7 ms·

Google specifically allows the use of the permission[1] if the app falls in a set that truly require it to function. File managers Backup and restore apps Anti

Google specifically allows the use of the permission[1] if the app falls in a set that truly require it to function. File managers Backup and restore apps Anti-virus apps Document management apps On-device file search Disk and file encryption Device-to-device data migration This Nextcloud app seems to be an app that mirrors your Nextcloud storage to your device, and I cannot understand why it would need all access to any other data stored on the external device -- with the enormous risk that entails -- much less that can't be selectively picked by the user. It isn't a file manager, it isn't a backup utility, it's a cloud provider with local mirroring. I get why Google told them to do things otherwise. Another comment mentions this is "bad faith" security and that's just overly cynical. Android and iOS both suffered from basically trusting app developers, and both were burned for it. Hardening down and making apps only request precisely what they actually need seems to be a massive user positive. [1] - https://developer.android.com/training/data-storage/manage-all-files?authuser=1 https://developer.android.com/training/data-storage/manage-a... - the exclusions can be found at the bottom.

pjc50 1y ago
Depends how you use it: I suspect people want their entire photo folders mirrored into Nextcloud from the device, which would fit under the "backup utility" category. > what they actually need seems to be a massive user positive So positive for the user that they filed a bug report about it?
- llm_nerd 1y ago
  It is a long-standing policy, not a "bug"[1]. Further it isn't the users complaining, it's a company of a fringe "cloud" product. I'm going to be gentle here and say their app looks incredibly shitty, and I suspect they saw an opportunity to get some free press on the "Google the monopolist" angle. >I suspect people want their entire photo folders mirrored into Nextcloud from the device That isn't remotely the contention, nor do photos even qualify for this as they use a different API. Further, the reason this company gives for refusing to use the obviously more suitable structured storage API is that they don't want their files -- presumably mirrored from the cloud storage -- visible to other apps. Their complaint is technical nonsense and doesn't pass an ounce of scrutiny. The argument by this company is nonsensical, and their argument seems to be "we did it this way before and we don't want to change". Firstly they can have their own app storage without granting access to any other app, and they can go through a system UI process to get access to additional folders (for instance "I want to back up my WhatsApp folder to this cloud provider"). They argue against the latter because they seem to think it somehow reveals the former, but that isn't the case whatsoever. [1] - Well it's a bug in the Nextcloud product where they seem to just ignore that the instance lacks a permission
  - pjc50 1y ago
    It is the users complaining, or rather specifically a user: https://github.com/nextcloud/android/issues/14135 https://github.com/nextcloud/android/issues/14135
    - llm_nerd 1y ago
      The user is complaining that the app isn't using the proper APIs. For instance in the case of the "exactly" guy, the app would use structured storage APIs to let the user grant permissions to backup their WhatsApp folder. Instead of fixing their app the company instead whines to the press and gives technically nonsensical rationale for why they can't just do the work necessary because "we did it this way before and they let us for a while, so..."
      - winkeltripel 1y ago
        9 years of the api working, then Google shuts them down. I expect an interface to be consistent after working for 9 years. I think they're trying to keep their story simple, for the sake of clarity. I believe the nextcloud team when they say they need the permission. Part of the issue is that nextcloud has many use cases, including ones where your files don't get synced to your mobile device until you touch the file, replacing them with a reference to a file. It's cool cause you can access and manage a tb of pictures or documents from a 64gb android.
        deng 1y ago
