search

microg / GmsCore

Free implementation of Play Services
https://microg.org
Apache License 2.0
8.2k stars 1.69k forks source link

Project funding and growth #753

Open Lanchon opened 5 years ago

Lanchon commented 5 years ago

this project is a huge effort of huge importance. it depends on the heroic efforts of one person for now. and everybody knows: men pass, institutions remain. save for unlikely regulation changes in the EU, this low key project might now be the one chance the world has to have a free but usable mobile platform in its future.

and unfortunately, things have been looking grim for a long while now. (#420, #752, etc.) i've come to believe that this project will fail unless an institution seriously backs and funds it, and AFAIK little if any work has been done on this front.

i imagine mavin would like getting competitively payed for his time on this project, and might like to devote more to it then. he might like leading a couple of professional, talented, hand picked devs working by his side instead of working in solitude. but he might not like politics and working for funding; yet he might benefit enormously from it.

but why would someone do something one doesn't like for a hobby? this might be why marvin hasn't seriously tried -i think- getting funding so far. and i also think this is obvious: if marvin has to do too much stuff he dislikes, he'll quit.

as it stands: 1) the project is hugely important for online freedom. 2) the project is in danger because it depends on the will and availability of a single person, marvin. 3) marvin is unlikely to fix # 2 by himself.

so can we help?

yes, marvin might not like strings attached to some offers of help, and it's absolutely his project. but nonetheless i say let's try getting the offers first. and strings? we'll cross that bridge when we get there (or actually, marvin would).

to market this project, we ourselves have to have a clear idea of its value. what is it? google has been proprietarizing Android for years and has been hugely successful. today it's hard to participate in online life without carrying a PC around and having google exclusively controlling your devices. some of us find that totally unacceptable and pay the price of rooting and become superuser of our devices too. the key word here being "too": yes, we control our devices, but so does google.

this was an utterly unthinkable situation 10 years ago: you can't use your computer unless you have a remote root account for some USA company in there available at all times.

even if you trust google not to do evil, would you trust the USA gov? what would it take for the DoJ to ask google to remotely hack your phone and download a copy of your decrypted signal/telegram/whatsapp local message database just because google can? would they do it? have they done it?

having google and indirectly the USA gov as an always connected, all accessing superuser in our computing devices is a huge problem for the world that seems to go largely unnoticed. and the options? apple? ok, switch bullcrap for cow crap.

i don't mind running google's proprietary software; i just don't want google to be root. that's microg's value for me. for others its value is different: maybe Richard Stallman would hate me for thinking this way. but if it was up to me, this is how i would sell microg.

who'd be likely interested in backing this?

we can compile a list and try to contact everyone on it, see how it goes. i'll start with a few names.

these two tried and failed to compete with Android:

whatever moved them to create those projects might move them to back microg.

google is making headway

google is advancing technologies that will further block competition. everyone here knows what safety net is all about: blocking competing platforms. it requires opt-in by app developer.

here's another of their gimmicks: app bundles. marketed as a way to ease app deployment and improve user experience, and also requiring dev opt-in, the technology is really about devs surrendering their signing keys to google. everything that this technology claims to do can be done without such a bold requirement. but what this technology achieves without stating it is inhibiting sideloading and blocking competing markets. and how long before google starts to inject their code inside all apps? what about their code failing unless running on a googlephone rendering in-the-wild apps unusable for "compatible" android platforms?

devs won't realize about these issues and will fall into google's traps unless there is a real userbase having these issues. and when enough apps are poisoned, the world won't be able to make a free android anymore; we need degoogleized androd devices in the wild ASAP.

so what now?

hopefully some of us will feel bold enough to reach out to some of the entities on this post. and please also add more names you can think of. the value of this project is huge, but i think that the entities that would benefit from it are unaware of its existence.

thanks!

julienschmidt commented 5 years ago

I'm not sure if funding is the real issue here. Of course it would be awesome if this project had some funding to motivate talented developers (especially marvin) to work on this project.

