5 ms·

This permission has been a security issue since its introduction. Random apps have been caught iterating over used media to extract geolocation history based on

This permission has been a security issue since its introduction. Random apps have been caught iterating over used media to extract geolocation history based on EXIF information and other such metadata (for no good reason, data collection for data traders), so Google did the right thing and made file access permission-first. Almost no apps need this permission, so being skeptical makes a lot of sense. File managers and other such apps are routinely permitted to use this permission, so it's not like Google is locking out utility apps or anything. The current state of Google Play is the result of years of Google being too permissive by default and trying to patch things later while desperately trying to remain backwards compatible. Give advertisers a finger and they take the whole hand. Your average Android phone's internal storage used to be full of dotfiles, hidden directories, not-so-hidden directories, all full of identifiers and cross-identifiers to break the cross-app tracking boundary enforced by the normal API. As far as I know, Google has made an API available for picking a directory to sync with. I'm not sure why NextCloud needs to see every file on my SD card when it can ask for folders to sync into and can use a normal file picker to upload new files without going through a file manager, but there's probably a feature somewhere hidden in their app that necessitates this permission. The policy itself makes a lot of sense and I'd argue is beneficial for Google Play's user base. NextCloud's problem seems to be that Google isn't letting a human with common sense review their upload. Because of Google being Google, outcry is the only way to get attention from an actual human being when it comes to app stores (Apple has had very similar issues, though they claim their reviews are all done by humans). EDIT: NextCloud states "SAF cannot be used, as it is for sharing/exposing our files to other apps, so the reviewer clearly misunderstood our app workflow." as a reason for not being able to use the better APIs, but I'm not sure if that's true. SAF has a dedicated API for maintaining access to a folder (https://developer.android.com/training/data-storage/shared/documents-files#perform-operations https://developer.android.com/training/data-storage/shared/d...). I think NextCloud misinterpreted Google here.

hedora 1y ago
Google broke backup, so the only way to get an e2e setup is with nextcloud. Obviously, a nightly backup of the phone can’t rely on user intervention.
- nolist_policy 1y ago
  SAF only requires user intervention once.
owebmaster 1y ago
> The current state of Google Play is the result of years of Google being too permissive Wrong. The current state is a result of Google monopolizing the android apps market. They should be split into 5 different companies. I do not care about the reasons Google think they are protecting me. They are protecting their absurd profit.
kukkamario 1y ago
NextCloud currently has to copy all files that it wants to upload & back up to its own app directory which is pain to actual usability. I'm guessing this annoyance is also related to these fun permission limitations.
- int_19h 1y ago
  Yep, and it extends to many other apps. For example, the Kiwix app was able to read .zim files directly from SD card (which you very much want to do since e.g. Wikipedia is >100 Gb). Not anymore.
- jeroenhd 1y ago
  NextCloud can request permanent access to a folder on internal storage and read & sync those directly. That's how KDE Connect does it. They haven't implemented the feature yet, at the moment.
kukkamario 1y ago
SAF documentation seems a bit misleading: takePersistableUriPermission part only talks about files, but other sources seem to indicate that it also works for directories so it should be possible to request permissions to a directory and then maintain it correctly.
supermatt 1y ago
What permission does Google drive have? That is the permission that NextCloud should be able to use in order to provide comparative features. People use NextCloud because they want to host their own “cloud” at home. If Google don’t let Nextcloud use the same permissions as their own services how are they supposed to do that?
- DrillShopper 1y ago
  Not allowing third parties to use all of the platform features is the kind of behavior that people used to call Microsoft a monopolist. In that lens I'll never understand anybody who thinks Microsoft was a monopolist in the 90s but think that Google is not now.
  - supermatt 1y ago
    Google absolutely is, but through lobbying they have managed to retain an antiquated definition of what the “market” is. I.e they would say it’s the mobile market, whereas the reality is that it’s now an “android” market and an “iOS” market. That’s exactly what the EUs “digital markets act” was created to address. In a true market there are no walled gardens, the market is accessible to all. Personally I think it’s not enough and that they should also be split up. Ideally I feel any corporation should be restricted to a single market segment or trade category.
- jeroenhd 1y ago
  Does Google Drive have the ability to synchronise arbitrary locations? I haven't used it in ages, but I don't think GDrive has any special features or abilities that NextCloud doesn't have. It certainly doesn't have the permission that NextCloud says it needs.
  - supermatt 1y ago
    When referring to google drive, I meant whatever the app/service is that backs up your device to Google Drive. As you cant switch out the backend that uses (it is hard coded to use google drive), you would need the same permissions in order to replicate it.
im3w1l 1y ago
Good guys should be able to iterate the files to help users achieve their goals. Bad guys should be thrown into jail.
xg15 1y ago
The API seems to have some peculiar restrictions, specifically that you cannot share the Downloads folder and no entire SD cards (only subfolders on the card). Maybe Nextcloud offered this functionality before and so couldn't restore it with the new API? Also, unsurprisingly, data/ and obb/ are also forbidden, so the API is unusable for a backup tool.
- jeroenhd 1y ago
  data/ and obb/ also weren't accessible with the "manage all files" permission, nor were they accessible to built-in apps from Google (except the ones that own the files, of course).
apitman 1y ago
> Google has made an API available for picking a directory to sync with The available APIs are a pain to work with and have terrible performance. And it doesn't work at all with native code. Also what about people using Nextcloud to back up their phones? It would need access to everything. If I want to give an app access to all my files, google shouldn't have a say in that. Their paternalism is pervasive and palpable.