        > I believe the nextcloud team when they say they need the permission. I don't (and I do use NC). The sentence "SAF cannot be used, as it is for sharing/exposing our files to other apps" is simply wrong and llm_nerd is right that SAF should be able to handle that use case,see https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d... There are some restrictions regarding which directories you can access, but for most use-cases it should be perfectly fine. It's also not that this should come as a surprise to them. In fact, there's an issue about this from the NC team themselves from August '22: https://github.com/nextcloud/android/issues/10123 https://github.com/nextcloud/android/issues/10123 Why they still think SAF cannot be used is a mystery to me.
- deng 1y ago
  > I suspect people want their entire photo folders mirrored into Nextcloud from the device, which would fit under the "backup utility" category. Exactly. Many people use Nextcloud's auto-upload to backup important data from their phone. In addition to photos, I use it to backup FreeOTP and WhatsApp, for instance. This does not work with the version from Google Play, see https://github.com/nextcloud/android/issues/14334 https://github.com/nextcloud/android/issues/14334 EDIT: After some research, I think even that use case should be possible with SAF, you just need to move your backups to external storage that you can access via SAF.
- blkhawk 1y ago
  yes, exactly - it has an "AutoUpload" function that worked super well. Make a photo and by the time you put the phone down its on a folder on your desktop read for say putting something on eBay. it stopped working well or at all over the last 2 years or so. I think if a simple "allow access to the photo folder" would have fixed it they out have used it. maybe it doesn't get the events when a photo is made?
- Ajedi32 1y ago
  > people want their entire photo folders mirrored Then request access to their media folder. You don't need full disk access.
  - hashhar 1y ago
    WhatsApp media lives in separate folder. PDFs that I download live in downloads folder (which you can't give access to for some reason anyway). Music lives elsewhere and so on.
    - Ajedi32 1y ago
      You can grant permission to multiple folders you know. Downloads is blocked because it would include everything you download, possibly including private stuff you don't want other apps to access. Just save the stuff that you want synced to a different folder. I guess if you really want everything synced (e.g. doing a full device backup) then that would fall under Google's exception for backup apps and it would be allowed full disk access. Those are kinda separate use cases though. Maybe Nextcloud could make a separate "Nextcloud Device Backup" app which does that?
      - daurentius523 1y ago
        > You can grant permission to multiple folders you know. I had to deal with another application (the only one that I found that for using my webdav solution does not automatically want to collect data and send it somewhere else) which instead of make backup of SD card was backup one folder - set server, password etc. for ONE folder PER backup action. - If you want to lose time for 2 hours, please do yourself this questionable favour but I do not want to do that because some "wise" people cannot comprehend that some people want copy of entire thing, not one folder, entire thing. > Downloads is blocked because it would include everything you download, possibly including private stuff you don't want other apps to access. The point: This is cloud application that connects to server that sits on my desk on NUC. Do you understand that in the (Google)-(Open Source)-(Own Server) the Google part is one that most reasonable people consider not private. > Just save the stuff that you want synced to a different folder. Do you move entire folders or every file each time you download something because app cannot backup it - or do you change app. What if that's the only app that does it privately? > Those are kinda separate use cases though. Maybe it is not system developer job to decide for me that I want to give application the permission to do what I want application to do. It is not system nor developer job to stop owner (administrator) from what owner decides to do. > Maybe Nextcloud could make a separate "Nextcloud Device Backup" app which does that? Maybe competitors should not have permission on deciding what their competitors should do. Google essentially makes everything private so cumbersome to use that it own solution seems easy.
