Android now forces apps to include proprietary code for push notifications

https://www.reddit.com/r/freesoftware/comments/by4ipr/android_now_forces_apps_to_include_proprietary/

by lelf • 7 years ago

665 270 7 years ago

geofft• 7 years ago

You can still write free software that uses it and produces a not-entirely-free artifact when compiled, though, right? (Is there a distribution restriction on the artifact, or is it impermissible to link it with GPL apps, or something?)

I'm curious if the free software apps are compelled not to link it to preserve the free software status of their code, or just voluntarily refusing on principle (which is laudable, to be clear).

icebraining4• 7 years ago

Only if you are the author of all the code, so that the GPL doesn't actually apply to you.

In this case, the Telegram-FOSS people take the original Telegram source (which is GPL licensed) and redistribute it, so they can't distribute a non-entirely-free apk without violating the original license.

Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff.

saagarjha8• 7 years ago

Telegram violates multiple open source licenses, so I wouldn’t hold it up as an example.

caf• 7 years ago

Other apps using, for example, GPL licensed libraries or accepting third-party contributions under the GPL exclusively are also forbidden from redistributing non-entirely-free stuff.

Or even just copying bits of GPL-licensed code in themselves.

userbinator• 7 years ago

Thought experiment: write an application that automatically downloads and combines code with all sorts of legally incompatible licenses to create an application and installs it on an Android device. If personally doing it is legal (and basically unenforceable), what about making it easy for others to? Besides, unless you're a "radical Stallmanist" (for lack of better term), chances are you have a mix of proprietary and FOSS and use it together on whatever data you work with.

This is why I think IP laws make no sense, arbitrary restrictions are arbitrary and stupid.

tannhaeuser• 7 years ago

IANAL, but I think that would be regarded as a circumvention device by a court. I hope you're not basing your opinion regarding laws entirely on this contrived case :)

Wowfunhappy4• 7 years ago

My understanding is that what you describe is completely legal.

ZFS on Linux is a good example of this. ZFS and the Linux kernel are both open source, but their licenses are incompatible with one another—ie, you can't combine the code.

A common workaround for this problem is to compile the source on the user's machine. When you install ZFS in Debian, apt will automatically download the ZFS and Linux source code, recompile the kernel with ZFS included, and install the result. This is all completely invisible to the user, except for the absurdly long install time.

bloak• 7 years ago

That would definitely be a dodgy thing to do. In general, law courts are interested in the net effect of what you're doing rather than the technical details of how you did it, and what you'd be doing in that case is equivalent to distributing the Frankenstein application yourself.

Describing in a blog post how to build the Frankenstein application is perhaps perfectly all right, but somewhere between there and the hypothetical application you described a fuzzy line would be crossed.

There's another fuzzy line relating to whether code is combined or not. Code that goes into the same statically linked binary is definitely combined, I presume. What about code that communicates via a REST API or a standard protocol? Perhaps it depends on the attitude of the communities that produce the code. The Linux people seem to be happy with non-free kernel modules in a way that some people wouldn't be.

krn2• 7 years ago

Ubuntu gets around any possible GPL violations by offering to download and install proprietary drivers (ex., Nvidia) and codecs during installation process. Could something similar work for Android apps?

jimmaswell• 7 years ago

GPL seems like it gets in the way more than it helps.

izacus15• 7 years ago

Yes, it would work - you could deliver the push notification module as a separate APK which talks to the main application part. It's still way more complexity than adding a GPL lib to your app.

antpls2• 7 years ago

Just curious, does it means that a proprietary application downloaded through an open-source GPL script makes the whole (application + script) "GPL compliant" ?

seba_dos1• 7 years ago

The mechanism used by Ubuntu for such drivers is completely unrelated to GPL violations. It's just there so the non-free software doesn't get installed by default. If there would be any violation without it, there would still be a violation with it.

javagram• 7 years ago

https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

so anything that is not distributed with the operating system needs to be available as source code, so that you can credibly offer to distribute the source code to the recipients.

jmkni3• 7 years ago

I'd love to know just how different/bare bones AOSP (Android Open Source Project) is to regular Android.

As an experiment, I'd love to compile it, put it on a spare phone and use it as my daily driver for a week.

grenoire• 7 years ago

Practically, it's very difficult. LineageOS people are trying to work on that, but it's just a very big hassle with the variety of OEM components running amok the industry.

jmkni3• 7 years ago

I'll check out LineageOS, thanks

iaml• 7 years ago

You won't get play store, default apps and apps from store itself. You can install f-droid, some other store or use microG as replacement for google services and apkmirror as a store, but you'll probably have some problems with compatibility.

realusername• 7 years ago

You can't get anything running with AOSP, there's not a single common phone which would run without random Android blobs & custom kernel changes. Then once you add those blobs, you need to add MicroG to have any hope to run any moderately popular app.

