign it with the original signing key. Android requires signature with the same signing key, when updating the application.
  - hnburnsy 3y ago
    So any government can come along and tell Google to repackage a special version of the app for delivery to certain targets or a targeted population? That is seriously messed up, I hope they don't cave.
    - deleted 3y ago
      [deleted]
Hizonner 3y ago
Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is bad key hygiene, and exposes the keys to many threats of many kinds. The people who maintain Android are not the people who curate the Play Store, nor are they necessarily using exactly the same tools or infrastructure. Letting the Play Store subvert security unilaterally enlarges the human, organizational, and technical attack surface for any number of threat actors. Furthermore it's easier to unobtrusively modify one user's copy of VLC than to modify one user's copy of Android, and also easier to change it back to cover your tracks. All of this significantly increases the chance of the whole system being subverted by any of a variety of threat actors from random rogue employees right on up to nation states. > Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices That could have been done without giving (any part of) Google the keys, using an obscure technique known as "a system design and manifest format that aren't minimum-effort-by-minimum-talent garbage". This is all really, really basic stuff. You don't just go around giving away giant attack surfaces for free. And Google is getting it wrong because doing it right would be slightly inconvenient.

tombert 3y ago

It seems less horrible on Android than iOS at least. It is still relatively easy to sideload stuff, even on Android TVs. I manually installed ScummVM that way, it wasn’t hard. What’s still concerning to me in the US is how the courts seem “just ok” with no reasonable ability to sideload on iPhones, giving Apple more or less unilateral authority to squash competition if they want. I know it’s technically possible to sideload on iOS if you have a Mac and directly compile the App yourself in Xcode, but Macs are pretty expensive, and that requires understanding dev tools and the like.

blackeyeblitzar 3y ago
Doesn’t side loading still pop up a warning message about security that helps deter users from going outside the Play store?
- aspenmayer 3y ago
  Yes, you have to enable the setting to install from unknown sources, which has a warning message prominently displayed. https://developer.android.com/distribute/marketing-tools/alternative-distribution#unknown-sources https://developer.android.com/distribute/marketing-tools/alt...
talldayo 3y ago
Hopefully, enabling that sort of sideloading as a possibility is the end-goal. Like you said, the market impact is obvious; it gives Apple complete and irrefutable control over what kind of competition can exist on their platform. Apple's game-plan seems to be deliberately ruining the iOS experience until regulators give up. There has been nothing more sad (or less unexpected) than Apple's tragic fall from grace. Maybe they were rotten from the start, but it feels like this squandered golden age of mobile computing is what they'll be remembered for. 15 long years of spooling up the money printers and praying nobody gets loud enough for the regulators to hear. What a sad waste of all our lives.
- metalspoon 3y ago
  Apple was always rotten unless Jobs kicked their ass. Once they kicked Jobs out and he came back to kick their ass again. He was the hero.

mjevans 3y ago

I _would_ like Android to have a more finely grained security model. > E.G. for files/folders... * Official not hobbled FS application, 'opens' files * Same Directory (read only) allowed access * Same Directory (write also) allowed access * Path & subpath RO * Path & subpath RW * Full ('SD card' only?) RO * Full ('SD card' only?) RW For VLC, depending on if I want it to encode files or not, whitelisting specific paths to look for files is what I'd want. It'd be nice if some of the other issues could be elaborated upon. Like that weird Android TV API version issue.

alerighi 3y ago
What I don't like about Android is that you need root to have full access to your filesystem. That to me is a shame, let me have a privileges that allows me to get access to app data. The current Android permission model doesn't allow, for example, to browse the data of the applications, i mean their folder in /data. For example if I want to backup app data on a cloud service, or make a full backup of the device, I simply can't. Either the app has to support a backup and restore feature to external storage, or you can't. Or I want to make some kind of integration that requires reading/writing directly on the sqlite database of an app, because it doesn't provide the facility that I need. To me it doesn't make a lot of sense, and it's the only reason I root my devices.
- bakugo 3y ago
  Agreed, accessing app data is the main reason I still root my Android devices today. Fun fact: whenever you download an image from the official Twitter android app, it saves a copy of that image to the app's data (not cache) and just leaves it there, forever. Since I have root, it doesn't really matter since I can literally just load up a file manager and delete the files as I would on a PC. But without root, there's nothing you can do about it other than wipe the app data completely every once in a while. Thankfully you don't lose much when doing this for this app, but this is far from the only app that has this sort of issue.
- nurettin 3y ago
  That would even make sense with the current restrictions. Just have a root shell app which gives unrestricted access to all folders. If the user wants to start it, they must authenticate.