GTP 1y ago
It's not just mirroring of your remote storage, you can also upload local files manually, turn on auto-upload for some directories (the main use case is uploading pictures) ant there was recently work being done to enable two-way-synchronization for directories that the user would like to sync. IMO it makes sense to let the users give it access to all the files on the phone, if they whish to do so.
- llm_nerd 1y ago
  For those scenarios, structured storage fits the bill. The app requests folder permission and the user, using system UIs, grants permissions on the folders they want to enable. >it makes sense to let the users give it access to all the files on the phone It doesn't even pretend to be a backup app, and further the permission we're talking about is limited to external storage (though that is a nebulous term on many Android devices where internal storage is split-brained on being internal and partly external). Further saying "let the user decide" works great in theory and with a considered, rational userbase. In reality it means that everyone just says sure to everything, and soon all of the user's data is exfiltrated and everyone is whining that Google/Apple/et al should have forseen this.
  - GTP 1y ago
    > For those scenarios, structured storage fits the bill. The app requests folder permission and the user, using system UIs, grants permissions on the folders they want to enable. I see your point, but why isn't this the case for document management apps? Also, Nextcloud can be extended with plugins, some of them falling in the document management category. > Further saying "let the user decide" works great in theory and with a considered, rational userbase. Nextcloud is mostly used by people that like to self-host their services, so in this case we fall into the rational userbase category.
    - Arnt 1y ago
      It is what e.g. Simple Gallery does. It works well. Nice API. https://play.google.com/store/apps/details?id=com.simplemobiletools.gallery.pro https://play.google.com/store/apps/details?id=com.simplemobi... or on github.
znpy 1y ago
I wonder if google’s drive app is subject to the same limitations, though.
- izacus 1y ago
  It is.
pomerange 1y ago
The app is a competitor to google drive (app). It is used to upload/download, backup, syncronize (one or two way) files, media and documents between the device and the cloud. Doesn't that cover more than one of the mentioned uses? Why would FilesyncPro (example) get to have the permission but not nextcloud client? Even for media files specifically there are a lot of gotchas without full file access, like risk of location being stripped from all images synced trough the app (unless user gives media location permission) or similarly missing exif.. To upload on change it needs to be allowed to watch the filesystem Meanwhile google drive gets to be installed as a system app
palata 1y ago
> This Nextcloud app seems to be Right, so you don't know the app. What about getting informed first? I use Nextcloud to backup files to the cloud. I want it to access my files.
- izacus 1y ago
  And you can let it if they use Storage Access Framework to ask for that permission without them requiring blanket access to all your private data. Perhaps you should get informed as well. In the end this is again app developers refusing to do the work to protect privacy and trying to push through the laziest most privacy voilating solution because it's less work.
  - palata 1y ago
    > Perhaps you should get informed as well. What did I say that was wrong? The comment I was answering to - that I assume you read - says: "This Nextcloud app seems to be [...] It isn't a file manager, it isn't a backup utility, it's a cloud provider with local mirroring." Which is wrong, isn't it?
  - albedoa 1y ago
    The person you are replying to has not denied anything you said, nor have they given any indication that they need to get informed. Your comment is wildly misplaced.
zb3 1y ago
Hello there, it seems I was indirectly mentioned.. So let me ask you, how does this: > Hardening down and making apps only request precisely what they actually need Relate to Google Play Services? It seems to relate only to third party apps, doesn't it?