Iolaum• 7 years ago

You can get a close enough view on this by finding a phone supported by LineageOS and installing it without anything esle (e.g. no fdroidPriviligedExtension, no openGapps etc).

Alternatively, or maybe even better to what you ask, if you have a Pixel phone you can build RattlesnakeOS, again without adding anything like openGapps, which is almost pure AOSP iirc.

pzmarzly6• 7 years ago

I was using clean LineageOS for over 2 years, recently switching to LineageOS+microG. I'm using APKPure and F-Droid for apps, Chrome for browsing (as in Firefox, last time I checked, one tap separates you from losing all open tabs). Some apps refuse to work or break (e.g. Bitwarden does not sync), some have degraded functionality (e.g. WhatsApp sometimes does not ring when someone is calling you), many are just spamming "This program will not run without Google Play Services" (but there is Xposed module called something like "This program will run" that gets rid of these). In case of Google Maps, I'm using old version (9.69.1), and for Youtube, I'm using NewPipe.

Overall I liked the experience, battery life (especially with greenify) was amazing.

saagarjha8• 7 years ago

I’m surprised Chrome runs without Google Play Services.

SmellyGeekBoy• 7 years ago

Chrome for browsing (as in Firefox, last time I checked, one tap separates you from losing all open tabs).

I've been using Firefox on Android for a couple of years now and have literally never had that happen, so I'm intrigued now. Are you referring to "Close All Tabs" being next to "Private Browsing" in the dropdown? I can see how that could be fat-fingered but I've always used the icon instead of the dropdown.

jeroenhd• 7 years ago

In my experience, Firefox with the Bitwarden addon installed syncs well without requiring you to install any Google services. The obvious downside being that you need to open Firefox to copy your password, but that can probably be worked around by adding a shortcut to the Bitwarden addon page to the home screen.

I don't know what you mean with "one tap away from losing all your tabs" though, perhaps you have an issue I haven't encountered yet. I personally never lose any Firefox tabs, even if I manage to make it crash somehow; I suppose what I'm trying to say is you might want to try Firefox again to see if the situation has improved.

As for maps and navigation, you might try Maps [0] or Here Maps [1] (if that runs without play services, I assume so with Microsoft behind it). Of course, an old copy of GMaps works fine, but Maps [0] is open source, which one might likely favour on a Google-less phone.

[0] https://f-droid.org/en/packages/com.github.axet.maps/ [1]: https://play.google.com/store/apps/details?id=com.here.app.m...

jmkni3• 7 years ago

Will give that a go, thanks for the info!

mehrdadn5• 7 years ago

Tangent, but can I ask what made you choose 9.69.1? I spent hours trying out a bunch of versions and ended up choosing 9.42.3 as it started up fast and was the last version that didn't have the "explore the city" nonsense taking up half the screen on startup. Curious what sweet spot you found in 9.69.1!

_bxg1• 7 years ago

microG still sends data to Google though, I believe, even though the local code is open. Without Google involved at all, Android is barely usable as a daily driver. I tried for a while.

petre• 7 years ago

What phone are you using? I'm looking to replace my aging Nexus 5 running LineageOS with something newer capable of running it which isn't huge.

scoutt• 7 years ago

I compile and run Android (AOSP) on custom devices. We're waiting to start CTS soon, to be able to run Google Services.

Without Google Services, a bare bone AOSP has more or less the same capabilities of some cheap low-end Chinese tablet that cannot run Google Apps.

Mbaqanga• 7 years ago

One day Google will regret having made Android open source and will try to fix it, but is it possible?

TeMPOraL• 7 years ago

I think they already do. Isn't it what Play Services is really all about?

squarefoot• 7 years ago

They never did. Releasing the source contributed creating the developers ecosystem we have today. What Google fears more than the Armageddon would be someone making a truly FOSS operating system capable of running on Android devices, and they prevent that by keeping device drivers and firmware tightly locked.

deogeo2• 7 years ago

Perhaps it is time to treat Google as the enemy, because that is how it is treating us.

throwayEngineer4• 7 years ago

Google puts 1 restriction, they are the enemy.

Apple has created priopritary connectors, closed off systems, paid barriers to entry, and banning apps from their store.

Where is Apple and Microsoft on the scale from Friend to Enemy?

pfortuny5• 7 years ago

Hi. Nobody said they are the friends here.

Just that Google is not.

Bud2• 7 years ago

What proprietary connectors? There was one significant one. Singular. Lightning. That's it, in the recent history of Apple. And thank God they created it: micro-USB sucks. There was a legitimate engineering need for it.

The other things you mention have all been a great service to users, in protecting their security and privacy.

deogeo2• 7 years ago

Apple lobbies against right to repair, and Microsoft lobbies for software patents, among other of their user-hostile actions, so they both deservedly fall under 'enemy'.

And do not pretend this '1 restriction' is the full extent of Google's user hostility - it is merely the latest straw.