But currently this project also has a really bad bus factor. Currently, when marvin is not available to work on this project, there is no progress at all. I'd thus suggest to slowly introduce new team members, maybe with initially very limited capabilities. For example, in my opinion, @ale5000-git has been very helpful with managing issues in the past. To tackle the ever growing list of open issues, I'd propose to give him at least rights to manage (close, tag, ...) issues. Likewise @Nanolx has been managing a quite successful fork for a while and @voidstarstar has been making some good code contributions recently. While I'd understand if marvin would not want to allow them to commit code without his review for now, I'd still suggest to add them as project members and encourage them to review pull-requests, request changes etc (and of course open their own pull-requests), thus further reducing the work for marvin. Eventually it would of course be great if there was at least a second developer with commit rights. GitHub nowadays also allows settings that would require e.g. approval of at least two team members before a pull request can be merged.

Lanchon commented 5 years ago

you are right on spot when you mention bus factor. and also right on this aspect of funding: paying marvin will not improve it.

and although all of your suggestions merit review, this issue is not about them. (i also think those were more or less argued before elsewhere without much action resulting from it, but that's irrelevant here.)

here is what this issue is about: finding an entity with some $$$ that will consider microg to be a strategic project for them and is willing to invest. this would result at least in some project manager's job to include keeping an eye on microg with the aim of making it survive independently of marvin's involvement. this would entail having at least someone else on the project who marvin would have to trust and train to replace him, even if marvin is boss.

this would probably involve marvin interviewing some pre-selected candidates and finding someone he thinks has enough reversing and programming experience for the job and with whom he thinks he'd enjoy working. this person would probably start with some feature: investigating, reversing, reporting, planning and coding it, with help from marvin. then, if it feels right to marvin, he'd start training them to the rest of the code base. with some luck, the project would have two marvins after a while, or more. think about how Firefox does not depend on any one dev: mozilla knows how to achieve that, and if they think microg would be valuable to them, they can easily pull it off again.

you could shuffle commit rights around, etc, and that could help a lot. but i'll quote myself on what this particular issue is about:

i've come to believe that this project will fail unless an institution seriously backs and funds it

this issue is a call to action: those who think they could effectively reach some entity regarding this project, please get your hands dirty and do it.

voidstarstar commented 5 years ago

Ultimately it's Marvin's project, so we should make sure to respect whatever decision he makes. Developing and maintaining an open source project can be time consuming, thankless, and exhausting, so it may not just be a funding issue. It's also worth mentioning that he set up Bountysource for the project, but this obviously would not compare to the resources that a large organization could potentially bring.

If you're goal is to attract more developers, I can try to give some insight as to my motivations. My (relatively small) contributions so far tend to fall into at least one of three categories:

  1. Personal Interest - I worked on features that I personally wanted to use. Dogfooding tends to be quite common for developers and aligns with selfish incentives.
  2. Utilitarian - I tried to find issues that would help the most people (e.g. related to GCM push notifications) for the least amount of effort to maximize the value my time can provide to the community. This includes issues with apps or android versions that I don't personally use, but I know will still benefit many users.
  3. Bounties - I worked on a couple issues with a bounty (which I haven't yet actually claimed). It's typically "beer money" (below a minimum wage if you calculate the hours worked), but every bit helps. If I earn enough, I might be able to buy new phones to make testing easier.

It's also important to note that while I consider myself proficient with Java, I would consider myself a beginner with Android development and mostly clueless when it comes to the protocols that are reverse engineered.

phone vendors: vendors producing Android phones cannot bundle microg without breaching contract.

There are also tons of generic tablets from companies that may not want to or be able to get certified by Google to run Play Services.

Also something that is probably overlooked is that as this project becomes bigger and starts making noise, Google will undoubtedly take notice and may even want to shut it down. If a large organization funds this project, then it will probably be necessary to make more serious efforts toward an independent push service. There are some open source alternatives that exist (and some discussions about a possible microG version), but so far none have really become widely used.

mar-v-in commented 5 years ago

Thanks for all your comments.

To make it short: microG is well funded.

The reason why from time to time I am off of working on microG is not financial, I am just not that kind of person to work all time on a single project.

