search

gouravkhunger / QuotesApp

A beautiful android Quotes App where you can read and save quotes.
https://gourav.sh/project/quotes-app
MIT License
47 stars 17 forks source link

SelfUpdater #22

Open IzzySoft opened 1 week ago

IzzySoft commented 1 week ago

Hi @gouravkhunger, I don't know if you still maintain this app – but it seems to include a SelfUpdater. Which is against the IzzyOnDroid App Inclusion Policy. Is that updater opt-in? Does it make the implications clear (e.g. that it bypasses the security checks performed in the IzzyOnDroid repo)? A quick scan of the code seems to say "no to all": it looks like the check is performed automatically, and that there's no setting to even disable it. Update check is performed without any "conditional".

I don't like setting an ultimatum, but as this repo here didn't see any activity for almost 2 years and I don't know if it is still active, this time I have to: without any response here within a month, the app will be removed from IzzyOnDroid at the end of that period. With a response, it depends of the planned action from your end of course. Thanks for understanding!

gouravkhunger commented 6 days ago

Hi @IzzySoft, that part is not a "self updater". It just checks if there are newer app versions available. And shows the option to open the latest github release page:

image

I agree the repo hasn't been active. I'm sorry I can't give a timeline on when I plan to do any refactors next.

IzzySoft commented 6 days ago

Thanks! But it still means your app reaches out to a (non-free) network service without explicit consent. Would you at least consider making that opt-in then?And even if the app does not install the update itself, presenting the option to update by downloading an APK from Github is circumventing the additional checks performed by e.g. the IzzyOnDroid repo, where the app might have been installed from – so that should at least be pointed out. Not everyone might be aware of this.