Edit: You may find calling someone an 'enemy' rather extremist - after all, Google is just doing what's best for its bottom line, same as other companies, right? But when they increase their profit not just by providing a good product/service, but also by altering the market/ecosystem/legal system to leave you worse off, what else would you call them? Perhaps sociopath - but "sociopath that's trying to get you for all you're worth" isn't meaningfully distinct from "enemy".

enitihas2• 7 years ago

Absolutely correct. HN somehow is fixated on google because google was maybe very good once and now maybe they aren't so good. The entirety of the App store is GPL hostile, so much so that the vlc devs had to rewrite a lot of vlc code to relicense just to make sure it could be distributed on the app store. Was the iOS notification lib ever open source, I don't know but I guess not.

The same with Microsoft. People keep bringing up dragonfly, while conveniently forgetting that bing already works and censors in China.

devolute• 7 years ago

^ this is commonly known as 'whataboutism'.

lern_too_spel6• 7 years ago

Google still lets you use your own push notification service. It will just be correctly reported as using more battery. The evil thing is not providing a GPL-compatible library for connecting to that service, but I'd be surprised if that isn't remedied.

evilDagmar5• 7 years ago

Not quite. Apps have always been held to accounting for the amount of battery and clockcycles they use. The only change here is that a notification is now required for an app to deploy a persistent service. If you request the absolute lowest priority for your notification, your app winds up in the list of apps which are "running" in the background (mainly because the stuff way down at the bottom is too easily missed). If you don't request the lowest priority notification, then your notification text says whatever you'd like it to say and your app doesn't feature in the default notification.

...and there are plenty of good reasons to explicitly register as a foreground service.

I agree with you that someone's bound to crank out a GPL-compatible lib for interfacing with FCM sooner or later.

shawnz6• 7 years ago

I think this is misleading. To me it seems the issue is that app developers are being forced to use the proprietary Firebase service, but they are NOT being forced to use a proprietary library from what I can tell. The library in fact DOES have an open source version available: https://firebaseopensource.com/projects/firebase/firebase-an...

icebraining4• 7 years ago

From what I can tell, you need firebase-messaging, which doesn't seem to be on that list. Am I reading it wrong?

Edit: seems I was reading correctly: https://github.com/firebase/firebase-android-sdk/issues/125#...

shawnz6• 7 years ago

Ah, thanks for the clarification.

Tepix• 7 years ago

Nope!

firebase-messaging is missing from this open source version.

evilDagmar5• 7 years ago

Sounds like an opportunity for someone to sit down and write one. The API and docs for it are fairly palatable and offer some very reasonable guidance on things like exponential backoff.

It still doesn't mean that they're going to be able to go without a persistent notification if they want to run their own background service, but that's a change that everyone is required to deal with. "Secret" background services were abused egregiously by bad actors and sloppy coders alike in the past and it's time for that to stop. This carp some people are floating about it incurring "warning" is nonsense--if they looked at the developer docs they'd see how easy it is to avoid that happening.

kartan• 7 years ago

Problem: The Firebase Android client library is proprietary, meaning FOSS apps can not use it. Apps that do not comply are reported to the user as "using too much battery".

This is a standard on the industry. From 1999: https://www.theregister.co.uk/1999/11/05/how_ms_played_the_i...

It doesn't matter how much money Google is going to have to pay in the future as a fine for this practice. The amount of money that they will get for kicking out the competition is going to be way higher. That is a learned lesson from Microsoft (and probably others before them).

pfortuny5• 7 years ago

So, if I understand correctly, the GPL prevents you from using a non-free library in your code? (Asking honestly: I have tried to find this elsewhere but the FSF page on the GPL is rather ... convoluted).

If that is so, then this is obviously a killer and quite seemingly arbitrary requirement. Your MS example is quite good.

gwicks562• 7 years ago

Yeah I'm confused too. I run an open source Android app used by a bunch of Universities, I'm not sure what this means? Surely you can still open source apps that use Firebase to send messages, you kind of don't have a choice.

laken• 7 years ago

The GPL requires that all code with the software under the license to also comply with the GPL, which includes libraries. Therefore, it's simply not possible (legally) to use non-GPL compatible libraries with GPL software. A lot of open-source licenses are compatible, such as the MIT or BSD license, but proprietary licenses are not obviously.

striking• 7 years ago

Your code is no longer completely FOSS when you do that. It depends on a binary blob that you can't see into.

simonh• 7 years ago

If you are the creator of the GPL software you can do what you like, link Firebase to it, distribute the app and release your code as GPL. You're effectively 'granting yourself' a proprietary license to use your code and a GPL license for everyone else to use it.

However it means nobody else can release their own apps (with notifications) on Android based on your code, or anyone else's GPL code. As soon as they link to Firebase and distribute they will violate the GPL by distributing a binary of someone else's GPL code with a proprietary library attached.

izacus15• 7 years ago

It should also be added that the whole backend is proprietary (and was for GCM as well) and is being maintained and paid for by Google.