I totally understand there is an issue with me being the only person managing the main code repositories, especially as it means there is huge delays from time to time when I am working on something else. While I very much like the contributions of "outside contributors" into microG, I don't feel very comfortable yet with any of them committing to the main repository without further review. Also I think that many outside contributors struggle to do their first commit, so any feedback on possible reasons for that would be super helpful for longterm success (for example I considered reorganizing the code base so that it becomes easier to grasp).

PS: I am currently working on a full rewrite of the maps implementation to finally solve all the issues around it (with apps for public transport, car/bike sharing, taxi, ...)

benyaminl commented 5 years ago

Thanks for all your comments. To make it short: microG is well funded.

Donations cover all operational costs (servers, etc) I currently receive funding through a grant of PrototypeFund (German government) to work on microG. Several organizations have in the past supported my development of microG and I am certain there will be funding for the time after PrototypeFund as well. Additionally, some organizations also announced willingness to financially support additional contributors, for example in form of a paid summer internship. Unfortunately there haven't been any good candidates for such funding yet. (Please let me know if you think you are one)

The reason why from time to time I am off of working on microG is not financial, I am just not that kind of person to work all time on a single project. I totally understand there is an issue with me being the only person managing the main code repositories, especially as it means there is huge delays from time to time when I am working on something else. While I very much like the contributions of "outside contributors" into microG, I don't feel very comfortable yet with any of them committing to the main repository without further review. Also I think that many outside contributors struggle to do their first commit, so any feedback on possible reasons for that would be super helpful for longterm success (for example I considered reorganizing the code base so that it becomes easier to grasp). PS: I am currently working on a full rewrite of the maps implementation to finally solve all the issues around it (with apps for public transport, car/bike sharing, taxi, ...)

Maybe Patreon? Many people will support it monthly and for android developer, maybe some big people from xda will.

chris42 commented 5 years ago

I agree with voidstarstar on this. The original microg is Marvins project and it is his decision to decide what to do with it. That said, I can't see a setup in which the style of Marvin would work with a backed, structured setup. To have a strong supporter/additional developers and a goal of microg (e.g. cover certain API functionality within certain timeframe), the project needs management. This will require constant attention, responsiveness and decisions. The "on and off" style Marvin prefers is suited for developing as part of a group when someone manages and balances this, but not as the centerpiece steering it as a bigger project. Out of my view, if anyone thinks about that "funding and growth" setup, you would need Marvin to give up control of microg or move it to a fork. This is by no means an accusation or negative part towards Marvin. He is free to do and handle things as he wants to. Certain ideas and goals might just require different prerequisites.

voidstarstar commented 5 years ago

@mar-v-in

Also I think that many outside contributors struggle to do their first commit, so any feedback on possible reasons for that would be super helpful for longterm success (for example I considered reorganizing the code base so that it becomes easier to grasp).

For me personally, a large hurdle was (and still is) the lack of documentation. I think the code is actually well written, but like many projects, it lacks enough comments/Javadoc. This project is also somewhat unique in that it could greatly benefit from documentation of any gathered knowledge on the reverse engineered protocols.

For example, in #737 I think I narrowed down the problem to this delete flag, but I don't fully understand what it does, so I would not feel comfortable changing it blindly. It was clearly added for a reason, but I can only infer what that reason is.

voidstarstar commented 5 years ago

@benyaminl

Maybe Patreon? Many people will support it monthly and for android developer, maybe some big people from xda will.

That might help attract new developers, but it sounds like it may not be the main issue:

To make it short: microG is well funded.

The reason why from time to time I am off of working on microG is not financial, I am just not that kind of person to work all time on a single project.

Nanolx commented 5 years ago

I might add to @voidstarstar that not just the developer information may be improvable, but also the user related documentation is scattered around and the wiki here is pretty much outdated and installation instructions kinda incomplete Nougat-onwards.

For example you'll find many infos, workarounds and the-like in @ale5000-git microG unofficial installer thread over at XDA, my NanoDroid thread over at XDA, signature spoofing XDA thread, official microG XDA thread and several others (either from specific users like Oswald Boelke or device specifc threads like modded stock ROMs with microG support)...

The information users might look for exists but you'll never know for sure where. I've compiled a list of known issues and fixes/work-arounds at the NanoDroid documentation#issues, as a starting point.

