5 ms·

> What "proprietary blobs" does Signal have? As they say in the Github readme, FCM and Google Maps. FCM doesn't technically require a blob — it's just that Go

by grishka 11mo ago

> What "proprietary blobs" does Signal have? As they say in the Github readme, FCM and Google Maps. FCM doesn't technically require a blob — it's just that Google wants you to think it does. I reverse engineered their library and it turned out to be a criminally over-engineered wrapper around two broadcast receivers. So, the Mastodon app is proudly the first app ever to both support FCM push notifications, and be 100% open-source.

nicoburns 11mo ago
Oo, do you have a link for your implementation? I will soon be looking at creating a library to support FCM (android push notifications) in Android apps written in Rust. And having a simpler interface with the OS (esp. if it therefore doesn't require building a non-syste library) would be incredibly helpful.
- GranPC 11mo ago
  Looks like this is the first commit where it was added: https://github.com/mastodon/mastodon-android/commit/a0cbf0fa31cbed1993daf6fda065739341f51643 https://github.com/mastodon/mastodon-android/commit/a0cbf0fa...
  - nicoburns 11mo ago
    Thanks! It looks like that repo is GPL though, which I respect but isn't going to work for my usage (where I'm trying to build a generic UI toolkit that can be used by all sorts of applications including closed source ones).
    - deleted 11mo ago
      [deleted]
    - cyberax 11mo ago
      If you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23bcc1619f8c5717de5b9d/play-services-core/src/main/java/org/microg/gms/gcm/McsService.java#L556 https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b... It's Apache 2.
    - grishka 11mo ago
      It's just two broadcast receivers (one for receiving the push token, another for receiving actual notifications), and one broadcast sender to ask GSF to give you a token. This code is so trivial it's not even worth separating into a library. Here's how you request a push token: Intent intent = new Intent("com.google.iid.TOKEN_REQUEST"); intent.setPackage("com.google.android.gms"); intent.putExtra("app", PendingIntent.getBroadcast(context, 0, new Intent(), PendingIntent.FLAG_IMMUTABLE)); intent.putExtra("sender", FCM_SENDER_ID); intent.putExtra("subtype", FCM_SENDER_ID); intent.putExtra("scope", "*"); intent.putExtra("kid", "|ID|1|"); context.sendBroadcast(intent); Here are the two receivers: <receiver android:name=".PushNotificationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND"> <intent-filter> <action android:name="com.google.android.c2dm.intent.RECEIVE" /> </intent-filter> </receiver> <receiver android:name=".api.PushSubscriptionManager$RegistrationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND"> <intent-filter> <action android:name="com.google.android.c2dm.intent.REGISTRATION"/> </intent-filter> </receiver> The first one is where you get notifications. The parameters you sent from the server will simply be your intent extras. The second one is where you get push tokens. There will be a "registration_id" extra string which is your token. It may start with "|ID|1|" (the "kid" parameter from the request, not quite sure what it does), in which case you need to remove that part. You want to refresh your push token every time your app gets updated and also just periodically if you haven't done it in a while. I do it every 30 days.
      - threecheese 11mo ago
        Did you just invent a way to circumvent the GPL? Brilliant! j/k ofc
        prophesi 11mo ago
        Their comment would technically be proprietary code since there's no license alongside it, but grishka wrote the original implementation of the reverse engineered code in that mastodon commit in the first place. So I'd imagine it's free game to use it as a reference (IANAL)
- ForHackernews 11mo ago
  Please consider supporting https://unifiedpush.org/ https://unifiedpush.org/ in addition to/instead of FCM.
landr0id 11mo ago
>As they say in the Github readme, FCM and Google Maps. Thanks, I didn't notice that. Reading this, I'm kind of surprised that Signal doesn't offer an OpenStreetMaps build as it seems like it'd be more inline with their philosophy.
- tomtomtom777 11mo ago
  The app doesn't even recognize geo:.. links, which makes degoogling rather hard.
cyberax 11mo ago
I reverse-engineered the notification infrastructure in Android, but for me it was the desire to be able to use customer-provided Google API keys ("google-services.json"). The protocol itself was easy, but my problem was that Google Play Services have a special permission to exempt itself from power management. And more importantly, grant that permission temporarily to the individual apps when they have a notification. I don't think I ever found out how to work around this.
gpvos 11mo ago
FCM = Firebase Cloud Messaging, a messaging and notification service run by Google. https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging
inputmice 11mo ago
Maybe the first but not the only one. Ltt.rs (an email client using JMAP) does this as well. BTW you can also directly deliver WebPush notifications to FCM servers. No need for a proxy/rely run by the app developer. Ltt.rs has support for both UnifiedPush and FCM and is fully open source. The code difference between UP and FCM is very very minimal since - as I said - both are just WebPush endpoints.

by grishka 11mo ago

nicoburns 11mo ago

Oo, do you have a link for your implementation? I will soon be looking at creating a library to support FCM (android push notifications) in Android apps written in Rust. And having a simpler interface with the OS (esp. if it therefore doesn't require building a non-syste library) would be incredibly helpful.

