4 ms·

The user is complaining that the app isn't using the proper APIs. For instance in the case of the "exactly" guy, the app would use structured storage APIs to le

The user is complaining that the app isn't using the proper APIs. For instance in the case of the "exactly" guy, the app would use structured storage APIs to let the user grant permissions to backup their WhatsApp folder. Instead of fixing their app the company instead whines to the press and gives technically nonsensical rationale for why they can't just do the work necessary because "we did it this way before and they let us for a while, so..."

winkeltripel 1y ago
9 years of the api working, then Google shuts them down. I expect an interface to be consistent after working for 9 years. I think they're trying to keep their story simple, for the sake of clarity. I believe the nextcloud team when they say they need the permission. Part of the issue is that nextcloud has many use cases, including ones where your files don't get synced to your mobile device until you touch the file, replacing them with a reference to a file. It's cool cause you can access and manage a tb of pictures or documents from a 64gb android.
- deng 1y ago
  > I believe the nextcloud team when they say they need the permission. I don't (and I do use NC). The sentence "SAF cannot be used, as it is for sharing/exposing our files to other apps" is simply wrong and llm_nerd is right that SAF should be able to handle that use case,see https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d... There are some restrictions regarding which directories you can access, but for most use-cases it should be perfectly fine. It's also not that this should come as a surprise to them. In fact, there's an issue about this from the NC team themselves from August '22: https://github.com/nextcloud/android/issues/10123 https://github.com/nextcloud/android/issues/10123 Why they still think SAF cannot be used is a mystery to me.
- threeseed 1y ago
  > I expect an interface to be consistent after working for 9 years Even if that interface is insecure and harmful to users ? As an industry we've learnt a lot about how apps siphon and sell your data. And I appreciate this probably doesn't apply to NextCloud but it can be difficult to build an API that is flexible and secure so you will get casualties.
  - lenkite 1y ago
    How is this interface "insecure and harmful to users" ?
    - Zak 1y ago
      Shady apps use file access to do tracking of various sorts and simply ingest private data that has nothing to do with their nominal purpose. Sophisticated users probably wouldn't install those apps, and certainly wouldn't agree to their request for filesystem access, but that's not who Google is trying to protect here. It's obviously not a security problem or a harm when used by an open source file synchronization app, and Google is being unsophisticated with its policy here.
      - apitman 1y ago
        Do you have links to stories about any of these shady apps that have now been stopped by this policy?
        Zak 1y ago
        Most of the time, when apps are caught doing something really shady, they're removed from the Play Store for doing the shady thing. A story wouldn't report that they stopped working because of a policy change, but some of these wouldn't make it into the store now: https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-on-google-play-send-your-data-to-china/ https://www.bleepingcomputer.com/news/security/apps-with-15m... https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-google-play-security/ https://www.zdnet.com/article/phantomlance-spying-campaign-b... https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/ https://www.welivesecurity.com/2023/05/23/android-app-breaki... There are also examples of apps using the filesystem to try to detect rooted devices, an invasion of user privacy: https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_access_to_your_file_system_without/ https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_a...
        1y ago
nottorp 1y ago
> to let the user grant permissions to backup their WhatsApp folder So a backup app should add support for every Android application that the user is likely to back up?
- nolist_policy 1y ago
  No, not at all. The new API simply presents a directory picker to the user. The user can give your app access to any directory.
  - g-b-r 1y ago
    Any directory that Google lets you access, which is very far from every directory. For example, without using Google'' backup you can't backup the data of other apps, such as games' progress.

winkeltripel 1y ago

9 years of the api working, then Google shuts them down. I expect an interface to be consistent after working for 9 years. I think they're trying to keep their story simple, for the sake of clarity. I believe the nextcloud team when they say they need the permission. Part of the issue is that nextcloud has many use cases, including ones where your files don't get synced to your mobile device until you touch the file, replacing them with a reference to a file. It's cool cause you can access and manage a tb of pictures or documents from a 64gb android.

deng 1y ago
> I believe the nextcloud team when they say they need the permission. I don't (and I do use NC). The sentence "SAF cannot be used, as it is for sharing/exposing our files to other apps" is simply wrong and llm_nerd is right that SAF should be able to handle that use case,see https://developer.android.com/training/data-storage/shared/documents-files#grant-access-directory https://developer.android.com/training/data-storage/shared/d... There are some restrictions regarding which directories you can access, but for most use-cases it should be perfectly fine. It's also not that this should come as a surprise to them. In fact, there's an issue about this from the NC team themselves from August '22: https://github.com/nextcloud/android/issues/10123 https://github.com/nextcloud/android/issues/10123 Why they still think SAF cannot be used is a mystery to me.
threeseed 1y ago
> I expect an interface to be consistent after working for 9 years Even if that interface is insecure and harmful to users ? As an industry we've learnt a lot about how apps siphon and sell your data. And I appreciate this probably doesn't apply to NextCloud but it can be difficult to build an API that is flexible and secure so you will get casualties.
- lenkite 1y ago
  How is this interface "insecure and harmful to users" ?
  - Zak 1y ago
    Shady apps use file access to do tracking of various sorts and simply ingest private data that has nothing to do with their nominal purpose. Sophisticated users probably wouldn't install those apps, and certainly wouldn't agree to their request for filesystem access, but that's not who Google is trying to protect here. It's obviously not a security problem or a harm when used by an open source file synchronization app, and Google is being unsophisticated with its policy here.
    - apitman 1y ago
      Do you have links to stories about any of these shady apps that have now been stopped by this policy?
      - Zak 1y ago
        Most of the time, when apps are caught doing something really shady, they're removed from the Play Store for doing the shady thing. A story wouldn't report that they stopped working because of a policy change, but some of these wouldn't make it into the store now: https://www.bleepingcomputer.com/news/security/apps-with-15m-installs-on-google-play-send-your-data-to-china/ https://www.bleepingcomputer.com/news/security/apps-with-15m... https://www.zdnet.com/article/phantomlance-spying-campaign-breaches-google-play-security/ https://www.zdnet.com/article/phantomlance-spying-campaign-b... https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/ https://www.welivesecurity.com/2023/05/23/android-app-breaki... There are also examples of apps using the filesystem to try to detect rooted devices, an invasion of user privacy: https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_access_to_your_file_system_without/ https://www.reddit.com/r/Android/comments/g6cdl6/apps_have_a...
        1y ago

nottorp 1y ago

> to let the user grant permissions to backup their WhatsApp folder So a backup app should add support for every Android application that the user is likely to back up?

nolist_policy 1y ago
No, not at all. The new API simply presents a directory picker to the user. The user can give your app access to any directory.
- g-b-r 1y ago
  Any directory that Google lets you access, which is very far from every directory. For example, without using Google'' backup you can't backup the data of other apps, such as games' progress.