It's only slightly better for signature spoofing documentation: Tingle, Haystack, LOS for microG, pre-patched ROMs, vdexextractor, smali/baksmali...

A mid-term project I had in mind for a few weeks now is to find one or two others and update the wiki here, turning it into the first place to look for information AND finding it. But I admit it: I've been to lazy to start and ask for co-volunteers. #ascheübermeinhaupt

snip

Many issues reported here are either duplicates of pre-existing ones or already fixed but still open. Unless I'm mistaken you can grant someone the ability to close or modify (read: adding tags/label to, change titles to be more descriptive) issues, without granting un-reviewed commits? If so I'd be willing to do some clean-up in the issues section (got a few days off from 26.04 - 01.05.). Related and likely useful #639

ale5000-git commented 5 years ago

I plan to document some functions/workaround, it will be in the project microG unofficial installer (but available directly online) and it will cover many microG related things.

Lanchon commented 5 years ago

this thread has morphed into something off-topic of my first post. we are again discussing how best to help marvin and that is great, just not in the context of this thread.

some organizations also announced willingness to financially support additional contributors, for example in form of a paid summer internship. Unfortunately there haven't been any good candidates for such funding yet. (Please let me know if you think you are one)

The reason why from time to time I am off of working on microG is not financial, I am just not that kind of person to work all time on a single project.

that is exactly the point. this project seems to require more time than you are willing to put in it, for whatever reason. it needs more time, put in by whoever. you are probably already putting more time that you'd like to into this project, but you want the results (and not necessarily the tediousness of 90% of the work). wouldn't you like to manage a team of one or two hand picked programmers who are paid, maybe part-time, to follow your command on this project? "reverse this service and tell me how it works", "try making a prototype clean room implementation of it, structure it sort of in this way". some entity could pay for those guys. or they could share some employees part time on your project. some entity could find candidates in your area for you to interview. and they could pay you for all the hours you put in.

I can't see a setup in which the style of Marvin would work with a backed, structured setup. To have a strong supporter/additional developers and a goal of microg (e.g. cover certain API functionality within certain timeframe), the project needs management. This will require constant attention, responsiveness and decisions. The "on and off" style Marvin prefers is suited for developing as part of a group when someone manages and balances this, but not as the centerpiece steering it as a bigger project.

and some entity could provide a part time project manager, who would still be under marvin's command.

my point is that: 1) all projects eventually die, but this one could live much longer with a serious backer. 2) a serious backer might be found (see the list in my first post to begin with) if we look for it, because this project is REALLY important.

as this project becomes bigger and starts making noise, Google will undoubtedly take notice and may even want to shut it down.

i couldn't care less. in fact, that would be the definition of this project's success. i'd like google to keep on crossing the line of anticompetitive practices: NDA contract for play store to lock in device manufacturers, safetynet to lock out competing devices, app bundles to lock out competing stores, closing down cloud messaging to lock out competing app stacks, etc. Android is perfectly capable of having a play store as a non-privileged regular app. i want the EU to force google to end all this crap and make them offer the play store as a regular app for any device, for free or the same price to use if it comes pre-installed in phones. want them to split the play store into a company separate from that which develops android. the more crap Google keeps on doing the better now, because they are waaaay past any reasonable line.

Lanchon commented 5 years ago

There are also tons of generic tablets from companies that may not want to or be able to get certified by Google to run Play Services.

it's not that easy. the contract goog makes OEM sign have them transitively apply the restrictions on manufacturing partners. if Foxconn manufactures for any google-signed OEM, they must say no to every non-signed OEM that wants to contract them. otherwise the breach contract with the signed-in OEM; and also google can go after said OEM (and i think this has happened). and what about supply chain restrictions? i have no idea, but there could be some too.

that's why it was sort of a miracle when Amazon could pull off the first non-google devices. nobody thought they would find chinese manufacturers that weren't under transitive contract.

regarding the tons of generic tablets you mention, i guess most of them probably google could shut down, but they don't care or want to. BTW, i believe none of this crap would withstand serious anti-trust scrutiny.

chris42 commented 5 years ago

this thread has morphed into something off-topic of my first post. we are again discussing how best to help marvin and that is great, just not in the context of this thread.

