Database Info

Google APK problem has a simple solution!

There is a simple solution to that all of this problem that anyone can use. This will effectively circumvent any legal issues and keep rom updates relatively simple.
1st Problem- A developer cannot distribute Google closed source aps.. This however does not prohibit legitimate users from holding a backup copy. (Fair Use protects the end user of this). If this were not so you could not have over the air backups on your phone, (update.zip)
2nd Continual updates of closed source google apps--- The updates provided by google will be pushed to us legitimately (hence always an approved up to date source for the closed source apps for our liscenced personal devices)
Solution--
-A rom cooker simply needs to build the rom with the applications in place, test as if a complete distribution and right before packaging pull the APKs that are closed source (the Rom does not have to be functional without them.
-The user simply downloads the rom as a "kitchen" places their apk files in a folder in the kitchen.. A provided script or simple program can be put in the kitchen to add these programs back into the package in their proper locations and resign. The output saved into a folder in the kitchen and boom functional rom
---This keeps the letter of the law and spirit, and since the developer is not distributing their code they are safe because they are only distributing android open code, but since YOU hold a legitimate ROM backup provided BY Google for YOUR liscenced device you can simply place such files in the provided folder. Run script and you are done. This program would be simple to create or scripted. File version would have to be simply pre agreed upon in the post much as some developers suggest a radio version with their roms.
--If you dont have a copy or dont hold the knowledge to extract them, then I am sure some kind souls would have accidentally placed them on rapid share for your backup enjoyment... (Liability is not on developers)
I took a screen shot of what I see as a possibility, I would make the application but I am not a ROM developer and these guys clearly have some headway on me....
Look at the picture attached....
By the way this would be legal and not infringe on the law. Since the developer is only providing a "blue print for a possible rom"

Interesting...I'm not a dev...but it seems it could possibly work.

Good idea, I was literally thinking the same thing. It could definitely work.

It would be simple enough.... very simple... Unfortunatly by the time I lay done the first line of code somebody here will have created 10 versions of this.. LOL I am rusty in programming.. Which for something so simple would probably not be needed.

it would definitely make sure that people had to step it up and learn more. I'm totally down for anything that makes people smarter!

I prefer a method such as this over the creation of replacement apps for the google suite (for the short term anyways..).l

http://twitter.com/cyanogen/status/4384352484

If a person can root their phone, or even copy their rom file to the phone then they already have more than enough skill to do a simple drag and drop and a double click... but then again I have been surprised (scared) many times by the average intellect of most people.

Mismatching is definately a problem but not one without a solution. Again some of this will have to be a little sneaky at first. But this is for a few apks. True they are intertwined in the os. Thats why a standard has to be followed for this...
It will make rom development a little more regid but still very much doable. The apks/odexs would have to be controlled a certain way but this is not out of the real of possibility... The roms would come at a slower pace for sure..

afbcamaro said:
Mismatching is definately a problem but not one without a solution. Again some of this will have to be a little sneaky at first. But this is for a few apks. True they are intertwined in the os. Thats why a standard has to be followed for this...
It will make rom development a little more regid but still very much doable. The apks/odexs would have to be controlled a certain way but this is not out of the real of possibility... The roms would come at a slower pace for sure..
Click to expand...
Click to collapse
The new, improved fix_permissions script available in this forum will fix all the mismatching and do the odexing. Perhaps a few lines of code added to the beginning of that (OS) script could transfer the Google apps from their storage spot into the newly installed CMUpdate. Just store backups of the necessary apps on the phone, install the new update, run the script that reinstalls the Google apps, fix permissions and Odex, and re-boot into your new ROM. It looks pretty straight-forward to me.

I am sure that in the beginning it will be complicated with multi steps, but soon there will be an auto-update ap that will do the lot!
Are there going to be compatability issues, even we will end up wiping everytime we get a new rom + closed apps in?
This is so stupid. Can anyone "outside US" take over the roms so we can move on unaffected, as it is happening with everything else in the net that they try to close/block/control?

zaqwsxzaqwsx said:
I am sure that in the beginning it will be complicated with multi steps, but soon there will be an auto-update ap that will do the lot!
Are there going to be compatability issues, even we will end up wiping everytime we get a new rom + closed apps in?
This is so stupid. Can anyone "outside US" take over the roms so we can move on unaffected, as it is happening with everything else in the net that they try to close/block/control?
Click to expand...
Click to collapse
that sounds good?!

