Closed IzzySoft closed 10 months ago
This project currently doesn't have a license, if I add a license it would be the MIT license because it's the least restrictive of those.
MIT sounds fine! So… would you? Because then I could see if I can add the app to my repo. Just checking to make sure I do not promise too much: Ouch.
Offending libs:
---------------
* Crashlytics (/com/crashlytics): NonFreeComp,Tracking
* Google Ads (/com/google/ads): Ads,NonFreeComp
* Firebase Data Transport (/com/google/android/datatransport): NonFreeNet
* Google Mobile Services (/com/google/android/gms): NonFreeComp
* Firebase (/com/google/firebase): NonFreeNet,NonFreeComp
* Firebase Analytics (/com/google/firebase/analytics): NonFreeComp,Tracking
* Firebase Installations (/com/google/firebase/installations): NonFreeNet
* ML Kit (/com/google/mlkit): NonFreeComp,Tracking
8 offenders.
I see the license is not the only show-stopper, there are also several proprietary components(NonFreeComp
) included with the app :cry:
Firebase is used for a core feature in the app: text detection. Unfortunately, I haven't found any open-source alternatives for text detection that are as convenient. I know about Tesseract OCR but it increments the size of the app considerably.
As for Crashlytics, is there any good open-source alternative for it?
Thanks for asking – and yes, there are good FOSS replacements for Firebase as well as alternatives for crash reporting and analytics (though the latter might not be as comfy, they are FOSS and can be used in privacy-friendly ways). You can find a list of those I know of behind this link.
With MLKit it gets a bit more complicated, though – here I'm not aware of alternatives :cry:
For crash reporting, e.g. F-Droid uses ACRA in their app, configured "opt-in" – in this case, the crash reporter just pops up a dialog showing what data will be send, and asks whether to send or not. For analytics, self-hosted Sentry.io is often used. Those who cannot self-host it use the one provided by Sentry itself. As long as it's opt-in, that's considered OK.
Thanks, I will check those alternatives for crash reporting.
In the case of OCR, I'm only using Firebase's on-device detection which works locally, I'm not using the web-based detection which requires an API key (I don't provide it nor do I ask users to provide it). Is it ok like that?
You're saying you don't use MLKit? My scanner detected that (and IIRC it's MLKit doing the OCR part, not Firebase).
Seeing you're willing to tackle the issues, let me make a suggestion: Tackle the "known ones" (Crashlytics, Firebase Analytics, Google Ads) first as they are clear. Once you have an APK with that accomplished, I run another scan and we see which way is forwards. Remaining GMS/Firebase are often dependencies of MLKit – but as I said, I do not really know a fitting replacement for that. I could of course check my library definitions – which I just did, and found a single hit on "ocr" which you already know: Tesseract. A search here on Github brings up 68 results for OCR with Kotlin, but I guess only a few of those are even technically fitting (I'm no Android or Kotlin dev, so I cannot really tell).
Yes, I use MLKit but I use a locally downloaded model with the app.
To detect text this model is used and no calls to an external server are made. It's free for the user if the user can download the model.
More info here about the unbundled model: https://developers.google.com/ml-kit/tips/installation-paths
You're aware of the difference between "free" and "libre"? Apologies if I sound like a teacher now, but to be sure please let me explain:
You get a "free beer" with that one, true. But you are not libre to deal with it as you want – it remains proprietary. And it drags in GMS + Firebase as dependency, to my knowledge – which again are "free beer" without "freedom". It's not the price that's concerning. With FLOSS, it's the 4 freedoms defining the L of "libre". These things violate freedom-1 (the freedom to modify how the code works) and thus also freedom-3 (to distribute the modified copy of the library).
Hence, MLKit (and GMS + Firebase) are not libre, they are not FLOSS (free/libre open source software). Unless you can point me to their source code stating a libre license (I didn't find that) – then I happily admit I'm wrong.
PS: I'm not aware of a alternatie to MLKit, unfortunately. But maybe asking at SoftwareRecs.SE could pop up some.
Thanks for the explanation. that cleared things up.
Having said that, unfortunately, I will have to close this issue because I can't remove the MLKit usage because it provides a core feature for the app, and for the moment there is no viable alternative. Feel free to reopen this issue or create another one if you have another inquiry.
Understandable – thanks a lot for trying! If you could let me know what core feature that is, I could add that to my snippet should I find an alternative (and hopefully remember to mention it here). Also, as you've already worked on some of the culprits, if you added a license and there's a new release, I could check again if it might be possible to add your app to my repo and simply mark the remaining ones as "AntiFeatures" (thee are labels for such things – so within limits, such is possible).
Could you please specify what license the app falls under? The sources give a mix of MIT and Apache. It would help if you'd add a license file to the repo (or at least make it clear in the Readme) specifying what the "final license" is for the app. Thanks in advance!