Having said that, making firebase-messaging GPL-compatible library seems to be something that should make a lot of sense for Google to allow GPL apps to be released on the platform.

FreeFull• 7 years ago

Probably LGPLing or MITing it, so closed-source apps can still use the library too.

sli• 7 years ago

Windows 8.1 was absolutely determined to convince me that my brand new i5 was incompatible with Windows 8.1. MS hasn't stopped with the incompatibility garbage.

verbatim• 7 years ago

In a world where CPUs now require microcode updates to run securely, it's not very obvious that this is bad behavior.

Maybe erring on the side of safety here makes sense?

izacus15• 7 years ago

It doesn't matter how much money Google is going to have to pay in the future as a fine for this practice. The amount of money that they will get for kicking out the competition is going to be way higher. That is a learned lesson from Microsoft (and probably others before them).

The competition in this case is Apples iOS, for which even HackerNews users love to harp over and over and over again how amazing it is and how little battery it uses because it doesn't allow apps to use anything but APNS, run anything in background or even include GPL source code.

This is what's Android competing against - an completely locked down operating system which cannot deliver any kind of GPL code. And every time it allows more freedom to developers it's punished in the market by losing against iOS and mocked on this very website about how it allowes their app developers to drain battery and access data.

What exactly do you expect Google to do here?

gubbrora2• 7 years ago

An ideal platform would use a foss compatible framework. It would allow the user to configure which server to use to push notifications(one server for all apps, since that is needed for battery reasons). Notifications would be encrypted with the apps key.

soulofmischief7• 7 years ago

I don't think you're focusing on the entire picture.

Some people here like iOS for the reasons you described. However I'm willing to bet, unless you can show me otherwise, that it's a vocal minority. I don't know of anyone personally who is happy that Apple disallows GPL code.

Comparing Apple's digital Fort Knox with Google's unsupervised free-for-all is a false dichotomy.

There exists a happy medium, where power users get all the freedom they want but apps are still by default beholden to certain restrictions. And this is orthogonal to a proprietary API.

kortilla• 7 years ago

Have you considered those two groups aren’t the same?

ViViDboarder• 7 years ago

I would like a choice between consistent and curated vs open and free with both respecting privacy.

Unfortunately, the choices today are limited.

Despegar• 7 years ago

The difference is Apple has been the same from the beginning. There was no bait and switch. People who bought Apple products knew what Apple was and will be and what the terms were.

With Google there is a bait and switch (and it doesn't really just apply to this particular story). They came to market defining themselves as the open alternative to Apple to get market share and developer interest (and evangelism), and now that they've achieved dominance the terms are changing.

There's no surprise that there's going to be massive pushback (and probably antitrust implications).

HillaryBriss3• 7 years ago

What exactly do you expect Google to do here?

Let app developers and users have a choice.

bad_user• 7 years ago

I use an iPhone currently but I'm wishing for an Android instead, precisely because Android allows some Free Software apps that have no equivalent for iPhone.

But yes, I agree, Android's competition is iOS and that's freaking sad.

xwvvvvwx• 7 years ago

Two things:

1. According to the reddit post the firebase library makes no difference to battery life

2. It is perfectly possible to provide strong guarantees around battery usage and resource consumption with open source code

evilDagmar5• 7 years ago

Problem: The Firebase Android client library is proprietary, meaning FOSS apps can not use it. Apps that do not comply are reported to the user as "using too much battery".

This is simply not true. These two points don't even make a coherent argument, as it's plainly discernible that lots of apps don't use the Firebase Android client library but aren't "reported to the user".

Furthermore, "using too much battery" is not what the notification says. It simply says "is using battery", and even this is avoidable.

kbumsik• 7 years ago

I'm not an Android dev, but according to the source in the article [1] this limitation is applied since Oreo, which is released two years ago. Why this problem arises today?

[1] https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

icebraining4• 7 years ago

Until April 11, 2019 you could use GCM instead of the Firebase system.

veeti• 7 years ago

The GCM client is/was also proprietary. There is nothing new here.

megous• 7 years ago

Can this fall under system library exception?

For example if you're building mingw32 based GPL C app, you're linking to all kinds of windows system libraries and there's no need for them to be under GPL.

If this notification library is available to anyone on Android and is part of the Android system platform, can it be the same, like some DLL that does notifications on windows?

izacus15• 7 years ago

No it doesn't, because the code that receives push notifications isn't part of AOSP.

shawnz6• 7 years ago

But my "system" isn't AOSP. It's my OEM's specific packaging of AOSP along with Google services and other components. Why should the line be drawn around AOSP specifically?

jakear• 7 years ago

I think it depends on if the library is distributed with the app or with the system. In this case, the library would be distributed with the app I believe, meaning it would not be exempted.

damnyou4• 7 years ago

I think this is true for GPLv2 but not for v3. But IANAL.

ddrager• 7 years ago

This has been coming for a while. We attempted to create a push-based notification system based on MQTT. It worked well, then the notifications started getting lost. Turns out, the receiver service was getting killed in the background. We found out the best way to get reliable notification was through Google's own GCM (which has now moved to Firebase Cloud Messaging.

