16 ms·
The recently lost file upload feature in the Nextcloud app for Android
- jsnell 1y agoDupe (250 points, 170 comments): https://news.ycombinator.com/item?id=43970959 https://news.ycombinator.com/item?id=43970959
- sierra1011 1y agoArguably the originator's blog post has some individual merit beyond an article from a tech news aggregator.
- izacus 1y agoThe merit seems to be repeating the screech cycle from HNers not understanding the context?
- deleted 1y ago[deleted]
- inigoalonso 1y agoThis is exactly why the EU's Digital Markets Act exists. And why it needs teeth. Google disabling Nextcloud's all-files access on Android, while quietly letting its own apps and big corporate players keep it, isn't about "security". It's about control. Nextcloud is a European, privacy-first alternative built on open standards and that can be fully aligned with GDPR requirements. Blocking its core functionality while favouring your own services is a textbook abuse of platform power. Android was supposed to be open, but moves like this show it (at least the Play Services verison) is just another walled garden. If the EU is serious about digital sovereignty and fair competition, this is the kind of behaviour that must be stopped. Otherwise, no European tech, no matter how compliant, open, or user-friendly, stands a chance.
- darkwater 1y agoWaiting for the nitpicker crowd "you can install AOSP and/or sideload APKs easily, so there is no incumbent abuse here!", just like we had them for IE (you can install another browser) and iPhone (you can buy another brand). Edit: oh we already have them in the other submission
- raverbashing 1y agoYeah it's the "less space than a Nomad" people I know, I used to be one of those
- geff82 1y agoJust use e/os ! ;)
- subscribed 1y agoMaybe something else instead. e/os famously leaves the bootloader gaping open after the installation (looks like relocking is only supported on Fairphones), is very late to release anything (their most recent ROM is still based on AOSP 14!), inc.securty updates. Doesn't sound like a serious project.
- em-bee 1y agowhat else? i'd rather have secure, stable and slow. i don't know about locking the bootloader (do you have a reference to that? i'd like to read up on it). but i don't care that their rom is always the most recent one. what matters is that e/OS is the only rom i am aware of that combines usability with security. graphene OS doesn't count because it is only available on pixel phones and therefore very limited in applicability. others i don't know.
- throw347897823 1y ago[flagged]
- Hilift 1y ago
- yard2010 1y agoGoddammit Pichai. We had something mediocre, why enshitify it to the oblivion?
- BLenkomo 1y agoI would like to have both options: Full file access and controlled access. I guess not eveyrone wants nextcloud full file sync. But yes this is shitty regarding google.
- jeroenhd 1y ago> SAF cannot be used, as it is for sharing/exposing our files to other apps SAF can be used. There are reasons why this wouldn't be a good fit for NextCloud (you can't share your entire internal storage, your download folder, or the root of an SD card, for instance), but I don't think NextCloud's statement makes sense.
- lozenge 1y agoThe point of their app is to backup an entire folder. Sharing from one app to Nextcloud doesn't provide ongoing access to backup later versions of the file.
- jeroenhd 1y agoWhich they can do, using SAF, without the "access to everything everywhere" permission that they want.
- sirdvd 1y ago> permission that they want "they", in my case it's me. With on my own Nextcloud server, on my own LAN. It's me that want "access to everything everywhere". Difficult for me to think that is not about gate keeping from Google.
- jasonlotito 1y agoCurious also, why can't users have access to everything everywhere for their own files?
- nolist_policy 1y agoUsers can access almost everything everywhere with file manager apps. On the Play Store, file manager apps are one of the exceptions that are allowed to access all files.
- criddell 1y agoUsually the answer is that it creates more problems for more people than it solves. The work involved to add options to allow full access is substantial and could increase the attack surface. Features that are expensive but only useful to a small portion of the userbase often don't get prioritized.
- AmazingTurtle 1y agoWe feel your pain at Nextcloud. Our team at Everfind (unified search across Drive, OneDrive, Dropbox, etc.) has spent the past year fighting for the *drive.readonly* scope simply so we can download files, run OCR, and index their full-text for users. Google keeps telling us to make do with *drive.file* + *drive.metadata.readonly*, which breaks continuous discovery and cripples search results for any new or updated document. Bottom line: Googles "least-privilege" rhetoric sounds noble, but in practice it gives Big Tech first-party apps privileged access while forcing independent vendors to ship half-working products - or get kicked out of the Play Store. The result is users lose features and choices, and small devs burn countless hours arguing with a copy-paste policy bot.