I disagree. Every comment in here was about project funding and growth. I think most of us are just taking a different viewpoint on how growth could look like and how funding could be needed.

I fully follow you in your enthusiasm for microg. I think it is a wonderful project and it would deserve to be something big: If you look on the smartphone market for a widely available system that you can tinker with, there is only Android. iOS is closed and other alternatives are just marginal. Microg is the only option to live in that - with using as little as possible from google frameworks but being able to integrate. With Fuchsia coming, it might be even more important to have an independent option. Microg is basically the little gaulish village.

What I tried to say in my post before and now: Jumping from a one person project with part time involvement to a managed project setup with professionally hired participants, management and funding is quite something. With microg only being fully understand by @mar-v-in himself, you will need him to take part in that transformation (to not start all over).

I don't think that can be ignored if you want to go forward. It is good to have a vision and target, but that also can be quite intimidating if the step is too big. Fundamentally the vision and target needs to be shared by marvin.

To leave the theoretic realm and put something out there to think about for marvin and anyone participating here. Some small practical steps:

Development

I think this is possible, as marvin stated he would be willing to get an intern (above mentioned are probably way more than that) and it would keep control with him.

Issues

This should be possible, as most of us already do support on issues. It would just give us some structured way to sort and clean up

Documentation and ancillary

As said above, I think this is possible, just some guideline is needed where to work on.

This could be a first low risk, light touch start of growing and creation of structures that probably would be needed for further steps. All without investor search, hiring, contracting, etc. Of course all depending on the individual willingness. But of course it increases the level of responsibility. Just food for thought

Lanchon commented 5 years ago

well, i'm not any good at this organizational work you are trying to do here. with this thread i wanted to discuss if there's a chance of some entity the likes of Amazon could do it for us. regarding volunteers, i think marvin needs someone local with whom he can physically meet; that's why employees seem more feasible to me. anyway, if someone can reach some entity that could help, maybe take the plunge.

bjmc commented 5 years ago

From reading this thread, it sounds like funding and motivation are not the primary stumbling blocks for this project, but it sounds like there is agreement that structured organizational support could be valuable.

One option I didn't see mentioned above would be joining an umbrella organization like the Apache Foundation (I notice microG is already under the Apache license). An advantage of this approach (as opposed to trying to get a Samsung or an Amazon interested in contributing to MicroG) is that there is already a well-defined path to apply and join, and they would be familiar with the issues faced by scrappy FLOSS software projects.

Thanks again to marvin for producing such a useful piece of software!

mar-v-in commented 5 years ago

@bjmc the problem with larger umbrella organizations is that most of them are at least partially funded by Google. While Google is not actively working against anything microG related at this point, they might not be happy to directly or indirectly fund its development. Even if Google is not against an inclusion of microG in the umbrella org, the umbrella org might see a conflict of interest and a future risk of funding.

I don't know how ASF thinks about this, but I certainly don't want them to be in the position to decide about having Google as a platinum sponsor (>$125k/year) or accepting microG under their umbrella

bjmc commented 5 years ago

@mar-v-in That's a good point. On the other hand, Google funds other nominal competitors like Mozilla. I assume a massive company like Google isn't all that concerned about a threat from microG, and I'd be surprised if it was worth the bad PR for them to give ASF a hard time about it. Still, I see your point about not wanting to put a foundation in the position of having to make a difficult choice.

There's also the https://e.foundation/ that has similar goals to microG, and I believe uses microG in their distribution. Certainly, they're not going to be seeking Google sponsorship any time soon! At a bare minimum, it seems like it would be fair to ask them to highlight the contributions of the microG project more prominently in their own marketing.

rugk commented 5 years ago

BTW regarding:

vendors producing Android phones cannot bundle microg without breaching contract

That should be a thing of the past, because of the recent EU anticompetitive/antitrust fine. AFAIK they are not allowed to disallow this, anymore.