Ok, so if they like the work Cyanogen has done, but they have problems with his distribution of certain elements, maybe he just needs to TALK to them and see what can be done. You cant tell me that they don't see the following, and publicity that his roms draw. That is advertising, and companies pay BIG Bucks for good advertising. They need to C.Y.A on their end, but I bet they woulds be happy to tell him what he can do to comply. Anything "gray area" that is done with the roms to come will certainly bring back the lawyer talk, so why not see what they have for ideas.

There's also the problem that software backup is NOT covered under Fair Use, which you can read about Here http://www.copyright.gov/title17/92chap1.html#107
There's also
http://www.copyright.gov/help/faq/faq-digital.html
That's an interesting read, specifically
It is also important to check the terms of sale or license agreement of the original copy of software in case any special conditions have been put in place by the copyright owner that might affect your ability or right under section 117 to make a backup copy. There is no other provision in the Copyright Act that specifically authorizes the making of backup copies of works other than computer programs even if those works are distributed as digital copies.
Click to expand...
Click to collapse
And out of the Google Market TOS(First one I found)
Section 3.5
Unless you have been specifically permitted to do so in a separate agreement with Google, you agree that you will not reproduce, duplicate, copy, sell, trade, or resell the Market for any purpose.
Click to expand...
Click to collapse
Our best bet is to convince Google to give Cyanogen a licence providing he takes certain actions to make sure end user has a licence, such as having Cyanogen updater only run on MyTouch, Hero and G1. Or get Google to give us these apps in push fashion after initial setup.

ohwut said:
Our best bet is to convince Google to give Cyanogen a licence providing he takes certain actions to make sure end user has a licence, such as having Cyanogen updater only run on MyTouch, Hero and G1. Or get Google to give us these apps in push fashion after initial setup.
Click to expand...
Click to collapse
Pretty much what I was leaning towards- there IS a way, it is a matter of figuring out what will make them happy. If it benefits them, and helps us it's a win-win
btw, greetings from Gresham Small world

What I would do is simple just get the dev to not include the google apps and add a standalone app which will then once on ur pc push your backup google apps back into the rom zzip and sign and voila. Simples
I really doubt google will attack anyone for holding copies on ur pc. How can they find out without invasion of privacy

Look any script that anyone compiles will be viewed as warez.
What you need to do is use existing apps. But installing and backing up should be done at the User level. Writing instructions on how to backup and reinstall applications will in no way violate Google agreement at the Dev level. It would however violate it at the User level. And even at that level it is not real clear as you are just using what was entitled to you at the purchase of the phone. You can technically go after Google for violating their end of the deal and not allowing you to use the content on the device.
They dont know how these apps ended up back on your phone they have no case.
And lets face it technically installing a custom rom is violation of the T-Mobile agreement in its self. Using the Tether app is violation of it also. So no matter what people are breaking the law as it is.

A script can not violate the law in this case. The user using it for illegal purposes can be.. but let's be honest most of the ground these coorporations use for infringement are in murky waters and can be defended with a pathetic lawyer, especially a user... most of us break the law with or without knowing it one or twice a year maybe more. Microsoft doesn't go after a user because it will do them more harm than good. A crime right that profiteers from this they will go after. Google has to prove monetary loss due to you action and with a user it will fall under to minor to show up on the radar. A lot of people are more afraid of these companies than they should be.... microsoft has taken action in the past with windows mobile.. xda could not host the roms... so they went to private host like rapidshare... whay they would have to do in order to go after a user cost more than is worth especially something that they know is shaky ground.... I would dare develop and host them offsite. We are trully making it much bigger than it is by being so fearful to come up with solutions. We are convincing outselves that every action to circumvent this is illegal as well

If google just made all of these apps available on the market it would solve the problem.
Then we could still have custom ROM's minus the propitiatory apps, then we could just install them from the market.
As long as the source already included all the dependency's I don't see how this would not work. There apps are free anyway and we would be getting them from the market, an "official" distributor of said apps.
Win win for everyone.
The market is not one of the propitiatory apps is it? Because that would kinda **** up my master plan here.