- theodric 1y agoSounds like it's time for an(other) antitrust lawsuit. At least Nextcloud is based in Europe, which has recently shown an appetite to stand up to tech giants on some things.
- HPsquared 1y agoThe question to ask is: do Google apps have an advantage here over others?
- donatzsky 1y agoI'd be surprised if they have to go through the same review process as everyone else. And even if they do, the reviewers are likely to give them a pass because it's Google.
- em-bee 1y agothey have the advantage that they can shape the API to their needs. yes, you can argue that google apps have the same limitations as other apps. but google defines the limitations. just because google doesn't need a feature, it doesn't mean that no one else needs or should have that feature. so google is able to define features that fit their business model, and they prevent anyone else from offering a different feature set. they own the platform and compete in it. that in itself is an advantage. to not have an advantage either google must not compete with apps on the platform and or they should relinquish their ownership of the platform.
- thombles 1y agoThis is also why the official SyncThing Android app stopped being distributed. There is a fork but it's not available on the Play Store.
- deng 1y agoThe problem with the SyncThing Android app is that it's just a wrapper around SyncThing, which is a Go library, but SAF does not give you simple file descriptors you can use in native code. Instead, you get "content://" URLs, and you need a Java/Kotlin bridge to convert these to file descriptors. That would need to be done in SyncThing itself (EDIT: or some other trickery, because it seems like syncthing-fork made it work somehow). However, AFAIK, this problem would not apply to the NextCloud app.
- treyd 1y ago> and you need a Java/Kotlin bridge to convert these to file descriptors. Do you need it in these languages or could you use anything that can make binder calls?
- deng 1y agoTo my knowledge you cannot access SAF through binder, for sure not officially.
- treyd 1y agoHow are the calls made?
- charcircuit 1y agoYou need it in the same sense you need to load the system's vulkan driver. System libraries don't have more permissions, but it's going to be extra work to reimplement and your code may break on different versions or devices.
- izacus 1y agoYou can get simple file descriptors for SAF, but you do need to ask for them via Java APIs.
- gitroom 1y agodamn this hits hard, i always feel locked out when stuff gets taken away like that - you ever wonder if tech shifts like this actually give us more control or just pull it away?
- throwaway984393 1y ago[dead]
- igtztorrero 1y agoGoogle's former motto, "Don't be evil," was a key part of their corporate code of conduct, emphasizing ethical and transparent business practices. In 2015 the motto was removed, since then we are in their clutches. Now they are like Microsoft, that's the reason Nextcloud was created!
- tacker2000 1y agoGoogle abusing their power, as usual. I guess Google Drive doesnt have these restrictions, does it? It's time the Europeans move together against these blatant antitrust violations.
- happyopossum 1y ago> I guess Google Drive doesnt have these restrictions, does it? It does
- tacker2000 1y agowell, then i stand corrected. then why should nextcloud have this permission if even google drive doesn't have it?
- apitman 1y agoBecause the Android system, which is controlled by Google, does have these permissions[0]. Google is able to offer automatic backup functionality that Nextcloud can't compete with. [0]: https://support.google.com/googleone/answer/9149304?hl=en&co=GENIE.Platform%3DAndroid https://support.google.com/googleone/answer/9149304?hl=en&co...
- deleted 1y ago[deleted]
- patcon 1y agoMonopoly behaviour. If they refuse to invest in the burden of due diligence required to allow others to operate exactly as they do, then they don't deserve to be managing the field. It's costly to supervise? Ok, then charge companies a token fee if it's a burden to monitor. Locking other players out is not the appropriate response
- jeppester 1y agoThere should be a DMCA-like law that would allow to instantly prohibit actions like these until they have been properly scrutinized.
- moonshot5 1y agoAOSP platform dev here. (Filesystem) Opinions my own, I don't speak for Google. Disclaimer: I don't use nextcloud, and have not looked at their app specifically, this is just a surface level observation from my relatively informed perspective. My take: SAF would work for this use case, as others have already mentioned. Google Drive does not have the permissions that next cloud claims Google is giving preferential treatment to, and is delivered via the Play store in the same way nextcloud's app is. As others have also observed, permissions such as MANAGE_EXTERNAL_STORAGE have been rampantly abused in the past, often in horrific ways.