Lanchon commented 5 years ago

That should be a thing of the past, because of the recent EU anticompetitive/antitrust fine. AFAIK they are not allowed to disallow this, anymore.

that's absolutely great. but who does it affect and when? there's an appeal. all the OEMs and their supply chain signed agreements that they wouldn't do forks. if the EU's decision stands the appeals, where is it in force? who does it affect? does it affect a supplier in china with which Google never had direct contact, but which signed a contract in S.Korea with some OEM? if it does, will the supplier go against Samsung or Google and breach contract on the grounds that the contract is illegal... in the EU? even if the supplier would prevail, does it want to embark in an endless legal battle or just keep supplying? is it even possible, does it have the resources?

i imagine it's just as hard today to build an android fork device in this world as it was a year ago.

given that android fork devices are hard to build everywhere due to google's obstruction, and that to market and android fork in the EU you first have to build it somewhere, the EU regulators should make google take legal steps to proactively annul all those contracts they signed or forced entities to sign in order to keep doing business in the EU.

besides that, they should open the play store to access (including paid apps) 1) via a public API or website or 2) via a downloadable play store client that works on any phone. they shouldn't be allowed to force the sale of a product (a googlephone) to sell another (an app) when there is no technical need.

and similarly, safety net shouldn't be allowed as it artificially requires a googlephone. they purportedly market safety net as a data safeguard for users but it ends up being an device lockout mechanism. the EU should force google to 1) make users opt-in to google's "protection" before running remote attestation (spyware) in their devices, and 2) provide users with an opt-out to google's oh so generous protection, meaning that for those users, google will attest what the user chooses to 3rd parties without running any spyware and without alerting 3rd parties of the situation.

rugk commented 5 years ago

BTW, anyway, I also doubt many hardware vendors would even want to ship microG. They rather want to ship their own app stores, think of Amazon or Chinese vendors or so. (and those already do so)

deutrino commented 5 years ago

It might be a good idea to open two issues in which we could build a list of what documentation work is needed, one for user-facing documentation, and one for developer-facing documentation. I would open them myself but I've barely interacted with the project, having only become a user a couple months ago. But I agree that the scattershot documentation is very problematic.

benyaminl commented 5 years ago

Maybe time to consider a proposal with Huawei. Hahaha..

Regards, Benyamin Limanto

Send via Outlook for Androidhttps://aka.ms/ghei36 from my ASUS Pegasus X005

From: Deutrino notifications@github.com Sent: Friday, May 24, 2019 6:00:54 AM To: microg/android_packages_apps_GmsCore Cc: Benyamin Limanto; Mention Subject: Re: [microg/android_packages_apps_GmsCore] Project funding and growth (#753)

It might be a good idea to open two issues in which we could build a list of what documentation work is needed, one for user-facing documentation, and one for developer-facing documentation. I would open them myself but I've barely interacted with the project, having only become a user a couple months ago. But I agree that the scattershot documentation is very problematic.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://github.com/microg/android_packages_apps_GmsCore/issues/753?email_source=notifications&email_token=AAVP2NHNVY2JWLFEPGRGPUTPW4O2NA5CNFSM4HFZGU42YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODWDWYUQ#issuecomment-495414354, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AAVP2NDKBFXAQUBEXJIVENTPW4O2NANCNFSM4HFZGU4Q.

rugk commented 5 years ago

Could the new https://github.com/sponsors be an option?

MrDodojo commented 5 years ago

Maybe time to consider a proposal with Huawei. Hahaha..

actually not a bad idea but I don't think they will

codethief commented 5 years ago

I second @rugk's question. In particular, I'm donating through BountySource right now and would rather do that through GitHub if it meant that they double the amount.

mar-v-in commented 5 years ago

@rugk @codethief I already joined their waitlist.

Nanolx commented 5 years ago

Kinda on-topic: congratulions @ale5000-git

(in case someone missed it, he's (I suppose /he/ is correct) now the second member of the microG project)

notpushkin commented 4 years ago

Additionally, some organizations also announced willingness to financially support additional contributors, for example in form of a paid summer internship. Unfortunately there haven't been any good candidates for such funding yet. (Please let me know if you think you are one)

Maybe we could put up some kind of notice about this on https://microg.org/ or in wiki or in README? Just a thought.