__rito__ 3y ago

I understand their delay in updating the Google Play Store version. Why is the F-droid entry 14 months behind?

fantyoon 3y ago
Unless VLC is one of the historic cases, F-Droid builds apps from source themselves [1]. They are more like a Linux Distro than an app store in that way. VLC hasn't had a new stable version tagged since 3.5.4 so that's what F-Droid ships[2]. [1]: https://f-droid.org/en/docs/FAQ_-_App_Developers/#will-my-app-be-built-from-source https://f-droid.org/en/docs/FAQ_-_App_Developers/#will-my-ap... [2]: https://code.videolan.org/Skantes/vlc-android/-/blob/master/NEWS?ref_type=heads https://code.videolan.org/Skantes/vlc-android/-/blob/master/...

ChrisMarshallNY 3y ago

Holy cow. If these folks can't contact someone, then I wonder who can? I assume it's because they won't make any money for the platform.

rnd0 3y ago
I'm guessing congresscritters and senators can; but not their aides or anyone lower down the foodchain.
emeril 3y ago
I've gotten the distinct impression that the only way to get google to fix something that isn't directly affecting their cash flow (e.g., a single user getting inappropriately (???) locked out of their account, some free app like vlc issue...) that you have to directly contact someone you know personally who works at google I haven't had a problem and I don't even work in tech but I personally know at least 3 people who work at google off the top of my head... this VLC guy should know way more That said, it's no excuse for Google's now, legendary, lack of customer service... or... just post on HN or know a reporter from NYT to write something up...

hwbunny 3y ago

VLC is a fine player, but it's very slow with new features. How come a project this big has to rely on donations? The extension API is terrible. One of my pet peeves are the subtitles. You cannot take screenshots without subtitles when it's on, because it's rendered on the same overlay as the video. Please put the subtitles on an overlay... If the audio volume can be on an overlay, so can the subtitles be. VLC needs to ramp up development and UI efforts, because PotPlayer is a much better, feature laden player, although it's Windows only :(.

jbk 3y ago

_(President of VideoLAN here)_ The remark here is that AppStores have so much power that they are forcing limiting rules, and few people complain, because they have no choices. On Android, we can either give Google our private (!) key or not support existing Android versions, and there is (as usual for Google) no one to discuss this with. On Windows, they changed soo many times the backend of their store, that even with support from the top of the hierarchy, we cannot even update our desktop apps (change a URL, not even a binary…) Apple, so far, is less annoying, but to support old versions (iOS9 or 10) is an always on battle. Apple AppStores does not allow GPL, Microsoft does not allow GPLv3 and Unity does not even allow LGPL… It’s very frustrating and time consuming, but because we don’t make money out of those, and we are on more platforms than anyone, we can complain publically…

heyoni 3y ago
There was wording in googles latest terms of service that seemed to imply that there would be recourse for certain violations and they wouldn’t jump straight to closing accounts and ignoring users’ pleas…I wonder if that’s a cultural shift that might extend to developer accounts and their android app store. If not today, hopefully soon.
blackeyeblitzar 3y ago
Thank you for a wonderful product and for drawing attention to this issue. Given all the anticompetitive changes from Microsoft recently, I am worried desktops are only going to get worse and become fully like mobile devices soon. I think current antitrust legislation isn’t enough. We need different laws with easier enforcement. And instead of wasting time with laws and legal battles, we just need trillion dollar companies to be heavily taxed and use that money to fund competition.
Const-me 3y ago
On Android, I think you can ignore the app store. I have never agreed to the ToS so none of the google’s services work on my phone, and I never used google account on the device. The play store is unavailable, yet I can install programs packaged into APK format. BTW, I use VLC-Android-3.5.4-arm64-v8a.apk to listen to internet radios I’ve subscribed. Very few players support M3U files with streaming URLs inside which include API key to authenticate. VLC does.

deleted 3y ago

[deleted]