- coded_monkey 1y ago> As others have also observed, permissions such as MANAGE_EXTERNAL_STORAGE have been rampantly abused in the past, often in horrific ways. The lack of consideration for this point in this thread scares me. The amount of data that can be taken from a device through a permission like this is likely huge and it’s not just about “protecting users from themselves”. I wouldn’t feel safe enabling it for any app, and while syncing all data on the device sounds very useful, it’s a damned if they do, damned if they don’t scenario for Google.
- zb3 1y ago> I wouldn’t feel safe enabling it for any app Then don't enable it, no need to take away my ability to do so. Granular permissions are good (especially when the app can't reliably know they were refused), providing I have the ultimate control. > it’s a damned if they do, damned if they don’t scenario for Google. Did they consider my scenario above - where the app doesn't know it was not granted a permission?
- IshKebab 1y ago> especially when the app can't reliably know they were refused That's the problem. Android didn't do this even though it was obviously what is needed. Android apps can easily tell what permissions they have. I think Google prioritised UX over power and security here. They were presumably scared about people accidentally clicking the "Silently deny" button and then getting confused when the app didn't work. Big missed opportunity.
- scottbez1 1y agoGoogle has a history of creating first-party-only APIs to give their own Android apps an edge. In 2014 Google split their drive app into multiple separate Android apps for docs, sheets, etc. Obviously getting users to install and migrate to new apps would be a burden, so they designed a 1-click install modal that Drive could use instead of the typical redirect-to-Play-Store flow. Neat! Around that time the company I worked for (large competitor of Drive) was about to split out some core functionality into a standalone app and wanted to use a similar flow for similar reasons - Nope! Google locked that API behind an app signature verification (not even a permission) so only Google signed apps could use it. No possibility to request the permission or appeal - just a hard-coded monopoly. There ARE legitimate reasons that things like this can be risky and abuse needs to be mitigated, but there's a line that Google regularly crosses between abuse mitigation and anti-competitive behavior.
- izacus 1y agoNone of Google apps use the permission Nexcloud wants. The only exception is the preloaded "Files" file explorer app which doesn't integrate with clouds.
- scottbez1 1y agoYou're attacking a strawman; anti-competitive behavior doesn't require that you do exactly the thing you prohibit others from doing. It can be anti-competitive to use your market control to restrict competition in ways that break competitors product but do not impact your own product. In any case, you've also ignored most of my comment which WAS an example of Google going that extra step of directly blocking APIs that they leverage themselves.
- aborsy 1y agoI rely on nextcloud AIO and need to sync my files. Google can prompt the user for permissions; it’s up to the user beyond that.
- dzikimarian 1y agoHonestly it's extremely annoying my device locks me out from my data - that would be third entry to my list: * Nextcloud cannot access all files, despite many other file managers can - at least Fdroid version works. * File manager cannot access /sdcard/android/data - inconvenient workaround via adb * App is allowed to decide if I can (manually) take screenshot/ocr the screen - usually it's banking app, that wants me to remember some long number - then I write it on closest piece of paper - awesome security. No workaround as far as I know. If I wanted such treatment I would buy ios :-|
- dotancohen 1y ago> App is allowed to decide if I can (manually) take screenshot/ocr the screen - usually it's banking app, that wants me to remember some long number - then I write it on closest piece of paper - awesome security. No workaround as far as I know. The workflow that I've seen was someone I've known for under a month asking me to photograph her screen and send the photograph over Telegram. Surely that is more secure than letting her just screenshot her own device.
- tuga2099 1y agoCan Google drive app for any android upload all file types?
- leetnewb 1y agoFrom my reading, the new API seems like a move in the right direction. But either way, Google is asking Nextcloud to silently break backup/sync-ing until users grant permission, and my guess is that many users won't notice until they discover data loss - the damage to trust and brand would be substantial. And I don't think it is fair for Google to demand in this case when the consequences are almost entirely felt by the users.
- squeedles 1y agoGoogle has reached out to Nextcloud and offered to restore the permission. Wonder if the decision was motivated by the technical arguments or if the antitrust trial and various mentions in the press were a persuading factor.