HOLY CRAP, i just had a realization... if Cyanogen could obtain a lisence from google, then we could probably put roms in SAM or even the market and just update or have an updater app that could save your homescreen and your google sign-in and other user data.... even have a rooting app on there
this could be a new step towards a more open android putting root and custom roms in the hands of regular users and then if that happens i think android would become truly great then we would surpass the iphone on so many levels not just the developer/flasher level, but on the reggy consumer level

Security does matter![Updated 25th. Jan]

Introduction
I have not seen much talk about security in XDA, and not at all on Neo Section.
SO here's just one informative link talking about using and developing apps and security risks involved
http://www.technologyreview.com/computing/25921/?mod=related
Any bug in software could potentially be used as a security loophole to gain access to private information, spy on you, get your credit card info(should you do such things on phone).
What is kind of unsettling is that everyone seems fine with modding, tweaking, developing and using those ROMs made in XDA without worrying if there could be that kind of bug in your made or used ROM.
You don't need a malicious app only to have risks. Most people use Windows so they should know that it is OP systems bugs and vulnerabilities that allow for unwanted access to your files, data, etc.
Android itself is having very non-foolproof security system. All apps on unrooted phone are in sandbox. That's no security measure at all. It doesn't limit app from stealing your private info at all, it only cant delete the whole ROM. That's just idiotic security system, for it is the only thing beside encrypting shut off phone on 3.0 and 4.0. So that means Android on it's own has no security measures while it's working. Even Windows has... some... but not too much... so you could pay for antivirus and antispyware software ofc.
It has always been the goal of big corporations to make money from insecurity, be they software developers, arms dealers and you name it. They all benefit from insecurities existing. Same is with Google and it's Android. But the good news is that we the users can modify Android. We could all say "Au revoir security bugs and loopholes!" if we would care about developing ROMs designed to make Android more secure... alas that's not happening yet!
Overview of Linux/Android security issues.
It's a short condensed description just to get you interested in the topic. There's lots of material on net, you only need to search, read, watch videos.
Linux becomes more vulnerable with more applications with different permissions installed. Same is true for Android.
Say your Phone Exporer has root access, that means it has root access to whole Android. To remove unnecessary risks, this app's root access should be limited to only most necessary functions it needs to operate.
Currently for Android there is no such solution. For Linux there is Apparmor.
http://en.wikipedia.org/wiki/AppArmor
Total root access is obvious vulnerability, but it is at least known one. Let's look at possibility of apps having hidden permissions and what that could mean to you.
Blade Buddy from Market.
On market it does not list permission to "Unique Device ID"(IMEI for GSM and MEID; ESN for CDMA) for free nor for paid version.
That means the author of BB has left the code from free version in paid one. This permission is used by ads to track you. It's not necessary code for ads, but it helps the dev know who clicked on the add and generated him some money. To see your money generating zombie empire stretch across the whole globe.... quite a thrill, isn't it?
So it's a latent code, with no benefit to user and an exploit only calling to be abused.
Unique Device ID allows you to be tracked on net and also where you are physically. GPS is just one way to find you, police for example have scanners to locate your devices physical location by the IMEI code. You can count on the "bad guys" having this technology as well, for it's quite a tool for burglars and other criminals.
The risks of your home being marked as the next dungeon to be looted by some raiders, I mean criminals(or perhaps WoW players sleepwalking and sleepraiding?) or getting your ID and bank details stolen by trojan/hacker is random. Yet the threat would not exist without apps having so flagrant hidden permissions.
Next app with ludicrous permissions
Brightest Flashlight
It does list many permissions, among them "Hardware controls - take pictures and videos ". No, it does not need a permission to take photos through cameras to operate the flashlight. But it's fun nonetheless for the dev to see his trusty peasants, or maybe he just likes to observe people like some watch fish in aquarium or hamsters in cage( "Look at that dork!", "You're one ugly m...f...er","ummm a couple kissing in dark with ma flashlight, what are they searching?", "what's that you eat, mr Korean, brains?" "hey show me that document again.")
You don't even need to run the app yourself. It can be triggered by hacker on background and take a snapshot of you.
On top of this little needless permission it has following hidden permissions:
1. Unique IMSI, read about here http://en.wikipedia.org/wiki/IMSI
2. MCC+MNC (CDMA)
3. Unique Devide ID
4. Cell Tower Name.
That's a lot of needless permissions for flashlight, these are there just to track you the app user and have nothing to do with your comfortable use of the app.
These are just 2 apps with totally needless permissions for their intended functioning. If you don't want your Windows and Linux have such security holes then why do you want your Android have them?! You don't want, that's the point and these apps would not be so popular if people would really know and care about their phone being secure.
It can be stated for sure that above exemplified permissions not listed on market are more useful for pranksters, criminals or someone plainly looking-down-on-all-the-dumb-sheep and not at all for any legitimate, user or customer friendly purposes.
There are very few tools to check for security and privacy problems in apps. That gives a sense that majority of devs do not want Android to be secure and private, because Android is another revenue generating platform through Google ads business of course. Were people more educated about the matter then Google ads business would shrink down as well. A private and secure Android can't be tracked or annoyed with ads. No ads, no profit. No security therefore means profit. Unfortunately this lack of security can be exploited by anyone with criminal or malignant intentions so very easily.