hedora 1y ago

Google broke backup, so the only way to get an e2e setup is with nextcloud. Obviously, a nightly backup of the phone can’t rely on user intervention.

nolist_policy 1y ago
SAF only requires user intervention once.

owebmaster 1y ago

> The current state of Google Play is the result of years of Google being too permissive Wrong. The current state is a result of Google monopolizing the android apps market. They should be split into 5 different companies. I do not care about the reasons Google think they are protecting me. They are protecting their absurd profit.

kukkamario 1y ago

NextCloud currently has to copy all files that it wants to upload & back up to its own app directory which is pain to actual usability. I'm guessing this annoyance is also related to these fun permission limitations.

int_19h 1y ago
Yep, and it extends to many other apps. For example, the Kiwix app was able to read .zim files directly from SD card (which you very much want to do since e.g. Wikipedia is >100 Gb). Not anymore.
jeroenhd 1y ago
NextCloud can request permanent access to a folder on internal storage and read & sync those directly. That's how KDE Connect does it. They haven't implemented the feature yet, at the moment.

kukkamario 1y ago

SAF documentation seems a bit misleading: takePersistableUriPermission part only talks about files, but other sources seem to indicate that it also works for directories so it should be possible to request permissions to a directory and then maintain it correctly.

supermatt 1y ago

What permission does Google drive have? That is the permission that NextCloud should be able to use in order to provide comparative features. People use NextCloud because they want to host their own “cloud” at home. If Google don’t let Nextcloud use the same permissions as their own services how are they supposed to do that?

DrillShopper 1y ago
Not allowing third parties to use all of the platform features is the kind of behavior that people used to call Microsoft a monopolist. In that lens I'll never understand anybody who thinks Microsoft was a monopolist in the 90s but think that Google is not now.
- supermatt 1y ago
  Google absolutely is, but through lobbying they have managed to retain an antiquated definition of what the “market” is. I.e they would say it’s the mobile market, whereas the reality is that it’s now an “android” market and an “iOS” market. That’s exactly what the EUs “digital markets act” was created to address. In a true market there are no walled gardens, the market is accessible to all. Personally I think it’s not enough and that they should also be split up. Ideally I feel any corporation should be restricted to a single market segment or trade category.
jeroenhd 1y ago
Does Google Drive have the ability to synchronise arbitrary locations? I haven't used it in ages, but I don't think GDrive has any special features or abilities that NextCloud doesn't have. It certainly doesn't have the permission that NextCloud says it needs.
- supermatt 1y ago
  When referring to google drive, I meant whatever the app/service is that backs up your device to Google Drive. As you cant switch out the backend that uses (it is hard coded to use google drive), you would need the same permissions in order to replicate it.

im3w1l 1y ago

Good guys should be able to iterate the files to help users achieve their goals. Bad guys should be thrown into jail.

xg15 1y ago

The API seems to have some peculiar restrictions, specifically that you cannot share the Downloads folder and no entire SD cards (only subfolders on the card). Maybe Nextcloud offered this functionality before and so couldn't restore it with the new API? Also, unsurprisingly, data/ and obb/ are also forbidden, so the API is unusable for a backup tool.

jeroenhd 1y ago
data/ and obb/ also weren't accessible with the "manage all files" permission, nor were they accessible to built-in apps from Google (except the ones that own the files, of course).

apitman 1y ago

> Google has made an API available for picking a directory to sync with The available APIs are a pain to work with and have terrible performance. And it doesn't work at all with native code. Also what about people using Nextcloud to back up their phones? It would need access to everything. If I want to give an app access to all my files, google shouldn't have a say in that. Their paternalism is pervasive and palpable.