Trackers in the latest release

[IzzySoft]

First thanks for providing your app! Unfortunately, v0.8 added a couple of non-free and tracking libs, making it essentially no longer FOSS:

Offending libs:
---------------
* Crashlytics (/com/crashlytics): NonFreeDep,Tracking
* Google Ads (/com/google/ads): Ads,NonFreeDep
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeDep
* Firebase (/com/google/firebase): NonFreeNet,NonFreeDep
* Firebase Analytics (/com/google/firebase/analytics): NonFreeDep,Tracking
* Firebase Installations (/com/google/firebase/installations): NonFreeNet

7 offenders.

According to the release notes, those where added intentionally. So please let me raise 2 question:

• would you consider removing them again, or at least replacing them with more privacy-friendly alternatives which are configured to be opt-in? Google isn't exactly known as a "privacy preserving entity", so the above will scare several users away.
• if not, would you at least consider a foss build flavor coming without those, providing its APK along the others at your releases?

I've removed v0.8 from my repo again and disabled updates until this issue is solved. If it cannot be solved, I'll unfortunately have to remove your app from my repo, which would be a pity – the idea is great, and the app certainly helpful for many. Thanks in advance!

[lorenzovngl]

Hello, thank you for opening this detailed issue. Yes, I intentionally added these libraries because I want to know how many users use my app and where they are, so I'm not considering to remove them. I might think in the future about a foss build flavor for my app, but now I don't. If you would like to keep v0.7 on your website I would be happy, but if you are forced to remove it, I would say thank you for having hosted it until today.

[IzzySoft]

I can keep v0.7 for a while – but it gets much outdated soon. I'd do so if we can strike a deal:

For now I'd add a note to the description why there are no updates – while you think about a foss flavor or replacement of those libs (as outlined above). Please decide until Summer; I'd set a marker to remove it then unless I heard back until July, with an ETA for not much later than August/September that I can pick up an alternative. This would give you some headroom now.

Deal?

[lorenzovngl]

Deal. Thank you 🙂

[IzzySoft]

Mark set! Looking forward to your next ping then :smiley:

[lorenzovngl]

Would you like me to use this issue to contact you or another method? Please let me know.

[IzzySoft]

This issue is fine (just leave it open please until solved). I've opened it, so I follow it. Should I not react in timely manner, maybe notifications didn't reach me – so in the worst case the flag I've set on my end (with a link here) should trigger me to come looking :wink:

Thanks a lot!

[IzzySoft]

I'd set a marker to remove it then unless I heard back until July, with an ETA for not much later than August/September that I can pick up an alternative.

OK, time to take a look again then. 1 down 6 to go:

Offending libs:
---------------
* Crashlytics (/com/crashlytics): NonFreeComp,Tracking
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeComp
* Firebase (/com/google/firebase): NonFreeNet,NonFreeComp
* Firebase Analytics (/com/google/firebase/analytics): NonFreeComp,Tracking
* Firebase Installations (/com/google/firebase/installations): NonFreeNet

6 offenders.

Maybe splitting up to build flavors (e.g. foss and gplay), and setting firebaseEnabled to false for the foss flavor? Or, the possibly easier approach with the two flavors established, replacing that conditional by

        gplayImplementation(platform(libs.firebase.bom))
        gplayImplementation(libs.firebase.analytics)
        gplayImplementation(libs.firebase.crashlytics)

so it gets only implemented for the gplay flavor – and then making the APK for both flavors available at the release tags?

[lorenzovngl]

Thank you for the suggestion on how to implement different flavors. I can't work on it until late August, is it ok?

[IzzySoft]

Can't expect you to have it finished early August :see_no_evil: So yes, of course. We've agreed on having it ready "at latest September". And I stay to my part of the deal :wink:

Oh, just to make sure: We're talking about August/September 2023 here, right? :rofl:

[lorenzovngl]

Sure, don't worry! 🤣

I will start to work on it.

[lorenzovngl]

@IzzySoft what program did you use to get the list of trackers in the app?

[IzzySoft]

My own library scanner. It's of course FOSS, see Identify modules in apps.

[lorenzovngl]

I finally released a FOSS version of the app: FoodExpirationDates-1.0-foss.apk

I scanned the apk using your tool and these are the results:

Libraries detected:
-------------------
* Android Support v4 (/android/support/v4): Development Framework, Apache-2.0
* AndroidX Activity (/androidx/activity): Utility, Apache-2.0
* Android Jetpack Annotations (/androidx/annotation): Utility, Apache-2.0
* Jetpack Compose (/androidx/compose): Development Framework, Apache-2.0
* Androidx Core (/androidx/core): Utility, Apache-2.0
* Android Emoji2 Compat (/androidx/emoji2): UI Component, Apache-2.0
* AndroidX Fragment (/androidx/fragment): UI Component, Apache-2.0
* Lifecycle (/androidx/lifecycle): Utility, Apache-2.0
* ProfileInstaller (/androidx/profileinstaller): Utility, Apache-2.0
* Room (/androidx/room): Utility, Apache-2.0
* Android Activity Saved State (/androidx/savedstate): Utility, Apache-2.0
* Android Jetpack VersionedParcelable (/androidx/versionedparcelable): Utility, Apache-2.0
* WorkManager (/androidx/work): Utility, Apache-2.0
* Dagger (/dagger): Utility, Apache-2.0
* kotlinx.coroutines (/kotlinx/coroutines): Utility, Apache-2.0

No offending libs found.

Please tell me if it's all ok.

[IzzySoft]

That looks fine, thanks! Switching to the FOSS build then. My updater will only pick APKs matching the regular expression /foss\.apk/i from now on (which is what you currently use, file name ending in foss.apk). Time to pick a badge to accompany the Play and Github ones, linking here I'd say :smiley:

Next station: F-Droid.org maybe?