pjc50 1y ago

Depends how you use it: I suspect people want their entire photo folders mirrored into Nextcloud from the device, which would fit under the "backup utility" category. > what they actually need seems to be a massive user positive So positive for the user that they filed a bug report about it?

llm_nerd 1y ago
It is a long-standing policy, not a "bug"[1]. Further it isn't the users complaining, it's a company of a fringe "cloud" product. I'm going to be gentle here and say their app looks incredibly shitty, and I suspect they saw an opportunity to get some free press on the "Google the monopolist" angle. >I suspect people want their entire photo folders mirrored into Nextcloud from the device That isn't remotely the contention, nor do photos even qualify for this as they use a different API. Further, the reason this company gives for refusing to use the obviously more suitable structured storage API is that they don't want their files -- presumably mirrored from the cloud storage -- visible to other apps. Their complaint is technical nonsense and doesn't pass an ounce of scrutiny. The argument by this company is nonsensical, and their argument seems to be "we did it this way before and we don't want to change". Firstly they can have their own app storage without granting access to any other app, and they can go through a system UI process to get access to additional folders (for instance "I want to back up my WhatsApp folder to this cloud provider"). They argue against the latter because they seem to think it somehow reveals the former, but that isn't the case whatsoever. [1] - Well it's a bug in the Nextcloud product where they seem to just ignore that the instance lacks a permission
- pjc50 1y ago
  It is the users complaining, or rather specifically a user: https://github.com/nextcloud/android/issues/14135 https://github.com/nextcloud/android/issues/14135
  - llm_nerd 1y ago
    The user is complaining that the app isn't using the proper APIs. For instance in the case of the "exactly" guy, the app would use structured storage APIs to let the user grant permissions to backup their WhatsApp folder. Instead of fixing their app the company instead whines to the press and gives technically nonsensical rationale for why they can't just do the work necessary because "we did it this way before and they let us for a while, so..."
    - winkeltripel 1y ago
      9 years of the api working, then Google shuts them down. I expect an interface to be consistent after working for 9 years. I think they're trying to keep their story simple, for the sake of clarity. I believe the nextcloud team when they say they need the permission. Part of the issue is that nextcloud has many use cases, including ones where your files don't get synced to your mobile device until you touch the file, replacing them with a reference to a file. It's cool cause you can access and manage a tb of pictures or documents from a 64gb android.
      - deng 1y ago
        > I believe the nextcloud team when they say they need the permission. I don't (and I do use NC). The sentence "SAF cannot be used, as it is for sharing/exposing our files to other apps" is simply wrong and llm_nerd is right that SAF should be able to handle that use case,see https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d... There are some restrictions regarding which directories you can access, but for most use-cases it should be perfectly fine. It's also not that this should come as a surprise to them. In fact, there's an issue about this from the NC team themselves from August '22: https://github.com/nextcloud/android/issues/10123 https://github.com/nextcloud/android/issues/10123 Why they still think SAF cannot be used is a mystery to me.
deng 1y ago
> I suspect people want their entire photo folders mirrored into Nextcloud from the device, which would fit under the "backup utility" category. Exactly. Many people use Nextcloud's auto-upload to backup important data from their phone. In addition to photos, I use it to backup FreeOTP and WhatsApp, for instance. This does not work with the version from Google Play, see https://github.com/nextcloud/android/issues/14334 https://github.com/nextcloud/android/issues/14334 EDIT: After some research, I think even that use case should be possible with SAF, you just need to move your backups to external storage that you can access via SAF.
blkhawk 1y ago
yes, exactly - it has an "AutoUpload" function that worked super well. Make a photo and by the time you put the phone down its on a folder on your desktop read for say putting something on eBay. it stopped working well or at all over the last 2 years or so. I think if a simple "allow access to the photo folder" would have fixed it they out have used it. maybe it doesn't get the events when a photo is made?
Ajedi32 1y ago
> people want their entire photo folders mirrored Then request access to their media folder. You don't need full disk access.
- hashhar 1y ago
  WhatsApp media lives in separate folder. PDFs that I download live in downloads folder (which you can't give access to for some reason anyway). Music lives elsewhere and so on.
  - Ajedi32 1y ago
    You can grant permission to multiple folders you know. Downloads is blocked because it would include everything you download, possibly including private stuff you don't want other apps to access. Just save the stuff that you want synced to a different folder. I guess if you really want everything synced (e.g. doing a full device backup) then that would fall under Google's exception for backup apps and it would be allowed full disk access. Those are kinda separate use cases though. Maybe Nextcloud could make a separate "Nextcloud Device Backup" app which does that?
    - daurentius523 1y ago
      > You can grant permission to multiple folders you know. I had to deal with another application (the only one that I found that for using my webdav solution does not automatically want to collect data and send it somewhere else) which instead of make backup of SD card was backup one folder - set server, password etc. for ONE folder PER backup action. - If you want to lose time for 2 hours, please do yourself this questionable favour but I do not want to do that because some "wise" people cannot comprehend that some people want copy of entire thing, not one folder, entire thing. > Downloads is blocked because it would include everything you download, possibly including private stuff you don't want other apps to access. The point: This is cloud application that connects to server that sits on my desk on NUC. Do you understand that in the (Google)-(Open Source)-(Own Server) the Google part is one that most reasonable people consider not private. > Just save the stuff that you want synced to a different folder. Do you move entire folders or every file each time you download something because app cannot backup it - or do you change app. What if that's the only app that does it privately? > Those are kinda separate use cases though. Maybe it is not system developer job to decide for me that I want to give application the permission to do what I want application to do. It is not system nor developer job to stop owner (administrator) from what owner decides to do. > Maybe Nextcloud could make a separate "Nextcloud Device Backup" app which does that? Maybe competitors should not have permission on deciding what their competitors should do. Google essentially makes everything private so cumbersome to use that it own solution seems easy.