GranPC 11mo ago
Looks like this is the first commit where it was added: https://github.com/mastodon/mastodon-android/commit/a0cbf0fa31cbed1993daf6fda065739341f51643 https://github.com/mastodon/mastodon-android/commit/a0cbf0fa...
- nicoburns 11mo ago
  Thanks! It looks like that repo is GPL though, which I respect but isn't going to work for my usage (where I'm trying to build a generic UI toolkit that can be used by all sorts of applications including closed source ones).
  - deleted 11mo ago
    [deleted]
  - cyberax 11mo ago
    If you need something permissively licensed, I believe microG also has implementation of the notification protocol: https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23bcc1619f8c5717de5b9d/play-services-core/src/main/java/org/microg/gms/gcm/McsService.java#L556 https://github.com/microg/GmsCore/blob/cb9be8f682d7649dae23b... It's Apache 2.
  - grishka 11mo ago
    It's just two broadcast receivers (one for receiving the push token, another for receiving actual notifications), and one broadcast sender to ask GSF to give you a token. This code is so trivial it's not even worth separating into a library. Here's how you request a push token: Intent intent = new Intent("com.google.iid.TOKEN_REQUEST"); intent.setPackage("com.google.android.gms"); intent.putExtra("app", PendingIntent.getBroadcast(context, 0, new Intent(), PendingIntent.FLAG_IMMUTABLE)); intent.putExtra("sender", FCM_SENDER_ID); intent.putExtra("subtype", FCM_SENDER_ID); intent.putExtra("scope", "*"); intent.putExtra("kid", "|ID|1|"); context.sendBroadcast(intent); Here are the two receivers: <receiver android:name=".PushNotificationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND"> <intent-filter> <action android:name="com.google.android.c2dm.intent.RECEIVE" /> </intent-filter> </receiver> <receiver android:name=".api.PushSubscriptionManager$RegistrationReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND"> <intent-filter> <action android:name="com.google.android.c2dm.intent.REGISTRATION"/> </intent-filter> </receiver> The first one is where you get notifications. The parameters you sent from the server will simply be your intent extras. The second one is where you get push tokens. There will be a "registration_id" extra string which is your token. It may start with "|ID|1|" (the "kid" parameter from the request, not quite sure what it does), in which case you need to remove that part. You want to refresh your push token every time your app gets updated and also just periodically if you haven't done it in a while. I do it every 30 days.
    - threecheese 11mo ago
      Did you just invent a way to circumvent the GPL? Brilliant! j/k ofc
      - prophesi 11mo ago
        Their comment would technically be proprietary code since there's no license alongside it, but grishka wrote the original implementation of the reverse engineered code in that mastodon commit in the first place. So I'd imagine it's free game to use it as a reference (IANAL)
ForHackernews 11mo ago
Please consider supporting https://unifiedpush.org/ https://unifiedpush.org/ in addition to/instead of FCM.

landr0id 11mo ago

>As they say in the Github readme, FCM and Google Maps. Thanks, I didn't notice that. Reading this, I'm kind of surprised that Signal doesn't offer an OpenStreetMaps build as it seems like it'd be more inline with their philosophy.

tomtomtom777 11mo ago
The app doesn't even recognize geo:.. links, which makes degoogling rather hard.

cyberax 11mo ago

I reverse-engineered the notification infrastructure in Android, but for me it was the desire to be able to use customer-provided Google API keys ("google-services.json"). The protocol itself was easy, but my problem was that Google Play Services have a special permission to exempt itself from power management. And more importantly, grant that permission temporarily to the individual apps when they have a notification. I don't think I ever found out how to work around this.

gpvos 11mo ago

FCM = Firebase Cloud Messaging, a messaging and notification service run by Google. https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging

inputmice 11mo ago

Maybe the first but not the only one. Ltt.rs (an email client using JMAP) does this as well. BTW you can also directly deliver WebPush notifications to FCM servers. No need for a proxy/rely run by the app developer. Ltt.rs has support for both UnifiedPush and FCM and is fully open source. The code difference between UP and FCM is very very minimal since - as I said - both are just WebPush endpoints.