We learned its incredibly difficult, if not impossible to build an app (with reliable notifications) that do not use Google services.

You can say its in an effort to maximize battery resources, which I totally understand, but by requiring a Google service (and now library) you are truly tied in to and reliant on their systems.

BTW, as others have pointed out, there are open source Firebase libraries (https://firebaseopensource.com/projects/firebase/firebase-an...)

bchimp4• 7 years ago

This has been true for awhile once they forced apps to use API26 or higher (if you want to be listed in the Play store, and really, there is no other place if you want decent exposure.)

I had a similar experience switching from "real background" to using FCM. I understand the battery saving motivation, but the problem is that the performance of the google service is terrible. The response time of my simple notification system was nearly instantaneous, but OK google, I'll play your game. I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM.

Reading the google docs, apparently google will deprioritize notifications that are shown but "not intereacted with" in a timely manner, so that is another source of delay.

I think the crux of the matter is that notifications have multiple purposes: signaling, and advertising, etc. Google hasn't provided a way for an app to declare its use case. So, you get policies to prevent notification spam creeping in and messing with basic app signaling functionality.

In the end, I kept both my "in-house" notifications for use by older Androids, and a kluge that uses FCM in addition, with some hacks to get somewhat better FCM performance. I live with the notification in Oreo+ and just tell users to ignore it (but honestly, I don't think users care that much.)

antpls2• 7 years ago

I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM.

(from what I remember of some android documentations) Your definition of "high priority" is different from Google's one, which is also different from the end-user's definition. Google probably favors the end-user's preferences more than the developer's preferences. If the user wants all notifications asap from a particular app, the system will do a best effort to deliver, given all the other apps notifications and the current battery level.

jayd163• 7 years ago

The response time of my simple notification system was nearly instantaneous, but OK google, I'll play your game. I put together something that used FCM and it can take 15 or 20 MINUTES to get even a "high priority" message from FCM.

Letting your phone actually sleep is the battery saving feature. Also, you get throttled for high volume so check that as well.

If you think your messages are so important to have a constant socket open then make a foreground service. You're abusing a system that is really not suited to your needs.

tjohns3• 7 years ago

15-20 minutes for a high-priority FCM message isn't normal.

Either your app is being rate limited by the server, or there's something unique about your network setup that is preventing push messages from getting through. There's not enough context here to know what's going on.

(Plenty of instant messaging apps use high-priority FCM messages, and get near instant delivery.)

HillaryBriss3• 7 years ago

there are open source libraries

Thanks for the link, but IDK. I don't see FCM in that collection. What am I misunderstanding here?

anotherwebdev• 7 years ago

Have you tried using VAPID? I didn't want to use firebase and the pwa app I made uses VAPID instead and push notifications show fine. Couldn't that be used in native push notifications, too?

https://developers.google.com/web/updates/2016/07/web-push-i...

barrkel• 7 years ago

Are Google push notifications reliable? They certainly don't work reliably for Gmail, I frequently don't find out about emails unti I open the app.

gdrift• 7 years ago

I think the only difference is that foreground service must show a notification that's all. Users will learn to just disable those useless notifications.

Ajedi323• 7 years ago

So to summarize, to save battery all notifications on Android (since two versions ago) have to go through a single notification service (rather than each app having the option of continuously running in the background and maintaining a connection with its own notification service). Recently Google killed their GCM notifications service in favor of Firebase Cloud Messaging, which (unlike GCM) unfortunately doesn't have an open source library available for it at the moment.

Does that sound right so far?

Anyway, the Telegram-FOSS team claims that this doesn't _actually_ save battery:

Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification.

But this seems rather unlikely to me. Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? Or am I just misreading that statement?

runeks• 7 years ago

Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all?

A single application running in the background probably uses only a small amount of extra power compared to the notification service alone.

However, a couple dozen applications -- all running in the background in order to enable notifications -- probably consume a lot more power than a single service.

Ajedi323• 7 years ago

There's also a wide variety of possible implementations of a notification service, and not all of them will necessarily be as power efficient as what Telegram-FOSS does.

DeonPenny• 7 years ago

I can tell you in the old android world. There was a not insignificant chance that 70-80% of apps that needed notifications or syncing did just that.

curt15• 7 years ago

So to summarize, to save battery all notifications on Android (since two versions ago) have to go through a single notification service

And presumably the user has no way to install alternate notification services?