The most important thing is to read the permissions before installing.

If you had read the article I linked. Those permissions don't matter anything really if stuff developers use doesn't reveal what it does, or developer itself doesn't disclose what the app does.
We can safely say that those permissions asked are just to make ordinary users of Android think that all is under their control.
I use Privacy Blocker app and it keeps finding app permissions that are not listed. Even that app doesn't find those permissions which Cyanogenmod permission manager shows. And I've sanitized all my apps, still I find my phone connecting to some odd servers while using certain paid and seemingly legit apps. I even found shapshots from front camera made by some app... and I am checking all permissions I can, even for those not listed.

What seems harmless but could reveal your IP address and potentially other data about you is... advertisements used by apps.
Ads can be far more than just a little annoyance that slows your device. Any file, picture loaded from some location in internet can be used to locate you.
I had a problem of getting phone call bills for calls lasting 10 to 20 secs that I never made after using a slew of market apps, flashlights, fun stuff, etc.
I paid two months for such calls trying to find out which app did it and still don't know which one it was. Skype(phone app has fake IP of Holland but actual connection goes to Moscow... oh come one what is this? Why such hiding? Like anyone would trust their phone's Skype connection stream through Moscow... no thank you! Then wonder still if the phone gets so slow and Skype call quality is so bad even over wifi while Windows Skype does just fine?), Brighest flashlight, some photo editors, and slew of other garbage I've already forgotten about cause I don't use any of it anymore.

First post updated

How about the new 4.3 update..in includes some security and privacy control..will this thing prevent you had mentioned?

Is there any way to reactivate this post? maybe start working on a security enhanced android ROM? I'm agree, Security does matter!

[Q] Is privacy enforced for apps in Marketplace?

Hi!
Tried finding the answer for this. both in Marketplace privacy terms, development guidelines etc. No luck other then very vague descriptions and guidelines.
So, hoping there might be som WP developers here, I'm wondering this:
Lets say I download and install a smart dialing app.
It has the permissions for Data services, Phone and Owner identity aswell as accessing the contacts.
Now, what stops this app from uploading all my contacts to unwanted destinations?
For example stealing information in purpose of spamming or marketing.
Is there any review of apps, behaviour or code when publishing to Marketplace?
Can I be as convinced that my privacy is respected by app developers?

All apps are reviewed (by real people, as well as by automated tools) before they are accepted to the marketplace. It's basically the same thing that Apple does, and although the list of what is and is not permitted varies a little, you can be sure that the kind of spyware you describe is firmly in the "not permitted" camp.
That said, mistakes can be made in reviewing, or things can be missed. Malware certainly could sneak past the Marketplace reviewers sometimes. Overall, though, it's rare.

Thanks for the reply! I suspected this and it's nice knowing that there are protections in place.
Of course, when one thinks twice, distribution of mal- and spyware through Marketplace would be very contraproductive to the plattform and harm it.
At the same time it would be nice finding some official info how this is enforced...