GTP 1y ago

It's not just mirroring of your remote storage, you can also upload local files manually, turn on auto-upload for some directories (the main use case is uploading pictures) ant there was recently work being done to enable two-way-synchronization for directories that the user would like to sync. IMO it makes sense to let the users give it access to all the files on the phone, if they whish to do so.

llm_nerd 1y ago
For those scenarios, structured storage fits the bill. The app requests folder permission and the user, using system UIs, grants permissions on the folders they want to enable. >it makes sense to let the users give it access to all the files on the phone It doesn't even pretend to be a backup app, and further the permission we're talking about is limited to external storage (though that is a nebulous term on many Android devices where internal storage is split-brained on being internal and partly external). Further saying "let the user decide" works great in theory and with a considered, rational userbase. In reality it means that everyone just says sure to everything, and soon all of the user's data is exfiltrated and everyone is whining that Google/Apple/et al should have forseen this.
- GTP 1y ago
  > For those scenarios, structured storage fits the bill. The app requests folder permission and the user, using system UIs, grants permissions on the folders they want to enable. I see your point, but why isn't this the case for document management apps? Also, Nextcloud can be extended with plugins, some of them falling in the document management category. > Further saying "let the user decide" works great in theory and with a considered, rational userbase. Nextcloud is mostly used by people that like to self-host their services, so in this case we fall into the rational userbase category.
  - Arnt 1y ago
    It is what e.g. Simple Gallery does. It works well. Nice API. https://play.google.com/store/apps/details?id=com.simplemobiletools.gallery.pro https://play.google.com/store/apps/details?id=com.simplemobi... or on github.

znpy 1y ago

I wonder if google’s drive app is subject to the same limitations, though.

izacus 1y ago
It is.

pomerange 1y ago

The app is a competitor to google drive (app). It is used to upload/download, backup, syncronize (one or two way) files, media and documents between the device and the cloud. Doesn't that cover more than one of the mentioned uses? Why would FilesyncPro (example) get to have the permission but not nextcloud client? Even for media files specifically there are a lot of gotchas without full file access, like risk of location being stripped from all images synced trough the app (unless user gives media location permission) or similarly missing exif.. To upload on change it needs to be allowed to watch the filesystem Meanwhile google drive gets to be installed as a system app

palata 1y ago

> This Nextcloud app seems to be Right, so you don't know the app. What about getting informed first? I use Nextcloud to backup files to the cloud. I want it to access my files.

izacus 1y ago
And you can let it if they use Storage Access Framework to ask for that permission without them requiring blanket access to all your private data. Perhaps you should get informed as well. In the end this is again app developers refusing to do the work to protect privacy and trying to push through the laziest most privacy voilating solution because it's less work.
- palata 1y ago
  > Perhaps you should get informed as well. What did I say that was wrong? The comment I was answering to - that I assume you read - says: "This Nextcloud app seems to be [...] It isn't a file manager, it isn't a backup utility, it's a cloud provider with local mirroring." Which is wrong, isn't it?
- albedoa 1y ago
  The person you are replying to has not denied anything you said, nor have they given any indication that they need to get informed. Your comment is wildly misplaced.

zb3 1y ago

Hello there, it seems I was indirectly mentioned.. So let me ask you, how does this: > Hardening down and making apps only request precisely what they actually need Relate to Google Play Services? It seems to relate only to third party apps, doesn't it?