Ajedi323• 7 years ago

I don't think so. A "notification service" isn't something that exists solely on the user's device; there's also a server-side component that each remote service that wants to send a push notification has to interact with.

So for Android to support alternate notification services, every app/service that wants to send push notifications would _also_ have to support those alternate services on their backends.

neves• 7 years ago

I think they said they aren't using any more battery than they were using before.

Sure they could implement their software using less battery, but these Google warnings could apply to anything. This app could perform better. This app could be smaller. This app could have less bugs.

The only thing that they can't say is: "This app could be more secure."

jtbayly• 7 years ago

It is my understanding that if it could have "less bugs" then it could be "more secure." Aren't bugs the cause of most security breakdowns?

izacus15• 7 years ago

But this seems rather unlikely to me. Are they saying that an application running continuously in the background uses the same amount of battery as an application that's not running at all? Or am I just misreading that statement?

I don't see how that could be true - Android has seen massive battery life improvements after introduction of Doze which forces apps to sleep and stops the from constantly waking up radio and main ARM core. FCM is the only service that can wake up the device remotely and includes throttling code. Before these changes Android had severe idle battery life issues (which were happily mocked by owners of locked down and proprietary iOS devices on this very website) since multiple apps waking up radio for notifications/synces caused radio/cpu to run pretty much constantly. It's worth noting that just doing a radio ping can increase power consumption by as much as 100x for next few minutes.

Maybe the Telegram report ignores the fact that they aren't allowed to wake up the device anymore. If you're measuring in isolation it's easy to make a case for "not making a difference".

AstralStorm6• 7 years ago

There is no way to wake up a device remotely ever. Firebase is doing the same thing anyone can, running on a schedule. It just batches the comms in one time slot. Android scheduler mechanism was supposed to offer the same benefit.

saurik• 7 years ago

The phrase "running continuously" makes it sound like they are doing something... but they aren't: they are blocked reading on a socket. The only time they would run is if they receive information, which is exactly when they would run anyway (as they got a notification). The difference in battery usage would essentially be down to subtle effects caused by the private memory of that process (which might be negligible) not being able to be used as a cache to make some other process more effective. The only reason this would matter is if the processes are forced to wake up occasionally to actively send some kind of keepalive on the socket (which would be an arbitrary requirement caused by the network), which still frankly would not necessarily use much battery if the OS does intelligent gathering of wakeups from multiple processes (like, it would exist and be measurable, but seems strange to me to be something to care about as the phone is probably already waking up every now and then to do other stuff Google wants). I mean, if the notification comes in and the app wouldn't have to wake up to process it normally (which might prevent paging some executable code in from flash) and the notification itself could be delayed into some kind of batch, then maybe? Apple actually does do some of this kind of stuff on iOS: I would bet Google doesn't.

izacus15• 7 years ago

The main issue with what you're mentioning is usually the fact that only Apple and Google servers tend to be whitelisted on telco routers for long polling connections. Trying to keep long-running HTTP connections for everyone else tends to be extremely hard on battery life since telcos can kill of connections even as often as 2 - 5 minutes. Powering up the main core and radio so often will make your phone hardly last 12 hours.

tjohns3• 7 years ago

GCM/FCM will delay low priority notifications, in order to batch as many together as possible.

On top of that, the cell networks don't allow keeping a socket open for more than a few minutes without sending keepalive packets. Unlike on desktop, keeping a socket open isn't "free" on mobile.

Waking up the cell radio has a significant penalty on battery life.

(And yes, Android batches up process wakeups as well. See the docs on "Doze Mode": https://developer.android.com/training/monitoring-device-sta...)

shawnz6• 7 years ago

Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification.

This doesn't sound like the right comparison to me -- shouldn't they be comparing FCM against the background app/persistent notification approach? Here, it sounds like they are comparing the background app approach against the persistent notification approach, but those are AFAIK basically the same technique, except the latter shows an annoying notification whereas the former didn't. So of course the performance would be the same.

EDIT: After reading the original post it is clear they are indeed not comparing against FCM. They are just comparing two different methods of running in the background. See: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/blob/mas...

habosa2• 7 years ago

[Firebase team member here] As far as I am aware, GCM never had an open-source client. In fact I don't think any "play-services-{x}" library has ever been open sourced.

jcriddle4• 7 years ago

Google probably wants one stream of data coming in that they have complete access to. Also probably make it more convenient to tap for the NSA

5trokerac3• 7 years ago

This was my first thought as well. If you can't get encrypted messaging apps to use the SMS service siphon you can at least snag notification text - and most people allow the message to be in the notification.

segmondy• 7 years ago

Google is one of the most evil companies out there for a company that started out with don't be evil. The have some very smart people, some amazing tech, but unfortunately they have some very evil people working for them help bent on maintaining their advantage by any means necessary.