Google Play support is evil

Dear fellow developers,
I wonder how log will it take before we will unite and take some serious action against Google Play practices. Maybe you heard about banned apps and blocked accounts. I got my app blocked today and believe me that it is VERY frustrating experience.
I can write what is wrong with Google Play developer support, but others already done that better: androidofvirtue. com/dear-google-play-we-need-to-talk-about-a-few-things/
Long story short, I feel that Google is abusing its dominant position on the market by providing little to no service to developers. Developers has no other option for app publishing as manufacturers are pre-installing its market to almost every device. Users have no option as they do not have any good alternative available.
Google must listen to us, we are helping them to get money and they are treating us like criminals without any explanations, without possibility to defend ourselves and without possibility to use other and maybe more reasonable app market.
As I am from the EU I wrote an appeal to European Commission to investigate the Google market position regarding the competition advantage abuse. I really hate do do it but currently I feel that I ran out of options and I hate more to feel so powerless against Google ignorance and stupidity of its app removal policies.
If you would like to help then write an appeal too. Contact is [email protected]
They must hear us!

what app did you make and whats the reason they removed it

The app was intended for automatic connection to open hotspots and wifi password sharing. It was possible to enter password for some wifi when you connected to it and it was then shared with other users. This function was explicitly named in the name of the app, description and under the password box directly in application, therefore every user was sharing the password by his will and he was well informed what he's doing. It was intended for sharing of passwords for various public places, cafés etc.
The funny thing is, that the app got approved on Amazon which is also very strict, but obviously employs sane people.
The reason for banning is here:
REASON FOR REMOVAL: Violation of section 4.4 of the Developer Distribution Agreement.
After a regular review we have determined that your app interferes with or accesses another service or product in an unauthorized manner. This violates the provision of your agreement with Google referred to above.
Click to expand...
Click to collapse
I think that they think that I was phishing the passwords or something like that. Or maybe it is not ok to connect to open wifi automatically. Or maybe they think that if somebody share password for some hotspot then other people are not authorized to use it, however I feel that if I share password then I am giving implicit authorization to other users.
Thats the worst part -I simply don't know what is wrong. Can I fix it by adding some policy agreement? Should I ask user for some explicit permission to share the password and authorization for other users to use it? Isn't it a bit crazy?
The whole thing is not about me or my app. I just spend like month of evenings to build it and catch all the bugs, I made worse investments. What I really don't like is the Google attitude. They are keeping their developers in uncertainty, they are threatening them and they are behaving like the worst essence of corporations. We just need alternative store to become strong enough otherwise Google will not listen to us.

You must explain why you are requesting ‘android.permission.BIND_DEVICE_ADMIN’

recently received many mails from google for many of my apps.
The email content is:
Code:
Hi Developers ,
We reviewed your app, XXXXXXX, with package name XXXXXX, and noticed that it violates our developer terms.
REASON FOR WARNING: Violation of the Deceptive behavior policy
You must explain to users why you are requesting the ‘android.permission.BIND_DEVICE_ADMIN’ in your app. Apps must provide accurate disclosure of their functionality and should perform as reasonably expected by the user. Any changes to device settings must be made with the user's knowledge and consent and be easily reversible by the user.
Please complete the following actions within 7 days, or your app will be removed from Google Play: Read through the Deceptive Device Settings Changes policy for more details, and make sure your app complies with all policies listed in the Developer Program Policies. If you don't need the BIND_DEVICE_ADMIN permission in your app: Remove your request for this permission from your app's manifest. Sign in to your Play Console and upload your modified, policy compliant APK. Or, if you need the BIND_DEVICE_ADMIN permission in your app: Include the following snippet in your app’s store listing description: “This app uses the Device Administrator permission.” Provide prominent user facing disclosure of this usage before asking the user to enable this permission within your app. Your disclosure must meet each of the following requirements: Disclosure must be displayed in normal course of usage of your app. Your users should not be required to navigate into a menu or settings to view disclosure. Disclosure must describe the functionality Device Admin permission is enabling for your app. Each security policy used with the Device Admin request must be declared in your disclosure, and each policy must be accompanied with justification for the request. Disclosure cannot only be placed in your privacy policy, TOS or EULA. Alternatively, you can choose to unpublish the app.
All violations are tracked. Serious or repeated violations of any nature will result in the termination of your developer account, and investigation and possible termination of related Google accounts.
Regards,
The Google Play Team
its is enough to update the store listing and the privacy policy ?