Without using Google's push notifications, you are going to end up with something that works about 75% of the time. When this first started happening to me, I lost tons of time thinking it was a bug only to finally realize I needed to use Google's library to get reliability for what once worked.

throwayEngineer4• 7 years ago

Google is the most evil, of the companies that started with "don't be evil".

Curious, what companies use that same phrase you are comparing it to?

Or if that isn't what you meant, where is Apple and Microsoft on the Good vs Evil dichotomy?

jchw2• 7 years ago

I was confused for a moment because I thought the Firebase SDK was open source.

Interestingly, though, the Android version appears to be only partly open source. I did not find an explanation as to why some of the source is not available, it is mentioned on the Github repository but not explained. In any case, I don’t see the code for Cloud Messaging in there.

It may not be that it is done out of secrecy, though. A cursory glance of the iOS SDK shows what seems to be the full iOS portion of Firebase Cloud Messaging:

https://github.com/firebase/firebase-ios-sdk/tree/master/Fir...

Though that also raises its own question: doesn’t iOS effectively enforce APNS, and all third party providers actually must go through that? I imagine going through a single provider really can improve battery life. Each push provider needs to background fetch.

FWIW, as far as I know, FCM and APNS are both free to use indefinitely. I’ve always found this a bit perplexing since I can’t even really fathom how many messages an app like Facebook or Twitter would push per month. I wonder what the odds are of this ever changing. The cynical viewpoint could go either way.

At face value, this really does seem problematic for open source projects. Can a GPL app link to (the non-open parts of) the Firebase SDK? My guess would be no.

Hope this can be resolved :( There’s some really great stuff on F-Droid, like Amaze file manager.

(Disclosure: I work for Google, but not on Android. I don’t even use Android phones anymore.)

habosa2• 7 years ago

[Firebase team member here] Our goal is to open source all of our SDKs, and we have steadily open-sourced more of them over time. The SDKs you see on GitHub right now are all standalone, they don't require communicating with Google Play services running on the device.

Our bar for moving an SDK to GitHub is that it has to be more than a source dump, it must be the source of truth for that team's development. Right now that's not possible for FCM because of the dependency it has on Google Play services.

jchw2• 7 years ago

Thanks for the clarification, seems pretty straightforward to me.

bubblethink3• 7 years ago

Is there a plan to a) Support use of FCM without play services (i.e., in AOSP)? b) If not, is there any legit path forward for cases like these short of them forking AOSP ?

greysonp3• 7 years ago

Even if the SDK's are open source, a lot of the problems we experience with FCM at Signal seem to be more of an issue with devices trying to optimize battery. Do you have any advice on how to avoid the system heavily delaying notifications? We've seen instances of high-priority notifications being delayed and batched together, even for users who have disabled battery optimizations.

bubblethink3• 7 years ago

At face value, this really does seem problematic for open source projects. Can a GPL app link to (the non-open parts of) the Firebase SDK? My guess would be no.

This is only partly a licensing issue. The larger problem is that the f-droid crowd has little to no desire to rely on FCM/GCM or other network services offered by google. At the very least, use of FCM would have to a part of AOSP or other (official) free software for it to even gain some legitimacy. At the moment, it is behind the play services ToS. And this still doesn't answer the question, "what if I don't want to use FCM?" If google's answer is, "Well, fork AOSP if you don't like it", we know that is a non-answer due to google's other tactics.

mtgx• 7 years ago

And through this, the FBI/GCHQ will get their much-wanted "targeted" malicious updates vector for which they've been asking for a while.

If Signal has to implement it, I assume the FBI will ask Google for the ability to insert itself in the proprietary code in some updates from day 2.

lern_too_spel6• 7 years ago

Signal already implements it. Signal uses E2E encryption, so your attack vector doesn't work. https://community.signalusers.org/t/gcm-will-be-removed-from...

buildzr2• 7 years ago

Signal uses E2E encryption, so your attack vector doesn't work.

End-to-end encryption is just that. That Firebase library is running on the client phone (aka, an end), if Google put code into the library allowing it to download updates it would also be running in Signal's context which would allow it to trivially dump and exfiltrate messages, memory, etc from the Signal process.

Now, we have no reason to believe such a mechanism is used here to my knowledge, but if they really wanted to, it would defeat end-to-end encryption.

buildzr2• 7 years ago

Signal has sworn by GCM the entire time they've been running on Android, it took a lot of whining from the community to get them to allow anything else.

tialaramex• 7 years ago

The reason to do this is security principle: Don't Stand Out.

If Bob uses Bob's personal notification system for Signal, a passive observer can see that Bob was notified by James. If everybody uses Huge Corp notifications the passive observer can only tell that James was notifying somebody about something and that Bob was notified about something.

ridaj• 7 years ago

Misleading title... Real title something like: apps that use Android push notifications without Firebase, including GPL-licensed apps, now reported as "using too much battery"

paulcarroty• 7 years ago

Good luck for people who still believe in marketing term "Android is Open Source".

lern_too_spel6• 7 years ago

How does this change that?

orblivion• 7 years ago

So are we, fans of FOSS, all-in on the Librem phone at this point?

ocdtrekkie• 7 years ago

I'm just waiting to find out if someone will get Librem 5 working with a Verizon approved networking module before I jump in. But yes, very excited.

DannyBee2• 7 years ago

Since the FSF does not consider GPLv2 to be Apache 2.0 compatible, telegram-FOSS is GPLv2, and Android libraries are usually Apache 2.0, you have always had a problem.

They also use a ton of Apache2 libraries (at least 5 or 6) directly in their source repo.

They don't appear to even bother to properly give attribution/etc for the used software, so yeah.

coding123• 7 years ago

This is so damn true I am LMAO at the other comments. So basically the entire community can get around the problem by releasing an Apache2 lic'd library that wraps whatever it is they need from firebase.

We'd be at a place no different from any other "FOSS" App on android today.

And https://opensource.stackexchange.com/a/4642

evilDagmar5• 7 years ago

This is pretty darned incorrect on a number of fronts. Skipping for the moment that a random histronic Reddit post is being considered "news"...

"Google started leveraging its de-facto monopoly on Android distributions by forcing all apps to use its proprietary service Firebase for push notifications."

A number of logical leaps of faith need to be made before the word "force" carries any truth, but no one's "forcing" anyone to do anything. A developer can still use the FCM or not, it's up to them. If a developer simply refuses to interface with any sort of proprietary code then it's a wonder they'll touch any commercial product at all (iOS included).

..and since Telegram-FOSS were cited as a source for this mess, here's the very first part of [i]their[/i] statement, which is also not true:

Since Android 8.0 Oreo, Google doesn't allow apps to run in the background anymore, requiring all apps which were previously keeping background connection to exclusively use its Firebase push messaging service.

Sooo very not true. Android [i]does[/i] still allow apps to run in the background. The developer docs caution against doing so without good reason because so many developers try very hard to ignore the lifecycle methods, resulting in many wasted clockcycles and reduced battery life.

But the Telegram team didn't stop there, so let's unpack the rest:

Sadly, if the app would set the notification to lower priority (to hide it a bit in the lower part of the notification screen), you would immediately get a system notification about Telegram "using battery", which is confusing and is the reason for this not being the default. Despite Google's misleading warnings, there is no difference in battery usage between v4.6 in "true background" and v4.9+ with notification.

First, it's not a "warning". It's simply a statement. ...and yes, if you're going to maintain a separate push notification service of your own (I'm looking at [i]you[/i], Facebook.) you [i]are[/i] going to be using at least a few clockcycles. There's no way around this.

The backgrounded apps notification is also as "judgement free" as any notification can possibly get. On my phone right now, running Android 8.0... "3 apps are using battery". One of these is my own app (which happens to be a homescreen widget), another is Life360, and another is GSam Battery Monitor. Tap that notification and a list appears, headed up with "Apps running in background" with "Tap for details on battery and data usage" and lists the apps with their icons. Tap one and it shows what resources the app [i]is[/i] actually using. GSAM... 52Mb of RAM, and ~55kB of data in the last month. 0% battery used since last full charge. My app, 0% battery (probably not enough to count as a whole percent) use since last full charge, 5.84MB of internal memory, no data usage. I don't know how other people might view them, but to me these seem like vindications. None of that information is being presented in any way that that should be construed as condemning or accusatory, let alone "misleading".

If Telegram-FOSS doesn't want users throwing a fit about their resource usage, perhaps they should spend a little time grooming user expectations to be more reasonable.

The reddit user who posted this mess, on the other hand... A five-year old account that only occasionally posts anything that doesn't smell of astroturf, and this one post is nearly 80% of their karma. Seems like they've decided to make a foray into outrage-farming.

Khaine• 7 years ago

“the definition of open: "mkdir android ; cd android ; repo init -u git://android.git.kernel.org/platform/manifest.git ; repo sync ; make"” [1]

Not anymore. Having basic android open source help when everything is pushed into the proprietary play store

[1] https://mobile.twitter.com/Arubin/status/27808662429

EGreg• 7 years ago

What do you mean FOSS apps can’t use a proprietary library?

The library’s license says that it cannot be used by AGPL software?

Because if not, the FOSS authors can just make builds for Android with it.

DigitalTerminal• 7 years ago

I am confused. The repo you linked to hasn't had a release since 2016, and I cannot find a reference to that library ANYWHERE else. The firebase android sdk, which is what I would guess you would use (though I don't do android, so could still be wrong) is apache. What am I missing?

astannard• 7 years ago

Amoungst this big thread, I've not noticed any evidence for this and the original article does not back this up with anything. Is the allegation that google are using battery warnings to push people towards using firebase notifications? Has anyone any experience of this?

Android now forces apps to include proprietary code for push notifications

Related Stories