I do not think so. You were clearly told that `` Disclosure must be displayed in normal course of usage of your app. Your users should not be required to navigate into a menu or settings to view disclosure.'' and ``Disclosure cannot only be placed in your privacy policy, TOS or EULA. ''

I received the same email regarding my app.
The instructions are quite clear at the first glance. On a closer look, however, it's not so clear, at least in my case:
in my app, the device administrator function is not strictly needed. It depends on what the user wants. The default is that it is not needed. If I would now push a notice and the handling to the main activity, I would hopelessly scare and annoy users who may never even get close to giving the app device admin permissions.
The process to request device admin rights includes a textual description by the app explaining why the permission is needed, and what sub-parts of the device admin rights. In my eyes this already fulfills the requirements in the email. Or does it not?
I'm in a very awkward position right now. The time they allow me to react is very short (7 days) and they don't even provide a reply address. I have now contacted the support team, but if I don't a reasonable response within a few days I might have to butcher this out over night and sure as hell will get bad reviews because of this.

For me it makes sense to remove this functionality for a while. And try to find out from Google what they mean by ``normal course of usage''. I'm afraid that you must show this disclosure in main activity every time regardless.

grfgames said:
For me it makes sense to remove this functionality for a while. And try to find out from Google what they mean by ``normal course of usage''. I'm afraid that you must show this disclosure in main activity every time regardless.
Click to expand...
Click to collapse
Yeah. Thing is that removing an integral part of an app on such short notice is likely to cause regression, let alone angry users that ask where the hell this has gone.
Google Play answered me now, twice, but only with the same lame text blocks. No real human interaction. I've now also posted to G+, let's see if anything happens there.
If I advertise this on the main page, I'm totally over-advertising an optional feature and even invite people to use it, which would be contrary to what Play want to archive. This sucks big time.

xrad said:
Yeah. Thing is that removing an integral part of an app on such short notice is likely to cause regression, let alone angry users that ask where the hell this has gone.
Google Play answered me now, twice, but only with the same lame text blocks. No real human interaction. I've now also posted to G+, let's see if anything happens there.
If I advertise this on the main page, I'm totally over-advertising an optional feature and even invite people to use it, which would be contrary to what Play want to archive. This sucks big time.
Click to expand...
Click to collapse
If you want your app to be available on PlayStore then what is so terrible about doing what they expect of developers that put their apps on PlayStore.
Everybody else must follow that rule, why shouldn't you?
It doesn't even matter what the circumstances are as to why you think it's unnecessary or unfair, all that matters is that is how it is to be done. Otherwise, no app on PlayStore, right?
grfgames said:
For me it makes sense to remove this functionality for a while. And try to find out from Google what they mean by ``normal course of usage''. I'm afraid that you must show this disclosure in main activity every time regardless.
Click to expand...
Click to collapse
I DO NOT PROVIDE HELP IN PM, KEEP IT IN THE THREADS WHERE EVERYONE CAN SHARE

@Droidriven: had you actually read my post, then you would understand that I'm in favor of the rule, but that I am criticizing the way they handle explain and enforce it. Essentially, their premise is that a the apps they are addressing with this current campaign always want to be devadmin. Mine only wants to be so if the users asks for it. But Google doesn't tell anything about such a scenario and only talks to me using bots and people using predefined text blocks. All on very short notice.

xrad said:
@Droidriven: had you actually read my post, then you would understand that I'm in favor of the rule, but that I am criticizing the way they handle explain and enforce it. Essentially, their premise is that a the apps they are addressing with this current campaign always want to be devadmin. Mine only wants to be so if the users asks for it. But Google doesn't tell anything about such a scenario and only talks to me using bots and people using predefined text blocks. All on very short notice.
Click to expand...
Click to collapse
I know. I was just saying that you're gonna have to do it their way in the end anyway. It's unfair but it is what it is.
I DO NOT PROVIDE HELP IN PM, KEEP IT IN THE THREADS WHERE EVERYONE CAN SHARE

my main issue is i lost my keystore during a hard drive problem so i cant update the application how ever if i updated my description and my privacy policy and say that i clearly use this permission it will solve this problem ??

any help will be appreciated